Function at 0x140001cc0
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x18], r8d
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x30
mov r9, qword [rcx + 8]
mov rdi, rdx
mov r14, rcx
mov rbx, r9
mov rax, qword [r9 + 8]
cmp byte [rax + 0x19], 0
jne 0x140001d14
cmp dword [rax + 0x20], r8d
jae 0x140001cfd
mov rax, qword [rax + 0x10]
jmp 0x140001d03
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x140001cf1
cmp rbx, r9
je 0x140001d14
cmp r8d, dword [rbx + 0x20]
jae 0x140001d4a
lea rax, [rbp + 0x30]
add rcx, 8
lea r8, [rbp + 0x20]
mov qword [rbp + 0x20], rax
call fcn.14000b2a0
mov r8, rbx
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x20]
lea rcx, [r14 + 8]
lea r9, [rax + 0x20]
call fcn.14000b2d0
mov r8d, dword [rbp + 0x30]
mov rbx, qword [rbp + 0x20]
cmp qword [rbx + 0x28], 0
je 0x140001dc5
mov rcx, qword [r14 + 8]
mov rbx, rcx
mov rax, qword [rcx + 8]
cmp byte [rax + 0x19], 0
jne 0x140001d85
cmp dword [rax + 0x20], r8d
jae 0x140001d6e
mov rax, qword [rax + 0x10]
jmp 0x140001d74
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x140001d62
cmp rbx, rcx
je 0x140001d85
cmp r8d, dword [rbx + 0x20]
jae 0x140001db7
lea rax, [rbp + 0x30]
lea r8, [rbp + 0x20]
mov qword [rbp + 0x20], rax
lea rcx, [r14 + 8]
call fcn.14000b2a0
mov r8, rbx
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x20]
lea rcx, [r14 + 8]
lea r9, [rax + 0x20]
call fcn.14000b2d0
mov rbx, qword [rbp + 0x20]
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, dword [rbp + 0x30]
mov rcx, qword [r14 + 8]
mov rbx, rcx
mov rax, qword [rcx + 8]
cmp byte [rax + 0x19], 0
jne 0x140001df9
cmp dword [rax + 0x20], r8d
jae 0x140001de2
mov rax, qword [rax + 0x10]
jmp 0x140001de8
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x140001dd6
cmp rbx, rcx
je 0x140001df9
cmp r8d, dword [rbx + 0x20]
jae 0x140001e2f
lea rax, [rbp + 0x30]
lea r8, [rbp + 0x20]
mov qword [rbp + 0x20], rax
lea rcx, [r14 + 8]
call fcn.14000b2a0
mov r8, rbx
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x20]
lea rcx, [r14 + 8]
lea r9, [rax + 0x20]
call fcn.14000b2d0
mov r8d, dword [rbp + 0x30]
mov rbx, qword [rbp + 0x20]
cmp qword [rbx + 0x30], 0
je 0x140001f22
mov rcx, qword [r14 + 8]
mov rbx, rcx
mov rax, qword [rcx + 8]
cmp byte [rax + 0x19], 0
jne 0x140001e73
nop dword [rax + rax]
cmp dword [rax + 0x20], r8d
jae 0x140001e5c
mov rax, qword [rax + 0x10]
jmp 0x140001e62
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x140001e50
cmp rbx, rcx
je 0x140001e73
cmp r8d, dword [rbx + 0x20]
jae 0x140001ea5
lea rax, [rbp + 0x30]
lea r8, [rbp + 0x20]
mov qword [rbp + 0x20], rax
lea rcx, [r14 + 8]
call fcn.14000b2a0
mov r8, rbx
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x20]
lea rcx, [r14 + 8]
lea r9, [rax + 0x20]
call fcn.14000b2d0
mov rbx, qword [rbp + 0x20]
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rdx, qword [r14 + 8]
mov rbx, rdx
mov rax, qword [rdx + 8]
cmp byte [rax + 0x19], 0
jne 0x140001ee4
mov ecx, dword [rbp + 0x30]
cmp dword [rax + 0x20], ecx
jae 0x140001ece
mov rax, qword [rax + 0x10]
jmp 0x140001ed4
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x140001ec3
cmp rbx, rdx
je 0x140001ee4
cmp ecx, dword [rbx + 0x20]
jae 0x140001f16
lea rax, [rbp + 0x30]
lea r8, [rbp + 0x20]
mov qword [rbp + 0x20], rax
lea rcx, [r14 + 8]
call fcn.14000b2a0
mov r8, rbx
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x20]
lea rcx, [r14 + 8]
lea r9, [rax + 0x20]
call fcn.14000b2d0
mov rbx, qword [rbp + 0x20]
mov qword [rbx + 0x30], 0
mov r8d, dword [rbp + 0x30]
cmp qword [rdi + 0x18], 8
jb 0x140001f2c
mov rdi, qword [rdi]
mov rcx, qword [r14 + 8]
mov rbx, rcx
mov rax, qword [rcx + 8]
cmp byte [rax + 0x19], 0
jne 0x140001f63
nop dword [rax]
cmp dword [rax + 0x20], r8d
jae 0x140001f4c
mov rax, qword [rax + 0x10]
jmp 0x140001f52
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x140001f40
cmp rbx, rcx
je 0x140001f63
cmp r8d, dword [rbx + 0x20]
jae 0x140001f95
lea rax, [rbp + 0x30]
lea r8, [rbp + 0x20]
mov qword [rbp + 0x20], rax
lea rcx, [r14 + 8]
call fcn.14000b2a0
mov r8, rbx
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x20]
lea rcx, [r14 + 8]
lea r9, [rax + 0x20]
call fcn.14000b2d0
mov rbx, qword [rbp + 0x20]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
xor edx, edx
mov dword [rsp + 0x20], 0x20000
lea r8d, [r9 + 4]
lea rcx, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rbx + 0x28], rax
mov rdx, qword [r14 + 8]
mov rbx, rdx
mov rax, qword [rdx + 8]
cmp byte [rax + 0x19], 0
jne 0x140001ff1
mov ecx, dword [rbp + 0x30]
nop dword [rax]
cmp dword [rax + 0x20], ecx
jae 0x140001fdb
mov rax, qword [rax + 0x10]
jmp 0x140001fe1
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x140001fd0
cmp rbx, rdx
je 0x140001ff1
cmp ecx, dword [rbx + 0x20]
jae 0x140002026
lea rax, [rbp + 0x30]
lea r8, [rbp + 0x20]
mov qword [rbp + 0x20], rax
lea rcx, [r14 + 8]
call fcn.14000b2a0
mov r8, rbx
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x20]
lea rcx, [r14 + 8]
lea r9, [rax + 0x20]
call fcn.14000b2d0
mov ecx, dword [rbp + 0x30]
mov rbx, qword [rbp + 0x20]
cmp qword [rbx + 0x28], 0
je 0x140002127
mov rdx, qword [r14 + 8]
mov rdi, rdx
mov rax, qword [rdx + 8]
cmp byte [rax + 0x19], 0
jne 0x140002063
cmp dword [rax + 0x20], ecx
jae 0x14000204d
mov rax, qword [rax + 0x10]
jmp 0x140002053
mov rdi, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x140002042
cmp rdi, rdx
je 0x140002063
cmp ecx, dword [rdi + 0x20]
jae 0x140002098
lea rax, [rbp + 0x30]
lea r8, [rbp + 0x20]
mov qword [rbp + 0x20], rax
lea rcx, [r14 + 8]
call fcn.14000b2a0
mov r8, rdi
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x20]
lea rcx, [r14 + 8]
lea r9, [rax + 0x20]
call fcn.14000b2d0
mov ecx, dword [rbp + 0x30]
mov rdi, qword [rbp + 0x20]
mov rdx, qword [r14 + 8]
mov rbx, rdx
mov rax, qword [rdx + 8]
cmp byte [rax + 0x19], 0
jne 0x1400020d1
nop dword [rax]
cmp dword [rax + 0x20], ecx
jae 0x1400020bb
mov rax, qword [rax + 0x10]
jmp 0x1400020c1
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1400020b0
cmp rbx, rdx
je 0x1400020d1
cmp ecx, dword [rbx + 0x20]
jae 0x140002103
lea rax, [rbp + 0x30]
lea r8, [rbp + 0x20]
mov qword [rbp + 0x20], rax
lea rcx, [r14 + 8]
call fcn.14000b2a0
mov r8, rbx
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x20]
lea rcx, [r14 + 8]
lea r9, [rax + 0x20]
call fcn.14000b2d0
mov rbx, qword [rbp + 0x20]
mov rcx, qword [rdi + 0x28]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], 0x20000
lea edx, [r9 + 6]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbx + 0x30], rax
mov ecx, dword [rbp + 0x30]
mov rdx, qword [r14 + 8]
mov rbx, rdx
mov rax, qword [rdx + 8]
cmp byte [rax + 0x19], 0
jne 0x140002159
cmp dword [rax + 0x20], ecx
jae 0x140002143
mov rax, qword [rax + 0x10]
jmp 0x140002149
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x140002138
cmp rbx, rdx
je 0x140002159
cmp ecx, dword [rbx + 0x20]
jae 0x14000218b
lea rax, [rbp + 0x30]
lea r8, [rbp + 0x20]
mov qword [rbp + 0x20], rax
lea rcx, [r14 + 8]
call fcn.14000b2a0
mov r8, rbx
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x20]
lea rcx, [r14 + 8]
lea r9, [rax + 0x20]
call fcn.14000b2d0
mov rbx, qword [rbp + 0x20]
cmp qword [rbx + 0x30], 0
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
setne al
mov byte [r14 + 0x20], al
add rsp, 0x30
pop r14
pop rdi
pop rbp
ret