Function at 0x1403d39b0
Capabilities:
Read file via mapping

Disassembly:
push rsi
push rdi
push r12
sub rsp, 0x80
mov rdi, rcx
mov rax, qword [0x14194d6d8]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea rsi, [rdi + 0x10]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x60], 0x1160913
mov dword [rsp + 0x64], 0
call fcn.140484c88
mov dword [rsp + 0x68], eax
call sub.KERNEL32.dll_GetCurrentProcessId
mov r8d, 0x7b
lea r12, [rsp + 0x38]
mov rdx, r12
mov dword [rsp + 0x6c], eax
mov word [r12], r8w
mov rcx, rdx
and rdx, 0xfffffffffffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x1403d3a37
mov rax, rdx
add rdx, rcx
call fcn.14042af70
add rax, r12
lea rdx, str._08X
mov rcx, rax
mov r8d, 0x1160913
call fcn.14036c680
mov rax, r12
lea rdx, str._0000_0000_
call fcn.140431a50
mov rdx, r12
mov rcx, rdx
and rdx, 0xfffffffffffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x1403d3a89
mov rax, rdx
add rdx, rcx
call fcn.14042af70
add rax, r12
lea rdx, str._02X
mov rcx, rax
movzx r8d, byte [rsp + 0x68]
call fcn.14036c680
mov rdx, r12
mov rcx, rdx
and rdx, 0xfffffffffffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x1403d3acc
mov rax, rdx
add rdx, rcx
call fcn.14042af70
add rax, r12
lea rdx, str._02X
mov rcx, rax
movzx r8d, byte [rsp + 0x69]
call fcn.14036c680
mov rax, r12
lea rdx, [0x14059f0a4]
call fcn.140431a50
mov rdx, r12
mov rcx, rdx
and rdx, 0xfffffffffffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x1403d3b1e
mov rax, rdx
add rdx, rcx
call fcn.14042af70
add rax, r12
lea rdx, str._02X
mov rcx, rax
movzx r8d, byte [rsp + 0x6a]
call fcn.14036c680
mov rdx, r12
mov rcx, rdx
and rdx, 0xfffffffffffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x1403d3b61
mov rax, rdx
add rdx, rcx
call fcn.14042af70
add rax, r12
lea rdx, str._02X
mov rcx, rax
movzx r8d, byte [rsp + 0x6b]
call fcn.14036c680
mov rdx, r12
mov rcx, rdx
and rdx, 0xfffffffffffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x1403d3ba4
mov rax, rdx
add rdx, rcx
call fcn.14042af70
add rax, r12
lea rdx, str._02X
mov rcx, rax
movzx r8d, byte [rsp + 0x6c]
call fcn.14036c680
mov rdx, r12
mov rcx, rdx
and rdx, 0xfffffffffffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x1403d3be7
mov rax, rdx
add rdx, rcx
call fcn.14042af70
add rax, r12
lea rdx, str._02X
mov rcx, rax
movzx r8d, byte [rsp + 0x6d]
call fcn.14036c680
mov rdx, r12
mov rcx, rdx
and rdx, 0xfffffffffffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x1403d3c2a
mov rax, rdx
add rdx, rcx
call fcn.14042af70
add rax, r12
lea rdx, str._02X
mov rcx, rax
movzx r8d, byte [rsp + 0x6e]
call fcn.14036c680
mov rdx, r12
mov rcx, rdx
and rdx, 0xfffffffffffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x1403d3c6d
mov rax, rdx
add rdx, rcx
call fcn.14042af70
add rax, r12
lea rdx, str._02X
mov rcx, rax
movzx r8d, byte [rsp + 0x6f]
call fcn.14036c680
mov rax, r12
lea rdx, [0x14059f0a8]
call fcn.140431a50
mov ecx, 4
xor edx, edx
mov r8, r12
call qword [sym.imp.KERNEL32.dll_OpenFileMappingA]
test rax, rax
je 0x1403d3cf1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
xor edx, edx
lea r8, [rsp + 0x30]
call fcn.14035a450
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x70], 0
xor rcx, rsp
cmp rcx, qword [0x14194d6d8]
jne 0x1403d3cec
add rsp, 0x80
pop r12
pop rdi
pop rsi
ret
call fcn.14043dac0
mov r10, rsp
mov r9, rsi
shr r9, 0x20
mov rcx, 0xffffffffffffffff
xor edx, edx
mov r8d, 4
mov dword [r10 + 0x20], esi
mov qword [r10 + 0x28], r12
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov r12, rax
test r12, r12
je 0x1403d3cb2
mov rax, rsp
xor r8d, r8d
mov rcx, r12
mov edx, 6
xor r9d, r9d
mov dword [rsp + 0x64], r12d
mov qword [rax + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
je 0x1403d3d5b
movups xmm0, xmmword [rsp + 0x60]
movups xmmword [rax], xmm0
add rax, 0x10
mov qword [rsp + 0x30], rax
jmp 0x1403d3cc6
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1403d3cb2