Function at 0x140019c10
Capabilities:
Get file size
Parse pe header
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x140069798]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov rbx, r8
mov r13, rdx
mov qword [rsp + 0x70], rdx
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x60]
call fcn.1400267c0
mov r9d, 0x104
lea r8, [rbp - 0x60]
xor edx, edx
mov rcx, rbx
call sub.KERNEL32.dll_K32GetModuleFileNameExW
xor r15d, r15d
test eax, eax
jne 0x140019c84
mov qword [r13], r15
mov qword [r13 + 8], r15
jmp 0x140019eab
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x78], r15
mov qword [rbp - 0x70], 7
mov word [rsp + 0x78], r15w
lea rax, [rbp - 0x60]
mov r14, 0xffffffffffffffff
mov r8, r14
nop dword [rax]
inc r8
cmp word [rax + r8*2], r15w
jne 0x140019cb0
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x78]
call fcn.1400022a0
nop
mov rax, qword [0x14006b468]
mov r10, qword [rax + 8]
mov rsi, rax
mov edi, 1
mov r12, qword [rbp - 0x70]
mov rbx, qword [rbp - 0x78]
mov r11, qword [rsp + 0x78]
cmp byte [r10 + 0x19], 0
jne 0x140019d9c
nop dword [rax]
nop dword [rax + rax]
lea r9, [r10 + 0x20]
lea rax, [rsp + 0x78]
cmp r12, 8
cmovae rax, r11
mov r11, qword [r9 + 0x10]
cmp qword [r9 + 0x18], 8
jb 0x140019d1f
mov r9, qword [r9]
mov rcx, r11
cmp rbx, r11
cmovb rcx, rbx
test rcx, rcx
je 0x140019d69
movzx edx, word [r9]
movzx r8d, word [rax]
cmp dx, r8w
jb 0x140019d6e
sub r9, rax
cmp dx, r8w
ja 0x140019d65
cmp rcx, rdi
je 0x140019d69
dec rcx
add rax, 2
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jae 0x140019d43
mov eax, r14d
jmp 0x140019d79
mov eax, edi
jmp 0x140019d79
cmp r11, rbx
jae 0x140019d73
mov eax, r14d
jmp 0x140019d79
mov eax, r15d
seta al
shr eax, 0x1f
test al, al
je 0x140019d86
mov r10, qword [r10 + 0x10]
jmp 0x140019d8c
mov rsi, r10
mov r10, qword [r10]
cmp byte [r10 + 0x19], 0
mov r11, qword [rsp + 0x78]
je 0x140019d00
cmp byte [rsi + 0x19], 0
jne 0x140019ed8
lea rax, [rsi + 0x20]
mov r10, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x140019db8
mov rax, qword [rax]
lea r9, [rsp + 0x78]
cmp r12, 8
cmovae r9, r11
mov rcx, rbx
cmp r10, rbx
cmovb rcx, r10
test rcx, rcx
je 0x140019e0b
movzx edx, word [r9]
movzx r8d, word [rax]
cmp dx, r8w
jb 0x140019e06
sub r9, rax
cmp dx, r8w
ja 0x140019e1c
cmp rcx, rdi
je 0x140019e0b
dec rcx
add rax, 2
movzx edx, word [rax + r9]
movzx r8d, word [rax]
cmp dx, r8w
jae 0x140019de9
mov edi, r14d
jmp 0x140019e1c
cmp rbx, r10
jae 0x140019e15
mov edi, r14d
jmp 0x140019e1c
mov edi, r15d
seta dil
shr edi, 0x1f
test dil, dil
jne 0x140019ed8
cmp rsi, qword [0x14006b468]
je 0x140019ed8
lea rdx, [rsp + 0x78]
lea rcx, [0x14006b468]
call fcn.140016140
mov qword [r13], r15
mov qword [r13 + 8], r15
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x140019e5b
lock inc dword [rcx + 8]
mov rcx, qword [rax]
mov qword [r13], rcx
mov rax, qword [rax + 8]
mov qword [r13 + 8], rax
mov rdx, qword [rbp - 0x70]
cmp rdx, 8
jb 0x140019eab
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019ea6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a29c
call fcn.140024eac
mov rax, r13
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.140024fc0
mov rbx, qword [rsp + 0x300]
add rsp, 0x2c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, [rsp + 0x78]
cmp r12, 8
cmovae rcx, r11
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x40], rax
cmp rax, 0xffffffffffffffff
je 0x140019f41
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r12d, eax
mov dword [rsp + 0x48], eax
mov rcx, rbx
cmp eax, 0xffffffff
jne 0x140019fc8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, r14
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov qword [r13], r15
mov qword [r13 + 8], r15
test rdi, rdi
je 0x140019f61
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test rsi, rsi
je 0x140019f6f
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rbx, 0xffffffffffffffff
je 0x140019f7f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 8
jb 0x140019eab
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019ea6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a29c
jmp 0x140019ea6
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rsi, rax
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x140019fff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, r14
jmp 0x140019f46
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
mov qword [rsp + 0x58], rax
test rax, rax
jne 0x14001a041
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, r15
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, r14
jmp 0x140019f4b
test r12d, r12d
je 0x140019f4b
mov eax, 0x5a4d
cmp word [rdi], ax
je 0x14001a07c
mov qword [r13], r15
mov qword [r13 + 8], r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140019e6a
movsxd rax, dword [rdi + 0x3c]
lea rcx, [rax + rdi]
mov qword [rsp + 0x70], rcx
cmp dword [rax + rdi], 0x4550
je 0x14001a0ba
mov qword [r13], r15
mov qword [r13 + 8], r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140019e6a
lea rcx, [rsp + 0x60]
call fcn.140014330
nop
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx + 0x90]
mov r12, qword [rsp + 0x60]
mov dword [r12], eax
shr rax, 0x20
mov dword [r12 + 4], eax
mov eax, ecx
sub eax, dword [rsp + 0x58]
add eax, 0x90
mov dword [r12 + 8], eax
cmp dword [r12 + 4], 0
ja 0x14001a156
mov qword [r13], r15
mov qword [r13 + 8], r15
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14001a05c
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14001a142
mov rbx, qword [rsp + 0x68]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], r14d
cmp r14d, 1
jne 0x14001a142
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
jmp 0x14001a05c
mov r10d, dword [r12]
lea rax, [rcx + 0x108]
mov qword [rsp + 0x70], rax
mov r9d, r15d
movzx r11d, word [rcx + 6]
test r11, r11
je 0x14001a0fb
mov r8, r15
lea rdx, [rax + 0x10]
nop word [rax + rax]
mov ecx, dword [rdx - 4]
cmp r10d, ecx
jb 0x14001a18f
add ecx, dword [rdx]
cmp r10d, ecx
jb 0x14001a1a4
inc r9d
inc r8
add rdx, 0x28
cmp r8, r11
jge 0x14001a0fb
jmp 0x14001a180
movsxd rax, r9d
lea rcx, [rax + rax*4]
mov rdx, qword [rsp + 0x70]
mov eax, dword [rdx + rcx*8 + 0x14]
sub eax, dword [rdx + rcx*8 + 0xc]
add eax, r10d
mov dword [rsp + 0x70], eax
je 0x14001a0fb
cmp eax, dword [rsp + 0x48]
ja 0x14001a0fb
mov ecx, dword [r12 + 4]
call fcn.1400252a4
mov qword [r12 + 0x10], rax
mov r8d, dword [r12 + 4]
xor edx, edx
mov rcx, rax
call fcn.1400267c0
mov r8d, dword [r12 + 4]
mov edx, dword [rsp + 0x70]
add rdx, rdi
mov rcx, qword [r12 + 0x10]
call fcn.140026110
lea rdx, [rsp + 0x78]
lea rcx, [0x14006b468]
call fcn.140016140
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14001a23b
lock inc dword [rcx + 8]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x68]
mov r12, qword [rsp + 0x60]
mov qword [rax], r12
mov r15, qword [rax + 8]
mov qword [rax + 8], rcx
test r15, r15
je 0x14001a28f
mov eax, r14d
lock xadd dword [r15 + 8], eax
cmp eax, 1
jne 0x14001a276
mov rax, qword [r15]
mov rcx, r15
call qword [rax]
lock xadd dword [r15 + 0xc], r14d
cmp r14d, 1
jne 0x14001a276
mov rax, qword [r15]
mov rcx, r15
call qword [rax + VariantCopy]
mov r12, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov qword [r13], r12
mov qword [r13 + 8], rcx
jmp 0x14001a05c
call fcn.14002b74c
int3