Function at 0x140026690
Capabilities:
Read file via mapping

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x180
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x14007bec0]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rbx, rcx
xor ebp, ebp
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rbp
lea rcx, [rsp + 0x48]
call fcn.140027140
mov rdi, qword [rsp + 0x50]
mov rcx, rdi
mov rsi, qword [rsp + 0x48]
sub rcx, rsi
movabs rax, 0x6666666666666667
imul rcx
mov r12, rdx
sar r12, 4
mov rax, r12
shr rax, 0x3f
add r12, rax
cmp r12d, 0xa
jbe 0x1400267ad
mov rcx, qword [rbx]
test rcx, rcx
je 0x140026731
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], rbp
lea rcx, [rbx + 0x10]
cmp qword [rcx + 0x18], 8
jb 0x14002673f
mov rcx, qword [rcx]
mov eax, r12d
shl eax, 8
add eax, 4
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 4]
or rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rbx], rax
test rax, rax
jne 0x1400267ad
test rsi, rsi
je 0x1400268ef
mov rbx, rsi
cmp rsi, rdi
je 0x1400268e7
cmp qword [rbx + 0x18], 8
jb 0x140026790
mov rcx, qword [rbx]
call fcn.140033ccc
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rbp
mov word [rbx], bp
add rbx, 0x28
cmp rbx, rdi
jne 0x140026781
jmp 0x1400268e7
mov qword [rsp + 0x20], rbp
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 2]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsp + 0x40], rax
mov dword [rax], r12d
lea r14, [rax + 4]
mov r15d, ebp
mov r13, rbp
test r12d, r12d
je 0x1400268a8
mov rbx, rsi
mov byte [rsp + 0x70], 0
xor edx, edx
mov r8d, 0xff
lea rcx, [rsp + 0x71]
call fcn.140037b90
cmp r12, r13
jbe 0x14002689b
cmp qword [rbx + 0x18], 8
jb 0x14002680f
mov rbp, qword [rbx]
jmp 0x140026812
mov rbp, rbx
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rax
or r9d, 0xffffffff
mov r8, rbp
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x140026865
xor ecx, ecx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
or r9d, 0xffffffff
mov r8, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rcx, r14
lea rdx, [rsp + 0x70]
mov r8d, pe_nt_image_headers64
call fcn.140033fc0
add r14, 0x100
inc r15d
inc r13
add rbx, 0x28
cmp r15d, r12d
jb 0x1400267e3
mov rax, qword [rsp + 0x40]
xor ebp, ebp
jmp 0x1400268a8
lea rcx, str.invalid_vector_T__subscript
call fcn.1400335c8
int3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
nop
test rsi, rsi
je 0x1400268ef
mov rbx, rsi
cmp rsi, rdi
je 0x1400268e7
nop
cmp qword [rbx + 0x18], 8
jb 0x1400268cf
mov rcx, qword [rbx]
call fcn.140033ccc
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rbp
mov word [rbx], bp
add rbx, 0x28
cmp rbx, rdi
jne 0x1400268c0
mov rcx, rsi
call fcn.140033ccc
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140033cf0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret