Function at 0x1000b3218
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
xor esi, esi
xor r13d, r13d
mov r14, r8
mov rbp, rdx
mov rdi, rcx
mov ebx, 0x80070057
test rdx, rdx
jne 0x1000b327f
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000b35a6
test byte [rcx + 0x1c], 1
je 0x1000b35a6
mov rcx, qword [rcx + 0x10]
lea edx, [rbp + 0x35]
lea r8, [0x100002fe8]
call fcn.100020584
jmp 0x1000b35a6
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r12d, eax
add eax, 0xffffff68
cmp eax, 0x7ff68
ja 0x1000b3557
and qword [rsp + 0x28], rsi
and dword [rsp + 0x20], esi
xor r9d, r9d
lea r8d, [r9 + 2]
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r13, rax
test rax, rax
jne 0x1000b3311
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000b3598
test byte [rcx + 0x1c], 1
je 0x1000b3598
mov rcx, qword [rcx + 0x10]
lea edx, [r13 + 0x37]
lea r8, [0x100002fe8]
mov r9d, ebx
call fcn.100020d8c
jmp 0x1000b3598
and qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rsi, rax
test rax, rax
jne 0x1000b336e
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000b358a
test byte [rcx + 0x1c], 1
je 0x1000b358a
lea edx, [rsi + 0x38]
jmp 0x1000b352c
cmp dword [rax], 0x414d5153
je 0x1000b33a6
mov ebx, 0x90070a0b
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000b358a
test byte [rcx + 0x1c], 1
je 0x1000b358a
mov edx, 0x39
jmp 0x1000b357a
lea rdx, [rdi + 0xc]
lea rcx, [rax + 0x18]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x1000b33ec
mov ebx, 0x90070a0b
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000b358a
test byte [rcx + 0x1c], 1
je 0x1000b358a
mov edx, 0x3a
lea r9, [rsi + 0x18]
jmp 0x1000b34e5
mov eax, dword [rdi + 8]
cmp dword [rsi + 4], eax
je 0x1000b3424
mov ebx, 0x90070a0b
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000b358a
test byte [rcx + 0x1c], 1
je 0x1000b358a
mov edx, 0x3b
jmp 0x1000b357a
lea rbx, [rsi + 0x10]
test rbx, rbx
je 0x1000b345a
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtQuerySystemTime]
test eax, eax
js 0x1000b345a
mov eax, dword [rbx]
xor ecx, ecx
mov dword [rsp + 0x78], eax
mov eax, dword [rbx + 4]
mov dword [rsp + 0x7c], eax
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x78], rax
setle cl
jmp 0x1000b345f
mov ecx, 1
test ecx, ecx
je 0x1000b3493
mov ebx, 0x90070a0a
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000b358a
test byte [rcx + 0x1c], 1
je 0x1000b358a
mov edx, 0x3c
jmp 0x1000b357a
lea r8, [0x10001a8f0]
mov r9d, 1
mov rdx, r14
mov rcx, rdi
call fcn.1000b2f7c
mov ebx, eax
test eax, eax
jns 0x1000b34fa
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000b358a
test byte [rcx + 0x1c], 1
je 0x1000b358a
lea r9, [0x10000a3b0]
test r14, r14
mov edx, 0x3d
cmovne r9, r14
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002fe8]
call fcn.100020614
jmp 0x1000b358a
mov r8d, r12d
mov rdx, rsi
mov rcx, rdi
call fcn.1000b3f1c
mov ebx, eax
test eax, eax
jns 0x1000b3541
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000b358a
test byte [rcx + 0x1c], 1
je 0x1000b358a
mov edx, 0x3e
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002fe8]
mov r9d, ebx
call fcn.100020d8c
jmp 0x1000b358a
mov eax, dword [rdi + 0xa0]
sub eax, dword [rdi + 0x90]
xor ebx, ebx
mov dword [rdi + 0x98], eax
jmp 0x1000b358a
mov ebx, 0x90070a0b
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000b35a6
test byte [rcx + 0x1c], 1
je 0x1000b35a6
mov edx, 0x36
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002fe8]
call fcn.100020584
test rsi, rsi
je 0x1000b3598
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test r13, r13
je 0x1000b35a6
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x40]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret