Function at 0x180001470
Capabilities:
Read file via mapping

Disassembly:
push rbx
push rdi
push r12
push r15
sub rsp, 0x68
xor ebx, ebx
mov rdi, r8
mov r12, rdx
mov r15d, ebx
mov r10d, ebx
lea rax, str.clr.dll
movzx r9d, word [rax + r10*2]
inc r10
cmp r9w, word [rdx + r10*2 - 2]
jne 0x1800014b4
cmp r10, 8
jne 0x180001490
mov rax, rbx
add rsp, 0x68
pop r15
pop r12
pop rdi
pop rbx
ret
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x98], rsi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
mov qword [rsp + 0x50], rax
cmp rax, 0xffffffffffffffff
je 0x1800018b8
xor r9d, r9d
xor edx, edx
mov rcx, rax
lea r8d, [r9 + 2]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x60], r14
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r14, rax
mov qword [rsp + 0xa8], rax
test rax, rax
je 0x1800018aa
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
mov qword [rsp + 0xa0], r13
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r13, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x180001899
movsxd rsi, dword [rax + 0x3c]
xor ecx, ecx
mov r8d, 0x3000
add rsi, rax
lea r9d, [rcx + 4]
mov qword [rsp + 0x90], rbp
mov edx, dword [rsi + 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsi + 0x54]
mov rdx, r13
mov rcx, rax
mov r15, rax
call fcn.180002d80
movsxd rbp, dword [r13 + 0x3c]
add rbp, r13
cmp bx, word [rsi + 6]
jae 0x1800015d1
nop dword [rax]
mov eax, ebx
lea rcx, [rax + rax*4]
mov edx, dword [rbp + rcx*8 + 0x11c]
mov r8d, dword [rbp + rcx*8 + 0x118]
mov ecx, dword [rbp + rcx*8 + 0x114]
add rcx, r15
add rdx, r13
call fcn.180002d80
movzx eax, word [rsi + 6]
inc ebx
cmp ebx, eax
jb 0x1800015a0
movsxd rbx, dword [r15 + 0x3c]
add rbx, r15
mov r10, qword [rbx + 0x30]
mov qword [rbx + 0x30], rdi
mov ecx, dword [rbx + 0xb4]
test ecx, ecx
je 0x180001704
mov eax, dword [rbx + 0xb0]
add rcx, rax
lea r11, [rax + r15]
add rcx, r15
cmp r11, rcx
jae 0x180001704
nop word [rax + rax]
mov eax, dword [r11 + 4]
test eax, eax
je 0x180001704
mov r8d, dword [r11]
lea r9, [rax - 8]
lea rdx, [r11 + 8]
shr r9, 1
add r8, r15
test r9d, r9d
je 0x1800016e2
nop word [rax + rax]
movzx eax, word [rdx]
dec r9d
movzx ecx, ax
shr cx, 0xc
cmp cx, 0xa
jne 0x18000166a
and eax, 0xfff
sub qword [rax + r8], r10
movzx eax, word [rdx]
and eax, 0xfff
add qword [rax + r8], rdi
jmp 0x1800016d5
cmp cx, 3
jne 0x180001687
and eax, 0xfff
sub dword [rax + r8], r10d
movzx eax, word [rdx]
and eax, 0xfff
add dword [rax + r8], edi
jmp 0x1800016d5
cmp cx, 1
jne 0x1800016b8
and eax, 0xfff
lea rcx, [rax + r8]
mov rax, r10
shr rax, 0x10
sub word [rcx], ax
movzx eax, word [rdx]
and eax, 0xfff
lea rcx, [rax + r8]
mov rax, rdi
shr rax, 0x10
add word [rcx], ax
jmp 0x1800016d5
cmp cx, 2
jne 0x1800016d5
and eax, 0xfff
sub word [rax + r8], r10w
movzx eax, word [rdx]
and eax, 0xfff
add word [rax + r8], di
add rdx, 2
test r9d, r9d
jne 0x180001640
mov eax, dword [r11 + 4]
mov ecx, dword [rbx + 0xb4]
add r11, rax
mov eax, dword [rbx + 0xb0]
add rax, r15
add rcx, rax
cmp r11, rcx
jb 0x180001610
cmp dword [rbx + 0x94], 0
je 0x180001883
mov r14d, dword [rbx + 0x90]
add r14, r15
cmp dword [r14], 0
je 0x18000187b
movabs r13, 0x8000000000000000
nop
mov ebx, dword [r14 + 0xc]
mov edx, 0x104
add rbx, r15
mov rcx, rbx
call fcn.1800026dc
mov edx, 2
lea rcx, [rax + 1]
mov rdi, rax
call fcn.1800028d4
mov rsi, rax
test rax, rax
je 0x180001868
lea r8, [rdi + 1]
lea rcx, [rsp + 0x58]
mov r9, rbx
mov rdx, rax
mov qword [rsp + 0x20], rdi
call fcn.180002c64
lea rdx, str.api_
mov r8d, 4
mov rcx, rsi
call fcn.18000252c
test eax, eax
je 0x1800017ac
lea rdx, str.ext_
mov r8d, 4
mov rcx, rsi
call fcn.18000252c
test eax, eax
jne 0x1800017fa
lea r8, [rsp + 0x40]
mov rdx, rsi
mov rcx, r12
call fcn.180001030
mov rbx, rax
test rax, rax
je 0x1800017fa
mov rcx, rsi
call fcn.180002918
mov rdi, qword [rsp + 0x40]
mov edx, 2
lea rcx, [rdi + 1]
call fcn.1800028d4
mov rsi, rax
test rax, rax
je 0x180001868
lea r8, [rdi + rdi]
mov rdx, rbx
mov rcx, rax
call fcn.180002d80
mov rcx, rsi
call fcn.1800018e0
mov rbp, rax
test rax, rax
je 0x180001860
mov eax, dword [r14]
test eax, eax
je 0x180001817
lea rbx, [r15 + rax]
jmp 0x18000181e
mov ebx, dword [r14 + 0x10]
add rbx, r15
mov edi, dword [r14 + 0x10]
mov rax, qword [rbx]
add rdi, r15
test rax, rax
je 0x180001860
nop dword [rax]
mov r8, rsi
mov rcx, rbp
test r13, rax
je 0x180001840
movzx edx, ax
jmp 0x180001847
lea rdx, [r15 + 2]
add rdx, rax
call fcn.180001960
add rbx, 8
add rdi, 8
mov qword [rdi - 8], rax
mov rax, qword [rbx]
test rax, rax
jne 0x180001830
mov rcx, rsi
call fcn.180002918
add r14, 0x14
cmp dword [r14], 0
jne 0x180001730
mov r13, qword [rsp + 0x48]
mov r14, qword [rsp + 0xa8]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x90]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r13, qword [rsp + 0xa0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, qword [rsp + 0x60]
mov rax, r15
mov rsi, qword [rsp + 0x98]
add rsp, 0x68
pop r15
pop r12
pop rdi
pop rbx
ret