Function at 0x180014300
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2f0]
sub rsp, 0x3f0
mov rax, qword [0x180082618]
xor rax, rsp
mov qword [rbp + 0x2e8], rax
xor ebx, ebx
mov dword [rsp + 0x50], r9d
lea esi, [r9 + 0xf]
mov qword [rbp - 0x68], rdx
mov r12, r8
mov r8, rdx
mov r15, rcx
lea r11d, [rbx + 0x72]
cmp r9d, esi
jae 0x180014646
mov rcx, qword [rbp - 0x80]
lea edi, [r9 - 0x107]
mov rax, qword [rbp - 0x80]
lea r13, [0x180000000]
mov qword [rsp + 0x60], rcx
lea r9d, [rbx + 0x65]
movzx ecx, byte [rsp + 0x55]
lea r11d, [rbx + 0x61]
mov byte [rsp + 0x54], cl
mov r14d, 0x6574
mov qword [rsp + 0x58], rax
nop dword [rax]
mov r10d, 0x53
lea edx, [r10 - 0x12]
cmp edi, 0x20
ja case.0x1800143ae.7
mov ecx, dword [r13 + rdi*4 + 0x14dd0]
add rcx, r13
jmp rcx
mov eax, 0x75
mov dword [rbp + 0x2bd], 0x6c616e
mov word [rbp + 0x2c4], ax
mov dword [rbp + 0x2c0], 0x74706143
jmp case.0x1800143ae.7
mov word [rbp + 0x2d8], bx
jmp case.0x1800143ae.7
mov eax, 0x45
mov word [rbp + 0x2b8], ax
mov eax, 0x72
mov dword [rbp + 0x2b9], 0x657478
mov word [rbp + 0x2bc], ax
jmp case.0x1800143ae.7
mov word [rbp + 0x2b5], r11w
mov word [rbp + 0x2b6], r14w
jmp case.0x1800143ae.7
mov dword [rbp + 0x2d4], 0x5f0032
jmp case.0x1800143ae.7
mov r8d, 5
lea rdx, [0x18007a686]
lea rcx, [rbp + 0x2d0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov r8d, 1
lea rdx, [0x18007a6a6]
lea rcx, [rbp + 0x2e2]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov r8, qword [rbp - 0x68]
mov word [rbp + 0x2e4], bx
jmp 0x180014615
mov eax, 0x57
mov word [rbp + 0x2a0], ax
mov word [rbp + 0x2a1], r10w
mov word [rbp + 0x2a2], dx
mov word [rbp + 0x2a3], r10w
jmp case.0x1800143ae.7
mov eax, 0x6c6c
mov word [rbp + 0x2b0], dx
mov word [rbp + 0x2b1], ax
jmp case.0x1800143ae.7
mov eax, 0x72
mov word [rbp + 0x2c5], ax
mov word [rbp + 0x2c6], r9w
mov dword [rbp + 0x2c7], 0x766544
mov dword [rbp + 0x2ca], 0x656369
jmp case.0x1800143ae.7
mov r8d, 2
lea rdx, [0x18007a71a]
lea rcx, [rbp + 0x2d0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov r8, qword [rbp - 0x68]
jmp 0x180014615
mov eax, 0x6f
mov word [rbp + 0x2b3], ax
mov eax, 0x63
mov word [rbp + 0x2b4], ax
jmp case.0x1800143ae.7
mov dword [rbp + 0x2a4], 0x6b636f
mov dword [rbp + 0x2a7], 0x577465
mov word [rbp + 0x2d0], bx
jmp case.0x1800143ae.7
mov rdx, rbx
mov qword [rsp + 0x58], rbx
jmp 0x180014624
cmp qword [r8 + 0x18], 8
mov rcx, r8
jb 0x180014557
mov rcx, qword [r8]
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdx, qword [rsp + 0x58]
mov r9d, 0x65
mov r8, qword [rbp - 0x68]
mov r10, rax
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x54], 1
lea r11d, [r9 - 4]
jmp 0x180014629
mov r8d, 0xd0
lea rdx, [rbp + 0x2d0]
lea rcx, [rbp + 0x2a0]
call fcn.1800131c0
mov r14, rax
lea r9, [rsp + 0x78]
mov eax, dword [r15]
lea r8, [rsp + 0x68]
mov dword [rsp + 0x68], eax
lea rcx, [rbp + 0x10]
mov eax, dword [r12]
mov edx, 0x31
mov dword [rsp + 0x78], eax
call fcn.18002fb00
test al, al
je 0x1800147a0
mov dword [rsp + 0x28], 1
lea r9, [rbp + 0x10]
xor r8d, r8d
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call r14
mov r8, qword [rbp - 0x68]
mov r14d, 0x6574
mov qword [r8], rax
mov r11d, 0x61
lea r9d, [r11 + 4]
mov rdx, qword [rsp + 0x58]
mov r10, qword [rsp + 0x60]
inc edi
lea eax, [rdi + 0x107]
cmp eax, esi
jb 0x180014390
mov r9d, dword [rsp + 0x50]
mov r11d, 0x72
jmp 0x180014661
mov rdx, qword [rbp - 0x80]
mov r10, qword [rbp - 0x80]
movzx eax, byte [rsp + 0x55]
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r10
mov byte [rsp + 0x54], al
lea eax, [r9 + r9*4]
mov r13d, r9d
shl eax, 9
mov dword [rsp + 0x74], eax
cmp r9d, eax
ja 0x1800147a3
mov r14d, dword [rsp + 0x74]
mov ecx, dword [rsp + 0x50]
mov r15d, dword [rsp + 0x74]
mov edi, dword [rsp + 0x74]
mov qword [rbp - 0x70], r14
nop
cmp r13d, 0x171e7
ja 0x1800149c2
je 0x180014982
cmp r13d, 0xaf77
ja 0x180014885
je 0x18001487d
mov eax, r13d
sub eax, 0x107
je 0x180014848
sub eax, 0x10
je 0x1800146f7
sub eax, 0x10
je 0x1800146e2
cmp eax, 0xa440
jne 0x180014d95
mov byte [rbp - 0x60], 1
jmp 0x180014d95
mov dword [rsp + 0x70], ebx
mov dword [rbp - 0x3c], ebx
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x38], ebx
mov dword [rbp - 0x34], ebx
jmp 0x180014d95
cmp r10, 0xffffffffffffffff
jne 0x180014d95
mov esi, 0x7f
cmp esi, 0x7f
je 0x180014827
cmp esi, 0x111
je 0x180014821
cmp esi, 0x1a3
je 0x1800147f5
cmp esi, 0x235
je 0x1800147d1
cmp esi, 0x2c7
jne 0x180014831
cmp byte [rsp + 0x56], bl
je 0x180014772
lea r8, [rbp - 0x58]
mov qword [rbp - 0x58], rbx
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesDecodeIncrementalHandleCreate
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x180014764
call sub.RPCRT4.dll_MesHandleFree
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x180014772
call sub.RPCRT4.dll_MesHandleFree
cmp byte [rsp + 0x57], bl
je 0x1800147a0
mov rcx, qword [rbp - 0x28]
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbx
call sub.RPCRT4.dll_MesIncrementalHandleReset
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x1800147a0
call sub.RPCRT4.dll_MesHandleFree
mov byte [rbp - 0x60], bl
mov rax, qword [rbp - 0x60]
mov rcx, qword [rbp + 0x2e8]
xor rcx, rsp
call fcn.1800375e0
mov rbx, qword [rsp + 0x430]
add rsp, 0x3f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
movzx eax, byte [rsp + 0x56]
mov ecx, ebx
cmp dword [rbp - 0x50], ebx
cmove ecx, eax
movzx eax, byte [rsp + 0x57]
cmp dword [rbp - 0x4c], ebx
mov byte [rsp + 0x56], cl
mov ecx, ebx
cmove ecx, eax
mov byte [rsp + 0x57], cl
jmp 0x180014831
lea r9, [rbp - 0x80]
mov qword [rbp - 0x28], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesEncodeIncrementalHandleCreate
lea r9, [rbp - 0x28]
mov dword [rbp - 0x50], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesEncodeIncrementalHandleCreate
mov dword [rbp - 0x4c], eax
jmp 0x180014831
mov qword [rbp - 0x80], rbx
jmp 0x180014831
mov byte [rsp + 0x56], 1
mov byte [rsp + 0x57], 1
add esi, 0x92
cmp esi, 0x359
jb 0x180014706
jmp 0x180014d87
mov qword [rsp + 0x40], rbx
xor edx, edx
mov qword [rsp + 0x38], rbx
xor ecx, ecx
mov qword [rsp + 0x30], rbx
mov r9d, 0x88
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call fcn.180015270
test al, al
je 0x1800147a0
jmp 0x180014d87
mov dword [rbp - 0x78], ebx
jmp 0x180014d95
cmp r13d, 0xb987
je 0x1800148d7
cmp r13d, 0x149c7
je 0x1800147a3
cmp r13d, 0x15dd7
jne 0x180014d95
lea rax, [rbp + 0x2b0]
mov r14, 0xffffffffffffffff
inc r14
cmp byte [rax + r14], bl
jne 0x1800148b6
xor edx, edx
mov qword [rbp - 0x70], r14
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x68], eax
jmp 0x180014d87
mov edx, dword [r12]
mov esi, 0x93
mov r14d, dword [r8]
mov dword [rsp + 0x70], edx
mov eax, esi
sub eax, 0x8f
je 0x180014949
sub eax, 1
je 0x18001495b
sub eax, 3
je 0x180014905
cmp eax, 1
jne 0x18001492c
mov edi, ecx
mov eax, ecx
jmp 0x180014938
cmp ecx, 0xffffffff
jne 0x180014928
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rsp + 0x50]
cmp dword [rax], 4
je 0x180014905
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rsp + 0x50]
cmp dword [rax], 0xb
je 0x180014905
mov edx, dword [rsp + 0x70]
inc esi
cmp esi, 0x97
jb 0x1800148e7
mov eax, edi
test eax, eax
jne 0x180014dbe
mov r14, qword [rbp - 0x70]
jmp 0x180014d87
mov eax, edx
mov qword [rbp], rax
mov dword [rbp - 4], ebx
mov dword [rbp - 8], 0xc01464a6
jmp 0x18001492c
lea r8, [rbp - 8]
mov edx, 0x8010641c
mov ecx, r14d
call fcn.180022ce0
test eax, eax
je 0x18001497c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov edi, dword [rax]
neg edi
jmp 0x180014936
mov edi, ebx
mov eax, ebx
jmp 0x180014938
xor r8d, r8d
mov dword [rbp - 0x48], 0x14
mov edx, 0xbe
lea rcx, [rbp - 0x48]
call fcn.180022d10
mov qword [rsp + 0x58], rax
mov rdx, rax
test rax, rax
je 0x180014dbe
mov eax, dword [rsp + 0x70]
mov dword [rdx], eax
mov eax, dword [rbp - 0x40]
mov dword [rdx + 8], eax
mov eax, dword [rbp - 0x3c]
mov dword [rdx + 4], eax
jmp 0x180014d8c
cmp r13d, 0x2e2a7
ja 0x180014ac5
je 0x180014dc6
cmp r13d, 0x20c37
je 0x180014a34
cmp r13d, 0x22a47
je 0x180014a23
cmp r13d, 0x2ba97
jne 0x180014d95
cmp qword [r12 + 0x18], 0x10
mov rdx, r12
jb 0x180014a03
mov rdx, qword [r12]
mov r8d, dword [rsp + 0x68]
lea r9, [rbp - 0x78]
mov rcx, r10
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov qword [rbp - 0x10], rbx
jmp 0x180014d87
mov eax, dword [rbp - 0x38]
mov dword [rdx + 0xc], eax
mov eax, dword [rbp - 0x34]
mov dword [rdx + 0x10], eax
jmp 0x180014d95
mov ecx, dword [rsp + 0x68]
mov r8, qword [r12 + 0x10]
mov dword [rbp - 0x30], ebx
cmp rcx, r8
ja 0x180014a61
mov qword [r12 + 0x10], rcx
mov rax, r12
cmp qword [r12 + 0x18], 0x10
jb 0x180014a59
mov rax, qword [r12]
mov byte [rax + rcx], bl
jmp 0x180014d91
mov rdx, qword [r12 + 0x18]
mov r14, rcx
mov rax, rdx
sub r14, r8
sub rax, r8
cmp r14, rax
ja 0x180014aa7
mov qword [r12 + 0x10], rcx
mov rax, r12
cmp rdx, 0x10
jb 0x180014a89
mov rax, qword [r12]
lea rsi, [rax + r8]
xor edx, edx
mov rcx, rsi
mov r8, r14
call sub.VCRUNTIME140.dll_memset
mov byte [rsi + r14], bl
mov r14, qword [rbp - 0x70]
jmp 0x180014d87
mov r9, r14
mov byte [rsp + 0x20], bl
xor r8d, r8d
mov rdx, r14
mov rcx, r12
call fcn.1800020a0
mov r14, qword [rbp - 0x70]
jmp 0x180014d87
cmp r13d, 0x368f7
je 0x180014d63
cmp r13d, 0x41757
je 0x180014af1
cmp r13d, 0x4c5b7
jne 0x180014d95
mov byte [rbp - 0x60], 1
jmp 0x1800147a3
mov eax, dword [rsp + 0x68]
cmp eax, dword [rbp - 0x78]
je 0x180014cdb
mov r14d, 0x3a
nop dword [rax]
nop dword [rax + rax]
cmp r14d, 0xcb0
ja 0x180014bc9
je 0x180014bbf
cmp r14d, 0x3a
je 0x180014bb0
cmp r14d, 0x2b8
je 0x180014b83
cmp r14d, 0x536
je 0x180014b77
cmp r14d, 0x7b4
je 0x180014b6c
cmp r14d, 0xa32
jne 0x180014cbd
mov word [rbp + 0x29b], r11w
mov dword [rbp + 0x29c], 0x7a6b72
jmp 0x180014cbd
mov byte [rbp + 0x29b], bl
jmp 0x180014cbd
mov byte [rbp + 0x29a], 0x5a
jmp 0x180014cbd
movzx eax, word [0x18007a734]
mov word [rbp + 0x293], ax
mov eax, dword [str.DQ2PD]
mov dword [rbp + 0x295], eax
movzx eax, word [0x18007a73c]
mov word [rbp + 0x299], ax
jmp 0x180014cbd
mov dword [rbp + 0x290], 0x564356
jmp 0x180014cbd
mov byte [rsp + 0x55], 1
jmp 0x180014cbd
cmp r14d, 0xf2e
je 0x180014ca3
cmp r14d, 0x11ac
je 0x180014c87
cmp r14d, 0x142a
je 0x180014bfe
cmp r14d, 0x1926
je 0x1800147a0
jmp 0x180014cbd
lea r9, [rbp - 0x18]
mov edx, r15d
lea r8, [rbp - 0x2c]
lea rcx, [rbp + 0x290]
call sub.RPCRT4.dll_MesEncodeFixedBufferHandleCreate
test eax, eax
je 0x180014c22
mov byte [rsp + 0x55], bl
jmp 0x180014cbd
cmp byte [rsp + 0x55], bl
je 0x180014cbd
mov esi, 0x11f
mov eax, esi
sub eax, 0x11f
je 0x180014c77
sub eax, 1
je 0x180014c62
cmp eax, 1
jne 0x180014c7b
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x180014c52
call sub.RPCRT4.dll_MesHandleFree
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x180014c7b
call sub.RPCRT4.dll_MesHandleFree
jmp 0x180014c7b
lea r8, [rbp - 0x20]
mov edx, r15d
lea rcx, [rbp + 0x290]
call sub.RPCRT4.dll_MesDecodeBufferHandleCreate
jmp 0x180014c7b
mov qword [rbp - 0x20], rbx
inc esi
cmp esi, 0x122
jb 0x180014c31
jmp 0x180014cbd
mov qword [r12 + 0x10], rbx
mov rax, r12
cmp qword [r12 + 0x18], 0x10
jb 0x180014c9b
mov rax, qword [r12]
mov byte [rax], bl
mov qword [rbp - 0x18], rbx
jmp 0x180014cbd
lea rax, [rbp + 0x290]
mov r15, 0xffffffffffffffff
inc r15
cmp byte [rax + r15], bl
jne 0x180014cb1
mov dword [rbp - 0x2c], ebx
add r14d, 0x27e
mov r11d, 0x72
cmp r14d, 0x1b6a
jbe 0x180014b10
mov r14, qword [rbp - 0x70]
cmp dword [rsp + 0x78], ebx
mov ecx, ebx
movzx eax, byte [rsp + 0x54]
cmove ecx, eax
mov byte [rsp + 0x54], cl
test cl, cl
je 0x180014d87
mov esi, 0xbe
nop word [rax + rax]
cmp esi, 0xbe
je 0x180014d38
cmp esi, 0x303e
je 0x180014d28
cmp esi, 0x5fbe
jne 0x180014d53
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x180014d53
call sub.RPCRT4.dll_MesHandleFree
jmp 0x180014d53
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x180014d53
call sub.RPCRT4.dll_MesHandleFree
jmp 0x180014d53
lea r8, [rbp - 0x58]
mov qword [rbp - 0x58], rbx
mov edx, r14d
lea rcx, [rbp + 0x2b0]
call sub.RPCRT4.dll_MesDecodeBufferHandleCreate
mov dword [rsp + 0x78], eax
add esi, 0x2f80
cmp esi, 0x8e80
jbe 0x180014d00
jmp 0x180014d87
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rbp - 0x10]
mov edx, r14d
lea r8, [rbp - 0x30]
lea rcx, [rbp + 0x2b0]
call sub.RPCRT4.dll_MesEncodeFixedBufferHandleCreate
mov dword [rsp + 0x78], eax
mov rdx, qword [rsp + 0x58]
mov r9d, dword [rsp + 0x50]
mov ecx, dword [rsp + 0x50]
lea eax, [r9 + r9*4]
shl eax, 5
add r13d, eax
cmp r13d, dword [rsp + 0x74]
ja 0x1800147a3
mov r10, qword [rsp + 0x60]
mov r11d, 0x72
mov r8, qword [rbp - 0x68]
jmp 0x180014690
mov rax, rbx
jmp 0x1800147a7
mov rax, rdx
jmp 0x1800147a7