Function at 0x140173500
Capabilities:
Check if file exists
Read file via mapping

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov r13d, r9d
mov rbx, r8
mov r15, rdx
mov rsi, rcx
mov rax, qword [0x140362028]
xor rax, rsp
mov qword [rsp + 0x50], rax
call fcn.1401738e0
mov ebp, eax
test eax, eax
jne 0x140173885
mov r12d, dword [rsp + 0xc0]
lea eax, [r12 + r13]
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x28], 0
mov rcx, 0xffffffffffffffff
xor edx, edx
mov r8d, 0x8000004
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbp, rax
cmp qword [rsi + 0x28], rax
je 0x1401735c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rax, qword [rsi + 0x28]
inc rax
cmp rax, 2
jb 0x14017359f
call fcn.1400c5840
mov rcx, qword [rsi + 0x28]
call fcn.1400e21b0
mov qword [rsi + 0x28], 0
mov rax, rbp
inc rax
cmp rax, 2
jb 0x1401735b4
mov qword [rsi + 0x28], rbp
call fcn.1400c5840
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbp, qword [rsi + 0x28]
mov rdi, qword [rsp + 0xc8]
lea rax, [rbp + 1]
cmp rax, 1
ja 0x1401735e4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov ebp, 0x19
jmp 0x140173885
mov qword [rsp + 0x20], 0
mov rcx, rbp
mov edx, 6
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
je 0x140173856
mov r14, rax
mov ebp, r13d
mov eax, r12d
mov qword [rsp + 0x38], rax
test rbx, rbx
je 0x140173651
test r12d, r12d
je 0x140173651
lea rdi, [r14 + rbp]
mov rcx, rdi
mov rdx, rbx
mov r8, qword [rsp + 0x38]
call fcn.1401a6090
xor eax, eax
mov rcx, qword [rdi + rax*8]
test rcx, rcx
je 0x140173648
sub rcx, rbx
mov qword [rdi + rax*8], rcx
inc rax
cmp rax, 0x40
jne 0x140173638
mov qword [0x140397648], rbp
mov rcx, rsi
call fcn.1400e23f0
mov ebp, 8
test al, al
je 0x14017386a
movabs rbx, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x48]
mov qword [rdi], rbx
mov rcx, qword [rsi]
mov qword [rsp + 0x20], rdi
lea rdx, [0x140397648]
mov r9d, 8
mov r8, rdx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140173865
cmp qword [rsp + 0x48], 8
mov qword [0x140397648], 0
mov ebp, 0x3a
jne 0x140173875
mov rax, qword [rsp + 0x38]
mov qword [0x140397650], rax
mov rcx, rsi
call fcn.1400e23f0
mov ebp, 8
test al, al
je 0x1401738aa
mov qword [rsp + 0x48], rbx
mov rcx, qword [rsi]
mov qword [rsp + 0x20], rdi
lea rdx, [0x140397650]
mov r9d, 8
mov r8, rdx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1401738a5
cmp qword [rsp + 0x48], 8
mov qword [0x140397650], 0
mov ebp, 0x3a
jne 0x140173875
mov ebp, dword [rsi + 0x10]
mov rax, qword [rsi]
mov qword [rsp + 0x38], rax
mov ecx, 0x40
call fcn.1401a2e6c
mov r12, rax
mov r9, qword [rsi + 0x40]
mov qword [rsp + 0x20], r15
mov rcx, rax
mov rdx, qword [rsp + 0x38]
mov r8d, ebp
call fcn.140194a50
mov rbp, qword [rsi + 0x38]
mov qword [rsi + 0x38], r12
test rbp, rbp
je 0x14017377b
mov rcx, rbp
call fcn.140194af0
mov rcx, rbp
call fcn.1401a2ea8
mov r12, qword [rsi + 0x38]
mov rcx, r12
mov rdx, r14
mov r8d, r13d
mov r9d, 0x400
call fcn.140194c30
mov ebp, 4
test al, al
je 0x140173885
lea r14, [rsp + 0x40]
mov qword [r14], rbx
mov r15, qword [rsi]
mov rbp, qword [rsi + 0x28]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor ecx, ecx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], 7
mov rcx, rax
mov rdx, rbp
mov r8, r15
mov r9, r14
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x1401738b7
mov rax, qword [rsp + 0x40]
mov qword [0x140397448], rax
mov rcx, rsi
call fcn.1400e23f0
mov ebp, 8
test al, al
je 0x1401738d3
mov qword [rsp + 0x48], rbx
mov rcx, qword [rsi]
mov qword [rsp + 0x20], rdi
lea rdx, [0x140397448]
mov r9d, 8
mov r8, rdx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1401738ce
cmp qword [rsp + 0x48], 8
mov qword [0x140397448], 0
mov ebp, 0x3a
jne 0x140173875
mov rcx, rsi
call fcn.1400e25f0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebp, ebp
jmp 0x140173885
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov ebp, 0x1b
jmp 0x140173885
mov ebp, 0x39
mov qword [0x140397648], 0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0xc8]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401a4270
mov eax, ebp
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ebp, 0x39
mov qword [0x140397650], 0
jmp 0x140173875
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0xc8]
mov dword [rcx], eax
mov ebp, 0x1a
jmp 0x140173885
mov ebp, 0x39
mov qword [0x140397448], 0
jmp 0x140173875