Function at 0x1400298f0
Capabilities:
Get file size
Parse pe header

Disassembly:
push rbx
push rbp
push rsi
push r14
sub rsp, 0xa8
xor ebp, ebp
mov rsi, rdx
mov qword [rsp + 0x48], rbp
mov rbx, rcx
mov dword [rsp + 0x34], ebp
mov r14d, ebp
cmp rdx, 0xffffffffffffffff
jne 0x14002992e
lea ecx, [rdx + 7]
call sub.KERNEL32.dll_SetLastError
xor eax, eax
add rsp, 0xa8
pop r14
pop rsi
pop rbp
pop rbx
ret
xor edx, edx
mov qword [rsp + 0xd0], rdi
mov rcx, rsi
call sub.KERNEL32.dll_GetFileSize
mov dword [rbx + 0x408], eax
cmp eax, 0xffffffff
je 0x14002a28e
mov edi, 2
mov qword [rsp + 0x28], rbp
mov r8d, edi
mov dword [rsp + 0x20], ebp
xor r9d, r9d
xor edx, edx
mov rcx, rsi
call sub.KERNEL32.dll_CreateFileMappingW
mov qword [rbx + 0x10], rax
test rax, rax
je 0x14002a28e
mov qword [rsp + 0x28], rbp
lea edx, [rdi + 2]
xor r9d, r9d
mov qword [rsp + 0x20], rbp
xor r8d, r8d
mov rcx, rax
call sub.KERNEL32.dll_MapViewOfFileEx
mov qword [rbx + 0x18], rax
mov r9, rax
test rax, rax
je 0x14002a28e
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x14002a284
mov edx, dword [r9 + 0x3c]
mov dword [rbx + 0x3fc], edx
mov dword [rbx + 0x3f0], ebp
mov eax, dword [r9 + 0x3c]
add eax, 7
and eax, 0xfffffff8
mov dword [rbx + 0x3f4], eax
mov eax, dword [rbx + 0x408]
cmp edx, eax
ja 0x14002a284
lea rcx, [rdx + 0x108]
cmp rcx, rax
ja 0x14002a284
movups xmm0, xmmword [r9]
lea rcx, [rbx + 0x68]
lea rax, [rdx + r9]
movups xmmword [rbx + 0x28], xmm0
movups xmm1, xmmword [r9 + 0x10]
movups xmmword [rbx + 0x38], xmm1
movups xmm0, xmmword [r9 + 0x20]
movups xmmword [rbx + 0x48], xmm0
movups xmm1, xmmword [r9 + 0x30]
movups xmmword [rbx + 0x58], xmm1
nop dword [rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm1, xmmword [rax - 0x70]
movups xmmword [rcx - 0x70], xmm1
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x60], xmm0
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x50], xmm1
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x40], xmm0
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x30], xmm1
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x20], xmm0
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x10], xmm1
sub rdi, 1
jne 0x140029a20
mov rax, qword [rax]
mov qword [rcx], rax
cmp dword [rbx + 0x68], 0x4550
je 0x140029a93
mov ecx, 0xbf
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x140029c90
movzx eax, word [rbx + 0x7c]
mov qword [rsp + 0xa0], r12
mov qword [rsp + 0x98], r13
mov qword [rsp + 0x90], r15
test ax, ax
je 0x140029c6c
lea ecx, [rax + 0x18]
movzx eax, word [rbx + 0x6e]
add ecx, edx
mov dword [rbx + 0x400], ecx
cmp eax, 0x10
ja 0x140029c6c
mov edx, ecx
lea r8, [rax + rax*4]
shl r8, 3
lea rcx, [rbx + 0x170]
add rdx, r9
call fcn.140085ca0
movzx eax, word [rbx + 0x6e]
lea r8, str..detour
mov dword [rsp + 0xe8], ebp
mov edi, ebp
mov dword [rsp + 0xe0], ebp
mov r12d, ebp
cmp bp, ax
jae 0x140029ba8
lea rdx, [rbx + 0x184]
mov r9d, eax
nop word [rax + rax]
mov rcx, rbp
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdx + rcx - 0x14]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x140029b96
cmp rcx, 8
jne 0x140029b30
mov ecx, dword [rdx]
mov rax, qword [rbx + 0x18]
movups xmm2, xmmword [rcx + rax + 0x20]
mov edi, dword [rcx + rax + 0x10]
movups xmm0, xmmword [rcx + rax]
psrldq xmm2, 0xc
movd r8d, xmm2
movaps xmmword [rsp + 0x50], xmm0
test r8d, r8d
je 0x140029b7c
lea eax, [rcx + 0x40]
mov dword [rbx + 0x3f4], r8d
mov dword [rbx + 0x3f0], eax
mov r8d, dword [rdx - 4]
mov r12d, dword [rdx - 8]
add r8d, r12d
mov dword [rsp + 0xe0], r8d
lea r8, str..detour
add rdx, 0x28
sub r9, 1
jne 0x140029b20
mov dword [rsp + 0xe8], r12d
mov edx, dword [rbx + 0xf8]
mov rcx, rbx
call fcn.14002a350
mov edx, edi
mov rcx, rbx
mov r13, rax
call fcn.14002a350
test rax, rax
mov r15, rax
cmove r15, r13
mov qword [rsp + 0x38], r15
test r13, r13
je 0x140029c6c
test r15, r15
je 0x140029c6c
xor edx, edx
mov esi, edx
nop dword [rax + rax]
mov eax, esi
lea rcx, [rax + rax*4]
cmp dword [r13 + rcx*4], edx
jne 0x140029c04
cmp dword [r13 + rcx*4 + 0x10], edx
je 0x140029c08
inc esi
jmp 0x140029bf0
mov dword [rsp + 0xd8], esi
lea rbp, [rbx + 0x428]
mov qword [rbp], rdx
mov dword [rsp + 0x30], edx
test esi, esi
je 0x14002a0dd
mov r10d, dword [r13 + 0xc]
test r10, r10
je 0x140029c6c
movzx r11d, word [rbx + 0x6e]
mov ecx, edx
test r11d, r11d
je 0x140029c6c
nop dword [rax + rax]
mov edx, ecx
lea rax, [rdx + rdx*4]
lea r9, [rbx + rax*8]
mov r8d, dword [r9 + 0x17c]
cmp r10, r8
jb 0x140029c65
mov eax, dword [r9 + 0x180]
add eax, r8d
cmp r10, rax
jb 0x140029ca5
inc ecx
cmp ecx, r11d
jb 0x140029c40
mov ecx, 0xc0
call sub.KERNEL32.dll_SetLastError
xor eax, eax
mov r13, qword [rsp + 0x98]
mov r12, qword [rsp + 0xa0]
mov r15, qword [rsp + 0x90]
mov rdi, qword [rsp + 0xd0]
add rsp, 0xa8
pop r14
pop rsi
pop rbp
pop rbx
ret
lea rax, [rdx + rdx*4]
mov edi, dword [rbx + rax*8 + 0x184]
sub rdi, r8
add rdi, qword [rbx + 0x18]
add rdi, r10
je 0x140029c6c
mov ecx, 0x38
call fcn.140057028
mov r14, rax
test rax, rax
je 0x14002a262
xor eax, eax
mov rcx, rdi
mov qword [r14], rax
mov dword [r14 + 8], eax
mov qword [r14 + 0x10], rax
mov qword [r14 + 0x18], rax
mov qword [r14 + 0x20], rax
mov qword [r14 + 0x30], rax
mov qword [r14 + 0x28], rax
mov qword [rbp], r14
mov rbp, r14
inc dword [rbx + 0x430]
call fcn.140028fa0
mov qword [r14 + 0x30], rax
test rax, rax
je 0x140029c76
mov eax, dword [r13]
xor edx, edx
mov dword [r14 + 0x1c], eax
mov eax, dword [r13 + 0x10]
mov dword [r14 + 0x20], eax
mov eax, dword [r13 + 8]
mov dword [r14 + 0x24], eax
mov qword [r14 + 0x10], rdx
mov dword [r14 + 0x18], edx
mov dword [r14 + 8], edx
mov eax, dword [r13 + 0x10]
cmp eax, r12d
jb 0x140029d5a
cmp eax, dword [rsp + 0xe0]
jae 0x140029d5a
mov qword [r14 + 0x28], rdx
mov dword [r14 + 8], 1
jmp 0x14002a0c2
mov r10d, dword [r15 + 0xc]
test r10, r10
je 0x140029c6c
movzx r11d, word [rbx + 0x6e]
mov ecx, edx
test r11d, r11d
je 0x140029c6c
nop word [rax + rax]
mov edx, ecx
lea rax, [rdx + rdx*4]
lea r9, [rbx + rax*8]
mov r8d, dword [r9 + 0x17c]
cmp r10, r8
jb 0x140029da5
mov eax, dword [r9 + 0x180]
add eax, r8d
cmp r10, rax
jb 0x140029db1
inc ecx
cmp ecx, r11d
jb 0x140029d80
jmp 0x140029c6c
lea rax, [rdx + rdx*4]
mov ecx, dword [rbx + rax*8 + 0x184]
sub rcx, r8
add rcx, qword [rbx + 0x18]
add rcx, r10
je 0x140029c6c
call fcn.140028fa0
mov qword [r14 + 0x28], rax
test rax, rax
je 0x140029c76
mov eax, dword [r13]
test eax, eax
jne 0x140029dea
mov eax, dword [r13 + 0x10]
xor edx, edx
mov r10d, eax
test eax, eax
je 0x140029e32
movzx r11d, word [rbx + 0x6e]
mov ecx, edx
test r11d, r11d
je 0x140029e32
nop
mov edx, ecx
lea rax, [rdx + rdx*4]
lea r9, [rbx + rax*8]
mov r8d, dword [r9 + 0x17c]
cmp r10, r8
jb 0x140029e29
mov eax, dword [r9 + 0x180]
add eax, r8d
cmp r10, rax
jb 0x140029f5b
inc ecx
cmp ecx, r11d
jb 0x140029e00
xor edx, edx
mov r12, rdx
mov eax, dword [r15]
test eax, eax
jne 0x140029e40
mov eax, dword [r15 + 0x10]
mov r10d, eax
test eax, eax
je 0x140029e85
movzx r11d, word [rbx + 0x6e]
mov ecx, edx
test r11d, r11d
je 0x140029e85
mov edx, ecx
lea rax, [rdx + rdx*4]
lea r9, [rbx + rax*8]
mov r8d, dword [r9 + 0x17c]
cmp r10, r8
jb 0x140029e7c
mov eax, dword [r9 + 0x180]
add eax, r8d
cmp r10, rax
jb 0x140029f78
inc ecx
cmp ecx, r11d
jb 0x140029e53
xor edx, edx
mov r15, rdx
mov ebp, edx
test r12, r12
je 0x14002a0a9
cmp qword [r12], 0
je 0x14002a0a9
nop
inc ebp
cmp qword [r12 + rbp*8], 0
jne 0x140029ea0
test ebp, ebp
je 0x14002a0a9
mov rcx, 0xffffffffffffffff
mov esi, ebp
mov eax, 0x20
mov dword [r14 + 0x18], ebp
mul rsi
cmovo rax, rcx
add rax, 8
cmovb rax, rcx
mov rcx, rax
call fcn.1400574e8
test rax, rax
je 0x14002a25c
lea rdi, [rax + 8]
mov qword [rax], rsi
mov rax, rdi
xor edx, edx
nop
mov qword [rax + 4], rdx
mov word [rax], dx
mov qword [rax + 0x18], rdx
mov qword [rax + 0x10], rdx
lea rax, [rax + 0x20]
sub rsi, 1
jne 0x140029ef0
mov qword [r14 + 0x10], rdi
test rdi, rdi
je 0x14002a262
mov esi, edx
test ebp, ebp
je 0x14002a0a2
sub r12, r15
nop dword [rax]
nop word [rax + rax]
mov qword [rdi + 4], 0
mov word [rdi], dx
mov qword [rdi + 0x18], rdx
mov qword [rdi + 0x10], rdx
mov r9, qword [r12 + r15]
test r9, r9
jns 0x140029f95
movzx eax, r9w
mov dword [rdi + 4], eax
mov dword [rdi + 8], eax
jmp 0x14002a08b
lea rax, [rdx + rdx*4]
mov r12d, dword [rbx + rax*8 + 0x184]
sub r12, r8
add r12, qword [rbx + 0x18]
add r12, r10
xor edx, edx
jmp 0x140029e35
lea rax, [rdx + rdx*4]
mov r15d, dword [rbx + rax*8 + 0x184]
sub r15, r8
add r15, qword [rbx + 0x18]
add r15, r10
xor edx, edx
jmp 0x140029e88
je 0x14002a006
movzx r11d, word [rbx + 0x6e]
mov ecx, edx
test r11d, r11d
je 0x14002a006
mov edx, ecx
lea rax, [rdx + rdx*4]
lea r10, [rbx + rax*8]
mov r8d, dword [r10 + 0x17c]
cmp r9, r8
jb 0x140029fc8
mov eax, dword [r10 + 0x180]
add eax, r8d
cmp r9, rax
jb 0x140029fd1
inc ecx
cmp ecx, r11d
jb 0x140029fa3
jmp 0x14002a004
lea rax, [rdx + rdx*4]
mov ecx, dword [rbx + rax*8 + 0x184]
sub rcx, r8
add rcx, qword [rbx + 0x18]
add rcx, r9
je 0x14002a004
movzx eax, word [rcx]
add rcx, 2
mov word [rdi], ax
call fcn.140028fa0
mov qword [rdi + 0x18], rax
test rax, rax
je 0x140029c76
xor edx, edx
mov r9, qword [r15]
test r9, r9
jns 0x14002a01a
movzx eax, r9w
mov dword [rdi + 4], eax
mov dword [rdi + 8], eax
jmp 0x14002a08b
je 0x14002a08b
movzx r11d, word [rbx + 0x6e]
mov ecx, edx
test r11d, r11d
je 0x14002a08b
nop dword [rax + rax]
mov edx, ecx
lea rax, [rdx + rdx*4]
lea r10, [rbx + rax*8]
mov r8d, dword [r10 + 0x17c]
cmp r9, r8
jb 0x14002a055
mov eax, dword [r10 + 0x180]
add eax, r8d
cmp r9, rax
jb 0x14002a05e
inc ecx
cmp ecx, r11d
jb 0x14002a030
jmp 0x14002a08b
lea rax, [rdx + rdx*4]
mov ecx, dword [rbx + rax*8 + 0x184]
sub rcx, r8
add rcx, qword [rbx + 0x18]
add rcx, r9
je 0x14002a08b
add rcx, 2
call fcn.140028fa0
mov qword [rdi + 0x10], rax
test rax, rax
je 0x140029c76
inc esi
add r15, 8
add rdi, 0x20
mov edx, 0
cmp esi, ebp
jb 0x140029f30
mov esi, dword [rsp + 0xd8]
mov r15, qword [rsp + 0x38]
mov rbp, r14
mov r12d, dword [rsp + 0xe8]
add r15, 0x14
mov qword [rsp + 0x38], r15
mov eax, dword [rsp + 0x30]
add r13, 0x14
inc eax
mov dword [rsp + 0x30], eax
cmp eax, esi
jb 0x140029c26
mov r14, qword [rsp + 0x48]
movzx edi, word [rbx + 0x6e]
mov r10d, edx
mov dword [rbx + 0x404], edx
cmp dx, di
jae 0x14002a232
mov r9d, edx
lea rbp, str..detour
mov esi, 0xffff
mov eax, r10d
lea rcx, [rax + rax*4]
lea r11, [rbx + rcx*8]
mov rcx, rdx
mov eax, dword [r11 + 0x180]
add eax, dword [r11 + 0x184]
cmp eax, r9d
cmova r9d, eax
mov dword [rbx + 0x404], r9d
nop dword [rax]
movzx eax, byte [r11 + rcx + 0x170]
inc rcx
cmp al, byte [rcx + rbp - 1]
jne 0x14002a223
cmp rcx, 8
jne 0x14002a130
mov r8d, dword [r11 + 0x184]
mov rdx, qword [rbx + 0x18]
add rdx, r8
movups xmm2, xmmword [rdx]
movups xmm3, xmmword [rdx + 0x10]
movups xmm4, xmmword [rdx + 0x20]
movd eax, xmm2
movdqa xmm0, xmm3
psrldq xmm0, 8
movdqa xmm1, xmm2
psrldq xmm1, 8
movd ecx, xmm1
movaps xmmword [rsp + 0x50], xmm2
test ecx, ecx
cmove ecx, eax
mov eax, dword [rsp + 0x5c]
sub eax, ecx
mov r14d, ecx
mov ecx, dword [r11 + 0x180]
add r14, rdx
mov dword [rsp + 0x34], eax
add ecx, r8d
cmp ecx, r9d
movd dword [rbx + 0x148], xmm0
movq rax, xmm3
movd dword [rbx + 0xf8], xmm3
cmova r9d, ecx
psrldq xmm3, 8
shr rax, 0x20
add di, si
mov dword [rbx + 0xfc], eax
movdqa xmm0, xmm4
movq rax, xmm3
movd dword [rbx + 0x150], xmm4
shr rax, 0x20
xor edx, edx
psrldq xmm0, 4
psrldq xmm4, 8
mov dword [rbx + 0xc0], edx
mov dword [rbx + 0x404], r9d
mov word [rbx + 0x6e], di
mov dword [rbx + 0x14c], eax
movd dword [rbx + 0x154], xmm0
movd dword [rbx + 0xb8], xmm4
mov dword [rbx + 0x434], 1
inc r10d
movzx eax, di
cmp r10d, eax
jb 0x14002a102
mov ecx, 0x10
call fcn.140057028
xor ebp, ebp
test rax, rax
je 0x14002a26c
mov ecx, dword [rsp + 0x34]
mov dword [rax + 8], ecx
mov qword [rax], r14
mov dword [rax + 0xc], ebp
mov qword [rbx + 8], rax
lea eax, [rbp + 1]
jmp 0x140029c78
xor ebp, ebp
mov qword [r14 + 0x10], rbp
mov ecx, 0xe
jmp 0x140029c71
mov ecx, 0xe
mov qword [rbx + 8], rbp
call sub.KERNEL32.dll_SetLastError
mov eax, 1
jmp 0x140029c78
mov ecx, 0xc1
call sub.KERNEL32.dll_SetLastError
xor eax, eax
jmp 0x140029c90