Function at 0x1000fd114
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
xor esi, esi
xor r13d, r13d
mov r14, r8
mov rbp, rdx
mov rdi, rcx
mov ebx, 0x80070057
test rdx, rdx
jne 0x1000fd17b
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000fd4a0
test byte [rcx + 0x1c], 1
je 0x1000fd4a0
mov rcx, qword [rcx + 0x10]
lea edx, [rbp + 0x35]
lea r8, [0x10001dbd8]
call fcn.100034764
jmp 0x1000fd4a0
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r12d, eax
add eax, 0xffffff68
cmp eax, 0x7ff68
ja 0x1000fd451
and qword [rsp + 0x28], rsi
and dword [rsp + 0x20], esi
xor r9d, r9d
lea r8d, [r9 + 2]
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r13, rax
test rax, rax
jne 0x1000fd20c
call sub.KERNEL32.dll_GetLastError
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000fd492
test byte [rcx + 0x1c], 1
je 0x1000fd492
mov rcx, qword [rcx + 0x10]
lea edx, [r13 + 0x37]
lea r8, [0x10001dbd8]
mov r9d, ebx
call fcn.100036328
jmp 0x1000fd492
and qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rsi, rax
test rax, rax
jne 0x1000fd268
call sub.KERNEL32.dll_GetLastError
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000fd484
test byte [rcx + 0x1c], 1
je 0x1000fd484
lea edx, [rsi + 0x38]
jmp 0x1000fd426
cmp dword [rax], 0x414d5153
je 0x1000fd2a0
mov ebx, 0x90070a0b
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000fd484
test byte [rcx + 0x1c], 1
je 0x1000fd484
mov edx, 0x39
jmp 0x1000fd474
lea rdx, [rdi + 0xc]
lea rcx, [rax + 0x18]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x1000fd2e6
mov ebx, 0x90070a0b
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000fd484
test byte [rcx + 0x1c], 1
je 0x1000fd484
mov edx, 0x3a
lea r9, [rsi + 0x18]
jmp 0x1000fd3df
mov eax, dword [rdi + 8]
cmp dword [rsi + 4], eax
je 0x1000fd31e
mov ebx, 0x90070a0b
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000fd484
test byte [rcx + 0x1c], 1
je 0x1000fd484
mov edx, 0x3b
jmp 0x1000fd474
lea rbx, [rsi + 0x10]
test rbx, rbx
je 0x1000fd354
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtQuerySystemTime]
test eax, eax
js 0x1000fd354
mov eax, dword [rbx]
xor ecx, ecx
mov dword [rsp + 0x78], eax
mov eax, dword [rbx + 4]
mov dword [rsp + 0x7c], eax
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x78], rax
setle cl
jmp 0x1000fd359
mov ecx, 1
test ecx, ecx
je 0x1000fd38d
mov ebx, 0x90070a0a
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000fd484
test byte [rcx + 0x1c], 1
je 0x1000fd484
mov edx, 0x3c
jmp 0x1000fd474
lea r8, [0x100027100]
mov r9d, 1
mov rdx, r14
mov rcx, rdi
call fcn.1000fce78
mov ebx, eax
test eax, eax
jns 0x1000fd3f4
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000fd484
test byte [rcx + 0x1c], 1
je 0x1000fd484
lea r9, [0x100002f60]
test r14, r14
mov edx, 0x3d
cmovne r9, r14
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dbd8]
call fcn.100034788
jmp 0x1000fd484
mov r8d, r12d
mov rdx, rsi
mov rcx, rdi
call fcn.1000fde14
mov ebx, eax
test eax, eax
jns 0x1000fd43b
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000fd484
test byte [rcx + 0x1c], 1
je 0x1000fd484
mov edx, 0x3e
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dbd8]
mov r9d, ebx
call fcn.100036328
jmp 0x1000fd484
mov eax, dword [rdi + 0xa0]
sub eax, dword [rdi + 0x90]
xor ebx, ebx
mov dword [rdi + 0x98], eax
jmp 0x1000fd484
mov ebx, 0x90070a0b
mov rcx, qword [0x100152eb8]
lea rax, [0x100152eb8]
cmp rcx, rax
je 0x1000fd4a0
test byte [rcx + 0x1c], 1
je 0x1000fd4a0
mov edx, 0x36
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dbd8]
call fcn.100034764
test rsi, rsi
je 0x1000fd492
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test r13, r13
je 0x1000fd4a0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x40]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret