Function at 0x18000e3e0
Capabilities:
Get file size
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov rsi, rdx
mov rbx, rcx
xor ebp, ebp
mov qword [rsp + 0x40], rbp
mov dword [rsp + 0x34], ebp
cmp rdx, 0xffffffffffffffff
jne 0x18000e416
lea ecx, [rdx + 7]
jmp 0x18000ed24
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rbx + 0x408], eax
cmp eax, 0xffffffff
je 0x18000ed2a
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], ebp
xor r9d, r9d
mov edi, 2
mov r8d, edi
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rbx + 0x10], rax
test rax, rax
je 0x18000ed2a
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov r9, rax
mov qword [rbx + 0x18], rax
test rax, rax
je 0x18000ed2a
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x18000ed1f
mov edx, dword [r9 + 0x3c]
mov dword [rbx + 0x3fc], edx
mov dword [rbx + 0x3f0], ebp
mov eax, dword [r9 + 0x3c]
add eax, 7
and eax, 0xfffffff8
mov dword [rbx + 0x3f4], eax
mov eax, dword [rbx + 0x408]
cmp edx, eax
ja 0x18000ed1f
lea rcx, [rdx + 0x108]
cmp rcx, rax
ja 0x18000ed1f
movups xmm0, xmmword [r9]
movups xmmword [rbx + 0x28], xmm0
movups xmm1, xmmword [r9 + 0x10]
movups xmmword [rbx + 0x38], xmm1
movups xmm0, xmmword [r9 + 0x20]
movups xmmword [rbx + 0x48], xmm0
movups xmm1, xmmword [r9 + 0x30]
movups xmmword [rbx + 0x58], xmm1
lea rcx, [rbx + 0x68]
lea rax, [rdx + r9]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdi, 1
jne 0x18000e500
mov rax, qword [rax]
mov qword [rcx], rax
cmp dword [rbx + 0x68], 0x4550
je 0x18000e56b
mov ecx, 0xbf
jmp 0x18000ed24
movzx eax, word [rbx + 0x7c]
test ax, ax
je 0x18000e722
lea ecx, [rax + 0x18]
add ecx, edx
mov dword [rbx + 0x400], ecx
movzx eax, word [rbx + 0x6e]
cmp eax, 0x10
ja 0x18000e722
lea r8, [rax + rax*4]
shl r8, 3
mov edx, ecx
add rdx, r9
lea rcx, [rbx + 0x170]
call fcn.180013a40
mov edi, ebp
mov r15d, ebp
mov dword [rsp + 0xf8], ebp
mov dword [rsp + 0xf0], ebp
movzx eax, word [rbx + 0x6e]
cmp bp, ax
jae 0x18000e661
lea rdx, [rbx + 0x184]
mov r9d, eax
lea r10, [0x18002d840]
nop word [rax + rax]
mov rcx, rbp
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdx + rcx - 0x14]
inc rcx
cmp al, byte [r10 + rcx - 1]
jne 0x18000e64f
cmp rcx, 8
jne 0x18000e5f0
mov ecx, dword [rdx]
mov rax, qword [rbx + 0x18]
movups xmm0, xmmword [rcx + rax]
movaps xmmword [rsp + 0x60], xmm0
movups xmm2, xmmword [rcx + rax + 0x20]
mov edi, dword [rcx + rax + 0x10]
psrldq xmm2, 0xc
movd r8d, xmm2
test r8d, r8d
je 0x18000e63c
lea eax, [rcx + 0x40]
mov dword [rbx + 0x3f0], eax
mov dword [rbx + 0x3f4], r8d
mov r15d, dword [rdx - 8]
mov r8d, dword [rdx - 4]
add r8d, r15d
mov dword [rsp + 0xf0], r8d
add rdx, 0x28
sub r9, 1
jne 0x18000e5e0
mov dword [rsp + 0xf8], r15d
mov edx, dword [rbx + 0xf8]
mov rcx, rbx
call fcn.180010970
mov r13, rax
mov edx, edi
mov rcx, rbx
call fcn.180010970
mov r14, rax
test rax, rax
cmove r14, r13
mov qword [rsp + 0x38], r14
test r13, r13
je 0x18000e722
test r14, r14
je 0x18000e722
xor r8d, r8d
lea rcx, [rbp*4]
add rcx, rbp
cmp dword [r13 + rcx*4], r8d
jne 0x18000e6b9
cmp dword [r13 + rcx*4 + 0x10], r8d
je 0x18000e6bd
inc ebp
jmp 0x18000e6a0
mov dword [rsp + 0xe8], ebp
lea r12, [rbx + 0x428]
mov qword [r12], r8
mov dword [rsp + 0x30], r8d
test ebp, ebp
je 0x18000eb7c
nop dword [rax]
mov r9d, dword [r13 + 0xc]
test r9, r9
je 0x18000e722
mov edx, r8d
movzx edi, word [rbx + 0x6e]
test edi, edi
je 0x18000e722
mov eax, edx
lea rcx, [rax + rax*4]
lea r8, [rbx + rcx*8]
mov ecx, dword [r8 + 0x17c]
mov r11d, dword [r8 + 0x180]
add r11d, ecx
cmp r9, rcx
jb 0x18000e71c
mov eax, r11d
cmp r9, rax
jb 0x18000e72c
inc edx
cmp edx, edi
jb 0x18000e6f4
mov ecx, 0xc0
jmp 0x18000ed24
mov esi, dword [r8 + 0x184]
sub rsi, rcx
add rsi, qword [rbx + 0x18]
add rsi, r9
je 0x18000e722
mov ecx, 0x38
call fcn.1800125f8
mov rdi, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x18000ed02
xor eax, eax
mov qword [rdi], rax
mov dword [rdi + 8], eax
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], rax
mov qword [rdi + 0x20], rax
mov qword [rdi + 0x30], rax
mov qword [rdi + 0x28], rax
test rdi, rdi
je 0x18000ed02
mov qword [r12], rdi
mov r12, rdi
mov qword [rsp + 0x48], rdi
inc dword [rbx + 0x430]
mov rcx, rsi
call fcn.180010d80
mov qword [rdi + 0x30], rax
test rax, rax
je 0x18000ed2a
mov eax, dword [r13]
mov dword [rdi + 0x1c], eax
mov eax, dword [r13 + 0x10]
mov dword [rdi + 0x20], eax
mov eax, dword [r13 + 8]
mov dword [rdi + 0x24], eax
xor r8d, r8d
mov qword [rdi + 0x10], r8
mov dword [rdi + 0x18], r8d
mov dword [rdi + 8], r8d
mov eax, dword [r13 + 0x10]
cmp eax, r15d
jb 0x18000e7ec
cmp eax, dword [rsp + 0xf0]
jae 0x18000e7ec
mov qword [rdi + 0x28], r8
mov dword [rdi + 8], 1
jmp 0x18000eb66
mov r9d, dword [r14 + 0xc]
test r9, r9
je 0x18000e722
mov edx, r8d
movzx esi, word [rbx + 0x6e]
test esi, esi
je 0x18000e722
nop dword [rax + rax]
mov eax, edx
lea rcx, [rax + rax*4]
lea r8, [rbx + rcx*8]
mov ecx, dword [r8 + 0x17c]
mov r11d, dword [r8 + 0x180]
add r11d, ecx
mov r10d, ecx
cmp r9, rcx
jb 0x18000e83b
mov eax, r11d
cmp r9, rax
jb 0x18000e847
inc edx
cmp edx, esi
jae 0x18000e722
jmp 0x18000e810
mov ecx, dword [r8 + 0x184]
sub rcx, r10
add rcx, qword [rbx + 0x18]
add rcx, r9
je 0x18000e722
call fcn.180010d80
mov qword [rdi + 0x28], rax
test rax, rax
je 0x18000ed2a
mov eax, dword [r13]
test eax, eax
jne 0x18000e87c
mov eax, dword [r13 + 0x10]
mov r9d, eax
xor r8d, r8d
test eax, eax
je 0x18000e8c6
mov edx, r8d
movzx esi, word [rbx + 0x6e]
test esi, esi
je 0x18000e8c6
mov eax, edx
lea rcx, [rax + rax*4]
lea r8, [rbx + rcx*8]
mov ecx, dword [r8 + 0x17c]
mov r11d, dword [r8 + 0x180]
add r11d, ecx
cmp r9, rcx
jb 0x18000e8bd
mov eax, r11d
cmp r9, rax
jb 0x18000e9b0
inc edx
cmp edx, esi
jb 0x18000e891
xor r8d, r8d
mov r12, r8
mov eax, dword [r14]
test eax, eax
jne 0x18000e8d4
mov eax, dword [r14 + 0x10]
mov r9d, eax
test eax, eax
je 0x18000e91b
mov edx, r8d
movzx esi, word [rbx + 0x6e]
test esi, esi
je 0x18000e91b
mov eax, edx
lea rcx, [rax + rax*4]
lea r8, [rbx + rcx*8]
mov ecx, dword [r8 + 0x17c]
mov r11d, dword [r8 + 0x180]
add r11d, ecx
cmp r9, rcx
jb 0x18000e912
mov eax, r11d
cmp r9, rax
jb 0x18000e9c9
inc edx
cmp edx, esi
jb 0x18000e8e6
xor r8d, r8d
mov r14, r8
mov r15d, r8d
test r12, r12
je 0x18000eb4b
cmp qword [r12], 0
je 0x18000eb4b
inc r15d
cmp qword [r12 + r15*8], 0
jne 0x18000e935
test r15d, r15d
je 0x18000eb4b
mov dword [rdi + 0x18], r15d
mov ebp, r15d
mov qword [rsp + 0x50], rbp
mov eax, 0x20
mul rbp
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
add rax, 8
cmovb rax, rcx
mov rcx, rax
call fcn.180012b1c
mov qword [rsp + 0x58], rax
test rax, rax
je 0x18000e9e2
mov qword [rax], rbp
lea rsi, [rax + 8]
lea rax, [0x18000e2f0]
mov qword [rsp + 0x20], rax
lea r9, [0x18000e2d0]
mov r8d, ebp
mov edx, 0x20
mov rcx, rsi
call fcn.180012b24
xor r8d, r8d
jmp 0x18000e9e8
mov r12d, dword [r8 + 0x184]
sub r12, rcx
add r12, qword [rbx + 0x18]
add r12, r9
xor r8d, r8d
jmp 0x18000e8c9
mov r14d, dword [r8 + 0x184]
sub r14, rcx
add r14, r9
add r14, qword [rbx + 0x18]
xor r8d, r8d
jmp 0x18000e91e
xor r8d, r8d
mov esi, r8d
mov qword [rdi + 0x10], rsi
test rsi, rsi
je 0x18000ed02
mov ebp, r8d
test r15d, r15d
je 0x18000eb44
lea rdi, [rsi + 4]
sub r12, r14
nop dword [rax + rax]
mov qword [rdi], 0
mov word [rdi - 4], r8w
mov qword [rdi + 0x14], r8
mov qword [rdi + 0xc], r8
mov r9, qword [r12 + r14]
test r9, r9
jns 0x18000ea3b
movzx eax, r9w
mov dword [rdi], eax
mov dword [rdi + 4], eax
jmp 0x18000eb2b
je 0x18000eab3
mov edx, r8d
movzx r11d, word [rbx + 0x6e]
test r11d, r11d
je 0x18000eab3
nop word [rax + rax]
mov eax, edx
lea rcx, [rax + rax*4]
lea r8, [rbx + rcx*8]
mov ecx, dword [r8 + 0x17c]
mov r10d, ecx
cmp r9, rcx
jb 0x18000ea77
mov eax, dword [r8 + 0x180]
add eax, ecx
cmp r9, rax
jb 0x18000ea80
inc edx
cmp edx, r11d
jae 0x18000eab0
jmp 0x18000ea50
mov ecx, dword [r8 + 0x184]
sub rcx, r10
add rcx, qword [rbx + 0x18]
add rcx, r9
je 0x18000eab0
movzx eax, word [rcx]
mov word [rdi - 4], ax
add rcx, 2
call fcn.180010d80
mov qword [rdi + 0x14], rax
test rax, rax
je 0x18000ed2a
xor r8d, r8d
mov r9, qword [r14]
test r9, r9
jns 0x18000eac6
movzx eax, r9w
mov dword [rdi], eax
mov dword [rdi + 4], eax
jmp 0x18000eb2b
je 0x18000eb2b
mov eax, r8d
movzx r11d, word [rbx + 0x6e]
test r11d, r11d
je 0x18000eb2b
mov ecx, eax
lea rdx, [rcx + rcx*4]
lea r8, [rbx + rdx*8]
mov edx, dword [r8 + 0x17c]
cmp r9, rdx
jb 0x18000eaf9
mov ecx, dword [r8 + 0x180]
add ecx, edx
cmp r9, rcx
jb 0x18000eb02
inc eax
cmp eax, r11d
jae 0x18000eb2b
jmp 0x18000ead5
mov ecx, dword [r8 + 0x184]
sub rcx, rdx
add rcx, qword [rbx + 0x18]
add rcx, r9
je 0x18000eb2b
add rcx, 2
call fcn.180010d80
mov qword [rdi + 0xc], rax
test rax, rax
je 0x18000ed2a
inc ebp
add r14, 8
add rdi, 0x20
cmp ebp, r15d
mov r8d, 0
jb 0x18000ea10
mov ebp, dword [rsp + 0xe8]
mov r14, qword [rsp + 0x38]
add r14, 0x14
mov qword [rsp + 0x38], r14
mov r15d, dword [rsp + 0xf8]
mov r12, qword [rsp + 0x48]
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
add r13, 0x14
cmp eax, ebp
jb 0x18000e6e0
mov dword [rbx + 0x404], r8d
mov r10d, r8d
movzx edi, word [rbx + 0x6e]
cmp r8w, di
jae 0x18000ecce
mov r9d, r8d
lea rsi, [0x18002d848]
mov ebp, 0xffff
mov eax, r10d
lea rcx, [rax + rax*4]
lea r11, [rbx + rcx*8]
mov eax, dword [r11 + 0x184]
add eax, dword [r11 + 0x180]
cmp eax, r9d
cmova r9d, eax
mov dword [rbx + 0x404], r9d
mov rcx, r8
nop dword [rax]
movzx eax, byte [r11 + rcx + 0x170]
inc rcx
cmp al, byte [rsi + rcx - 1]
jne 0x18000ecbf
cmp rcx, 8
jne 0x18000ebd0
mov r8d, dword [r11 + 0x184]
mov rdx, qword [rbx + 0x18]
add rdx, r8
movups xmm2, xmmword [rdx]
movaps xmmword [rsp + 0x60], xmm2
movups xmm3, xmmword [rdx + 0x10]
movups xmm4, xmmword [rdx + 0x20]
mov ecx, dword [rdx + 8]
movd eax, xmm2
test ecx, ecx
cmove ecx, eax
mov eax, dword [rsp + 0x6c]
sub eax, ecx
mov dword [rsp + 0x34], eax
mov eax, ecx
add rax, rdx
mov qword [rsp + 0x40], rax
mov ecx, dword [r11 + 0x180]
add ecx, r8d
cmp ecx, r9d
cmova r9d, ecx
mov dword [rbx + 0x404], r9d
add di, bp
mov word [rbx + 0x6e], di
movd dword [rbx + 0xf8], xmm3
movq rax, xmm3
shr rax, 0x20
mov dword [rbx + 0xfc], eax
movdqa xmm0, xmm3
psrldq xmm0, 8
movd dword [rbx + 0x148], xmm0
psrldq xmm3, 8
movq rax, xmm3
shr rax, 0x20
mov dword [rbx + 0x14c], eax
movd dword [rbx + 0x150], xmm4
movdqa xmm0, xmm4
psrldq xmm0, 4
movd dword [rbx + 0x154], xmm0
xor r8d, r8d
mov dword [rbx + 0xc0], r8d
psrldq xmm4, 8
movd dword [rbx + 0xb8], xmm4
mov dword [rbx + 0x434], 1
inc r10d
movzx eax, di
cmp r10d, eax
jb 0x18000eba3
mov ecx, 0x10
call fcn.1800125f8
mov qword [rsp + 0xe8], rax
xor ebp, ebp
test rax, rax
je 0x18000ed09
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
mov ecx, dword [rsp + 0x34]
mov dword [rax + 8], ecx
mov dword [rax + 0xc], ebp
mov qword [rbx + 8], rax
lea eax, [rbp + 1]
jmp 0x18000ed2c
mov ecx, 0xe
jmp 0x18000ed24
mov qword [rbx + 8], rbp
mov ecx, 0xe
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 1
jmp 0x18000ed2c
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0xe0]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret