Function at 0x14000ee00
Capabilities:
Read file via mapping

Disassembly:
push r12
push r13
push r14
push r15
sub rsp, 0x138
mov r12, rcx
mov r13d, edx
lea r15, [r12 + 0x40]
mov rcx, r15
call fcn.14000f190
mov r14, rax
mov rcx, r14
call fcn.140023dc0
mov rcx, r12
mov rdx, r15
mov r8, r14
mov byte [r14 + rax - 4], 0
call fcn.14000f200
lea rdx, [0x1400082f6]
lea r15, [rsp + 0x30]
mov rcx, r15
call fcn.140023e10
mov rcx, r15
mov rdx, r14
call fcn.140023e30
mov rcx, r15
call fcn.140023dc0
mov ecx, 0x1f0003
xor edx, edx
mov r8, r15
mov dword [rsp + rax + 0x30], r13d
call qword [sym.imp.KERNEL32.dll_OpenEventA]
mov qword [r12], rax
test rax, rax
je 0x14000f161
mov rcx, r15
lea rdx, [0x1400082ff]
call fcn.140023e10
mov rcx, r15
mov rdx, r14
call fcn.140023e30
mov rcx, r15
call fcn.140023dc0
mov ecx, 0x1f0003
xor edx, edx
mov r8, r15
mov dword [rsp + rax + 0x30], r13d
call qword [sym.imp.KERNEL32.dll_OpenEventA]
mov qword [r12 + 8], rax
test rax, rax
je 0x14000f135
mov rcx, r15
lea rdx, [0x140008310]
call fcn.140023e10
mov rcx, r15
mov rdx, r14
call fcn.140023e30
mov rcx, r15
call fcn.140023dc0
mov ecx, 0xf001f
xor edx, edx
mov r8, r15
mov dword [rsp + rax + 0x30], r13d
call qword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov rcx, rax
mov rax, rsp
xor r8d, r8d
mov edx, 0xf001f
xor r9d, r9d
mov qword [r12 + 0x10], rcx
mov qword [rax + 0x20], 0x100
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [r12 + 0x28], rax
cmp qword [r12 + 0x10], 0
je 0x14000f109
test rax, rax
je 0x14000f109
mov rcx, r15
lea rdx, [0x14000831c]
call fcn.140023e10
mov rcx, r15
lea rdx, [0x140008324]
call fcn.140023e30
mov rcx, r15
mov rdx, r14
call fcn.140023e30
mov rcx, r15
call fcn.140023dc0
mov dword [rsp + rax + 0x30], r13d
mov rax, rsp
mov rcx, 0xffffffffffffffff
xor edx, edx
mov r8d, 4
xor r9d, r9d
mov dword [rax + 0x20], 0x41000
mov qword [rax + 0x28], r15
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rcx, rax
mov rax, rsp
xor r8d, r8d
mov edx, 0xf001f
xor r9d, r9d
mov qword [r12 + 0x18], rcx
mov qword [rax + 0x20], 0x41000
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [r12 + 0x30], rax
cmp qword [r12 + 0x18], 0
je 0x14000f0dd
test rax, rax
je 0x14000f0dd
mov rcx, r15
lea rdx, [0x14000831c]
call fcn.140023e10
mov rcx, r15
lea rdx, [0x140008332]
call fcn.140023e30
mov rcx, r15
mov rdx, r14
call fcn.140023e30
mov rcx, r15
call fcn.140023dc0
mov dword [rsp + rax + 0x30], r13d
mov rax, rsp
mov rcx, 0xffffffffffffffff
xor edx, edx
mov r8d, 4
xor r9d, r9d
mov dword [rax + 0x20], 0x400000
mov qword [rax + 0x28], r15
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rcx, rax
mov rax, rsp
xor r8d, r8d
mov edx, 0xf001f
xor r9d, r9d
mov qword [r12 + 0x20], rcx
mov qword [rax + 0x20], 0x400000
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [r12 + 0x38], rax
cmp qword [r12 + 0x18], 0
je 0x14000f0b1
cmp qword [r12 + 0x30], 0
je 0x14000f0b1
mov rax, qword [r12 + 0x28]
mov dword [rax], 0x41000
mov dword [rax + 4], 0x400000
mov rcx, qword [r12]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [r12 + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
add rsp, 0x138
pop r15
pop r14
pop r13
pop r12
ret
lea rdx, [0x140008341]
xor ecx, ecx
mov r8, r14
mov r9d, 0x10
call qword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
dec eax
add rsp, 0x138
pop r15
pop r14
pop r13
pop r12
ret
lea rdx, [0x14000835d]
xor ecx, ecx
mov r8, r14
mov r9d, 0x10
call qword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
dec eax
add rsp, 0x138
pop r15
pop r14
pop r13
pop r12
ret
lea rdx, [0x140008378]
xor ecx, ecx
mov r8, r14
mov r9d, 0x10
call qword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
dec eax
add rsp, 0x138
pop r15
pop r14
pop r13
pop r12
ret
lea rdx, [0x140008390]
xor ecx, ecx
mov r8, r14
mov r9d, 0x10
call qword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
dec eax
add rsp, 0x138
pop r15
pop r14
pop r13
pop r12
ret
lea rdx, [0x1400083af]
xor ecx, ecx
mov r8, r14
mov r9d, 0x10
call qword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
dec eax
add rsp, 0x138
pop r15
pop r14
pop r13
pop r12
ret