Function at 0x1400015d8
Capabilities:
Get file size
Read file via mapping

Disassembly:
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14000172b
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140001551
movzx eax, word [r8]
test ax, ax
je 0x140001551
mov word [rcx], ax
add r8, 2
add rcx, 2
sub rdx, rsi
jne 0x14000152c
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov rcx, r9
mov word [rax], r14w
call qword [sym.imp.KERNEL32.dll_GlobalFree]
lea rcx, [rbp + 0xe0]
lea rbx, [rbp + 0xe0]
jmp 0x140001580
mov rbx, rax
lea rcx, [rax + 4]
lea rdx, [0x14000a764]
call qword [sym.imp.msvcrt.dll_wcsstr]
test rax, rax
jne 0x140001579
lea rcx, [rbp + 0xe0]
mov rax, rbx
sub rax, rcx
lea r8, str.psfamily.dat
sar rax, 1
mov rdx, r13
sub rdx, rax
mov rcx, rbx
call fcn.140001008
mov qword [rsp + 0x30], r14
lea rcx, [rbp + 0xe0]
mov dword [rsp + 0x28], 0x100080
xor r9d, r9d
mov r8d, esi
mov dword [rsp + 0x20], 3
add byte [rdx - 0x80000000], bh
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, rdi
je 0x14000165c
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r15d, eax
cmp eax, 0xffffffff
je 0x140001650
xor r9d, r9d
mov qword [rsp + 0x28], r14
xor edx, edx
mov dword [rsp + 0x20], r14d
mov rcx, rbx
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r14, rax
xor eax, eax
test r14, r14
je 0x140001650
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea edx, [rax + 4]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rcx, r14
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r14d, r14d
test rsi, rsi
jne 0x140001668
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, rdi
mov rsi, r14
test r14, r14
je 0x14000150f
mov r8d, r15d
mov rcx, rsi
call fcn.140006a20
test rsi, rsi
je 0x140001681
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp rbx, rdi
je 0x14000168f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp - 0x80]
mov r13d, 0x40
sub eax, dword [rsp + 0x48]
mov ecx, r13d
lea eax, [rax + rax*4]
add eax, eax
movsxd rdx, eax
lea rdx, [rdx*8 - 0xa0]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x70], rax
test rax, rax
je 0x14000150f
mov ebx, 0x118
mov ecx, r13d
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x58], rax
mov r13, rax
test rax, rax
jne 0x1400016e8
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140001712
mov rdx, rbx
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
xor ebx, ebx
mov qword [rsp + 0x68], rax
mov r14, rax
test rax, rax
jne 0x14000178d
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor r14d, r14d
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_LocalFree]
test r13, r13
je 0x14000172b
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [0x14002bc40]
test rcx, rcx
je 0x14000173d
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [0x14002bc48]
test rcx, rcx
je 0x14000174f
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x140001762
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [rbp - 0x78]
test rax, rax
je 0x140001774
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [0x14002bbf8], r14d
je 0x140001f7d
lea rcx, [0x14000a8c0]
mov edx, 0x118
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp - 0x78], rax
test rax, rax
je 0x140001709
cmp dword [0x14002bbf8], ebx
je 0x1400017c7
cmp dword [0x14002bc00], ebx
jne 0x1400017c7
lea rcx, [0x14000a768]
call qword [sym.imp.msvcrt.dll_printf]
mov r15, qword [rbp - 0x78]
lea rdi, [0x14000f070]
mov esi, ebx
mov ecx, r12d
imul rdx, rcx, 0x70
lea rbx, [rcx*8]
add rdx, rdi
lea r8, [r14 + rcx*8]
mov qword [r15 + rcx*8], rdx
add rbx, r13
mov rcx, rbx
call fcn.1400050d0
mov rax, qword [rbx]
inc r12d
add esi, dword [rax]
cmp r12d, 0xd
jb 0x1400017d4
mov r15d, dword [rbp - 0x80]
xor ebx, ebx
cmp dword [0x14002bbf8], ebx
mov dword [rsp + 0x4c], esi
mov esi, dword [rsp + 0x48]
lea rdi, [rbx - 1]
mov dword [rsp + 0x44], r12d
je 0x140001850
cmp dword [0x14002bc00], ebx
jne 0x14000183b
lea rcx, [0x14000a798]
call qword [sym.imp.msvcrt.dll_printf]
cmp dword [0x14002bbf8], ebx
je 0x140001850
lea rcx, [0x14000a7c8]
call qword [sym.imp.msvcrt.dll_printf]
invalid
mov eax, dword [rax]
invalid
lea ecx, [rsi + 2]
mov dword [rbp - 0x68], ecx
cmp ecx, r15d
jae 0x140001d73
mov eax, ecx
mov rcx, qword [rbp - 0x60]
lea r14, [rcx + rax*8]
mov qword [rbp - 0x50], r14
mov r9, qword [r14]
mov rax, rdi
inc rax
cmp byte [r9 + rax], bl
jne 0x140001873
mov r15d, 1
add eax, r15d
cmp eax, 0x104
ja 0x140001eeb
lea edx, [rax + rax]
mov dword [rsp + 0x20], eax
xor r8d, r8d
lea rcx, [rbp + 0x500]
call qword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeN]
mov qword [rsp + 0x30], rbx
lea rcx, [rbp + 0x500]
mov dword [rsp + 0x28], 0x100080
xor r9d, r9d
mov r8d, r15d
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp - 0x58], rax
mov rsi, rax
cmp rax, rdi
je 0x14000193c
mov qword [rsp + 0x28], rbx
lea r8d, [r15 + 1]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbx, rax
xor eax, eax
test rbx, rbx
je 0x14000192f
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea edx, [rax + 4]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rcx, rbx
mov r15, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
test r15, r15
push qword [rbp + 0x19]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x58], rdi
mov r15, rbx
test rbx, rbx
je 0x140001ef2
mov rax, qword [r14]
lea rdx, [0x14000a7f0]
mov edx, dword [0x14040c379]
mov edx, dword [rdx + rax*4 - 0xc]
test edx, edx
jne 0x140001d7d
cmp eax, 0x401
jne 0x140001d67
mov eax, edx
ret
add cl, byte [rbx + 0x40a60c15]
add byte [rbx - 0x7a0b7dac], cl
sal byte [rcx + rdi*2 - 0x75], cl
mov eax, esi