Function at 0x14000e700
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push r15
sub rsp, 0x180
mov rax, qword [0x1400ec0a0]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov r15, rdx
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x104
call fcn.140082860
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x104
lea r8, [rsp + 0x50]
mov rcx, rax
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExA]
lea rcx, [rsp + 0x50]
test eax, eax
jne 0x14000e772
mov r8d, 0x103
lea rdx, str._not_found_
call fcn.140095d10
mov eax, 3
jmp 0x14000e9a5
mov qword [rsp + 0x1a8], rsi
xor r9d, r9d
mov qword [rsp + 0x178], r12
mov edx, 0x80000000
xor r12d, r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 3
lea r8d, [r12 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000e7bb
lea eax, [rsi + 6]
jmp 0x14000e995
mov qword [rsp + 0x28], r12
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], r12d
mov r8d, 0x1000002
mov qword [rsp + 0x1a0], rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rbp, rax
test rax, rax
jne 0x14000e7fa
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [rbp + 6]
jmp 0x14000e98d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000e81a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 7
jmp 0x14000e98d
xor r9d, r9d
mov qword [rsp + 0x170], r14
xor r8d, r8d
mov qword [rsp + 0x20], r12
mov rcx, rbp
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r14, rax
test rax, rax
jne 0x14000e85d
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [r14 + 8]
jmp 0x14000e985
movsxd r8, dword [rax + 0x3c]
movzx edx, r12w
add r8, r14
mov qword [rsp + 0x190], rbx
movzx r9d, word [r8 + 6]
cmp r12w, r9w
jae 0x14000e95b
movzx r10d, word [r8 + 0x14]
lea r11, str..text
nop dword [rax + rax]
movzx eax, dx
lea rcx, [rax + rax*4]
mov rax, r12
lea rbx, [r10 + rcx*8]
add rbx, r8
movzx ecx, byte [rbx + rax + 0x18]
inc rax
cmp cl, byte [r11 + rax - 1]
jne 0x14000e94e
cmp rax, 6
jne 0x14000e8a1
mov ecx, dword [rbx + 0x24]
lea r9, [rsp + 0x40]
mov edx, dword [rbx + 0x20]
lea r8d, [rax + 0x3a]
add rcx, r15
mov dword [rsp + 0x40], r12d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x14000e9c6
cmp dword [rsp + 0x40], r12d
je 0x14000e9c6
mov eax, dword [rbx + 0x24]
mov r8d, dword [rbx + 0x20]
lea rdx, [rax + r14]
lea rcx, [rax + r15]
call fcn.1400822b0
mov ecx, dword [rbx + 0x24]
lea r9, [rsp + 0x44]
mov edx, dword [rbx + 0x20]
add rcx, r15
mov r8d, dword [rsp + 0x40]
mov dword [rsp + 0x44], r12d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x14000e9bf
cmp dword [rsp + 0x44], r12d
je 0x14000e9bf
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x14000e97d
inc dx
cmp dx, r9w
jb 0x14000e890
mov ebx, inet_ntoa
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rbx, qword [rsp + 0x190]
mov r14, qword [rsp + 0x170]
mov rbp, qword [rsp + 0x1a0]
mov rsi, qword [rsp + 0x1a8]
mov r12, qword [rsp + 0x178]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140045970
add rsp, 0x180
pop r15
ret
mov ebx, 0xa
jmp 0x14000e960
mov ebx, 9
jmp 0x14000e960