Function at 0x18002f350
Capabilities:
Get file size
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov rsi, rdx
mov rbx, rcx
xor edi, edi
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x34], edi
cmp rdx, 0xffffffffffffffff
jne 0x18002f386
lea ecx, [rdx + 7]
jmp 0x18002fc81
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rbx + 0x408], eax
cmp eax, 0xffffffff
je 0x18002fc87
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
mov edi, 2
mov r8d, edi
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rbx + 0x10], rax
test rax, rax
je 0x18002fc87
xor esi, esi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov r9, rax
mov qword [rbx + 0x18], rax
test rax, rax
je 0x18002fc87
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x18002fc7c
mov edx, dword [r9 + 0x3c]
mov dword [rbx + 0x3fc], edx
mov dword [rbx + 0x3f0], esi
mov eax, dword [r9 + 0x3c]
add eax, 7
and eax, 0xfffffff8
mov dword [rbx + 0x3f4], eax
mov eax, dword [rbx + 0x408]
cmp edx, eax
ja 0x18002fc7c
lea rcx, [rdx + 0x108]
cmp rcx, rax
ja 0x18002fc7c
movups xmm0, xmmword [r9]
movups xmmword [rbx + 0x28], xmm0
movups xmm1, xmmword [r9 + 0x10]
movups xmmword [rbx + 0x38], xmm1
movups xmm0, xmmword [r9 + 0x20]
movups xmmword [rbx + 0x48], xmm0
movups xmm1, xmmword [r9 + 0x30]
movups xmmword [rbx + 0x58], xmm1
lea rcx, [rbx + 0x68]
lea rax, [rdx + r9]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdi, 1
jne 0x18002f472
mov rax, qword [rax]
mov qword [rcx], rax
cmp dword [rbx + 0x68], 0x4550
je 0x18002f4dd
mov ecx, 0xbf
jmp 0x18002fc81
movzx eax, word [rbx + 0x7c]
test ax, ax
je 0x18002f68d
lea ecx, [rax + 0x18]
add ecx, edx
mov dword [rbx + 0x400], ecx
movzx eax, word [rbx + 0x6e]
cmp eax, 0x10
ja 0x18002f68d
lea r8, [rax + rax*4]
shl r8, 3
mov edx, ecx
add rdx, r9
lea rcx, [rbx + 0x170]
call fcn.1801a4560
mov edi, esi
mov r15d, esi
mov dword [rsp + 0xf8], esi
mov dword [rsp + 0xf0], esi
movzx eax, word [rbx + 0x6e]
cmp si, ax
jae 0x18002f5d1
lea rdx, [rbx + 0x184]
mov r9d, eax
lea r10, [0x1801e5eb0]
nop dword [rax]
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdx + rcx - 0x14]
inc rcx
cmp al, byte [r10 + rcx - 1]
jne 0x18002f5bf
cmp rcx, 8
jne 0x18002f560
mov ecx, dword [rdx]
mov rax, qword [rbx + 0x18]
movups xmm0, xmmword [rcx + rax]
movaps xmmword [rsp + 0x60], xmm0
movups xmm2, xmmword [rcx + rax + 0x20]
mov edi, dword [rcx + rax + 0x10]
psrldq xmm2, 0xc
movd r8d, xmm2
test r8d, r8d
je 0x18002f5ac
lea eax, [rcx + 0x40]
mov dword [rbx + 0x3f0], eax
mov dword [rbx + 0x3f4], r8d
mov r15d, dword [rdx - 8]
mov r8d, dword [rdx - 4]
add r8d, r15d
mov dword [rsp + 0xf0], r8d
add rdx, 0x28
sub r9, 1
jne 0x18002f550
mov dword [rsp + 0xf8], r15d
mov edx, dword [rbx + 0xf8]
mov rcx, rbx
call fcn.1800318f0
mov r13, rax
mov edx, edi
mov rcx, rbx
call fcn.1800318f0
mov r14, rax
test rax, rax
cmove r14, r13
mov qword [rsp + 0x38], r14
test r13, r13
je 0x18002f68d
test r14, r14
je 0x18002f68d
mov ebp, esi
nop
mov eax, ebp
lea rcx, [rax + rax*4]
cmp dword [r13 + rcx*4], esi
jne 0x18002f624
cmp dword [r13 + rcx*4 + 0x10], esi
je 0x18002f628
inc ebp
jmp 0x18002f610
mov dword [rsp + 0xe8], ebp
lea r12, [rbx + 0x428]
mov qword [r12], rsi
mov dword [rsp + 0x30], esi
test ebp, ebp
je 0x18002facd
mov r9d, dword [r13 + 0xc]
test r9, r9
je 0x18002f68d
mov ecx, esi
movzx r11d, word [rbx + 0x6e]
test r11d, r11d
je 0x18002f68d
nop dword [rax + rax]
mov edx, ecx
lea rax, [rdx + rdx*4]
mov r8d, dword [rbx + rax*8 + 0x17c]
mov r10d, dword [rbx + rax*8 + 0x180]
add r10d, r8d
cmp r9, r8
jb 0x18002f686
mov eax, r10d
cmp r9, rax
jb 0x18002f697
inc ecx
cmp ecx, r11d
jb 0x18002f660
mov ecx, 0xc0
jmp 0x18002fc81
lea rax, [rdx + rdx*4]
mov esi, dword [rbx + rax*8 + 0x184]
sub rsi, r8
add rsi, qword [rbx + 0x18]
add rsi, r9
je 0x18002f68d
mov ecx, 0x38
call fcn.1801860bc
mov rdi, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x18002fc5f
xor eax, eax
mov qword [rdi], rax
mov dword [rdi + 8], eax
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], rax
mov qword [rdi + 0x20], rax
mov qword [rdi + 0x30], rax
mov qword [rdi + 0x28], rax
mov qword [r12], rdi
mov r12, rdi
mov qword [rsp + 0x48], rdi
inc dword [rbx + 0x430]
mov rcx, rsi
call fcn.180031cf0
mov qword [rdi + 0x30], rax
test rax, rax
je 0x18002fc87
mov eax, dword [r13]
mov dword [rdi + 0x1c], eax
mov eax, dword [r13 + 0x10]
mov dword [rdi + 0x20], eax
mov eax, dword [r13 + 8]
mov dword [rdi + 0x24], eax
xor esi, esi
mov qword [rdi + 0x10], rsi
mov dword [rdi + 0x18], esi
mov dword [rdi + 8], esi
mov eax, dword [r13 + 0x10]
cmp eax, r15d
jb 0x18002f74f
cmp eax, dword [rsp + 0xf0]
jae 0x18002f74f
mov qword [rdi + 0x28], rsi
mov dword [rdi + 8], 1
jmp 0x18002fab7
mov r9d, dword [r14 + 0xc]
test r9, r9
je 0x18002f68d
mov ecx, esi
movzx r11d, word [rbx + 0x6e]
test r11d, r11d
je 0x18002f68d
nop dword [rax]
mov edx, ecx
lea rax, [rdx + rdx*4]
mov r8d, dword [rbx + rax*8 + 0x17c]
mov r10d, dword [rbx + rax*8 + 0x180]
add r10d, r8d
cmp r9, r8
jb 0x18002f796
mov eax, r10d
cmp r9, rax
jb 0x18002f7a3
inc ecx
cmp ecx, r11d
jae 0x18002f68d
jmp 0x18002f770
lea rax, [rdx + rdx*4]
mov ecx, dword [rbx + rax*8 + 0x184]
sub rcx, r8
add rcx, qword [rbx + 0x18]
add rcx, r9
je 0x18002f68d
call fcn.180031cf0
mov qword [rdi + 0x28], rax
test rax, rax
je 0x18002fc87
mov eax, dword [r13]
test eax, eax
jne 0x18002f7dc
mov eax, dword [r13 + 0x10]
mov r9d, eax
test eax, eax
je 0x18002f821
mov ecx, esi
movzx r11d, word [rbx + 0x6e]
test r11d, r11d
je 0x18002f821
nop
mov edx, ecx
lea rax, [rdx + rdx*4]
mov r8d, dword [rbx + rax*8 + 0x17c]
mov r10d, dword [rbx + rax*8 + 0x180]
add r10d, r8d
cmp r9, r8
jb 0x18002f81a
mov eax, r10d
cmp r9, rax
jb 0x18002f956
inc ecx
cmp ecx, r11d
jb 0x18002f7f0
mov r12, rsi
mov eax, dword [r14]
test eax, eax
jne 0x18002f82f
mov eax, dword [r14 + 0x10]
mov r9d, eax
test eax, eax
je 0x18002f873
mov ecx, esi
movzx r11d, word [rbx + 0x6e]
test r11d, r11d
je 0x18002f873
mov edx, ecx
lea rax, [rdx + rdx*4]
mov r8d, dword [rbx + rax*8 + 0x17c]
mov r10d, dword [rbx + rax*8 + 0x180]
add r10d, r8d
cmp r9, r8
jb 0x18002f86c
mov eax, r10d
cmp r9, rax
jb 0x18002f971
inc ecx
cmp ecx, r11d
jb 0x18002f842
mov r14, rsi
mov r15d, esi
test r12, r12
je 0x18002fa9c
cmp qword [r12], rsi
je 0x18002fa9c
nop dword [rax]
inc r15d
cmp qword [r12 + r15*8], rsi
jne 0x18002f890
test r15d, r15d
je 0x18002fa9c
mov dword [rdi + 0x18], r15d
mov ebp, r15d
mov qword [rsp + 0x50], rbp
mov eax, 0x20
mul rbp
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
add rax, 8
cmovb rax, rcx
mov rcx, rax
call fcn.180186108
mov qword [rsp + 0x58], rax
test rax, rax
je 0x18002f906
mov qword [rax], rbp
lea rsi, [rax + 8]
lea rax, [0x18002f260]
mov qword [rsp + 0x20], rax
lea r9, [0x18002f240]
mov r8d, ebp
mov edx, 0x20
mov rcx, rsi
call fcn.180186890
nop
mov qword [rdi + 0x10], rsi
test rsi, rsi
je 0x18002fc5f
xor edi, edi
mov ebp, edi
test r15d, r15d
je 0x18002fa93
lea rdi, [rsi + 4]
sub r12, r14
xor esi, esi
nop dword [rax]
mov qword [rdi], rsi
mov word [rdi - 4], si
mov qword [rdi + 0x14], rsi
mov qword [rdi + 0xc], rsi
mov r9, qword [r12 + r14]
test r9, r9
jns 0x18002f98c
movzx eax, r9w
mov dword [rdi], eax
mov dword [rdi + 4], eax
jmp 0x18002fa7e
lea rax, [rdx + rdx*4]
mov r12d, dword [rbx + rax*8 + 0x184]
sub r12, r8
add r12, qword [rbx + 0x18]
add r12, r9
jmp 0x18002f824
lea rax, [rdx + rdx*4]
mov r14d, dword [rbx + rax*8 + 0x184]
sub r14, r8
add r14, qword [rbx + 0x18]
add r14, r9
jmp 0x18002f876
je 0x18002fa02
mov ecx, esi
movzx r11d, word [rbx + 0x6e]
test r11d, r11d
je 0x18002fa02
nop word [rax + rax]
mov edx, ecx
lea rax, [rdx + rdx*4]
lea r10, [rbx + rax*8]
mov r8d, dword [r10 + 0x17c]
cmp r9, r8
jb 0x18002f9c5
mov eax, dword [r10 + 0x180]
add eax, r8d
cmp r9, rax
jb 0x18002f9ce
inc ecx
cmp ecx, r11d
jae 0x18002fa02
jmp 0x18002f9a0
lea rax, [rdx + rdx*4]
mov ecx, dword [rbx + rax*8 + 0x184]
sub rcx, r8
add rcx, qword [rbx + 0x18]
add rcx, r9
je 0x18002fa02
movzx eax, word [rcx]
mov word [rdi - 4], ax
add rcx, 2
call fcn.180031cf0
mov qword [rdi + 0x14], rax
test rax, rax
je 0x18002fc87
mov r9, qword [r14]
test r9, r9
jns 0x18002fa15
movzx eax, r9w
mov dword [rdi], eax
mov dword [rdi + 4], eax
jmp 0x18002fa7e
je 0x18002fa7e
mov ecx, esi
movzx r11d, word [rbx + 0x6e]
test r11d, r11d
je 0x18002fa7e
mov edx, ecx
lea rax, [rdx + rdx*4]
lea r10, [rbx + rax*8]
mov r8d, dword [r10 + 0x17c]
cmp r9, r8
jb 0x18002fa48
mov eax, dword [r10 + 0x180]
add eax, r8d
cmp r9, rax
jb 0x18002fa51
inc ecx
cmp ecx, r11d
jae 0x18002fa7e
jmp 0x18002fa23
lea rax, [rdx + rdx*4]
mov ecx, dword [rbx + rax*8 + 0x184]
sub rcx, r8
add rcx, qword [rbx + 0x18]
add rcx, r9
je 0x18002fa7e
add rcx, 2
call fcn.180031cf0
mov qword [rdi + 0xc], rax
test rax, rax
je 0x18002fc87
inc ebp
add r14, 8
add rdi, 0x20
cmp ebp, r15d
jb 0x18002f930
jmp 0x18002fa95
xor esi, esi
mov ebp, dword [rsp + 0xe8]
mov r14, qword [rsp + 0x38]
add r14, 0x14
mov qword [rsp + 0x38], r14
mov r15d, dword [rsp + 0xf8]
mov r12, qword [rsp + 0x48]
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
add r13, 0x14
cmp eax, ebp
jb 0x18002f646
mov dword [rbx + 0x404], esi
mov r10d, esi
movzx edi, word [rbx + 0x6e]
cmp si, di
jae 0x18002fc2b
mov r9d, esi
lea rbp, [0x1801e5eb8]
mov r14d, 0xffff
mov eax, r10d
lea rcx, [rax + rax*4]
lea r11, [rbx + rcx*8]
mov eax, dword [r11 + 0x180]
add eax, dword [r11 + 0x184]
cmp eax, r9d
cmova r9d, eax
mov dword [rbx + 0x404], r9d
mov rcx, rsi
nop dword [rax]
movzx eax, byte [r11 + rcx + 0x170]
inc rcx
cmp al, byte [rcx + rbp - 1]
jne 0x18002fc1c
cmp rcx, 8
jne 0x18002fb20
mov r8d, dword [r11 + 0x184]
mov rdx, qword [rbx + 0x18]
movups xmm2, xmmword [rdx + r8]
movaps xmmword [rsp + 0x60], xmm2
movups xmm3, xmmword [rdx + r8 + 0x10]
movups xmm4, xmmword [rdx + r8 + 0x20]
movdqa xmm1, xmm2
psrldq xmm1, 8
movd ecx, xmm1
movd eax, xmm2
test ecx, ecx
cmove ecx, eax
mov eax, dword [rsp + 0x6c]
sub eax, ecx
mov dword [rsp + 0x34], eax
mov eax, ecx
add rax, rdx
add rax, r8
mov qword [rsp + 0x40], rax
mov ecx, dword [r11 + 0x180]
add ecx, r8d
cmp ecx, r9d
cmova r9d, ecx
mov dword [rbx + 0x404], r9d
add di, r14w
mov word [rbx + 0x6e], di
movd dword [rbx + 0xf8], xmm3
movq rax, xmm3
shr rax, 0x20
mov dword [rbx + 0xfc], eax
movdqa xmm0, xmm3
psrldq xmm0, 8
movd dword [rbx + 0x148], xmm0
psrldq xmm3, 8
movq rax, xmm3
shr rax, 0x20
mov dword [rbx + 0x14c], eax
movd dword [rbx + 0x150], xmm4
movdqa xmm0, xmm4
psrldq xmm0, 4
movd dword [rbx + 0x154], xmm0
mov dword [rbx + 0xc0], esi
psrldq xmm4, 8
movd dword [rbx + 0xb8], xmm4
mov dword [rbx + 0x434], 1
inc r10d
movzx eax, di
cmp r10d, eax
jb 0x18002faf3
mov ecx, 0x10
call fcn.1801860bc
mov qword [rsp + 0xe8], rax
test rax, rax
je 0x18002fc66
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
mov ecx, dword [rsp + 0x34]
mov dword [rax + 8], ecx
mov dword [rax + 0xc], esi
mov qword [rbx + 8], rax
mov eax, 1
jmp 0x18002fc89
mov ecx, 0xe
jmp 0x18002fc81
mov qword [rbx + 8], rsi
mov ecx, 0xe
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 1
jmp 0x18002fc89
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0xe0]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret