Function at 0x100009804
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
xor ebx, ebx
xor r9d, r9d
xor r8d, r8d
lea eax, [rbx + 1]
mov qword [rsp + 0x30], rbx
mov dword [rdx], ebx
mov dword [rsp + 0x28], eax
lea eax, [rbx + 3]
mov si, bx
mov edx, 0x80000000
mov qword [rsp + 0x48], rbx
mov word [rsp + 0xb0], bx
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x44], esi
mov r15, rbx
mov rdi, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
mov qword [rsp + 0x58], rax
cmp rax, 0xffffffffffffffff
jne 0x100009874
xor eax, eax
jmp 0x100009eb9
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
mov rcx, r14
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rsp + 0x50], rax
cmp rax, rbx
jne 0x1000098af
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10000986d
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
xor r11d, r11d
mov rbp, rax
cmp rax, r11
jne 0x1000098df
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000098a4
cmp byte [rax], 0x74
mov edx, r11d
mov r8d, 0xff00
jne 0x100009920
cmp byte [rax + 1], 0x74
jne 0x100009920
cmp byte [rax + 2], 0x63
jne 0x100009920
cmp byte [rax + 3], 0x66
jne 0x100009920
mov ecx, dword [rax + 0xc]
mov edx, ecx
mov eax, ecx
and eax, r8d
shl edx, 0x10
add edx, eax
mov eax, ecx
shr ecx, 0x18
shr eax, 8
shl edx, 8
and eax, r8d
add edx, eax
add edx, ecx
mov eax, edx
mov r12d, 0x100
add rbp, rax
mov dword [rsp + 0x40], r12d
movzx eax, word [rbp + 4]
movzx r14d, ax
shr ax, 8
imul r14w, r12w
add r14w, ax
je 0x100009e87
lea rbx, [rbp + 0xc]
mov r13w, r11w
cmp r11w, r14w
jae 0x100009e87
mov r9d, 1
jmp 0x100009971
mov r8d, 0xff00
mov r12d, 0x100
mov al, byte [rbx]
cmp al, 0x6d
jne 0x1000099d2
cmp byte [rbx + 1], 0x61
jne 0x1000099d2
cmp byte [rbx + 2], 0x78
jne 0x1000099d2
cmp byte [rbx + 3], 0x70
jne 0x1000099d2
mov ecx, dword [rbx + 8]
mov eax, ecx
mov edx, ecx
and eax, r8d
shl edx, 0x10
add edx, eax
mov eax, ecx
shr ecx, 0x18
shr eax, 8
shl edx, 8
and eax, r8d
add edx, eax
add edx, ecx
mov eax, edx
add rax, rbp
movzx ecx, word [rax + 4]
movzx r8d, cx
shr cx, 8
imul r8w, r12w
add r8w, cx
mov word [rsp + 0xb0], r8w
jmp 0x100009b6c
cmp al, 0x68
jne 0x100009a37
cmp byte [rbx + 1], 0x65
jne 0x100009a37
cmp byte [rbx + 2], 0x61
jne 0x100009a37
cmp byte [rbx + 3], 0x64
jne 0x100009a37
mov ecx, dword [rbx + 8]
mov eax, ecx
mov edx, ecx
and eax, r8d
shl edx, 0x10
add edx, eax
mov eax, ecx
shr ecx, 0x18
shl edx, 8
shr eax, 8
and eax, r8d
mov r8w, word [rsp + 0xb0]
add edx, eax
add edx, ecx
mov eax, edx
add rax, rbp
movzx ecx, word [rax + 0x32]
movzx edx, cx
shr cx, 8
imul dx, r12w
add dx, cx
mov word [rsp + 0xb8], dx
jmp 0x100009b74
cmp al, 0x6c
jne 0x100009a8f
cmp byte [rbx + 1], 0x6f
jne 0x100009a8f
cmp byte [rbx + 2], 0x63
jne 0x100009a8f
cmp byte [rbx + 3], 0x61
jne 0x100009a8f
mov ecx, dword [rbx + 8]
mov edx, ecx
mov eax, ecx
shl edx, 0x10
and eax, r8d
add edx, eax
mov eax, ecx
shr ecx, 0x18
shl edx, 8
shr eax, 8
and eax, r8d
mov r8w, word [rsp + 0xb0]
add edx, eax
add edx, ecx
mov r12d, edx
mov dx, word [rsp + 0xb8]
add r12, rbp
mov qword [rsp + 0x48], r12
jmp 0x100009b79
cmp al, 0x63
jne 0x100009b63
cmp byte [rbx + 1], 0x6d
jne 0x100009b63
cmp byte [rbx + 2], 0x61
jne 0x100009b63
cmp byte [rbx + 3], 0x70
jne 0x100009b63
mov ecx, dword [rbx + 8]
mov r13d, r11d
mov edx, ecx
mov eax, ecx
and eax, r8d
shl edx, 0x10
add edx, eax
mov eax, ecx
shr ecx, 0x18
shr eax, 8
shl edx, 8
and eax, r8d
add edx, eax
add edx, ecx
mov r10d, edx
add r10, rbp
movzx eax, word [r10 + 2]
lea r8, [r10 + 4]
movzx r9d, ax
shr ax, 8
imul r9w, r12w
add r9w, ax
cmp r11w, r9w
jae 0x100009b5d
mov r12d, 1
movzx eax, word [r8 + 2]
mov ecx, 0x100
movzx edx, ax
shr ax, 8
imul dx, cx
movzx ecx, word [r8]
add dx, ax
movzx eax, cx
shr cx, 8
imul ax, word [rsp + 0x40]
add ax, cx
mov ecx, 3
cmp ax, cx
jne 0x100009b4f
cmp dx, r12w
je 0x100009c35
cmp dx, r11w
je 0x100009c35
add r13w, r12w
add r8, 8
cmp r13w, r9w
jb 0x100009b05
mov r9d, 1
mov r8w, word [rsp + 0xb0]
mov dx, word [rsp + 0xb8]
mov r12, qword [rsp + 0x48]
mov r10d, 4
add r13w, r9w
add rbx, 0x10
cmp r13w, r14w
jb 0x100009965
cmp r8w, r11w
je 0x100009e87
cmp r12, r11
je 0x100009e87
cmp si, r11w
je 0x100009e87
cmp r15, r11
je 0x100009e87
mov r14w, r10w
cmp dx, r11w
jne 0x100009bc7
mov r14d, 2
movzx r13d, r11w
cmp r11w, si
jae 0x100009e87
movzx eax, r13w
lea rcx, [rax + rax*2]
movzx eax, word [r15 + rcx*2 + 2]
movzx ebx, word [r15 + rcx*2]
mov word [rsp + 0x40], ax
cmp bx, ax
ja 0x100009e66
movzx esi, word [r15 + rcx*2 + 4]
add si, bx
cmp si, r8w
ja 0x100009e73
movzx ecx, si
cmp dx, r11w
movzx edx, r14w
lea rax, [rcx + 1]
jne 0x100009d80
imul rax, rdx
imul rdx, rcx
movzx eax, word [rax + r12]
cmp word [rdx + r12], ax
jmp 0x100009d90
mov ecx, dword [r8 + 4]
mov r8d, 0xff00
mov edx, 0x100
mov r12d, ecx
mov eax, ecx
and eax, r8d
shl r12d, 0x10
add r12d, eax
mov eax, ecx
shr ecx, 0x18
shr eax, 8
shl r12d, 8
and eax, r8d
add r12d, eax
add r12d, ecx
add r12, r10
mov r10d, 4
movzx ecx, word [r12]
movzx eax, cx
shr cx, 8
imul ax, dx
add ax, cx
cmp ax, r10w
jne 0x100009d5f
movzx eax, word [r12 + 6]
mov esi, eax
shl eax, 8
shr esi, 8
add esi, eax
sar esi, 1
dec si
movzx eax, si
mov dword [rsp + 0x44], esi
lea rcx, [rax + rax*2]
add rcx, rcx
call qword [sym.imp.msvcrt.dll_malloc]
xor r11d, r11d
mov r15, rax
cmp rax, r11
je 0x100009e87
movzx r8d, si
lea r9, [r12 + 0xe]
cmp r8d, r11d
jle 0x100009b5d
lea ecx, [r8 + 1]
lea r10, [rax + 4]
mov esi, 1
movsxd rdx, ecx
mov r12d, 0x100
lea r11, [r9 + rdx*4 + 2]
lea rdx, [r9 + rdx*2 + 2]
movzx ecx, word [r9]
add r9, 2
movzx eax, cx
shr cx, 8
imul ax, r12w
add ax, cx
movzx ecx, word [rdx]
add rdx, 2
mov word [r10 - 2], ax
movzx eax, cx
shr cx, 8
imul ax, r12w
add ax, cx
movzx ecx, word [r11]
mov word [r10 - 4], ax
movzx eax, cx
shr cx, 8
add r11, 2
imul ax, r12w
add ax, cx
mov word [r10], ax
add r10, 6
sub r8, rsi
jne 0x100009cf8
mov esi, dword [rsp + 0x44]
xor r11d, r11d
jmp 0x100009b5d
mov r12, qword [rsp + 0x48]
mov dx, word [rsp + 0xb8]
mov r8w, word [rsp + 0xb0]
mov r9d, 1
jmp 0x100009b7f
imul rax, rdx
imul rdx, rcx
mov eax, dword [rax + r12]
cmp dword [rdx + r12], eax
je 0x100009e47
cmp rdi, r11
jne 0x100009dc7
mov rax, qword [rsp + 0xa8]
mov rcx, r10
add dword [rax], r9d
call qword [sym.imp.msvcrt.dll_malloc]
xor r11d, r11d
mov rdi, rax
cmp rax, r11
je 0x100009e87
mov word [rax], bx
mov word [rax + 2], bx
jmp 0x100009e34
mov r8, qword [rsp + 0xa8]
movzx ecx, bx
mov r12d, dword [r8]
lea eax, [r12 - 1]
mov edx, eax
movzx eax, word [rdi + rax*4 + 2]
sub ecx, eax
cmp ecx, r9d
jne 0x100009df5
add word [rdi + rdx*4 + 2], r9w
mov r12, qword [rsp + 0x48]
jmp 0x100009e3e
inc r12d
mov dword [r8], r12d
cmp r12d, r11d
jbe 0x100009e87
mov edx, r12d
mov rcx, rdi
shl rdx, 2
call qword [sym.imp.msvcrt.dll_realloc]
xor r11d, r11d
cmp rax, r11
je 0x100009e87
lea ecx, [r12 - 1]
mov r12, qword [rsp + 0x48]
mov rdi, rax
mov word [rax + rcx*4], bx
mov word [rax + rcx*4 + 2], bx
mov edx, ecx
mov r10d, 4
lea r9d, [r10 - 3]
mov r8w, word [rsp + 0xb0]
mov dx, word [rsp + 0xb8]
add bx, r9w
add si, r9w
cmp bx, word [rsp + 0x40]
jbe 0x100009bff
mov esi, dword [rsp + 0x44]
add r13w, r9w
cmp r13w, si
jmp 0x100009bcf
cmp rdi, r11
je 0x100009e84
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
xor r11d, r11d
mov rdi, r11
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
cmp r15, rbx
je 0x100009eb6
mov rcx, r15
call qword [sym.imp.msvcrt.dll_free]
mov rax, rdi
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret