Function at 0x18001bbbc
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rbp
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
and qword [rax - 0x48], 0
xor r9d, r9d
mov dword [rax - 0x50], 0x80
mov edx, 0x80000000
mov dword [rax - 0x58], 3
lea r8d, [r9 + 1]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
nop dword [rax + rax]
mov qword [rsp + 0x88], rax
mov edi, 0x80070000
mov ebp, 0x80004005
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x18001bc44
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, edi
test eax, eax
cmovle ebx, eax
test ebx, ebx
cmovns ebx, ebp
test ebx, ebx
js 0x18001bdfa
and qword [rsp + 0x28], 0
xor r9d, r9d
and dword [rsp + 0x20], 0
xor edx, edx
mov rcx, rsi
lea r8d, [r9 + 2]
call qword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_CreateFileMappingW]
nop dword [rax + rax]
mov r15, rax
test rax, rax
jne 0x18001bc92
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, edi
test eax, eax
cmovle ebx, eax
test ebx, ebx
cmovns ebx, ebp
test ebx, ebx
js 0x18001bdeb
and qword [rsp + 0x90], 0
lea rdx, [rsp + 0x90]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileSizeEx]
nop dword [rax + rax]
test eax, eax
je 0x18001bcba
xor ebx, ebx
jmp 0x18001bcdd
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, edi
test eax, eax
cmovle ebx, eax
test ebx, ebx
cmovns ebx, ebp
test ebx, ebx
js 0x18001bddc
mov rax, qword [rsp + 0x90]
mov ecx, 0x40000000
cmp rax, rcx
mov esi, 0x80004005
cmovg rax, rcx
xor edi, edi
mov qword [rsp + 0x90], rax
mov ebp, eax
mov eax, edi
cmp rax, rbp
jae 0x18001bdd4
mov r14, rbp
mov r9d, edi
sub r14, rax
mov rcx, r15
cmp rbp, r14
cmovb r14, rbp
xor r8d, r8d
mov qword [rsp + 0x20], r14
lea edx, [r8 + 4]
call qword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_MapViewOfFile]
nop dword [rax + rax]
mov r12, rax
test rax, rax
jne 0x18001bd63
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
cmovns ebx, esi
test ebx, ebx
js 0x18001bdca
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r14
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
nop dword [rax + rax]
xor r9d, r9d
lea r8, [rsp + 0x40]
mov rcx, rax
lea edx, [r9 + 1]
call qword [sym.imp.api_ms_win_core_memory_l1_1_1.dll_PrefetchVirtualMemory]
nop dword [rax + rax]
test eax, eax
je 0x18001bd9c
xor ebx, ebx
jmp 0x18001bdbb
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
cmovns ebx, esi
mov rcx, r12
call qword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_UnmapViewOfFile]
nop dword [rax + rax]
add edi, ebp
test ebx, ebx
jns 0x18001bd02
mov rsi, qword [rsp + 0x88]
mov rcx, r15
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret