Function at 0x30013ee8
Capabilities:
Get file size
Read file via mapping

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
movabs rax, 0x88
call sub.KERNEL32.dll___chkstk
sub rsp, rax
mov r14, r8
mov r15, rdx
mov rbx, rcx
xor r9d, r9d
mov qword [rsp + 0x48], r9
xor r12d, r12d
mov qword [rsp + 0x68], r12
xor ecx, ecx
mov qword [rsp + 0x60], rcx
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x70], 0
xor r13d, r13d
xor esi, esi
mov qword [rsp + 0x78], rcx
cmp dword [rbx + 0x20], esi
jg 0x30013f6d
mov dword [0x30089c7c], 1
xor eax, eax
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
cmp dword [0x30089c5c], 0
je 0x30013f7d
mov dword [rbx + 0x34], 1
mov ecx, dword [rbx + 0x58]
test ecx, ecx
jne 0x30013f89
cmp dword [rbx + 0x54], ecx
je 0x30013f9e
cmp dword [rbx + 0x30], 0
jne 0x30013f53
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x30013f9e
cmp word [rax], 0
jne 0x30013f53
test ecx, ecx
je 0x30013fdc
mov rax, qword [rbx]
test rax, rax
je 0x30013faf
cmp byte [rax], 0
jne 0x30013f53
mov rax, qword [rbx + 8]
test rax, rax
je 0x30013fbd
cmp byte [rax], 0
jne 0x30013f53
mov rax, qword [rbx + 0x18]
test rax, rax
je 0x30013fcc
cmp word [rax], 0
jne 0x30013f53
cmp dword [rbx + 0x34], 0
jne 0x30013f53
cmp dword [rbx + 0x38], 0
jne 0x30013f53
mov rax, qword [rbx]
test rax, rax
je 0x30014074
cmp byte [rax], 0
je 0x30014074
mov rdi, rax
cmp byte [rax], 0
je 0x30014007
cmp byte [rdi], 0x3b
je 0x30014007
add rdi, 1
cmp byte [rdi], 0
jne 0x30013ff9
mov rcx, rax
lea rdx, [rsp + 0x48]
cmp byte [rdi], 0
jne 0x3001401e
call fcn.30010e78
mov rax, rdi
jmp 0x3001402a
mov byte [rdi], 0
call fcn.30010e78
lea rax, [rdi + 1]
cmp byte [rax], 0
jne 0x30013ff1
mov r9, qword [rsp + 0x48]
mov rcx, r9
call fcn.30010d58
mov r13d, eax
test r13d, r13d
jle 0x30014074
add r13d, 1
mov edx, 0x106
mov ecx, r13d
call fcn.30021110
mov qword [rsp + 0x70], rax
test rax, rax
je 0x30014071
mov r8d, r13d
mov rdx, rax
mov rcx, qword [rsp + 0x48]
call fcn.30010dbc
jmp 0x30014074
xor r13d, r13d
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x30014091
cmp byte [rcx], 0
je 0x30014091
lea rdx, [rsp + 0x68]
call fcn.300105e4
mov r12, qword [rsp + 0x68]
cmp dword [rbx + 0x30], 0
je 0x300140ac
cmp dword [0x30089c68], 0
jne 0x300140ac
mov rax, qword [0x300867c8]
mov qword [rsp + 0x58], rax
lea rcx, [rbx + 0x10]
call fcn.30011c4c
lea rcx, [rbx + 0x18]
call fcn.30011c4c
mov r8, qword [rsp + 0x58]
test r8, r8
je 0x300140cf
cmp word [r8], 0
ja 0x300140f1
test r13d, r13d
jg 0x300140f1
test r12, r12
jne 0x300140f1
cmp dword [rbx + 0x34], r12d
jne 0x300140f1
cmp dword [rbx + 0x38], r12d
jne 0x300140f1
cmp qword [rbx + 0x10], r12
jne 0x300140f1
cmp qword [rbx + 0x18], r12
je 0x3001416d
mov ecx, dword [rbx + 0x38]
or ecx, dword [rbx + 0x34]
lea rax, [rbx + 0x48]
mov qword [rsp + 0x38], r8
mov dword [rsp + 0x30], ecx
mov qword [rsp + 0x28], rax
mov rax, qword [rbx + 0x18]
mov qword [rsp + 0x20], rax
mov r9, qword [rbx + 0x10]
mov r8, r12
mov edx, r13d
mov rcx, qword [rsp + 0x70]
call fcn.30011308
test eax, eax
je 0x3001478c
cmp dword [0x300899f0], 0
jne 0x3001416d
mov qword [rsp + 0x20], rbx
lea r9, [0x300063c4]
mov r8, qword [0x30088730]
mov edx, 0x6d
mov rcx, qword [0x30089a38]
call fcn.30003e04
test rax, rax
jne 0x3001416d
mov dword [r15 + 0x10], 1
jmp 0x3001478c
mov esi, 1
mov dword [rbx + 0x50], esi
call fcn.30017760
test eax, eax
je 0x30013f53
cmp dword [rbx + 0x34], 0
je 0x30014351
cmp dword [0x30089c68], 0
jne 0x300141c5
mov rdx, qword [0x30086180]
test rdx, rdx
je 0x3001478a
mov r8d, dword [0x30086188]
lea rcx, str.memory.dmp
call fcn.3001788c
test eax, eax
jne 0x30014351
jmp 0x3001478a
test r14, r14
je 0x3001478a
cmp word [r14], 0
je 0x3001478a
mov rcx, r14
call fcn.30021a10
mov r12d, eax
add r12d, 1
lea ecx, [r12 + r12]
mov edx, 0x106
call fcn.30021110
mov rdi, rax
test rdi, rdi
je 0x3001478a
mov r8d, r12d
mov rdx, rdi
mov rcx, r14
call fcn.300258c0
mov dx, 0x7c
mov rcx, rdi
call fcn.30008f74
mov r12, rax
mov byte [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 3
mov edx, 0x80000000
mov rcx, r12
call fcn.3000a3dc
mov r14, rax
cmp r14, 0xffffffffffffffff
je 0x300146f1
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 2
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rbp, rax
test rbp, rbp
je 0x3001431b
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 4
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r15, rax
test r15, r15
je 0x3001430b
lea rdx, [0x30037f52]
mov rcx, r12
call fcn.30009e0c
mov r12, rax
test r12, r12
je 0x300142fb
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r8d, eax
mov rdx, r15
mov rcx, r12
call fcn.3001788c
mov rcx, r12
test eax, eax
je 0x300146e5
call fcn.30021150
mov r12b, 1
jmp 0x30014300
mov r12b, byte [rsp + 0x40]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
jmp 0x30014310
mov r12b, byte [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x30014320
mov r12b, byte [rsp + 0x40]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r12b, r12b
je 0x300146f1
mov dx, 0x7c
xor ecx, ecx
call fcn.30008f74
mov r12, rax
test r12, r12
jne 0x3001421f
mov rcx, rdi
call fcn.30021150
cmp dword [rbx + 0x38], 0
je 0x300143b2
cmp dword [0x30089c68], 0
jne 0x300143b2
cmp dword [0x30089a4c], 0
jne 0x300143b2
mov r9d, 1
lea r8, [0x30086190]
mov edx, 0x104
lea rcx, [0x300863b8]
call fcn.3000f5c0
mov rdx, qword [0x300861a0]
test rdx, rdx
je 0x3001478a
mov r8d, dword [0x300861a8]
lea rcx, str.sharedmemory.dmp
call fcn.3001788c
test eax, eax
je 0x3001478a
xor edi, edi
mov rax, qword [rbx + 0x40]
cmp word [rax], di
jbe 0x3001445d
movsxd r12, edi
imul r12, r12, 0x110
mov rax, qword [rbx + 0x40]
mov rax, qword [rax + 0x10]
lea rcx, [rax + r12 + 0xc]
call fcn.300219f0
mov r14d, eax
add r14d, 1
mov edx, r14d
lea rcx, [rsp + 0x50]
call fcn.30021290
test eax, eax
je 0x3001478a
mov rax, qword [rbx + 0x40]
mov rax, qword [rax + 0x10]
lea rcx, [rax + r12 + 0xc]
mov r8d, r14d
mov rdx, qword [rsp + 0x50]
call fcn.300258f0
mov rcx, qword [rsp + 0x50]
call fcn.30009da0
mov rax, qword [rbx + 0x40]
mov rdx, qword [rax + 0x10]
add rdx, r12
mov r8d, dword [rdx + 8]
mov rdx, qword [rdx]
mov rcx, qword [rsp + 0x50]
call fcn.3001788c
mov rcx, qword [rsp + 0x50]
test eax, eax
je 0x30014700
call fcn.300214c0
add edi, 1
mov rax, qword [rbx + 0x40]
movzx eax, word [rax]
cmp edi, eax
jl 0x300143c1
lea rcx, [rsp + 0x78]
call fcn.30011b48
test eax, eax
je 0x30014495
mov rdi, qword [rsp + 0x78]
mov rcx, rdi
call fcn.300219f0
add eax, 1
mov r8d, eax
mov rdx, rdi
lea rcx, str.version.txt
call fcn.3001788c
test eax, eax
je 0x3001478a
cmp qword [rsp + 0x48], 0
je 0x300144b2
mov edx, r13d
mov rcx, qword [rsp + 0x70]
call fcn.3001117c
test eax, eax
je 0x3001478a
mov r8, qword [rsp + 0x58]
test r8, r8
je 0x300144d7
cmp dword [rbx + 0x30], 0
je 0x300144d7
lea rdx, [rsp + 0x60]
mov rcx, r8
call fcn.30013d14
test eax, eax
je 0x3001478a
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x300144ee
call fcn.300111b8
test eax, eax
je 0x3001478a
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x3001464e
mov dx, 0x3b
call fcn.30008f74
mov rdi, rax
lea rbp, [0x30037f52]
xor r14b, r14b
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 3
mov edx, 0x80000000
mov rcx, rdi
call fcn.3000a3dc
mov r12, rax
cmp r12, 0xffffffffffffffff
je 0x300145f9
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 2
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov r13, rax
test r13, r13
je 0x300145eb
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 4
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r15, rax
test r15, r15
je 0x300145e2
mov rdx, rbp
mov rcx, rdi
call fcn.30009e0c
mov r14, rax
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r8d, eax
mov rdx, r15
mov rcx, r14
call fcn.3001788c
mov rcx, r14
test eax, eax
je 0x300146f4
call fcn.30021150
mov r14b, 1
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14b, r14b
jne 0x30014637
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x58], eax
mov rdx, rbp
mov rcx, rdi
call fcn.30009e0c
mov rdi, rax
mov byte [rdi], 0x21
mov r8d, 4
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.3001788c
mov rcx, rdi
test eax, eax
je 0x300146f4
call fcn.30021150
mov dx, 0x3b
xor ecx, ecx
call fcn.30008f74
mov rdi, rax
test rdi, rdi
jne 0x3001450e
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x3001475d
mov dx, 0x3b
call fcn.30008f74
mov r12, rax
lea r15, str..ver
lea rdx, [rsp + 0x58]
mov rcx, r12
call fcn.3000a4b0
mov r13d, eax
test r13d, r13d
jle 0x3001470c
mov edx, 0x106
mov ecx, r13d
call fcn.30021110
mov r14, rax
test r14, r14
je 0x300146a6
movsxd rcx, r13d
mov rdi, r14
xor eax, eax
rep stosb byte [rdi], al
mov r9, r14
mov r8d, r13d
mov edx, dword [rsp + 0x58]
mov rcx, r12
call fcn.3000a590
mov rdx, r15
mov rcx, r12
call fcn.30009e0c
mov rdi, rax
mov r8d, r13d
mov rdx, r14
mov rcx, rdi
call fcn.3001788c
mov rcx, rdi
test eax, eax
je 0x300146f4
call fcn.30021150
mov rcx, r14
jmp 0x30014741
xor esi, esi
call fcn.30021150
mov rcx, rdi
jmp 0x300146f6
mov rcx, rdi
xor esi, esi
call fcn.30021150
jmp 0x3001478c
xor esi, esi
call fcn.300214c0
jmp 0x3001478c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x50], eax
mov rdx, r15
mov rcx, r12
call fcn.30009e0c
mov rdi, rax
mov byte [rdi], 0x21
mov r8d, 4
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.3001788c
mov rcx, rdi
test eax, eax
je 0x300146f4
call fcn.30021150
mov dx, 0x3b
xor ecx, ecx
call fcn.30008f74
mov r12, rax
test r12, r12
jne 0x3001466e
lea rdi, [rbx + 0x24]
add rbx, 0x28
mov rdx, rdi
mov rcx, rbx
call fcn.3001799c
test eax, eax
jne 0x3001478c
mov dword [rdi], eax
mov rcx, qword [rbx]
test rcx, rcx
je 0x3001478a
call fcn.30021150
mov qword [rbx], 0
xor esi, esi
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x300147c2
xor ebx, ebx
cmp word [rcx], bx
jbe 0x300147bd
movsxd rax, ebx
mov rcx, qword [rcx + 0x10]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
add ebx, 1
mov rcx, qword [rsp + 0x68]
movzx eax, word [rcx]
cmp ebx, eax
jl 0x3001479d
call fcn.3002d1f8
mov rax, qword [rsp + 0x60]
test rax, rax
je 0x3001480c
xor ebx, ebx
cmp word [rax], bx
jbe 0x300147f5
movsxd rcx, ebx
shl rcx, 5
add rcx, qword [rax + 0x10]
call fcn.300098a4
add ebx, 1
mov rcx, qword [rsp + 0x60]
movzx eax, word [rcx]
cmp ebx, eax
mov rax, rcx
jl 0x300147d3
mov rcx, rax
call fcn.3002df00
mov edx, 1
mov rcx, qword [rsp + 0x60]
call fcn.30013ea8
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x30014848
xor ebx, ebx
cmp word [rcx], bx
jbe 0x30014843
movsxd rax, ebx
mov rdx, qword [rcx + 0x10]
cmp qword [rdx + rax*8], 0
je 0x30014839
mov rcx, qword [rdx + rax*8]
call fcn.30021150
mov rcx, qword [rsp + 0x48]
add ebx, 1
movzx eax, word [rcx]
cmp ebx, eax
jl 0x3001481d
call fcn.3002d1f8
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x3001485a
mov rcx, rax
call fcn.30021150
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x30014869
call fcn.30021150
mov eax, esi
jmp 0x30013f55