Function at 0x140011ec0
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x40
mov rbp, qword [rsp + 0x90]
mov r13, r9
mov rsi, r8
lea eax, [r9 + rbp]
mov r14, rdx
mov rdi, rcx
xor r15d, r15d
mov r8d, 0x8000004
xor r9d, r9d
xor edx, edx
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbx, rax
mov qword [rdi + 0x28], rax
test rax, rax
jne 0x140011f26
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14001212a
mov qword [rsp + 0x90], r15
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, qword [rdi]
mov dword [rsp + 0x30], r15d
lea r9, [rsp + 0x90]
mov rcx, rax
mov rdx, rbx
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 6
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x140011f1b
mov rcx, qword [rdi + 0x28]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 6]
mov qword [rsp + 0x78], r12
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r12, rax
test rax, rax
jne 0x140011f92
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140012125
lea r8, [rax + r13]
mov rdx, rbp
mov rcx, rsi
call fcn.140011d10
mov r11, qword [rsp + 0x90]
mov ebx, 1
mov qword [0x140114690], r11
mov rcx, qword [rdi]
test rcx, rcx
jne 0x140011fc2
lea eax, [rcx + 8]
jmp 0x140011ffa
lea rax, [rsp + 0x70]
lea r8, [0x140114690]
lea rdx, [0x140114690]
mov r9d, 8
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140011fee
mov eax, ebx
jmp 0x140011ffa
cmp qword [rsp + 0x70], 8
mov eax, r15d
setne al
mov qword [0x140114690], r15
test eax, eax
jne 0x1400120b7
mov qword [0x140114778], r13
mov rcx, qword [rdi]
test rcx, rcx
jne 0x14001201d
lea eax, [rcx + 8]
jmp 0x140012055
lea rax, [rsp + 0x70]
lea r8, [0x140114778]
lea rdx, [0x140114778]
mov r9d, 8
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140012049
mov eax, ebx
jmp 0x140012055
cmp qword [rsp + 0x70], 8
mov eax, r15d
setne al
mov qword [0x140114778], r15
test eax, eax
jne 0x1400120b7
mov qword [0x140114780], rbp
mov rcx, qword [rdi]
test rcx, rcx
jne 0x140012074
lea eax, [rcx + 8]
jmp 0x1400120ac
lea rax, [rsp + 0x70]
lea r8, [0x140114780]
lea rdx, [0x140114780]
mov r9d, 8
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x1400120a0
mov eax, ebx
jmp 0x1400120ac
cmp qword [rsp + 0x70], 8
mov eax, r15d
setne al
mov qword [0x140114780], r15
test eax, eax
je 0x1400120c7
cmp eax, ebx
jne 0x1400120c3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, ebx
jmp 0x140012125
mov ecx, 0x68
call fcn.1400abd9c
test rax, rax
je 0x1400120f9
mov rcx, qword [rdi + 0x40]
mov r9, qword [rdi + 0x30]
mov r8d, dword [rdi + 0x10]
mov rdx, qword [rdi]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.140019080
jmp 0x1400120fc
mov rax, r15
mov r9d, 0x400
mov r8, r13
mov rdx, r12
mov rcx, rax
mov qword [rdi + 0x38], rax
call fcn.1400199a0
test al, al
jne 0x14001211f
mov eax, 8
jmp 0x140012125
mov qword [rdi + 8], r15
xor eax, eax
mov r12, qword [rsp + 0x78]
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret