Function at 0x1401d5f58
Capabilities:
Read file via mapping

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov r14, r9
mov r15, r8
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1403ac028]
xor rax, rsp
mov qword [rsp + 0x50], rax
call fcn.1401d62ba
mov ebp, eax
test eax, eax
jne 0x1401d611a
mov qword [rsp + 0x40], rdi
mov ebx, dword [rsp + 0xc0]
cmp byte [r15], 0
mov rdi, rbx
je 0x1401d5fae
mov rdi, qword [r15 + 8]
add rdi, rbx
cmp byte [r14], 0
je 0x1401d5fb8
add rdi, qword [r14 + 8]
mov rax, rdi
shr rax, 0x20
jne 0x1401d62b3
mov r13, qword [rsp + 0xc8]
lea r12, [rsi + 0x28]
mov dword [rsp + 0x20], edi
mov qword [rsp + 0x28], 0
mov rcx, 0xffffffffffffffff
xor edx, edx
mov r8d, 0x8000004
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rcx, r12
mov rdx, rax
call fcn.1400a727c
mov rcx, qword [rsi + 0x28]
lea rax, [rcx + 1]
cmp rax, 1
ja 0x1401d6023
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [r13], eax
mov ebp, 0x19
jmp 0x1401d611a
mov qword [rsp + 0x20], 0
mov edx, 6
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
je 0x1401d610b
mov r12, rax
cmp byte [r15], 0
mov r13, rbx
je 0x1401d609c
mov r8, qword [r15 + 8]
test r8, r8
je 0x1401d6095
lea r13, [r12 + rbx]
mov rbp, qword [r15 + 0x10]
mov rcx, r13
mov rdx, rbp
call fcn.140204f20
xor eax, eax
mov rcx, qword [r13 + rax*8]
test rcx, rcx
je 0x1401d6082
sub rcx, rbp
mov qword [r13 + rax*8], rcx
inc rax
cmp rax, 0x40
jne 0x1401d6070
cmp byte [r15], 0
je 0x1401d62b1
mov r13, qword [r15 + 8]
add r13, rbx
cmp byte [r14], 0
je 0x1401d60c1
lea rcx, [r12 + r13]
mov r8, qword [r14 + 8]
mov rdx, qword [r14 + 0x10]
call fcn.140204f20
cmp byte [r14], 0
je 0x1401d62b1
add r13, qword [r14 + 8]
cmp r13, rdi
jne 0x1401d62b6
mov qword [0x1403ec9a8], rbx
lea r8, [0x1403ec9a8]
mov r9d, 8
mov rcx, rsi
call fcn.1401d5ece
mov qword [0x1403ec9a8], 0
test eax, eax
mov r13, qword [rsp + 0xc8]
je 0x1401d613a
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [r13], eax
jmp 0x1401d611a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [r13], eax
mov ebp, 0x1b
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140203460
mov eax, ebp
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
cmp byte [r15], 0
je 0x1401d616f
mov rax, qword [r15 + 8]
mov qword [0x1403ec9b0], rax
lea r8, [0x1403ec9b0]
mov r9d, 8
mov rcx, rsi
call fcn.1401d5ece
mov qword [0x1403ec9b0], 0
test eax, eax
jne 0x1401d60fd
cmp byte [r14], 0
je 0x1401d61a8
mov rax, qword [r14 + 8]
mov qword [0x1403ec9b8], rax
lea r8, [0x1403ec9b8]
mov r9d, 8
mov rcx, rsi
call fcn.1401d5ece
mov qword [0x1403ec9b8], 0
test eax, eax
jne 0x1401d60fd
mov ebp, dword [rsi + 0x10]
mov r14, qword [rsi]
mov ecx, 0x40
call fcn.14020216c
mov r15, rax
mov r9, qword [rsi + 0x38]
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov rcx, r15
mov rdx, r14
mov r8d, ebp
call fcn.1401f85d8
lea rcx, [rsi + 0x30]
mov rdx, r15
call fcn.1401d5952
mov rcx, qword [rsi + 0x30]
mov rdx, r12
mov r8d, dword [rsp + 0xc0]
mov r9d, 0x400
call fcn.1401f86e0
mov ebp, 4
test al, al
je 0x1401d611a
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x48]
mov qword [rdi], rax
mov rbx, qword [rsi]
mov r14, qword [rsi + 0x28]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor ecx, ecx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], 7
mov rcx, rax
mov rdx, r14
mov r8, rbx
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x1401d629d
mov rax, qword [rsp + 0x48]
mov qword [0x1403ec758], rax
lea r8, [0x1403ec758]
mov r9d, 8
mov rcx, rsi
call fcn.1401d5ece
mov qword [0x1403ec758], 0
test eax, eax
jne 0x1401d60fd
mov rcx, rsi
call fcn.1400f41a0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebp, ebp
jmp 0x1401d611a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [r13], eax
mov ebp, 0x1a
jmp 0x1401d611a
ud2
int3
int3