Function at 0x180001480
Capabilities:
Read file via mapping

Disassembly:
push rbx
push rsi
push rdi
push r12
push r15
sub rsp, 0x60
xor ebx, ebx
mov rdi, r8
mov r12, rdx
mov rsi, rcx
lea rax, str.clr.dll
mov r15d, ebx
mov r10d, ebx
nop dword [rax]
nop dword [rax + rax]
movzx r9d, word [rax + r10*2]
inc r10
cmp r9w, word [rdx + r10*2 - 2]
jne 0x1800014d5
cmp r10, 8
jne 0x1800014b0
mov rax, rbx
add rsp, 0x60
pop r15
pop r12
pop rdi
pop rsi
pop rbx
ret
mov rdx, rcx
lea rcx, str._REFRESH__Opening_file:__S
call fcn.180001de0
xor r9d, r9d
mov qword [rsp + 0x30], rbx
lea r8d, [r9 + 1]
mov edx, 0x80000000
mov rcx, rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
mov qword [rsp + 0x50], rax
cmp rax, 0xffffffffffffffff
je 0x1800014c6
xor r9d, r9d
xor edx, edx
mov rcx, rax
lea r8d, [r9 + 2]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0xa0], r14
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r14, rax
mov qword [rsp + 0xa8], rax
test rax, rax
je 0x18000192a
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
mov qword [rsp + 0x98], r13
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r13, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x180001919
movsxd rsi, dword [rax + 0x3c]
lea rcx, str._REFRESH__Allocating_memory_for_library
mov qword [rsp + 0x90], rbp
add rsi, rax
call fcn.180001de0
mov edx, dword [rsi + 0x50]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea rcx, str._REFRESH__Copying_PE_header_into_memory
mov r15, rax
call fcn.180001de0
mov r8d, dword [rsi + 0x54]
mov rdx, r13
mov rcx, r15
call fcn.1800031d0
lea rcx, str._REFRESH__Copying_PE_sections_into_memory
call fcn.180001de0
movsxd rbp, dword [r13 + 0x3c]
add rbp, r13
cmp bx, word [rsi + 6]
jae 0x180001621
nop dword [rax + rax]
mov eax, ebx
lea rcx, [rax + rax*4]
mov edx, dword [rbp + rcx*8 + 0x11c]
mov r8d, dword [rbp + rcx*8 + 0x118]
mov ecx, dword [rbp + rcx*8 + 0x114]
add rcx, r15
add rdx, r13
call fcn.1800031d0
movzx eax, word [rsi + 6]
inc ebx
cmp ebx, eax
jb 0x1800015f0
movsxd rbx, dword [r15 + 0x3c]
lea rcx, str._REFRESH__Calculating_file_relocations
add rbx, r15
call fcn.180001de0
mov r10, qword [rbx + 0x30]
mov qword [rbx + 0x30], rdi
mov ecx, dword [rbx + 0xb4]
test ecx, ecx
je 0x180001754
mov eax, dword [rbx + 0xb0]
add rcx, rax
lea r11, [rax + r15]
add rcx, r15
cmp r11, rcx
jae 0x180001754
mov eax, dword [r11 + 4]
test eax, eax
je 0x180001754
mov r8d, dword [r11]
lea r9, [rax - 8]
lea rdx, [r11 + 8]
shr r9, 1
add r8, r15
test r9d, r9d
je 0x180001732
nop dword [rax]
movzx eax, word [rdx]
dec r9d
movzx ecx, ax
shr cx, 0xc
cmp cx, 0xa
jne 0x1800016ba
and eax, 0xfff
sub qword [rax + r8], r10
movzx eax, word [rdx]
and eax, 0xfff
add qword [rax + r8], rdi
jmp 0x180001725
cmp cx, 3
jne 0x1800016d7
and eax, 0xfff
sub dword [rax + r8], r10d
movzx eax, word [rdx]
and eax, 0xfff
add dword [rax + r8], edi
jmp 0x180001725
cmp cx, 1
jne 0x180001708
and eax, 0xfff
lea rcx, [rax + r8]
mov rax, r10
shr rax, 0x10
sub word [rcx], ax
movzx eax, word [rdx]
and eax, 0xfff
lea rcx, [rax + r8]
mov rax, rdi
shr rax, 0x10
add word [rcx], ax
jmp 0x180001725
cmp cx, 2
jne 0x180001725
and eax, 0xfff
sub word [rax + r8], r10w
movzx eax, word [rdx]
and eax, 0xfff
add word [rax + r8], di
add rdx, 2
test r9d, r9d
jne 0x180001690
mov eax, dword [r11 + 4]
mov ecx, dword [rbx + 0xb4]
add r11, rax
mov eax, dword [rbx + 0xb0]
add rax, r15
add rcx, rax
cmp r11, rcx
jb 0x180001663
lea rcx, str._REFRESH__Resolving_Import_Address_Table__IAT_
call fcn.180001de0
cmp dword [rbx + 0x94], 0
je 0x180001903
mov r14d, dword [rbx + 0x90]
add r14, r15
cmp dword [r14], 0
je 0x1800018fb
movabs r13, 0x8000000000000000
nop dword [rax + rax]
mov ebx, dword [r14 + 0xc]
mov edx, 0x104
add rbx, r15
mov rcx, rbx
call fcn.180002b14
mov edx, 2
lea rcx, [rax + 1]
mov rdi, rax
call fcn.180002d0c
mov rsi, rax
test rax, rax
je 0x1800018e8
lea r8, [rdi + 1]
lea rcx, [rsp + 0x58]
mov r9, rbx
mov rdx, rax
mov qword [rsp + 0x20], rdi
call fcn.18000309c
lea rcx, str._REFRESH__Loading_library:__S
mov rdx, rsi
call fcn.180001de0
lea rdx, str.api_
mov r8d, 4
mov rcx, rsi
call fcn.1800028e8
test eax, eax
je 0x18000181b
lea rdx, str.ext_
mov r8d, 4
mov rcx, rsi
call fcn.1800028e8
test eax, eax
jne 0x180001878
lea r8, [rsp + 0x40]
mov rdx, rsi
mov rcx, r12
call fcn.180001030
mov rbx, rax
test rax, rax
je 0x180001878
mov rcx, rsi
call fcn.180002d50
mov rdi, qword [rsp + 0x40]
mov edx, 2
lea rcx, [rdi + 1]
call fcn.180002d0c
mov rsi, rax
test rax, rax
je 0x1800018e8
lea r8, [rdi + rdi]
mov rdx, rbx
mov rcx, rax
call fcn.1800031d0
lea rcx, str._REFRESH__Redirected_library:__S
mov rdx, rsi
call fcn.180001de0
mov rcx, rsi
call fcn.180001950
mov rbp, rax
test rax, rax
je 0x1800018e0
mov eax, dword [r14]
test eax, eax
je 0x180001895
lea rbx, [r15 + rax]
jmp 0x18000189c
mov ebx, dword [r14 + 0x10]
add rbx, r15
mov edi, dword [r14 + 0x10]
mov rax, qword [rbx]
add rdi, r15
test rax, rax
je 0x1800018e0
nop dword [rax + rax]
mov r8, rsi
mov rcx, rbp
test r13, rax
je 0x1800018c0
movzx edx, ax
jmp 0x1800018c7
lea rdx, [r15 + 2]
add rdx, rax
call fcn.1800019e0
add rbx, 8
add rdi, 8
mov qword [rdi - 8], rax
mov rax, qword [rbx]
test rax, rax
jne 0x1800018b0
mov rcx, rsi
call fcn.180002d50
add r14, 0x14
cmp dword [r14], 0
jne 0x180001790
mov r13, qword [rsp + 0x48]
mov r14, qword [rsp + 0xa8]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x90]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r13, qword [rsp + 0x98]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, qword [rsp + 0xa0]
mov rax, r15
add rsp, 0x60
pop r15
pop r12
pop rdi
pop rsi
pop rbx
ret