Function at 0x7ff74afa788
Capabilities:
Access pe header
Check if file exists
Read file via mapping

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x50
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x40], rbx
mov qword [rbp + 0x48], rsi
mov qword [rbp + 0x50], rdi
mov rax, qword [0x7ff74b58340]
xor rax, rbp
mov qword [rbp + 8], rax
xor r14d, r14d
mov r12, rdx
mov rsi, rcx
mov ebx, r14d
mov rdi, r14
cmp rcx, r14
je 0x7ff74b1945c
cmp rdx, r14
je 0x7ff74b1945c
cmp word [rcx], 0x22
je 0x7ff74b1945c
mov dword [rdx], r14d
mov qword [rsp + 0x30], r14
lea r15d, [r14 + 1]
xor r9d, r9d
mov edx, 0x80000000
mov r8d, r15d
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x7ff74afdfc9
xor r9d, r9d
xor edx, edx
mov rcx, r13
lea r8d, [r9 + 2]
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r15, rax
cmp rax, r14
je 0x7ff74b1930a
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r14, rax
test rax, rax
je 0x7ff74b1936d
mov rcx, rax
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
je 0x7ff74b193b4
movzx eax, word [rax + 4]
cmp eax, 0x14c
je 0x7ff74b06a4b
cmp eax, 0x200
je 0x7ff74afa899
cmp eax, 0x8664
jne 0x7ff74b19416
mov dword [r12], 2
jmp 0x7ff74afa8a3
test r14, r14
je 0x7ff74afa8b1
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
xor r14d, r14d
cmp r15, r14
je 0x7ff74afa8c2
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp r13, 0xffffffffffffffff
je 0x7ff74afa8d6
cmp r13, r14
je 0x7ff74afa8d6
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rdi, r14
jne 0x7ff74afe0b2
mov eax, ebx
jmp 0x7ff74afa8e3
mov rcx, qword [rbp + 8]
xor rcx, rbp
call fcn.7ff74ae3090
mov rbx, qword [rbp + 0x40]
mov rsi, qword [rbp + 0x48]
mov rdi, qword [rbp + 0x50]
lea rsp, [rbp + 0x10]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call sub.KERNEL32.dll_GetLastError
cmp eax, 2
jne 0x7ff74b19296
mov edx, 0x20a
mov qword [rbp], r14
cmp qword [0x7ff74b585e0], rdx
jb 0x7ff74b1922b
mov rcx, qword [0x7ff74b585e8]
add rcx, 0x212
cmp rcx, rdx
jb 0x7ff74b1922b
call fcn.7ff74ae6340
cmp eax, r14d
je 0x7ff74b1922b
mov eax, dword [rsp]
mov eax, 0x220
sub rsp, rax
lea rdi, [rsp + 0x40]
mov eax, dword [rdi]
cmp rdi, r14
je 0x7ff74b1922b
mov dword [rdi], 0x6b637453
add rdi, 8
je 0x7ff74b1922b
lea rax, [rbp]
mov r13d, 0x104
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, rsi
xor ecx, ecx
mov r9d, r13d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_SearchPathW]
cmp eax, r14d
jne 0x7ff74b19257
call sub.KERNEL32.dll_GetLastError
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r14d
cmovle ebx, eax
cmp dword [0x7ff74b582c8], r14d
je 0x7ff74afa8d6
mov rcx, qword [0x7ff74b58350]
lea rax, [0x7ff74b58350]
cmp rcx, rax
je 0x7ff74afa8d6
test byte [rcx + 0x1c], r15b
je 0x7ff74afa8d6
jmp 0x7ff74b192df
lea rcx, [rdi - 8]
cmp dword [rcx], 0x70616548
jne 0x7ff74afa8df
jmp 0x7ff74b19450
mov dword [r12], 1
jmp 0x7ff74afa8a3
mov ecx, 0x212
call qword [0x7ff74b585f0]
mov rdi, rax
cmp rax, r14
je 0x7ff74b19300
add rdi, 8
mov dword [rax], 0x70616548
jne 0x7ff74afe03d
jmp 0x7ff74b19300
cmp eax, r13d
ja 0x7ff74afe06b
mov qword [rsp + 0x30], r14
xor r9d, r9d
mov r8d, r15d
mov edx, 0x80000000
mov rcx, rdi
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r13, rax
cmp rax, 0xffffffffffffffff
jne 0x7ff74afa81a
call sub.KERNEL32.dll_GetLastError
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r14d
cmovle ebx, eax
cmp dword [0x7ff74b582c8], r14d
je 0x7ff74afa8d6
mov rcx, qword [0x7ff74b58350]
lea rax, [0x7ff74b58350]
cmp rcx, rax
je 0x7ff74afa8d6
test byte [rcx + 0x1c], r15b
je 0x7ff74afa8d6
mov edx, 0x2e
jmp 0x7ff74b192e4
mov edx, 0x2d
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff74b4f5f0]
mov r9, rsi
mov dword [rsp + 0x20], ebx
call fcn.7ff74b298f0
jmp 0x7ff74afa8d6
mov ebx, 0x8007000e
jmp 0x7ff74afa8d6
call sub.KERNEL32.dll_GetLastError
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r14d
cmovle ebx, eax
cmp dword [0x7ff74b582c8], r14d
je 0x7ff74afa8b4
mov rcx, qword [0x7ff74b58350]
lea rax, [0x7ff74b58350]
cmp rcx, rax
je 0x7ff74afa8b4
test byte [rcx + 0x1c], 1
je 0x7ff74afa8b4
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff74b4f5f0]
mov edx, 0x2f
mov r9, rsi
mov dword [rsp + 0x20], ebx
call fcn.7ff74b298f0
jmp 0x7ff74afa8b4
call sub.KERNEL32.dll_GetLastError
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
cmp dword [0x7ff74b582c8], r14d
je 0x7ff74afa8a3
mov rcx, qword [0x7ff74b58350]
lea rax, [0x7ff74b58350]
cmp rcx, rax
je 0x7ff74afa8a3
test byte [rcx + 0x1c], 1
je 0x7ff74afa8a3
lea edx, [r14 + 0x30]
jmp 0x7ff74b193fa
call sub.KERNEL32.dll_GetLastError
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
cmp dword [0x7ff74b582c8], 0
je 0x7ff74afa8a3
mov rcx, qword [0x7ff74b58350]
lea rax, [0x7ff74b58350]
cmp rcx, rax
je 0x7ff74afa8a3
test byte [rcx + 0x1c], 1
je 0x7ff74afa8a3
mov edx, 0x31
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff74b4f5f0]
mov r9, rsi
mov dword [rsp + 0x20], ebx
call fcn.7ff74b298f0
jmp 0x7ff74afa8a3
cmp dword [0x7ff74b582c8], 0
mov ebx, 0x800700c1
je 0x7ff74afa8a3
mov rcx, qword [0x7ff74b58350]
lea rax, [0x7ff74b58350]
cmp rcx, rax
je 0x7ff74afa8a3
test byte [rcx + 0x1c], 1
je 0x7ff74afa8a3
mov edx, 0x32
jmp 0x7ff74b193fa
call qword [0x7ff74b585f8]
nop
jmp 0x7ff74afa8df
mov eax, 0x80070057
jmp 0x7ff74afa8e3