Function at 0x1800307d0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov rax, qword [0x18008b088]
xor rax, rsp
mov qword [rbp + 0x18], rax
xor r10d, r10d
mov qword [rsp + 0x60], rdx
lea r13d, [rcx - 0xd]
mov dword [rsp + 0x4c], ecx
lea r11, [0x180000000]
mov r15, r8
mov rbx, r9
mov r8, rdx
lea edi, [r10 + 0x6c]
mov r12d, ecx
cmp ecx, r13d
jbe 0x180030908
mov rsi, qword [rsp + 0x70]
lea r14d, [rcx - 0xdc]
mov r11d, 0x75
lea edx, [r11 + 1]
lea edi, [rdx - 0x56]
lea r10d, [r11 - 0x29]
cmp r14d, 0x2b
ja case.0x180030872.5
lea rcx, [0x180000000]
movzx eax, byte [rcx + r14 + 0x31090]
mov ecx, dword [rcx + rax*4 + 0x3105c]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor edx, edx
mov dword [rsp + 0x50], 3
xor ecx, ecx
mov r8d, 0xc9
call fcn.1800074f0
lea r9, [rsp + 0x50]
mov qword [0x18008b280], rax
lea r8, [rbp - 8]
mov dword [rsp + 0x50], edi
mov edx, 0x4d
lea rcx, [rsp + 0x40]
call fcn.18003b000
mov rdx, qword [0x18008b280]
lea r8, [rbp - 8]
mov r9d, 0xd0
xor ecx, ecx
call fcn.180048c80
mov edi, 0x6c
mov r8, qword [rsp + 0x60]
mov edx, 0xffffffff
add r12d, edx
add r14d, edx
cmp r12d, r13d
ja 0x180030836
mov ecx, dword [rsp + 0x4c]
lea r11, [0x180000000]
xor r10d, r10d
imul eax, ecx, 0x596
mov r14d, ecx
mov dword [rsp + 0x6c], eax
cmp ecx, eax
ja case.0x180030f56.0
mov r13, qword [rsp + 0x70]
mov edx, 0x29
mov rsi, qword [rsp + 0x70]
movabs r9, 0x3300490032
mov r12d, dword [rsp + 0x6c]
movzx r15d, byte [rsp + 0x40]
cmp r14d, 0x19845
ja 0x180030db4
je 0x180030d5d
cmp r14d, 0x66c3
ja 0x180030ccb
je 0x180030c85
mov eax, r14d
sub eax, 0xe0
je 0x180030c1e
sub eax, 0xd
je 0x180030c78
cmp eax, 0x6033
jne 0x180030c1e
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x180030c05
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x1800309ae
mov rax, qword [rbx]
mov word [rax + rcx], 0x5f
mov ecx, dword [rsp + 0x4c]
jmp 0x180030c1e
mov edx, 0x40
mov rcx, rbx
call fcn.180042fa0
jmp case.0x180030872.5
mov dil, 0x30
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x1800309fe
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x1800309f3
mov rax, qword [rbx]
mov byte [rax + rcx], dil
mov byte [rax + rcx + 1], 0
jmp 0x180030a11
xor r8d, r8d
movzx r9d, dil
mov rcx, rbx
lea edx, [r8 + 1]
call fcn.180001e40
inc dil
cmp dil, 0x39
jbe 0x1800309d2
jmp case.0x180030872.5
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x180030a4b
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x180030a40
mov rax, qword [rbx]
mov word [rax + rcx], 0x2d
jmp case.0x180030872.5
xor r8d, r8d
mov r9b, 0x2d
mov rcx, rbx
lea edx, [r8 + 1]
call fcn.180001e40
jmp case.0x180030872.5
mov dil, 0x41
nop word [rax + rax]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x180030a9c
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x180030a91
mov rax, qword [rbx]
mov byte [rax + rcx], dil
mov byte [rax + rcx + 1], 0
jmp 0x180030aaf
xor r8d, r8d
movzx r9d, dil
mov rcx, rbx
lea edx, [r8 + 1]
call fcn.180001e40
inc dil
cmp dil, 0x5a
jbe 0x180030a70
jmp case.0x180030872.5
mov word [rbp - 0x4e], r10w
jmp case.0x180030872.5
mov edi, 0x33
nop dword [rax]
mov eax, edi
sub eax, 0x33
je 0x180030ae4
cmp eax, 1
jne 0x180030b1e
mov rax, rsi
jmp 0x180030c51
mov r8, qword [r8]
xor edx, edx
mov rcx, qword [r15]
mov eax, 0xffffffff
div r8
cmp rcx, rax
ja 0x180030bfe
imul rcx, r8
mov rdx, rcx
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov rsi, rax
test rax, rax
je 0x180030bfe
mov r8, qword [rsp + 0x60]
inc edi
cmp edi, 0x35
jb 0x180030ad0
mov eax, 0x5f
mov dword [rbp - 0x5e], 0x470021
mov word [rbp - 0x5a], ax
mov eax, 0x41
mov word [rbp - 0x50], ax
mov dword [rbp - 0x58], 0x530049
mov dword [rbp - 0x54], 0x56005f
jmp case.0x180030872.5
mov dword [rbp - 0x64], 0x260026
mov word [rbp - 0x60], di
jmp case.0x180030872.5
mov dil, 0x61
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x180030b9c
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x180030b91
mov rax, qword [rbx]
mov byte [rax + rcx], dil
mov byte [rax + rcx + 1], 0
jmp 0x180030baf
xor r8d, r8d
movzx r9d, dil
mov rcx, rbx
lea edx, [r8 + 1]
call fcn.180001e40
inc dil
cmp dil, 0x7a
jbe 0x180030b70
jmp case.0x180030872.5
mov word [rbp - 0x70], dx
mov dword [rbp - 0x6e], 0x6c0061
mov word [rbp - 0x6a], r11w
mov dword [rbp - 0x68], 0x200065
jmp case.0x180030872.5
mov eax, 0x55
mov dword [rbp - 0x4a], 0x280045
mov edi, 0x6c
mov word [rbp - 0x4c], ax
mov word [rbp - 0x42], di
mov dword [rbp - 0x46], 0x610076
jmp 0x1800308e1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
xor r8d, r8d
mov r9b, 0x5f
mov rcx, rbx
lea edx, [r8 + 1]
call fcn.180001e40
mov ecx, dword [rsp + 0x4c]
xor r10d, r10d
mov r8, qword [rsp + 0x60]
lea r11, [0x180000000]
imul eax, ecx, 0x6e
mov edx, 0x29
movabs r9, 0x3300490032
lea edi, [rdx + 0x43]
add r14d, eax
cmp r14d, dword [rsp + 0x6c]
jbe 0x180030941
mov rax, qword [rbp - 0x80]
mov rcx, qword [rbp + 0x18]
xor rcx, rsp
call fcn.18006d4c0
mov rbx, qword [rsp + 0x160]
add rsp, 0x120
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov dword [rbp - 0x40], 0x650075
mov word [rbp - 0x3c], dx
jmp 0x180030c1e
mov r8d, 2
mov word [rbp - 0x3a], r10w
lea rdx, [0x1800745cc]
lea rcx, [rbp - 0x38]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov dword [rbp - 0x36], 0x47
lea rdx, [0x1800745d0]
mov r8d, 2
mov dword [rbp - 0x34], 0x49
lea rcx, [rbp - 0x32]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
jmp 0x180030c17
cmp r14d, 0xcc99
je 0x180030d31
cmp r14d, 0x1326f
jne 0x180030c1e
lea rcx, [rbp - 0x38]
sub rcx, 2
nop dword [rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x180030cf0
mov eax, dword [0x1800745b4]
movsd xmm0, qword [str.I16_V]
mov dword [rcx], eax
movzx eax, word [0x1800745b8]
mov word [rcx + 4], ax
mov eax, dword [0x1800745c8]
mov ecx, dword [rsp + 0x4c]
mov dword [rbp - 0x18], eax
mov qword [rbp - 0x16], r9
movsd qword [rbp - 0x20], xmm0
jmp 0x180030c1e
movsd xmm0, qword [str.EXT_]
mov eax, 0x5f
mov dword [rbp - 0x30], eax
movzx eax, word [0x1800745e0]
mov dword [rbp - 0x2e], 0x53
mov word [rbp - 0x24], ax
movsd qword [rbp - 0x2c], xmm0
jmp 0x180030c1e
mov r8d, 0xa
lea rdx, [rbp - 0x10]
lea ecx, [r8 - 8]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itow]
cmp qword [rbx + 0x18], 8
mov rcx, rbx
jb 0x180030d7e
mov rcx, qword [rbx]
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x30], rax
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea r8d, [rax + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r13, rax
mov byte [rsp + 0x40], 1
jmp 0x180030c17
cmp r14d, 0x32f9d
ja 0x180031038
je 0x180030f26
cmp r14d, 0x1fe1b
je 0x180030e73
cmp r14d, 0x263f1
je 0x180030e48
cmp r14d, 0x2c9c7
jne 0x180030c1e
cmp qword [r8 + 0x18], 0x10
mov rdx, r8
jb 0x180030df7
mov rdx, qword [r8]
mov r8d, dword [rsp + 0x58]
lea r9, [rsp + 0x68]
mov rcx, r13
mov qword [rsp + 0x20], r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r8d, dword [rsp + 0x50]
lea r9, [rbp - 0x38]
lea rdx, [rbp - 0x70]
mov rcx, rsi
call sub.IMM32.dll_ImmRegisterWordW
mov rcx, r13
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rsp + 0x4c]
xor r10d, r10d
test edi, edi
jne 0x180030c1e
mov byte [rsp + 0x40], dil
jmp 0x180030c1e
xor edx, edx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, qword [rsp + 0x60]
xor r8d, r8d
mov edx, eax
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x50], 1
call fcn.180043120
jmp 0x180030c17
cmp r13, 0xffffffffffffffff
jne 0x180030f19
nop dword [rax]
mov eax, edi
sub eax, 0x6c
je 0x180030f04
sub eax, 1
je 0x180030ee8
sub eax, 1
je 0x180030e9c
cmp eax, 1
je case.0x180030f56.0
jmp 0x180030f04
test r12d, r12d
movzx eax, r15b
mov ecx, r10d
cmove ecx, eax
movzx r15d, cl
test cl, cl
je 0x180030ee2
lea r8, [rbp - 0x78]
mov qword [rbp - 0x78], r10
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesDecodeIncrementalHandleCreate
mov rcx, qword [rsp + 0x70]
mov r12d, eax
test rcx, rcx
je 0x180030ed4
call sub.RPCRT4.dll_MesHandleFree
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x180030ee2
call sub.RPCRT4.dll_MesHandleFree
mov byte [rbp - 0x80], 0
jmp 0x180030f04
lea r9, [rsp + 0x70]
mov qword [rsp + 0x70], r10
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov r15b, 1
call sub.RPCRT4.dll_MesEncodeIncrementalHandleCreate
mov r12d, eax
inc edi
mov r10d, 0
cmp edi, 0x70
jb 0x180030e80
mov ecx, dword [rsp + 0x4c]
mov rsi, r10
mov dword [rsp + 0x68], r10d
jmp 0x180030c1e
mov eax, dword [rsp + 0x58]
cmp eax, dword [rsp + 0x68]
je 0x180031013
mov edi, 5
nop dword [rax]
cmp edi, 5
ja case.default.0x180030f56
mov eax, edi
mov ecx, dword [r11 + rax*4 + 0x310bc]
add rcx, r11
jmp rcx
cmp byte [rsp + 0x48], 0
je 0x180030f92
mov rcx, qword [rsp + 0x78]
xor r9d, r9d
mov dword [rsp + 0x28], r10d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r10
call sub.RPCRT4.dll_MesIncrementalHandleReset
mov rcx, qword [rsp + 0x78]
mov dword [rsp + 0x5c], eax
test rcx, rcx
je 0x180030f92
call sub.RPCRT4.dll_MesHandleFree
mov dword [rsp + 0x5c], eax
mov byte [rbp - 0x80], 0
jmp case.default.0x180030f56
mov qword [r8 + 0x10], r10
mov rax, r8
cmp qword [r8 + 0x18], 0x10
mov qword [rsp + 0x78], r10
jb 0x180030fae
mov rax, qword [r8]
mov byte [rax], 0
jmp case.default.0x180030f56
mov byte [rsp + 0x48], 1
jmp case.default.0x180030f56
movzx eax, byte [rsp + 0x48]
mov ecx, r10d
cmp dword [rsp + 0x5c], 0
cmove ecx, eax
mov byte [rsp + 0x48], cl
jmp case.default.0x180030f56
lea r9, [rsp + 0x78]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesEncodeIncrementalHandleCreate
mov dword [rsp + 0x5c], eax
mov r8, qword [rsp + 0x60]
lea r11, [0x180000000]
mov eax, 0xffffffff
mov r10d, 0
add edi, eax
lea eax, [rdi + 0x94]
cmp eax, 0x93
ja 0x180030f40
mov ecx, dword [rsp + 0x4c]
cmp byte [rsp + 0x40], 0
je 0x180030c1b
mov r8d, dword [rsp + 0x50]
lea r9, [rbp - 0x38]
lea rdx, [rbp - 0x70]
mov rcx, rsi
call sub.IMM32.dll_ImmUnregisterWordW
jmp 0x180030c17
cmp r14d, 0x39573
je 0x180031053
cmp r14d, 0x3fb49
je case.0x180030f56.0
jmp 0x180030c1e
mov byte [rbp - 0x80], 1
jmp 0x180030c1e