Function at 0x18002c340
Capabilities:
Get file size
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov rsi, rdx
mov rbx, rcx
xor edi, edi
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x34], edi
cmp rdx, 0xffffffffffffffff
jne 0x18002c376
lea ecx, [rdx + 7]
jmp 0x18002cc6e
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rbx + 0x408], eax
cmp eax, 0xffffffff
je 0x18002cc74
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
mov edi, 2
mov r8d, edi
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rbx + 0x10], rax
test rax, rax
je 0x18002cc74
xor esi, esi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov r9, rax
mov qword [rbx + 0x18], rax
test rax, rax
je 0x18002cc74
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x18002cc69
mov edx, dword [r9 + 0x3c]
mov dword [rbx + 0x3fc], edx
mov dword [rbx + 0x3f0], esi
mov eax, dword [r9 + 0x3c]
add eax, 7
and eax, 0xfffffff8
mov dword [rbx + 0x3f4], eax
mov eax, dword [rbx + 0x408]
cmp edx, eax
ja 0x18002cc69
lea rcx, [rdx + 0x108]
cmp rcx, rax
ja 0x18002cc69
movups xmm0, xmmword [r9]
movups xmmword [rbx + 0x28], xmm0
movups xmm1, xmmword [r9 + 0x10]
movups xmmword [rbx + 0x38], xmm1
movups xmm0, xmmword [r9 + 0x20]
movups xmmword [rbx + 0x48], xmm0
movups xmm1, xmmword [r9 + 0x30]
movups xmmword [rbx + 0x58], xmm1
lea rcx, [rbx + 0x68]
lea rax, [rdx + r9]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdi, 1
jne 0x18002c462
mov rax, qword [rax]
mov qword [rcx], rax
cmp dword [rbx + 0x68], 0x4550
je 0x18002c4cd
mov ecx, 0xbf
jmp 0x18002cc6e
movzx eax, word [rbx + 0x7c]
test ax, ax
je 0x18002c67d
lea ecx, [rax + 0x18]
add ecx, edx
mov dword [rbx + 0x400], ecx
movzx eax, word [rbx + 0x6e]
cmp eax, 0x10
ja 0x18002c67d
lea r8, [rax + rax*4]
shl r8, 3
mov edx, ecx
add rdx, r9
lea rcx, [rbx + 0x170]
call fcn.18017c7f0
mov edi, esi
mov r15d, esi
mov dword [rsp + 0xf8], esi
mov dword [rsp + 0xf0], esi
movzx eax, word [rbx + 0x6e]
cmp si, ax
jae 0x18002c5c1
lea rdx, [rbx + 0x184]
mov r9d, eax
lea r10, [0x1801b9d30]
nop dword [rax]
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdx + rcx - 0x14]
inc rcx
cmp al, byte [r10 + rcx - 1]
jne 0x18002c5af
cmp rcx, 8
jne 0x18002c550
mov ecx, dword [rdx]
mov rax, qword [rbx + 0x18]
movups xmm0, xmmword [rcx + rax]
movaps xmmword [rsp + 0x60], xmm0
movups xmm2, xmmword [rcx + rax + 0x20]
mov edi, dword [rcx + rax + 0x10]
psrldq xmm2, 0xc
movd r8d, xmm2
test r8d, r8d
je 0x18002c59c
lea eax, [rcx + 0x40]
mov dword [rbx + 0x3f0], eax
mov dword [rbx + 0x3f4], r8d
mov r15d, dword [rdx - 8]
mov r8d, dword [rdx - 4]
add r8d, r15d
mov dword [rsp + 0xf0], r8d
add rdx, 0x28
sub r9, 1
jne 0x18002c540
mov dword [rsp + 0xf8], r15d
mov edx, dword [rbx + 0xf8]
mov rcx, rbx
call fcn.18002e600
mov r13, rax
mov edx, edi
mov rcx, rbx
call fcn.18002e600
mov r14, rax
test rax, rax
cmove r14, r13
mov qword [rsp + 0x38], r14
test r13, r13
je 0x18002c67d
test r14, r14
je 0x18002c67d
mov ebp, esi
nop
mov eax, ebp
lea rcx, [rax + rax*4]
cmp dword [r13 + rcx*4], esi
jne 0x18002c614
cmp dword [r13 + rcx*4 + 0x10], esi
je 0x18002c618
inc ebp
jmp 0x18002c600
mov dword [rsp + 0xe8], ebp
lea r12, [rbx + 0x428]
mov qword [r12], rsi
mov dword [rsp + 0x30], esi
test ebp, ebp
je 0x18002cabd
mov r9d, dword [r13 + 0xc]
test r9, r9
je 0x18002c67d
mov ecx, esi
movzx r11d, word [rbx + 0x6e]
test r11d, r11d
je 0x18002c67d
nop dword [rax + rax]
mov edx, ecx
lea rax, [rdx + rdx*4]
mov r8d, dword [rbx + rax*8 + 0x17c]
mov r10d, dword [rbx + rax*8 + 0x180]
add r10d, r8d
cmp r9, r8
jb 0x18002c676
mov eax, r10d
cmp r9, rax
jb 0x18002c687
inc ecx
cmp ecx, r11d
jb 0x18002c650
mov ecx, 0xc0
jmp 0x18002cc6e
lea rax, [rdx + rdx*4]
mov esi, dword [rbx + rax*8 + 0x184]
sub rsi, r8
add rsi, qword [rbx + 0x18]
add rsi, r9
je 0x18002c67d
mov ecx, 0x38
call fcn.18015de64
mov rdi, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x18002cc46
xor eax, eax
mov qword [rdi], rax
mov dword [rdi + 8], eax
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], rax
mov qword [rdi + 0x20], rax
mov qword [rdi + 0x30], rax
mov qword [rdi + 0x28], rax
mov qword [r12], rdi
mov r12, rdi
mov qword [rsp + 0x48], rdi
inc dword [rbx + 0x430]
mov rcx, rsi
call fcn.18002e980
mov qword [rdi + 0x30], rax
test rax, rax
je 0x18002cc74
mov eax, dword [r13]
mov dword [rdi + 0x1c], eax
mov eax, dword [r13 + 0x10]
mov dword [rdi + 0x20], eax
mov eax, dword [r13 + 8]
mov dword [rdi + 0x24], eax
xor esi, esi
mov qword [rdi + 0x10], rsi
mov dword [rdi + 0x18], esi
mov dword [rdi + 8], esi
mov eax, dword [r13 + 0x10]
cmp eax, r15d
jb 0x18002c73f
cmp eax, dword [rsp + 0xf0]
jae 0x18002c73f
mov qword [rdi + 0x28], rsi
mov dword [rdi + 8], 1
jmp 0x18002caa7
mov r9d, dword [r14 + 0xc]
test r9, r9
je 0x18002c67d
mov ecx, esi
movzx r11d, word [rbx + 0x6e]
test r11d, r11d
je 0x18002c67d
nop dword [rax]
mov edx, ecx
lea rax, [rdx + rdx*4]
mov r8d, dword [rbx + rax*8 + 0x17c]
mov r10d, dword [rbx + rax*8 + 0x180]
add r10d, r8d
cmp r9, r8
jb 0x18002c786
mov eax, r10d
cmp r9, rax
jb 0x18002c793
inc ecx
cmp ecx, r11d
jae 0x18002c67d
jmp 0x18002c760
lea rax, [rdx + rdx*4]
mov ecx, dword [rbx + rax*8 + 0x184]
sub rcx, r8
add rcx, qword [rbx + 0x18]
add rcx, r9
je 0x18002c67d
call fcn.18002e980
mov qword [rdi + 0x28], rax
test rax, rax
je 0x18002cc74
mov eax, dword [r13]
test eax, eax
jne 0x18002c7cc
mov eax, dword [r13 + 0x10]
mov r9d, eax
test eax, eax
je 0x18002c811
mov ecx, esi
movzx r11d, word [rbx + 0x6e]
test r11d, r11d
je 0x18002c811
nop
mov edx, ecx
lea rax, [rdx + rdx*4]
mov r8d, dword [rbx + rax*8 + 0x17c]
mov r10d, dword [rbx + rax*8 + 0x180]
add r10d, r8d
cmp r9, r8
jb 0x18002c80a
mov eax, r10d
cmp r9, rax
jb 0x18002c946
inc ecx
cmp ecx, r11d
jb 0x18002c7e0
mov r12, rsi
mov eax, dword [r14]
test eax, eax
jne 0x18002c81f
mov eax, dword [r14 + 0x10]
mov r9d, eax
test eax, eax
je 0x18002c863
mov ecx, esi
movzx r11d, word [rbx + 0x6e]
test r11d, r11d
je 0x18002c863
mov edx, ecx
lea rax, [rdx + rdx*4]
mov r8d, dword [rbx + rax*8 + 0x17c]
mov r10d, dword [rbx + rax*8 + 0x180]
add r10d, r8d
cmp r9, r8
jb 0x18002c85c
mov eax, r10d
cmp r9, rax
jb 0x18002c961
inc ecx
cmp ecx, r11d
jb 0x18002c832
mov r14, rsi
mov r15d, esi
test r12, r12
je 0x18002ca8c
cmp qword [r12], rsi
je 0x18002ca8c
nop dword [rax]
inc r15d
cmp qword [r12 + r15*8], rsi
jne 0x18002c880
test r15d, r15d
je 0x18002ca8c
mov dword [rdi + 0x18], r15d
mov ebp, r15d
mov qword [rsp + 0x50], rbp
mov eax, 0x20
mul rbp
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
add rax, 8
cmovb rax, rcx
mov rcx, rax
call fcn.18015deb0
mov qword [rsp + 0x58], rax
test rax, rax
je 0x18002c8f6
mov qword [rax], rbp
lea rsi, [rax + 8]
lea rax, [0x18002c250]
mov qword [rsp + 0x20], rax
lea r9, [0x18002c230]
mov r8d, ebp
mov edx, 0x20
mov rcx, rsi
call fcn.18015e630
nop
mov qword [rdi + 0x10], rsi
test rsi, rsi
je 0x18002cc46
xor edi, edi
mov ebp, edi
test r15d, r15d
je 0x18002ca83
lea rdi, [rsi + 4]
sub r12, r14
xor esi, esi
nop dword [rax]
mov qword [rdi], rsi
mov word [rdi - 4], si
mov qword [rdi + 0x14], rsi
mov qword [rdi + 0xc], rsi
mov r9, qword [r12 + r14]
test r9, r9
jns 0x18002c97c
movzx eax, r9w
mov dword [rdi], eax
mov dword [rdi + 4], eax
jmp 0x18002ca6e
lea rax, [rdx + rdx*4]
mov r12d, dword [rbx + rax*8 + 0x184]
sub r12, r8
add r12, qword [rbx + 0x18]
add r12, r9
jmp 0x18002c814
lea rax, [rdx + rdx*4]
mov r14d, dword [rbx + rax*8 + 0x184]
sub r14, r8
add r14, qword [rbx + 0x18]
add r14, r9
jmp 0x18002c866
je 0x18002c9f2
mov ecx, esi
movzx r11d, word [rbx + 0x6e]
test r11d, r11d
je 0x18002c9f2
nop word [rax + rax]
mov edx, ecx
lea rax, [rdx + rdx*4]
lea r10, [rbx + rax*8]
mov r8d, dword [r10 + 0x17c]
cmp r9, r8
jb 0x18002c9b5
mov eax, dword [r10 + 0x180]
add eax, r8d
cmp r9, rax
jb 0x18002c9be
inc ecx
cmp ecx, r11d
jae 0x18002c9f2
jmp 0x18002c990
lea rax, [rdx + rdx*4]
mov ecx, dword [rbx + rax*8 + 0x184]
sub rcx, r8
add rcx, qword [rbx + 0x18]
add rcx, r9
je 0x18002c9f2
movzx eax, word [rcx]
mov word [rdi - 4], ax
add rcx, 2
call fcn.18002e980
mov qword [rdi + 0x14], rax
test rax, rax
je 0x18002cc74
mov r9, qword [r14]
test r9, r9
jns 0x18002ca05
movzx eax, r9w
mov dword [rdi], eax
mov dword [rdi + 4], eax
jmp 0x18002ca6e
je 0x18002ca6e
mov ecx, esi
movzx r11d, word [rbx + 0x6e]
test r11d, r11d
je 0x18002ca6e
mov edx, ecx
lea rax, [rdx + rdx*4]
lea r10, [rbx + rax*8]
mov r8d, dword [r10 + 0x17c]
cmp r9, r8
jb 0x18002ca38
mov eax, dword [r10 + 0x180]
add eax, r8d
cmp r9, rax
jb 0x18002ca41
inc ecx
cmp ecx, r11d
jae 0x18002ca6e
jmp 0x18002ca13
lea rax, [rdx + rdx*4]
mov ecx, dword [rbx + rax*8 + 0x184]
sub rcx, r8
add rcx, qword [rbx + 0x18]
add rcx, r9
je 0x18002ca6e
add rcx, 2
call fcn.18002e980
mov qword [rdi + 0xc], rax
test rax, rax
je 0x18002cc74
inc ebp
add r14, 8
add rdi, 0x20
cmp ebp, r15d
jb 0x18002c920
jmp 0x18002ca85
xor esi, esi
mov ebp, dword [rsp + 0xe8]
mov r14, qword [rsp + 0x38]
add r14, 0x14
mov qword [rsp + 0x38], r14
mov r15d, dword [rsp + 0xf8]
mov r12, qword [rsp + 0x48]
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
add r13, 0x14
cmp eax, ebp
jb 0x18002c636
mov dword [rbx + 0x404], esi
mov r10d, esi
movzx edi, word [rbx + 0x6e]
cmp si, di
jae 0x18002cc1b
mov r9d, esi
lea rbp, [0x1801b9d38]
mov r14d, 0xffff
mov eax, r10d
lea rcx, [rax + rax*4]
lea r11, [rbx + rcx*8]
mov eax, dword [r11 + 0x180]
add eax, dword [r11 + 0x184]
cmp eax, r9d
cmova r9d, eax
mov dword [rbx + 0x404], r9d
mov rcx, rsi
nop dword [rax]
movzx eax, byte [r11 + rcx + 0x170]
inc rcx
cmp al, byte [rcx + rbp - 1]
jne 0x18002cc0c
cmp rcx, 8
jne 0x18002cb10
mov r8d, dword [r11 + 0x184]
mov rdx, qword [rbx + 0x18]
movups xmm2, xmmword [rdx + r8]
movaps xmmword [rsp + 0x60], xmm2
movups xmm3, xmmword [rdx + r8 + 0x10]
movups xmm4, xmmword [rdx + r8 + 0x20]
movdqa xmm1, xmm2
psrldq xmm1, 8
movd ecx, xmm1
movd eax, xmm2
test ecx, ecx
cmove ecx, eax
mov eax, dword [rsp + 0x6c]
sub eax, ecx
mov dword [rsp + 0x34], eax
mov eax, ecx
add rax, rdx
add rax, r8
mov qword [rsp + 0x40], rax
mov ecx, dword [r11 + 0x180]
add ecx, r8d
cmp ecx, r9d
cmova r9d, ecx
mov dword [rbx + 0x404], r9d
add di, r14w
mov word [rbx + 0x6e], di
movd dword [rbx + 0xf8], xmm3
movq rax, xmm3
shr rax, 0x20
mov dword [rbx + 0xfc], eax
movdqa xmm0, xmm3
psrldq xmm0, 8
movd dword [rbx + 0x148], xmm0
psrldq xmm3, 8
movq rax, xmm3
shr rax, 0x20
mov dword [rbx + 0x14c], eax
movd dword [rbx + 0x150], xmm4
movdqa xmm0, xmm4
psrldq xmm0, 4
movd dword [rbx + 0x154], xmm0
mov dword [rbx + 0xc0], esi
psrldq xmm4, 8
movd dword [rbx + 0xb8], xmm4
mov dword [rbx + 0x434], 1
inc r10d
movzx eax, di
cmp r10d, eax
jb 0x18002cae3
mov ecx, 0x10
call fcn.18015de64
mov qword [rsp + 0xe8], rax
test rax, rax
je 0x18002cc4d
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
mov ecx, dword [rsp + 0x34]
mov dword [rax + 8], ecx
mov dword [rax + 0xc], esi
jmp 0x18002cc50
mov ecx, 0xe
jmp 0x18002cc6e
mov rax, rsi
mov qword [rbx + 8], rax
test rax, rax
jne 0x18002cc62
lea ecx, [rax + 0xe]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 1
jmp 0x18002cc76
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0xe0]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret