Function at 0x1401b9c10
Capabilities:
Read file via mapping

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x90
lea rbp, [rsp + 0x80]
movaps xmmword [rbp], xmm6
mov rax, r8
mov rdi, rcx
mov dword [rbp - 0x40], 0
xorps xmm6, xmm6
movups xmmword [rbp - 0x38], xmm6
mov dword [rbp - 0x28], 7
mov qword [rbp - 0x24], 0
mov word [rbp - 0x1c], 0
mov byte [rbp - 0x20], 1
lea r8, [rbp - 0x40]
mov rcx, rdx
mov rdx, rax
call fcn.1401d6af0
mov rsi, rdx
test rax, rax
je 0x1401b9cd6
mov eax, esi
and eax, 3
cmp eax, 1
jne 0x1401b9cca
mov rax, rsi
dec rsi
mov rbx, qword [rax - 1]
mov r14, qword [rax + 7]
mov rax, qword [r14]
test rax, rax
je 0x1401b9c96
mov rcx, rbx
call rax
cmp qword [r14 + 8], 0
je 0x1401b9cb9
cmp qword [r14 + 0x10], 0x11
jb 0x1401b9ca8
mov rbx, qword [rbx - 8]
mov rcx, qword [0x14031a288]
xor edx, edx
mov r8, rbx
call fcn.1401fb9c4
mov rcx, qword [0x14031a288]
xor edx, edx
mov r8, rsi
call fcn.1401fb9c4
mov qword [rdi], 0
jmp 0x1401b9e9a
movaps xmmword [rbp - 0x20], xmm6
movaps xmmword [rbp - 0x30], xmm6
movaps xmmword [rbp - 0x40], xmm6
mov dword [rbp - 0x10], 0
lea rdx, [rbp - 0x40]
mov rcx, rsi
call sub.kernel32.dll_GetFileInformationByHandle
test eax, eax
je 0x1401b9d7f
test byte [rbp - 0x3f], 4
je 0x1401b9d26
mov qword [rbp - 0x48], 0
lea r8, [rbp - 0x48]
mov rcx, rsi
mov edx, 9
mov r9d, 8
call sub.kernel32.dll_GetFileInformationByHandleEx
test eax, eax
je 0x1401b9d7f
mov r12d, dword [rbp - 0x20]
mov r15d, dword [rbp - 0x1c]
test rsi, rsi
je 0x1401b9e03
mov qword [rbp - 0x40], 0
call sub.kernel32.dll_GetCurrentProcess
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rbp - 0x40]
mov rcx, rax
mov rdx, rsi
mov r8, rax
call sub.kernel32.dll_DuplicateHandle
test eax, eax
je 0x1401b9e86
mov rbx, qword [rbp - 0x40]
jmp 0x1401b9e05
call sub.kernel32.dll_GetLastError
mov cl, 1
test cl, cl
jne 0x1401b9ddf
shl rax, 0x20
or rax, 2
lea rbx, [rax - 1]
mov r14, qword [rax - 1]
mov r15, qword [rax + 7]
mov rax, qword [r15]
test rax, rax
je 0x1401b9dab
mov rcx, r14
call rax
cmp qword [r15 + 8], 0
je 0x1401b9dce
cmp qword [r15 + 0x10], 0x11
jb 0x1401b9dbd
mov r14, qword [r14 - 8]
mov rcx, qword [0x14031a288]
xor edx, edx
mov r8, r14
call fcn.1401fb9c4
mov rcx, qword [0x14031a288]
xor edx, edx
mov r8, rbx
call fcn.1401fb9c4
mov qword [rdi], 0
mov rcx, rsi
movaps xmm6, xmmword [rbp]
add rsp, 0x90
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
jmp sub.kernel32.dll_CloseHandle
xor ebx, ebx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rbx
xor edx, edx
mov r8d, 2
xor r9d, r9d
call sub.kernel32.dll_CreateFileMappingA
test rax, rax
je 0x1401b9e75
mov r14, rax
shl r12, 0x20
or r12, r15
mov qword [rsp + 0x20], r12
mov rcx, rax
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call sub.kernel32.dll_MapViewOfFile
mov r15, rax
mov rcx, r14
call sub.kernel32.dll_CloseHandle
test r15, r15
je 0x1401b9e75
mov qword [rdi + 8], rbx
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], r12
mov qword [rdi], 1
jmp 0x1401b9e92
mov qword [rdi], 0
mov rcx, rbx
call sub.kernel32.dll_CloseHandle
jmp 0x1401b9e92
call sub.kernel32.dll_GetLastError
mov qword [rdi], 0
mov rcx, rsi
call sub.kernel32.dll_CloseHandle
movaps xmm6, xmmword [rbp]
add rsp, 0x90
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret