Function at 0x140008c78
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x230
xor r13d, r13d
mov r14, r9
mov rbx, r8
mov rsi, rdx
mov r15, rcx
cmp rdx, r13
je 0x140008ca8
mov r12, qword [rdx]
jmp 0x140008caf
lea r12, [0x1400f9548]
lea rcx, [rsp + 0x280]
mov edx, 0x105
call fcn.14005a1c4
mov rdx, qword [rsp + 0x280]
mov rbp, rdx
cmp rbx, r13
je 0x140008cd6
cmp qword [rbx], r13
jne 0x140008cec
xor ecx, ecx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rdx, qword [rsp + 0x280]
cmp rbx, r13
je 0x140008d18
cmp qword [rbx], r13
jne 0x140008d00
mov rcx, rbx
call fcn.140064e2c
jmp 0x140008d18
mov rdx, qword [rbx]
lea rcx, [rsp + 0x280]
call fcn.140064e2c
mov rbp, qword [rsp + 0x280]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rbx, [rsp + 0x288]
cmp r14, r13
movsxd rcx, eax
cmovne rbx, r14
lea rdx, [rsp + 0x78]
lea rax, [rcx + rcx + 2]
mov edi, 1
mov r8d, 0x8000004
mov qword [rsp + 0x50], rax
add eax, 0x28
xor r9d, r9d
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x78], 0x18
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x80], r13
mov dword [rsp + 0x88], edi
mov qword [rsp + 0x288], r13
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
cmp rax, 0xffffffffffffffff
cmove rax, r13
mov qword [rbx], rax
cmp rax, r13
jne 0x140008da2
mov rcx, qword [rsp + 0x288]
cmp rcx, r13
jmp 0x140008dcd
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 6]
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r13, rax
test rax, rax
jne 0x140008de8
mov rcx, qword [rsp + 0x288]
test rcx, rcx
je 0x140008f8f
cmp rcx, 0xffffffffffffffff
je 0x140008f8f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140008f8f
mov rax, qword [rsp + 0x50]
lea rcx, [r13 + 8]
mov rdx, r15
mov r8, rax
mov qword [r13], rax
call fcn.14001b7a8
mov r15, qword [rsp + 0x50]
xor edx, edx
lea rcx, [r13 + r15 + 8]
lea r8d, [rdx + 0x12]
call fcn.1400dd9e0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov r8, rbx
mov r8, qword [rbx]
lea rdx, str._map:0x_p:_lu
lea rcx, [rsp + 0x100]
mov r9d, r15d
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, str.PECMD_LOAD
lea rcx, [rsp + 0x278]
or r8, 0xffffffffffffffff
call fcn.140064d54
mov rbx, qword [rsp + 0x290]
xor r13d, r13d
cmp word [rbx], r13w
je 0x140008e9d
lea rdx, str.logs:_
lea rcx, [rsp + 0x278]
call fcn.14005a28c
lea rcx, [rsp + 0x278]
mov rdx, rbx
call fcn.14005a28c
lea rdx, [0x1400f97c4]
lea rcx, [rsp + 0x278]
call fcn.14005a28c
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x278]
call fcn.14005a28c
lea rcx, [rsp + 0x278]
mov rdx, r12
call fcn.14005a28c
cmp r14, r13
je 0x140008edc
mov rdx, qword [rsp + 0x278]
mov rcx, rsi
call fcn.140064e2c
jmp 0x140008f66
xor eax, eax
lea rcx, [rsp + 0x98]
xor edx, edx
lea r8d, [rax + 0x60]
mov qword [rsp + 0x58], r13
mov dword [rsp + 0x90], 0x68
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
call fcn.1400dd9e0
mov rdx, qword [rsp + 0x278]
lea r11, [rsp + 0x58]
lea rax, [rsp + 0x90]
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
xor r9d, r9d
xor r8d, r8d
mov rcx, rbp
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], edi
call fcn.1400dcefc
cmp eax, r13d
je 0x140008f66
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x278]
call fcn.140052160
mov rcx, qword [rsp + 0x288]
cmp rcx, r13
je 0x140008f8c
cmp rcx, 0xffffffffffffffff
je 0x140008f8c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, r13d
lea rcx, [rsp + 0x280]
call fcn.140052160
mov rbx, qword [rsp + 0x270]
mov eax, edi
add rsp, 0x230
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret