Function at 0x140007f98
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x238
xor r15d, r15d
mov r14, r9
mov rbx, r8
mov rbp, rdx
mov rdi, rcx
cmp rdx, r15
je 0x140007fc9
mov r13, qword [rdx]
jmp 0x140007fd0
lea r13, [0x1400d63f4]
lea rcx, [rsp + 0x298]
mov edx, 0x105
call fcn.14004bedc
mov rdx, qword [rsp + 0x298]
mov r12, rdx
cmp rbx, r15
je 0x140007ff7
cmp qword [rbx], r15
jne 0x14000800d
xor ecx, ecx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rdx, qword [rsp + 0x298]
cmp rbx, r15
je 0x140008039
cmp qword [rbx], r15
jne 0x140008021
mov rcx, rbx
call fcn.140058a38
jmp 0x140008039
mov rdx, qword [rbx]
lea rcx, [rsp + 0x298]
call fcn.140058a38
mov r12, qword [rsp + 0x298]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rbx, [rsp + 0x50]
cmp r14, r15
cmovne rbx, r14
lea eax, [rax + rax + 2]
or rdi, 0xffffffffffffffff
mov dword [rsp + 0x288], eax
add eax, 0x14
lea rdx, [rsp + 0x78]
mov esi, 1
xor r9d, r9d
mov r8d, 0x8000004
mov rcx, rdi
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x78], 0x18
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x80], r15
mov dword [rsp + 0x88], esi
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x70], rbx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
cmp rax, rdi
cmove rax, r15
mov qword [rbx], rax
cmp rax, r15
jne 0x1400080bf
mov rcx, qword [rsp + 0x50]
cmp rcx, r15
jmp 0x1400080e7
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 6]
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r15, rax
test rax, rax
jne 0x140008101
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400082ac
cmp rcx, rdi
je 0x1400082ac
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400082ac
movsxd rax, dword [rsp + 0x288]
mov rdx, qword [rsp + 0x280]
lea rcx, [r15 + 4]
mov r8, rax
mov dword [r15], eax
mov rbx, rax
call fcn.1400177f8
xor edx, edx
lea rcx, [rbx + r15 + 4]
lea r8d, [rdx + 0x10]
call fcn.1400b93b0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov r8, qword [rsp + 0x70]
mov r9d, dword [rsp + 0x288]
mov r8, qword [r8]
lea rdx, str._map:0x_p:_lu
lea rcx, [rsp + 0x100]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, str.PECMD_LOAD
lea rcx, [rsp + 0x290]
or r8d, 0xffffffff
call fcn.140058960
mov rbx, qword [rsp + 0x2a0]
xor edi, edi
cmp word [rbx], di
je 0x1400081c0
lea rdx, str.logs:_
lea rcx, [rsp + 0x290]
call fcn.14004bfa8
lea rcx, [rsp + 0x290]
mov rdx, rbx
call fcn.14004bfa8
lea rdx, [0x1400d6c70]
lea rcx, [rsp + 0x290]
call fcn.14004bfa8
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x290]
call fcn.14004bfa8
lea rcx, [rsp + 0x290]
mov rdx, r13
call fcn.14004bfa8
cmp r14, rdi
je 0x1400081ff
mov rdx, qword [rsp + 0x290]
mov rcx, rbp
call fcn.140058a38
jmp 0x140008287
xor eax, eax
lea rcx, [rsp + 0x98]
xor edx, edx
lea r8d, [rax + 0x60]
mov qword [rsp + 0x58], rdi
mov dword [rsp + 0x90], 0x68
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
call fcn.1400b93b0
mov rdx, qword [rsp + 0x290]
lea r11, [rsp + 0x58]
lea rax, [rsp + 0x90]
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
mov rcx, r12
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], esi
call fcn.1400b8af0
cmp eax, edi
je 0x140008287
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x290]
call fcn.140044f24
mov rcx, qword [rsp + 0x50]
cmp rcx, rdi
je 0x1400082aa
cmp rcx, 0xffffffffffffffff
je 0x1400082aa
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, edi
lea rcx, [rsp + 0x298]
call fcn.140044f24
mov eax, esi
add rsp, 0x238
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret