Function at 0x140001980
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push rbx
push rdi
push r12
sub rsp, 0x70
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor r12d, r12d
call fcn.1400014a0
mov rcx, rax
mov edx, 0x3769c839
call fcn.140001670
mov rcx, rax
call fcn.1400017e0
test eax, eax
mov ebx, r12d
mov edi, 1
cmovne ebx, edi
call fcn.1400014a0
mov rcx, rax
mov edx, 0xe7abfe15
call fcn.140001670
mov rcx, rax
call fcn.1400017e0
test eax, eax
je 0x1400019e2
inc ebx
call fcn.1400014a0
mov rcx, rax
mov edx, 0xcd8386bd
call fcn.140001670
mov rcx, rax
call fcn.1400017e0
test eax, eax
je 0x140001a02
inc ebx
call fcn.1400014a0
mov rcx, rax
mov edx, 0x93b5b728
call fcn.140001670
mov rcx, rax
call fcn.1400017e0
test eax, eax
je 0x140001a22
inc ebx
test ebx, ebx
je 0x140001c28
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x98], rsi
mov qword [rsp + 0xa0], r14
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
xorps xmm0, xmm0
xor eax, eax
mov qword [rsp + 0x50], rax
movups xmmword [rsp + 0x40], xmm0
call fcn.1400014a0
mov r9d, 0x18
lea r8, [rsp + 0x40]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
mov rbp, qword [rsp + 0x40]
lea rcx, str.C:WindowsSystem32_ntdll.dll
mov qword [rsp + 0x30], r12
xor r9d, r9d
mov dword [rsp + 0x28], r12d
mov r8d, edi
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x28], r12
xor r9d, r9d
mov rcx, rax
mov dword [rsp + 0x20], r12d
xor edx, edx
mov r8d, 0x1000002
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
xor r9d, r9d
mov qword [rsp + 0x20], r12
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
movsxd rsi, dword [rbp + 0x3c]
movzx edi, r12w
add rsi, rbp
mov r14, rax
cmp r12w, word [rsi + 6]
jae 0x140001ba8
mov qword [rsp + 0xa8], r15
lea r15, str..text
movzx ecx, word [rsi + 0x14]
mov r8, r15
movzx eax, di
add rcx, rsi
lea rbx, [rax*4 + 3]
add rbx, rax
lea rbx, [rcx + rbx*8]
mov rax, rbx
sub r8, rbx
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140001b43
inc rax
test ecx, ecx
jne 0x140001b30
test edx, edx
jne 0x140001b93
mov ecx, dword [rbx + 0xc]
lea r9, [rsp + 0x58]
mov edx, dword [rbx + 8]
add rcx, rbp
mov r8d, 0x40
mov dword [rsp + 0x58], r12d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [rbx + 0xc]
mov r8d, dword [rbx + 8]
lea rdx, [rax + r14]
lea rcx, [rax + rbp]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [rbx + 0xc]
lea r9, [rsp + 0x58]
mov edx, dword [rbx + 8]
add rcx, rbp
mov r8d, dword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
inc di
cmp di, word [rsi + 6]
jb 0x140001b03
mov r15, qword [rsp + 0xa8]
call fcn.1400014a0
mov rcx, rax
mov edx, 0x3769c839
call fcn.140001670
mov rcx, rax
call fcn.1400017e0
call fcn.1400014a0
mov rcx, rax
mov edx, 0xe7abfe15
call fcn.140001670
mov rcx, rax
call fcn.1400017e0
call fcn.1400014a0
mov rcx, rax
mov edx, 0xcd8386bd
call fcn.140001670
mov rcx, rax
call fcn.1400017e0
call fcn.1400014a0
mov rcx, rax
mov edx, 0x93b5b728
call fcn.140001670
mov rcx, rax
call fcn.1400017e0
mov r14, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x98]
mov rbp, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140002030
add rsp, 0x70
pop r12
pop rdi
pop rbx
ret