Function at 0x18009b530
Capabilities:
Read file via mapping

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rsi
mov rax, qword [0x1801b8080]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor dil, dil
imul ebx, dword [0x1801c0a48], 0x410
add ebx, 0x418
xor esi, esi
mov rcx, qword [0x1801c0a20]
test rcx, rcx
je 0x18009b742
mov rax, qword [0x1801c0a28]
test rax, rax
je 0x18009b5a0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [0x1801c0a28], rsi
mov rcx, qword [0x1801c0a20]
mov eax, ebx
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 6]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdx, rax
mov qword [0x1801c0a28], rax
test rax, rax
je 0x18009b742
mov qword [0x1801c0a50], rax
test rax, rax
je 0x18009b60d
cmp dword [rax], 0x35343332
jne 0x18009b60d
cmp dword [rax + 4], 1
jne 0x18009b60d
cmp dword [rax + 8], esi
jne 0x18009b60d
mov eax, dword [0x1801c0a48]
dec eax
lea rcx, [rax*8 + 0x18]
mov eax, dword [rdx + 0xc]
cmp rax, rcx
jne 0x18009b60d
mov dil, 1
movzx eax, dil
jmp 0x18009b850
cmp qword [0x1801c12b8], rsi
je 0x18009b724
lea rcx, [0x1801c12b8]
call fcn.1800cdd20
mov rax, qword [0x1801c12b8]
cmp byte [rax + 0x78], sil
je 0x18009b71d
cmp dword [rax + 0x80], 2
jb 0x18009b71d
movzx ebx, byte [rax + 0x84]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
movdqa xmm1, xmmword [0x18016e090]
movdqu xmmword [rsp + 0x48], xmm1
mov word [rsp + 0x38], si
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [0x1801683e0]
lea rcx, [rsp + 0x38]
call fcn.1800ceea0
mov dword [rsp + 0x28], 0x10b
lea rax, str.RC::RCProcMemoryShared_struct_RC::RCDesktopItemClickedData_::InitAndCheckFileMapping
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_frameworkinclude_frameworkmemoryshared_rcmemoryshared.h
lea r8, [rsp + 0x38]
mov edx, 2
lea rcx, [0x1801c12b8]
call fcn.1800ce9d0
test bl, bl
je 0x18009b6c8
lea rdx, [rsp + 0x38]
lea rcx, [0x1801c12b8]
call fcn.1800ced60
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x18009b70a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18009b705
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009b873
call fcn.1800ecd20
movdqa xmm0, xmmword [0x18016e090]
movdqu xmmword [rsp + 0x48], xmm0
mov word [rsp + 0x38], si
mov rdx, qword [0x1801c0a28]
test rdx, rdx
je 0x18009b739
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [0x1801c0a28], rsi
movzx eax, dil
jmp 0x18009b850
cmp qword [0x1801c12b8], rsi
je 0x18009b84e
lea rcx, [0x1801c12b8]
call fcn.1800cdd20
mov rax, qword [0x1801c12b8]
cmp byte [rax + 0x78], sil
je 0x18009b84e
cmp dword [rax + 0x80], 2
jb 0x18009b84e
movzx ebx, byte [rax + 0x84]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
movdqa xmm1, xmmword [0x18016e090]
movdqu xmmword [rsp + 0x48], xmm1
mov word [rsp + 0x38], si
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [0x1801684d0]
lea rcx, [rsp + 0x38]
call fcn.1800ceea0
mov dword [rsp + 0x28], 0xfa
lea rax, str.RC::RCProcMemoryShared_struct_RC::RCDesktopItemClickedData_::InitAndCheckFileMapping
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_frameworkinclude_frameworkmemoryshared_rcmemoryshared.h
lea r8, [rsp + 0x38]
mov edx, 2
lea rcx, [0x1801c12b8]
call fcn.1800ce9d0
test bl, bl
je 0x18009b7fd
lea rdx, [rsp + 0x38]
lea rcx, [0x1801c12b8]
call fcn.1800ced60
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x18009b83b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18009b836
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009b86d
call fcn.1800ecd20
movdqa xmm0, xmmword [0x18016e090]
movdqu xmmword [rsp + 0x48], xmm0
mov word [rsp + 0x38], si
xor al, al
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800eccc0
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
call fcn.18010e7e4
int3
call fcn.18010e7e4
int3