Function at 0x1000fd608
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
xor esi, esi
xor r13d, r13d
mov r14, r8
mov rbp, rdx
mov rdi, rcx
mov ebx, 0x80070057
test rdx, rdx
jne 0x1000fd66f
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000fd994
test byte [rcx + 0x1c], 1
je 0x1000fd994
mov rcx, qword [rcx + 0x10]
lea edx, [rbp + 0x35]
lea r8, [0x10001dbd8]
call fcn.100034784
jmp 0x1000fd994
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r12d, eax
add eax, 0xffffff68
cmp eax, 0x7ff68
ja 0x1000fd945
and qword [rsp + 0x28], rsi
and dword [rsp + 0x20], esi
xor r9d, r9d
lea r8d, [r9 + 2]
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r13, rax
test rax, rax
jne 0x1000fd700
call sub.KERNEL32.dll_GetLastError
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000fd986
test byte [rcx + 0x1c], 1
je 0x1000fd986
mov rcx, qword [rcx + 0x10]
lea edx, [r13 + 0x37]
lea r8, [0x10001dbd8]
mov r9d, ebx
call fcn.100036510
jmp 0x1000fd986
and qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rsi, rax
test rax, rax
jne 0x1000fd75c
call sub.KERNEL32.dll_GetLastError
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000fd978
test byte [rcx + 0x1c], 1
je 0x1000fd978
lea edx, [rsi + 0x38]
jmp 0x1000fd91a
cmp dword [rax], 0x414d5153
je 0x1000fd794
mov ebx, 0x90070a0b
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000fd978
test byte [rcx + 0x1c], 1
je 0x1000fd978
mov edx, 0x39
jmp 0x1000fd968
lea rdx, [rdi + 0xc]
lea rcx, [rax + 0x18]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x1000fd7da
mov ebx, 0x90070a0b
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000fd978
test byte [rcx + 0x1c], 1
je 0x1000fd978
mov edx, 0x3a
lea r9, [rsi + 0x18]
jmp 0x1000fd8d3
mov eax, dword [rdi + 8]
cmp dword [rsi + 4], eax
je 0x1000fd812
mov ebx, 0x90070a0b
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000fd978
test byte [rcx + 0x1c], 1
je 0x1000fd978
mov edx, 0x3b
jmp 0x1000fd968
lea rbx, [rsi + 0x10]
test rbx, rbx
je 0x1000fd848
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtQuerySystemTime]
test eax, eax
js 0x1000fd848
mov eax, dword [rbx]
xor ecx, ecx
mov dword [rsp + 0x78], eax
mov eax, dword [rbx + 4]
mov dword [rsp + 0x7c], eax
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x78], rax
setle cl
jmp 0x1000fd84d
mov ecx, 1
test ecx, ecx
je 0x1000fd881
mov ebx, 0x90070a0a
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000fd978
test byte [rcx + 0x1c], 1
je 0x1000fd978
mov edx, 0x3c
jmp 0x1000fd968
lea r8, [0x100027110]
mov r9d, 1
mov rdx, r14
mov rcx, rdi
call fcn.1000fd36c
mov ebx, eax
test eax, eax
jns 0x1000fd8e8
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000fd978
test byte [rcx + 0x1c], 1
je 0x1000fd978
lea r9, [0x100002f60]
test r14, r14
mov edx, 0x3d
cmovne r9, r14
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dbd8]
call fcn.1000347a8
jmp 0x1000fd978
mov r8d, r12d
mov rdx, rsi
mov rcx, rdi
call fcn.1000fe308
mov ebx, eax
test eax, eax
jns 0x1000fd92f
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000fd978
test byte [rcx + 0x1c], 1
je 0x1000fd978
mov edx, 0x3e
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dbd8]
mov r9d, ebx
call fcn.100036510
jmp 0x1000fd978
mov eax, dword [rdi + 0xa0]
sub eax, dword [rdi + 0x90]
xor ebx, ebx
mov dword [rdi + 0x98], eax
jmp 0x1000fd978
mov ebx, 0x90070a0b
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000fd994
test byte [rcx + 0x1c], 1
je 0x1000fd994
mov edx, 0x36
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dbd8]
call fcn.100034784
test rsi, rsi
je 0x1000fd986
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test r13, r13
je 0x1000fd994
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x40]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret