Function at 0x140043d40
Capabilities:
Get disk information
Get file size
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rax, qword [0x1400de638]
xor rax, rsp
mov qword [rbp + 0x27], rax
xor r14d, r14d
mov qword [rbp + 0x17], r8
mov qword [r8], r14
mov rdi, rdx
mov r13d, ecx
mov dword [rbp - 0x19], ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov rcx, rax
lea edx, [r14 + 8]
lea r8d, [r14 + 0x28]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov r15, rax
test rax, rax
je 0x140043dc6
lea rax, [0x1400a6c00]
mov dword [r15 + 8], r14d
mov qword [r15], rax
mov qword [r15 + 0x10], r14
mov qword [r15 + 0x18], r14
mov qword [r15 + 0x20], r14
jmp 0x140043dc9
mov r15, r14
mov rbx, r15
test r15, r15
jne 0x140043de1
mov r14d, 0x8007000e
mov edx, 0xa6
jmp 0x14004410b
test r13d, 0xfffffffc
je 0x140043e0d
mov rcx, qword [rbp + 0x5f]
lea r8, str.minkernelmrtmrm_srcmrmmin_basefile.cpp
mov r14d, 0x80070057
mov edx, 0xbf
mov r9d, r14d
call fcn.140002980
jmp 0x140044106
mov rcx, r14
mov qword [rbp - 9], r14
mov bl, r13b
mov qword [rbp + 7], rcx
mov qword [rbp - 0x11], rcx
mov rsi, r14
and bl, 1
je 0x140043e6d
xor eax, eax
mov dword [rbp + 0x1f], eax
mov word [rbp + 0x23], ax
test rdi, rdi
je 0x140043eae
movzx eax, word [rdi]
test ax, ax
je 0x140043eae
movzx ecx, word [rdi + 2]
test cx, cx
je 0x140043eae
mov word [rbp + 0x21], cx
lea rcx, [rbp + 0x1f]
mov word [rbp + 0x1f], ax
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
nop dword [rax + rax]
test eax, 0xfffffffc
jne 0x140043e6a
cmp eax, 2
jne 0x140043eae
mov bl, r14b
lea r8, [rbp - 9]
mov rcx, rdi
lea rdx, [rbp - 0x11]
call fcn.140043b98
mov rsi, qword [rbp - 9]
mov r14d, eax
mov rax, qword [rbp - 0x11]
test r14d, r14d
jns 0x1400440a9
mov rcx, qword [rbp + 0x5f]
lea r8, str.minkernelmrtmrm_srcmrmmin_basefile.cpp
mov r9d, r14d
mov edx, 0xd3
call fcn.140002980
jmp 0x1400440fe
xor eax, eax
mov qword [rbp - 0x11], r14
mov qword [rbp - 1], rax
mov rcx, rdi
lea rax, [rbp - 0x11]
mov qword [rsp + 0x30], rax
call fcn.140058568
mov r14d, eax
test eax, eax
jns 0x140043f04
mov rcx, qword [rbp + 0x5f]
lea r8, str.minkernelmrtmrm_srcmrmmin_basefile.cpp
mov r9d, eax
mov edx, 0x84
call fcn.140002980
mov rcx, qword [rbp - 0x11]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14004409e
call sub.KERNEL32.dll_CloseHandle
jmp 0x14004409e
mov rbx, qword [rbp - 0x11]
lea rdx, [rbp - 1]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
nop dword [rax + rax]
test eax, eax
jne 0x140043f3e
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx r14d, ax
or r14d, 0x80070000
test eax, eax
cmovle r14d, eax
jmp 0x140043f41
xor r14d, r14d
test r14d, r14d
jns 0x140043f71
mov rcx, qword [rbp + 0x5f]
lea r8, str.minkernelmrtmrm_srcmrmmin_basefile.cpp
mov r9d, r14d
mov edx, 0x85
call fcn.140002980
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14004409e
mov rcx, rbx
jmp 0x140043efa
and qword [rsp + 0x28], rsi
xor r9d, r9d
and dword [rsp + 0x20], esi
xor edx, edx
mov rcx, rbx
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x140043fbc
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx r14d, ax
or r14d, 0x80070000
test eax, eax
cmovle r14d, eax
xor r13d, r13d
jmp 0x140043fc2
xor r14d, r14d
mov r13, rdi
test r14d, r14d
jns 0x14004400c
mov edx, 0x86
mov rcx, qword [rbp + 0x5f]
lea r8, str.minkernelmrtmrm_srcmrmmin_basefile.cpp
mov r9d, r14d
call fcn.140002980
lea rax, [r13 - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140043ff1
mov rcx, rdi
call sub.KERNEL32.dll_CloseHandle
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14004409a
mov rcx, rbx
call sub.KERNEL32.dll_CloseHandle
jmp 0x14004409a
and qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
nop dword [rax + rax]
mov qword [rbp - 9], rax
test rax, rax
jne 0x140044056
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx r14d, ax
or r14d, 0x80070000
test eax, eax
cmovle r14d, eax
mov rax, qword [rbp - 9]
jmp 0x140044059
xor r14d, r14d
test r14d, r14d
jns 0x140044068
mov edx, 0x87
jmp 0x140043fcc
mov rcx, qword [rbp - 1]
mov rsi, rax
lea rax, [r13 - 1]
mov qword [rbp + 7], rcx
cmp rax, 0xfffffffffffffffd
ja 0x140044085
mov rcx, rdi
call sub.KERNEL32.dll_CloseHandle
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140044097
mov rcx, rbx
call sub.KERNEL32.dll_CloseHandle
xor r14d, r14d
mov r13d, dword [rbp - 0x19]
mov rax, qword [rbp + 7]
mov bl, 1
jmp 0x140043e88
mov r8, rax
mov rdx, rsi
mov rcx, r15
call fcn.140043904
mov r14d, eax
test eax, eax
js 0x1400440c9
bts r13d, 0x10
mov dword [r15 + 8], r13d
jmp 0x1400440fe
test bl, bl
je 0x1400440de
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
nop dword [rax + rax]
jmp 0x1400440fe
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
test r14d, r14d
jns 0x140044120
mov rbx, r15
mov edx, 0xa8
mov rcx, qword [rbp + 0x5f]
lea r8, str.minkernelmrtmrm_srcmrmmin_basefile.cpp
mov r9d, r14d
call fcn.140002980
jmp 0x14004412c
mov rax, qword [rbp + 0x17]
xor ebx, ebx
xor r14d, r14d
mov qword [rax], r15
test rbx, rbx
je 0x140044145
mov r8, qword [rbx]
mov edx, 1
mov rcx, rbx
mov rax, qword [r8]
call qword [case.0x1400462a5.0]
mov eax, r14d
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1400a0610
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret