Function at 0x41a900
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov rax, rsp
sub rsp, 0x198
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax - 8], rdi
mov qword [rax - 0x10], r12
mov qword [rax - 0x18], r13
mov qword [rax - 0x20], r14
mov rax, qword [0x00445028]
mov qword [rsp + 0x160], rax
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor ebp, ebp
mov qword [rcx + 8], rbp
mov dword [rcx + 0x10], ebp
lea rax, [0x004366a8]
mov qword [rcx], rax
mov dword [rcx + 0x18], ebp
xor edx, edx
call qword [0x004366b0]
nop
lea rax, [0x004366e8]
mov qword [rbx], rax
movsxd rdi, dword [rbx + 0x10]
mov edx, edi
mov rcx, rbx
call qword [0x004366f0]
cmp edi, edi
jge 0x41a999
mov rcx, rdi
add rcx, qword [rbx + 8]
mov eax, edi
sub eax, edi
movsxd r8, eax
mov rdx, rcx
call fcn.00421230
nop
lea rax, [0x004379d8]
mov qword [rbx], rax
mov byte [rsp + 0x48], 0x50
xor eax, eax
mov byte [rsp + 0x4c], al
mov dword [rsp + 0x49], 0x6054b
mov r8d, 0x104
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 3]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r12, rax
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], ebp
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov r13, rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r14, rax
mov eax, 0x51eb851f
mul esi
shr edx, 5
mov eax, 0xc800
cmp edx, eax
cmovb edx, eax
mov eax, esi
sub eax, edx
sub eax, 0x16
cmovs eax, ebp
movsxd rbp, eax
add rbp, r14
sub esi, eax
lea edi, [rsi - 0x16]
test edi, edi
js 0x41aae8
mov ecx, dword [rsp + 0x48]
nop
movsxd rax, edi
cmp dword [rax + rbp], ecx
je 0x41aa7e
dec edi
jns 0x41aa70
jmp 0x41aae8
sub esi, edi
sub esi, 0x16
lea ecx, [rsi + 1]
mov eax, dword [rbx + 0x18]
cmp ecx, eax
jle 0x41aac8
cmp eax, 8
jge 0x41aa99
mov dword [rbx + 0x18], 8
mov eax, dword [rbx + 0x18]
cmp ecx, eax
jle 0x41aaa5
add eax, eax
mov dword [rbx + 0x18], eax
cmp ecx, dword [rbx + 0x18]
jle 0x41aab7
add ecx, 0xb
mov eax, ecx
and eax, 7
sub ecx, eax
mov dword [rbx + 0x18], ecx
movsxd rdx, dword [rbx + 0x18]
mov rcx, qword [rbx + 8]
call fcn.00421150
mov qword [rbx + 8], rax
movsxd r8, esi
mov rax, qword [rbx + 8]
mov byte [r8 + rax], 0
mov dword [rbx + 0x10], esi
movsxd rcx, edi
lea rdx, [rcx + rbp + 0x16]
mov rcx, qword [rbx + 8]
call fcn.00421230
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbx
mov rcx, qword [rsp + 0x160]
call fcn.00435170
mov rbx, qword [rsp + 0x1a8]
mov rbp, qword [rsp + 0x1b0]
mov rsi, qword [rsp + 0x1b8]
mov rdi, qword [rsp + 0x190]
mov r12, qword [rsp + 0x188]
mov r13, qword [rsp + 0x180]
mov r14, qword [rsp + 0x178]
add rsp, 0x198
ret