Function at 0x1800034a0
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov qword [rsp + 0x20], rbp
push rdi
push r12
push r15
sub rsp, 0x40
xor r12d, r12d
mov r15, rdx
mov qword [rsp + 0x30], r12
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov rbp, rcx
mov dword [rsp + 0x20], 3
lea r8d, [r12 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1800034f9
xor eax, eax
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r12
pop rdi
ret
xor r9d, r9d
mov qword [rsp + 0x28], r12
xor edx, edx
mov qword [rsp + 0x70], r14
mov rcx, rdi
mov dword [rsp + 0x20], r12d
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r14, rax
test rax, rax
jne 0x180003532
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x180003642
xor r9d, r9d
mov qword [rsp + 0x68], rsi
xor r8d, r8d
mov qword [rsp + 0x20], r12
mov rcx, r14
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rsi, rax
test rax, rax
jne 0x180003570
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x18000363d
xor edx, edx
mov qword [rsp + 0x60], rbx
mov rcx, rdi
add rsi, 0x2ab9e
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
mov rax, qword [r15]
sub rbx, 0x2ab9e
test rax, rax
je 0x18000359f
cmp rax, rbx
cmovbe rbx, rax
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x18000360c
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.____Mapping_of
call fcn.180003290
mov rcx, rax
mov rdx, rbp
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
mov rcx, rax
lea rdx, str._is_invalid_
call fcn.180003290
mov rcx, rax
lea rdx, [0x180003460]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x180003638
test rbx, rbx
jne 0x180003656
mov rbp, r12
mov rbx, r12
mov rcx, rsi
mov qword [r15], rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbp
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov r14, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r12
pop rdi
ret
mov edx, 1
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rbp, rax
test rax, rax
je 0x180003614
mov r8, rbx
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
jmp 0x180003617