Function at 0x10010b010
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
movdqu xmm0, xmmword [0x1003478d8]
xor r14d, r14d
or r15, 0xffffffffffffffff
mov ebp, r9d
mov rbx, r15
mov rdi, r14
mov r13, r14
mov r12, r15
movdqu xmmword [rax - 0x40], xmm0
cmp rcx, r14
je 0x10010b369
cmp qword [rsp + 0xd8], r14
je 0x10010b369
cmp dword [0x100349f80], 1
je 0x10010b07c
mov esi, 0x8000ffff
jmp 0x10010b218
xor r9d, r9d
mov qword [rsp + 0x30], r14
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, r14
je 0x10010b343
cmp rax, r15
je 0x10010b343
lea rdx, [rsp + 0xb0]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r15d, eax
cmp eax, 0xffffffff
je 0x10010b343
cmp dword [rsp + 0xb0], r14d
je 0x10010b0e9
mov esi, 0x80070057
jmp 0x10010b218
cmp eax, 0xc800000
ja 0x10010b0df
xor r9d, r9d
mov r8d, ebp
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rsp + 0x50], rax
cmp rax, r14
je 0x10010b343
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
mov rdi, rax
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbp, rax
cmp rax, r14
je 0x10010b343
or rbx, 0xffffffffffffffff
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x58], rax
mov r12, rsi
mov qword [rsp + 0x60], rsi
cmp dword [rsp + 0x70], r14d
jne 0x10010b172
lea rcx, [0x100348450]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [rsp + 0x70], 1
mov rdx, rbp
mov rbp, qword [0x100348570]
lea r8, [rsp + 0x40]
mov rcx, rbp
mov esi, r14d
call fcn.10010b37c
mov r14d, dword [rsp + 0x40]
mov r13b, al
test al, al
jne 0x10010b1c1
lea r8, [rsp + 0x58]
mov edx, r14d
mov rcx, rbp
call fcn.10010b448
mov r12, qword [rsp + 0x60]
mov esi, eax
test eax, eax
js 0x10010b2c4
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x48], rax
xor ebp, ebp
test r13b, r13b
mov r13, qword [rsp + 0x48]
sete bpl
test esi, esi
jns 0x10010b208
mov rcx, qword [0x100331948]
lea rax, [0x100331948]
cmp rcx, rax
je 0x10010b204
test byte [rcx + 0x3c], 2
je 0x10010b204
mov rcx, qword [rcx + 0x30]
lea r8, [0x100020598]
mov edx, 0x13
mov r9d, esi
call fcn.100050618
test esi, esi
js 0x10010b215
test ebp, ebp
jne 0x10010b2dd
mov esi, 0x800700b7
xor r14d, r14d
mov rcx, qword [0x100331948]
lea rax, [0x100331948]
cmp rcx, rax
je 0x10010b249
test byte [rcx + 0x3c], 2
je 0x10010b249
mov rcx, qword [rcx + 0x30]
lea r8, [0x100020598]
mov edx, 0x23
mov r9d, esi
call fcn.100050618
cmp dword [rsp + 0x70], r14d
je 0x10010b25d
lea rcx, [0x100348450]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp r12, r14
je 0x10010b271
cmp r12, 0xffffffffffffffff
je 0x10010b271
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp r13, r14
je 0x10010b27f
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp rdi, r14
je 0x10010b28d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rbx, r14
je 0x10010b2a1
cmp rbx, 0xffffffffffffffff
je 0x10010b2a1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x80]
mov eax, esi
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov r13, qword [rsp + 0x58]
mov r14d, dword [rsp + 0xb0]
mov ebp, dword [rsp + 0xb0]
jmp 0x10010b1d3
mov rax, qword [0x100348570]
movsxd rcx, r14d
xor r14d, r14d
shl rcx, 4
add rcx, qword [rax + 8]
mov rax, qword [rcx]
mov rcx, qword [rsp + 0xd8]
mov qword [rcx], rax
cmp dword [rsp + 0x70], r14d
je 0x10010b319
lea rcx, [0x100348450]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [rsp + 0x70], r14d
mov rax, qword [rsp + 0xe0]
cmp rax, r14
je 0x10010b329
mov dword [rax], r15d
mov rax, qword [rsp + 0xe8]
cmp rax, r14
je 0x10010b36e
mov rcx, qword [rsp + 0x50]
mov rdi, r14
mov qword [rax], rcx
jmp 0x10010b36e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, r14d
jne 0x10010b358
mov esi, 0x80004005
jmp 0x10010b218
movzx esi, ax
or esi, 0x80070000
cmp eax, r14d
cmovle esi, eax
jmp 0x10010b36e
mov esi, 0x80070057
cmp esi, r14d
jge 0x10010b249
jmp 0x10010b218