Function at 0x2100daba0
Capabilities:
Get file size
Parse pe header
Read file via mapping

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa8
xor edx, edx
mov rbx, rcx
call method.path_conv.get_nt_native_path__UNICODE_STRING_
test rax, rax
je 0x2100dad20
mov r8d, dword [0x2102d1cd0]
xor eax, eax
lea rcx, [rsp + 0x40]
lea r9, [rsp + 0x60]
mov edx, 0x80100000
mov dword [rsp + 0x70], 0x30
mov qword [rsp + 0x78], 0
test r8d, r8d
lea r8, [rsp + 0x70]
mov qword [rsp + 0x98], 0
setne al
add rbx, 0x78
add eax, eax
or eax, dword [rbx - 0x74]
mov dword [rsp + 0x28], 0x4060
mov dword [rsp + 0x20], 7
mov dword [rsp + 0x88], eax
mov rax, qword [0x2102d1cc8]
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x90], rax
call sym.NtOpenFile
test eax, eax
js 0x2100dad50
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x48]
call sym.GetFileSizeEx
test eax, eax
je 0x2100dad70
mov edx, dword [0x21034b048]
cmp qword [rsp + 0x48], rdx
jle 0x2100dac72
mov dword [rsp + 0x48], edx
mov dword [rsp + 0x20], 0
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov r8d, 2
mov qword [rsp + 0x28], 0
lea rdx, [0x2102d1cc0]
call sym.CreateFileMappingA
mov rcx, qword [rsp + 0x40]
mov r12, rax
call sym.NtClose
test r12, r12
je 0x2100dad50
mov eax, dword [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov edx, 4
mov rcx, r12
lea r14, [0x210298760]
mov qword [rsp + 0x20], rax
call sym.MapViewOfFile
mov r13, rax
test rax, rax
je 0x2100dad0f
cmp word [rax], 0x5a4d
jne 0x2100dad00
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x2100dad00
cmp word [rcx + 4], 0x8664
je 0x2100dad88
mov rcx, r13
lea r14, [0x210298760]
call sym.UnmapViewOfFile
mov rcx, r12
call sym.CloseHandle
jmp 0x2100dad57
mov dword [rsp + 0x28], 0x4060
xor r8d, r8d
lea rcx, [rsp + 0x40]
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 7
mov edx, 0x80100000
call sym.NtOpenFile
test eax, eax
jns 0x2100dac4a
nop
lea r14, [0x210298760]
mov rax, r14
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x40]
lea r14, [0x210298760]
call sym.NtClose
jmp 0x2100dad57
mov ebp, dword [rcx + 0x90]
mov r11d, dword [rcx + 0x94]
test ebp, ebp
je 0x2100dad00
lea r8, [rsp + 0x3c]
mov edx, ebp
call sym.rvadelta__IMAGE_NT_HEADERS64__unsigned_int__unsigned_int_
mov qword [rsp + 0x50], rax
test rax, rax
js 0x2100dad00
mov edx, dword [rsp + 0x3c]
sub ebp, eax
lea ecx, [rdx + rbp]
cmp ecx, dword [0x21034b048]
ja 0x2100dae6a
add rbp, r13
xor esi, esi
mov ecx, dword [rbp + 0x10]
mov qword [rsp + 0x58], rbp
test ecx, ecx
je 0x2100dad00
test rsi, rsi
mov rbx, r13
lea r14, [0x210298760]
cmovne rbx, rsi
lea rdi, [0x2103182e0]
jmp 0x2100dae10
mov eax, dword [rbp + 0x24]
add rbp, 0x14
test eax, eax
je 0x2100dae50
mov rax, qword [rsp + 0x50]
mov r15d, dword [rbp + 0xc]
xor edx, edx
mov r8d, 3
sub r15, rax
add r15, rbx
mov rcx, r15
call sym.LoadLibraryExA
test rax, rax
jne 0x2100dae00
mov r8d, 0x104
mov rdx, r15
mov rcx, rdi
call sym.msys_2.0.dll_strlcpy
lea r14, [0x2103182e0]
jmp 0x2100dae00
test rsi, rsi
je 0x2100dae5d
mov rcx, rsi
call sym.UnmapViewOfFile
mov rcx, r13
call sym.UnmapViewOfFile
jmp 0x2100dad0f
mov dword [rsp + 0x28], edx
lea r10, [rsp + 0x50]
mov r9d, ebp
mov r8, r12
mov dword [rsp + 0x20], r11d
lea rcx, [rsp + 0x58]
mov rdx, r10
call sym.remap__IMAGE_IMPORT_DESCRIPTOR__long__void__unsigned_int__unsigned_int__unsigned_int_
mov rsi, rax
test rax, rax
je 0x2100dad00
mov rbp, qword [rsp + 0x58]
mov edx, dword [rbp + 0x10]
test edx, edx
je 0x2100dae55
mov rax, qword [rsp + 0x50]
jmp 0x2100dade1