Function at 0x1400036e8
Capabilities:
Create process on windows
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r14
push r15
sub rsp, 0x120
mov r15d, r8d
mov ebx, edx
cmp edx, 0x1678
jae 0x140003714
xor eax, eax
jmp 0x140003a73
mov r8, rcx
xor edx, edx
lea ecx, [rdx + 6]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov rsi, rax
mov qword [rsp + 0x68], rax
test rax, rax
je 0x14000370d
mov r14, rbx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 6]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbx, rax
mov qword [rsp + 0x70], rax
test rax, rax
jne 0x140003762
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000370d
mov dword [rsp + 0x30], 0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov ecx, dword [rax + 0x1670]
lea rax, [rcx + 0x1680]
cmp r14, rax
jb 0x140003838
mov eax, dword [rcx + rbx + 0x1678]
test eax, eax
je 0x140003838
shr rax, 2
mov qword [rsp + 0x60], rax
cmp rax, 0x2000
jae 0x140003a8d
movdqu xmmword [rsp + 0x88], xmm0
lea r9, [rbx + 0x167c]
add r9, rcx
mov qword [rsp + 0x88], r9
lea r14, [r9 + rax*2]
mov qword [rsp + 0x90], r14
and qword [rsp + 0x58], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x80], rax
cmp dword [rbx + 0x1654], 0
je 0x140003816
lea r8, [rbx + 0x218]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x78]
call fcn.140003ab4
cmp dword [rbx + 0x1658], 0
je 0x140003838
lea r8, [rbx + 0xa18]
mov r9, r14
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x78]
call fcn.140003ab4
mov edx, dword [rbx + 0x1654]
test edx, edx
je 0x140003876
mov rcx, qword [rsp + 0x48]
lea rax, [rbx + 0x218]
test rcx, rcx
cmovne rax, rcx
mov qword [rsp + 0x38], rax
test edx, edx
je 0x140003876
mov rcx, qword [rsp + 0x50]
lea rax, [rbx + 0xa18]
test rcx, rcx
cmovne rax, rcx
mov qword [rsp + 0x40], rax
test r15d, r15d
je 0x1400039c3
mov dword [rsp + 0xa0], WSAStartup
xor edx, edx
lea r8d, [rdx + 0x6c]
lea rcx, [rsp + 0xa4]
call sub.msvcrt.dll_memset
mov eax, dword [rbx + 0x1644]
mov dword [rsp + 0xf8], eax
mov edx, dword [rbx + 4]
mov dword [rsp + 0xa4], edx
mov rcx, qword [rbx + 0x1648]
mov qword [rsp + 0x100], rcx
mov rax, qword [rbx + 0x163c]
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0x100], rcx
mov rax, qword [rbx + 8]
mov qword [rsp + 0xa8], rax
mov eax, dword [rbx + 0x1420]
mov dword [rsp + 0xd0], eax
cmp dword [rbx + 0x1660], 0
je 0x14000390b
lea rax, [rbx + 0x1434]
mov qword [rsp + 0xe8], rax
cmp dword [rbx + 0x165c], 0
je 0x140003923
lea rax, [rbx + 0x1218]
mov qword [rsp + 0xc8], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0xb8], rax
cmp dword [rbx + 0x166c], 0
je 0x140003948
lea rax, [rbx + 0x1674]
mov qword [rsp + 0xe0], rax
cmp dword [rbx + 0x1650], 0
je 0x14000395d
lea rax, [rbx + 0x10]
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0xc0], rax
bts edx, 0xc
mov dword [rsp + 0xa4], edx
lea rcx, [rsp + 0xa0]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [rbx + 0x1668], eax
mov rax, qword [rsp + 0xd8]
mov qword [rbx + 0x1424], rax
mov rcx, qword [rsp + 0x108]
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov dword [rbx + 0x1664], eax
mov rcx, qword [rsp + 0x108]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14d, dword [rbx + 0x1668]
jmp 0x140003a28
mov r9d, dword [rbx + 0x1420]
mov eax, dword [rbx + 0x165c]
lea rcx, [rbx + 0x1218]
neg eax
sbb r8, r8
and r8, rcx
mov eax, dword [rbx + 0x1650]
lea rcx, [rbx + 0x10]
neg eax
sbb rdx, rdx
and rdx, rcx
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], r8
mov r9, qword [rsp + 0x40]
mov r8, qword [rsp + 0x38]
mov rcx, qword [rbx + 8]
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov qword [rsp + 0x110], rax
mov qword [rbx + 0x1424], rax
xor r14d, r14d
cmp eax, 0x20
setg r14b
mov dword [rsp + 0x30], r14d
jmp 0x140003a3e
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140003a4e
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140003a5e
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r14d
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov r14, qword [r11 + 0x20]
mov rsp, r11
pop r15
ret
lea rax, str.buffer_too_large
mov qword [rsp + 0x148], rax
lea rdx, [0x140028f08]
lea rcx, [rsp + 0x148]
call sub.msvcrt.dll__CxxThrowException
nop
int3