Function at 0x140001a50
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push rbx
push rdi
push r12
sub rsp, 0x70
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x60], rax
call fcn.140001570
mov rcx, rax
mov edx, 0x6c366432
call fcn.140001740
mov rcx, rax
call fcn.1400018b0
xor r12d, r12d
test eax, eax
mov ebx, r12d
setne bl
call fcn.140001570
mov rcx, rax
mov edx, 0x74e87eee
call fcn.140001740
mov rcx, rax
call fcn.1400018b0
test eax, eax
lea edi, [rbx + 1]
cmove edi, ebx
call fcn.140001570
mov rcx, rax
mov edx, 0x24ca98d6
call fcn.140001740
mov rcx, rax
call fcn.1400018b0
test eax, eax
lea ebx, [rdi + 1]
cmove ebx, edi
call fcn.140001570
mov rcx, rax
mov edx, 0x6215d241
call fcn.140001740
mov rcx, rax
call fcn.1400018b0
test eax, eax
lea ecx, [rbx + 1]
cmove ecx, ebx
test ecx, ecx
je 0x140001cfa
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x98], rsi
mov qword [rsp + 0xa0], r14
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
xorps xmm0, xmm0
xor eax, eax
mov qword [rsp + 0x50], rax
movups xmmword [rsp + 0x40], xmm0
call fcn.140001570
mov r9d, 0x18
lea r8, [rsp + 0x40]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
mov rbp, qword [rsp + 0x40]
lea rcx, str.C:WindowsSystem32_ntdll.dll
mov qword [rsp + 0x30], r12
xor r9d, r9d
mov dword [rsp + 0x28], r12d
mov edx, 0x80000000
mov r8d, 1
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x28], r12
xor r9d, r9d
mov rcx, rax
mov dword [rsp + 0x20], r12d
xor edx, edx
mov r8d, 0x1000002
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
xor r9d, r9d
mov qword [rsp + 0x20], r12
mov rcx, rax
xor r8d, r8d
mov edx, 4
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
movsxd rsi, dword [rbp + 0x3c]
movzx edi, r12w
add rsi, rbp
mov r14, rax
cmp r12w, word [rsi + 6]
jae 0x140001c7a
mov qword [rsp + 0xa8], r15
lea r15, str..text
nop dword [rax + rax]
movzx ecx, word [rsi + 0x14]
mov r8, r15
movzx eax, di
add rcx, rsi
lea rbx, [rax*4 + 3]
add rbx, rax
lea rbx, [rcx + rbx*8]
mov rax, rbx
sub r8, rbx
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140001c15
inc rax
test ecx, ecx
jne 0x140001c02
test edx, edx
jne 0x140001c65
mov ecx, dword [rbx + 0xc]
lea r9, [rsp + 0x58]
mov edx, dword [rbx + 8]
add rcx, rbp
mov r8d, 0x40
mov dword [rsp + 0x58], r12d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [rbx + 0xc]
mov r8d, dword [rbx + 8]
lea rdx, [rax + r14]
lea rcx, [rax + rbp]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [rbx + 0xc]
lea r9, [rsp + 0x58]
mov edx, dword [rbx + 8]
add rcx, rbp
mov r8d, dword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
inc di
cmp di, word [rsi + 6]
jb 0x140001be0
mov r15, qword [rsp + 0xa8]
call fcn.140001570
mov rcx, rax
mov edx, 0x6c366432
call fcn.140001740
mov rcx, rax
call fcn.1400018b0
call fcn.140001570
mov rcx, rax
mov edx, 0x74e87eee
call fcn.140001740
mov rcx, rax
call fcn.1400018b0
call fcn.140001570
mov rcx, rax
mov edx, 0x24ca98d6
call fcn.140001740
mov rcx, rax
call fcn.1400018b0
call fcn.140001570
mov rcx, rax
mov edx, 0x6215d241
call fcn.140001740
mov rcx, rax
call fcn.1400018b0
mov r14, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x98]
mov rbp, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140002100
add rsp, 0x70
pop r12
pop rdi
pop rbx
ret