Function at 0x1800024d4
Capabilities:
Get file size
Parse pe header
Read file via mapping

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov dword [rax + 0x20], r9d
mov dword [rax + 0x18], r8d
mov dword [rax + 0x10], edx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov eax, dword [0x18000fe94]
xor edi, edi
mov r12, qword [0x18000fe88]
xor edx, edx
mov r14d, dword [0x18000fe90]
mov rbx, rcx
mov r13d, dword [0x18000fec8]
mov esi, edi
mov dword [rsp + 0xb0], eax
mov rax, qword [0x18000fe80]
mov qword [rsp + 0x48], rax
mov eax, dword [0x18000fe98]
mov dword [rsp + 0xd0], eax
mov eax, dword [0x18000fe9c]
mov dword [rsp + 0xa8], eax
mov dword [rsp + 0xc8], r14d
mov qword [rsp + 0x50], r12
mov dword [rsp + 0x40], r13d
call qword [sym.imp.KERNEL32.dll_GetFileSize]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
xor edx, edx
mov dword [rsp + 0x20], edi
lea r8d, [rdi + 2]
mov rcx, rbx
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rsp + 0x58], rax
mov r15, rax
test rax, rax
je 0x180002805
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
lea edx, [rdi + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
xor r8d, r8d
mov rdi, rax
test rax, rax
je 0x180002805
mov eax, 0x5a4d
cmp word [rdi], ax
jne 0x1800027fc
movsxd rax, dword [rdi + 0x3c]
test eax, eax
jle 0x1800027fc
cmp eax, ebp
jge 0x1800027fc
lea rcx, [rdi + rax]
mov eax, 0x454e
movzx edx, word [rcx]
sub edx, eax
je 0x18000261f
cmp edx, 2
jne 0x1800027fc
cmp dword [rcx], 0x4550
je 0x1800025fa
mov rbx, r8
jmp 0x180002616
mov eax, pe_nt_image_headers64
cmp word [rcx + 0x14], ax
jb 0x1800025f5
mov edx, dword [rcx + 0x98]
mov rcx, rdi
call fcn.180002278
mov rbx, rax
lea rbp, [0x1800022fc]
jmp 0x180002654
cmp word [rcx], ax
je 0x180002629
mov rbx, r8
jmp 0x18000264d
mov al, byte [rcx + 0x36]
sub al, 2
test al, 0xfd
jne 0x180002624
mov eax, 0x300
cmp word [rcx + 0x3e], ax
jb 0x180002624
movzx eax, word [rcx + 0x24]
cmp ax, word [rcx + 0x26]
je 0x180002624
movzx ebx, ax
add rbx, rcx
lea rbp, [0x1800023f8]
test rbx, rbx
je 0x1800027fc
test r12, r12
jne 0x18000268a
lea rax, [rsp + 0xb8]
mov r8d, 0x67932
lea r9d, [r12 + 0xe]
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov rcx, rdi
call rbp
mov rsi, rax
jmp 0x1800027fc
test r14d, r14d
je 0x1800027fc
mov r15d, dword [rsp + 0xa8]
mov r12d, dword [rsp + 0xd0]
lea rax, [rsp + 0xb8]
mov r9d, 0xe
mov qword [rsp + 0x20], rax
mov r8d, r15d
mov rdx, rbx
mov rcx, rdi
call rbp
mov r14, rax
xor eax, eax
test r14, r14
je 0x1800027f7
cmp word [r14], ax
jne 0x1800027f7
lea r10d, [rax + 1]
cmp word [r14 + 2], r10w
jne 0x1800027f7
mov edx, dword [rsp + 0xb0]
movzx ecx, r13w
movzx eax, r12w
mov r8d, ecx
mov dword [rsp + 0xc0], ecx
mov r9d, eax
mov dword [rsp + 0x20], edx
mov rcx, r14
mov edx, r10d
mov dword [rsp + 0xd8], eax
call qword [0x18000d600]
mov dword [rsp + 0xa8], eax
mov r9d, 3
mov r8d, eax
mov rdx, rbx
lea rax, [rsp + 0xb8]
neg r8d
mov rcx, rdi
mov qword [rsp + 0x20], rax
call rbp
mov rcx, rax
test rax, rax
je 0x1800027f7
cmp dword [rax], 0x28
je 0x18000275d
cmp dword [rax], 0xc
jne 0x1800027f7
mov r8, qword [rsp + 0x48]
test r8, r8
je 0x180002774
mov edx, dword [rsp + 0xa8]
mov eax, esi
mov dword [r8 + rax*4], edx
mov eax, dword [rsp + 0xb0]
mov r9d, 0x30000
mov edx, dword [rsp + 0xb8]
mov r8d, 1
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0xd8]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0xc0]
mov dword [rsp + 0x20], eax
call qword [0x18000d5f8]
mov rdx, qword [rsp + 0x50]
mov r10d, 1
mov ecx, esi
add esi, r10d
mov qword [rdx + rcx*8], rax
movsxd rax, r13d
shr rax, 0x10
test ax, ax
je 0x1800027e2
movzx r13d, ax
mov eax, r12d
shr rax, 0x10
movzx r12d, ax
jmp 0x1800026e8
mov r13d, dword [rsp + 0x40]
add r15d, r10d
cmp esi, dword [rsp + 0xc8]
jb 0x18000269b
mov r15, qword [rsp + 0x58]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp r15, 0xffffffffffffffff
je 0x180002814
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret