Function at 0x14000ab30
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov qword [rsp + 0x20], r9
mov byte [rsp + 0x18], r8b
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov r14, rcx
xor edi, edi
mov r13d, edi
lea r12, [0x140010490]
test rdx, rdx
cmovne r12, rdx
lea esi, [rdi + 1]
test r12, r12
je 0x14000aba5
mov edx, 0x81
mov ecx, edx
mov rax, r12
cmp byte [rax], dil
je 0x14000ab86
add rax, rsi
sub rcx, rsi
jne 0x14000ab79
mov rax, rcx
sub rdx, rcx
neg rax
sbb r13, r13
and r13, rdx
neg rcx
sbb ebx, ebx
not ebx
mov ecx, 0x80070057
and ebx, ecx
jmp 0x14000abac
mov ecx, 0x80070057
mov ebx, ecx
test ebx, ebx
cmovs r13, rdi
mov qword [rsp + 0x70], r13
js 0x14000afda
mov dword [rsp + 0xc8], 0x400000
mov dword [rsp + 0xcc], 0x100000
lea r15, [r13 + 1]
lea rax, [r15 + 0x60]
cmp rax, 0x60
jb 0x14000afd8
lea rdx, [rax + 0x400000]
cmp rdx, rax
jb 0x14000afd8
mov rax, qword [rsp + 0xc8]
shr rax, 0x20
add rax, rdx
mov qword [rsp + 0xd8], rax
cmp rax, rdx
jb 0x14000afd8
cmp rax, 0x600000
ja 0x14000afd8
lea rdx, [rsp + 0x38]
mov rcx, qword [r14 + 0x420]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
nop dword [rax + rax]
test eax, eax
jne 0x14000ac6e
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
cmove eax, esi
test eax, eax
jg 0x14000af5c
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
cmove ebx, esi
jmp 0x14000afda
mov ebx, edi
mov rcx, qword [rsp + 0xd8]
cmp dword [rsp + 0x3c], edi
jg 0x14000ac8b
mov eax, dword [rsp + 0x38]
cmp rax, rcx
je 0x14000ad3c
xor r9d, r9d
xor r8d, r8d
mov edx, ecx
mov rcx, qword [r14 + 0x420]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
nop dword [rax + rax]
mov dword [rsp + 0xd0], edi
cmp eax, 0xffffffff
jne 0x14000acfd
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
cmove eax, esi
test eax, eax
jg 0x14000acdc
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
cmove ebx, esi
jmp 0x14000acf6
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
cmove eax, esi
movzx ebx, ax
or ebx, 0x80070000
mov dword [rsp + 0xd0], ebx
mov rcx, qword [r14 + 0x420]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
nop dword [rax + rax]
test eax, eax
jne 0x14000ad5c
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
cmove eax, esi
test eax, eax
jg 0x14000ad40
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
cmove ebx, esi
mov eax, ebx
jmp 0x14000ad63
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
cmove eax, esi
movzx ebx, ax
or ebx, 0x80070000
jmp 0x14000ad3c
mov eax, dword [rsp + 0xd0]
test eax, eax
js 0x14000afda
mov rcx, qword [r14 + 0x420]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
nop dword [rax + rax]
test eax, eax
je 0x14000ac3d
lea rax, [r14 + 0x208]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xd8]
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 4]
mov rcx, qword [r14 + 0x420]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
nop dword [rax + rax]
mov qword [r14 + 0x428], rax
test rax, rax
je 0x14000ac3d
mov rcx, rax
call qword [sym.imp.iertutil.dll_Ordinal_50]
nop dword [rax + rax]
mov ebx, eax
mov dword [rsp + 0xd0], eax
test eax, eax
js 0x14000afda
mov rbx, qword [rsp + 0xd8]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 6]
mov rcx, qword [r14 + 0x428]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
nop dword [rax + rax]
mov qword [r14 + 0x430], rax
test rax, rax
je 0x14000ac3d
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov rcx, qword [r14 + 0x430]
mov qword [rcx], 0x4020077
mov dword [r14 + 0x438], 0x60
lea rax, [r15 + 0x60]
mov dword [r14 + 0x43c], eax
mov dword [r14 + 0x440], 0x400000
lea rdx, [rax + 0x400000]
mov dword [r14 + 0x444], edx
mov dword [r14 + 0x448], 0x100000
mov dword [r14 + 0x44c], ebx
mov dword [rcx + 8], eax
mov eax, dword [r14 + 0x440]
mov dword [rcx + 0xc], eax
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], rdi
mov dword [rcx + 0x20], edi
mov eax, dword [r14 + 0x444]
mov dword [rcx + 0x24], eax
mov eax, dword [r14 + 0x448]
mov dword [rcx + 0x28], eax
mov qword [rcx + 0x2c], rdi
mov qword [rcx + 0x34], rdi
mov dword [rcx + 0x3c], edi
mov dword [rcx + 0x40], 0x80
mov eax, dword [r14 + 0x438]
mov dword [rcx + 0x5c], eax
mov rcx, qword [r14 + 0x430]
add rcx, 0x60
mov ebx, edi
test r13, r13
je 0x14000af9d
lea rax, [r15 - 1]
mov edx, 0x7ffffffe
cmp rax, rdx
mov eax, 0x80070057
cmova ebx, eax
mov dword [rsp + 0x34], ebx
test ebx, ebx
js 0x14000af98
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x40], rcx
mov ebx, edi
mov rax, rdi
mov qword [rsp + 0x48], rax
test r15, r15
je 0x14000af7d
test rdx, rdx
je 0x14000af78
mov r8b, byte [r12]
test r8b, r8b
je 0x14000af78
add r12, rsi
mov qword [rsp + 0x58], r12
mov byte [rcx], r8b
add rcx, rsi
mov qword [rsp + 0x40], rcx
sub r15, rsi
mov qword [rsp + 0x60], r15
sub rdx, rsi
mov qword [rsp + 0x68], rdx
add rax, rsi
mov qword [rsp + 0x48], rax
jmp 0x14000af1c
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
cmove eax, esi
movzx ebx, ax
or ebx, 0x80070000
jmp 0x14000afda
test r15, r15
jne 0x14000af92
sub rcx, rsi
mov qword [rsp + 0x40], rcx
sub rax, rsi
mov qword [rsp + 0x48], rax
mov ebx, 0x8007007a
mov dword [rsp + 0x34], ebx
jmp 0x14000af9d
test r15, r15
je 0x14000afa0
mov byte [rcx], dil
mov dword [rsp + 0xd0], ebx
jmp 0x14000afb6
cmp ebx, 0x80070570
jne 0x14000afc8
mov rcx, r14
call fcn.14000b690
jmp 0x14000afda
test ebx, ebx
js 0x14000afda
mov rcx, r14
call fcn.14000b0f8
mov ebx, eax
jmp 0x14000afda
mov ebx, ecx
mov eax, ebx
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret