Function at 0x180050880
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x370]
sub rsp, 0x470
mov rax, qword [0x180079798]
xor rax, rsp
mov qword [rbp + 0x360], rax
xor ebx, ebx
mov qword [rbp - 0x58], rdx
mov r12, rdx
mov qword [rsp + 0x68], r9
mov rdx, qword [rbp + 0x3d0]
lea eax, [r8 + 0xb]
mov dword [rsp + 0x48], r8d
mov r14d, r8d
mov qword [rbp - 0x80], rdx
lea r11d, [rbx + 0x74]
lea rsi, [0x180000000]
mov rdi, rcx
mov r15d, r8d
cmp r8d, eax
jae 0x180050e04
mov r13, qword [rbp - 0x60]
lea eax, [r15 - 0x74]
movabs r10, 0x61006c0043
movabs r9, 0x6e006e0055
movabs r8, 0x6400310066
cmp eax, 0x3d
ja case.0x180050930.127
movzx eax, byte [rsi + rax + 0x512f4]
mov ecx, dword [rsi + rax*4 + 0x512c4]
add rcx, rsi
jmp rcx
movzx r14d, byte [rdi + 2]
nop word [rax + rax]
mov esi, 0x23
cmp esi, 0x23
je 0x1800509a8
cmp esi, 0xaf0
je 0x18005095f
cmp esi, 0x15bd
jne 0x1800509c3
add r14b, r14b
jmp 0x1800509c3
movzx eax, byte [rdi + 3]
test eax, eax
je 0x18005099c
sub eax, 1
je 0x18005098f
sub eax, 1
je 0x180050983
cmp eax, 1
jne 0x18005099e
dec byte [rdi + 1]
mov esi, 0xaf0
mov r15d, r11d
jmp 0x1800509c3
dec byte [rdi]
mov esi, 0xaf0
mov r15d, r11d
jmp 0x1800509c3
inc byte [rdi + 1]
mov esi, 0xaf0
mov r15d, r11d
jmp 0x1800509c3
inc byte [rdi]
mov esi, 0xaf0
mov r15d, r11d
jmp 0x1800509c3
test r14b, r14b
jns 0x1800509c3
mov r8, rdi
mov rdx, r12
mov ecx, 0x6c
call fcn.18003c530
mov r11d, 0x74
add esi, 0xacd
cmp esi, 0x2067
jbe 0x180050945
test r14b, r14b
jne 0x180050940
mov r14d, dword [rsp + 0x48]
jmp case.0x180050930.127
mov rax, qword [rsp + 0x68]
movzx eax, byte [rax]
add eax, 0xfffffff6
cmp eax, 0xb
ja case.0x180050a08.11
cdqe
mov ecx, dword [rsi + rax*4 + 0x51334]
add rcx, rsi
jmp rcx
mov esi, 0x114
nop
mov eax, esi
sub eax, 0x113
je 0x180050a4e
cmp eax, 1
jne 0x180050a3f
xor r9d, r9d
mov byte [rsp + 0x40], 2
lea rax, [rsp + 0x40]
mov rdx, rdi
mov rcx, r12
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 0x2b]
call fcn.180036b60
dec esi
cmp esi, 0x112
ja 0x180050a10
jmp case.0x180050a08.11
mov r9, r12
lea rcx, [0x18005bdd0]
mov r8, rdi
mov edx, 0xeb
call fcn.18002d9c0
jmp case.0x180050a08.11
mov r14d, 0xf3
cmp r14d, 0xf3
je 0x180050b55
cmp r14d, 0x788d
je 0x180050aa6
cmp r14d, 0xf027
jne 0x180050b70
xor r9d, r9d
xor r8d, r8d
mov dl, 3
mov rcx, r12
call qword [rdi + reloc.SHELL32.dll_ILFindLastID]
jmp 0x180050b70
movzx eax, byte [r13 + 4]
lea rcx, [rsp + 0x40]
or al, 0xb0
mov r9d, 0x68
mov r8, r12
mov byte [rsp + 0x40], al
mov rdx, rdi
call fcn.180043f50
mov esi, 0x17
nop dword [rax]
mov eax, esi
sub eax, 0x14
je 0x180050af8
sub eax, 1
je 0x180050af2
cmp eax, 2
jne 0x180050aff
xor r9d, r9d
mov r8b, 1
movzx edx, al
mov rcx, r12
call qword [rdi + reloc.SHELL32.dll_ILFindLastID]
jmp 0x180050aff
mov qword [r12], rdi
jmp 0x180050aff
mov rax, qword [r12]
mov qword [rdi], rax
inc esi
cmp esi, 0x1a
jb 0x180050ad0
mov r9, r12
mov dword [rsp + 0x20], 0x89
mov r8, rdi
mov rdx, r13
xor ecx, ecx
call fcn.1800350a0
test al, al
jne 0x180050b70
mov byte [rsp + 0x58], bl
mov rax, qword [rsp + 0x58]
mov rcx, qword [rbp + 0x360]
xor rcx, rsp
call fcn.1800596f0
mov rbx, qword [rsp + 0x4c0]
add rsp, 0x470
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r13, qword [rdi + 8]
lea rcx, [0x18005be48]
mov r9, r12
mov r8, rdi
mov edx, 0xeb
call fcn.18002d9c0
add r14d, 0x779a
cmp r14d, 0x166ce
jbe 0x180050a70
jmp 0x180050c55
mov r14d, 0x9f
nop
mov eax, r14d
sub eax, 0x9f
je 0x180050bdb
sub eax, 1
je 0x180050ba9
cmp eax, 1
je case.0x180050e5a.0
jmp 0x180050c45
movzx eax, byte [rdx]
lea rcx, [rsp + 0x40]
mov rdx, rdi
mov byte [rsp + 0x40], al
mov r9d, 0x68
mov r8, r12
call fcn.180043f50
xor r9d, r9d
xor r8d, r8d
mov dl, 3
mov rcx, r12
call qword [rdi + reloc.SHELL32.dll_ILFindLastID]
mov byte [rsp + 0x58], 1
jmp 0x180050c41
xor r9d, r9d
mov r8b, 1
mov dl, 3
mov rcx, r12
call qword [rdi + reloc.SHELL32.dll_ILFindLastID]
mov esi, 0x17
nop
mov eax, esi
sub eax, 0x14
je 0x180050c18
sub eax, 1
je 0x180050c12
cmp eax, 2
jne 0x180050c1f
xor r9d, r9d
xor r8d, r8d
movzx edx, al
mov rcx, r12
call qword [rdi + reloc.SHELL32.dll_ILFindLastID]
jmp 0x180050c1f
mov qword [r12], rdi
jmp 0x180050c1f
mov rax, qword [r12]
mov qword [rdi], rax
inc esi
cmp esi, 0x1a
jb 0x180050bf0
mov r9d, 0x68
mov byte [rsp + 0x40], 0x81
mov r8, r12
lea rcx, [rsp + 0x40]
mov rdx, rdi
call fcn.180043f50
mov rdx, qword [rbp - 0x80]
inc r14d
cmp r14d, 0xa2
jb 0x180050b90
mov r14d, dword [rsp + 0x48]
mov rax, qword [rsp + 0x68]
lea rdx, [rsp + 0x40]
mov r15d, 0x80
mov r9, rdi
mov r8, r12
movzx eax, byte [rax]
mov byte [rsp + 0x40], al
lea ecx, [r15 + 0x51]
mov rax, qword [rbp - 0x80]
mov qword [rsp + 0x20], rax
call fcn.1800070b0
mov byte [rsp + 0x58], al
jmp case.0x180050930.127
mov esi, 0x28
cmp esi, 0x28
je 0x180050cb6
cmp esi, 0x1798
jne 0x180050cd5
mov rcx, qword [r12]
mov rdx, rdi
call qword [0x1800798a0]
jmp 0x180050b2b
xor r9d, r9d
mov dword [rsp + 0x20], 0x4f
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.180025280
test al, al
je 0x180050df3
add esi, 0x1770
cmp esi, 0x2ee0
jbe 0x180050c97
mov dword [rbp], 0x61
jmp case.0x180050930.127
mov qword [rbp + 0x1a], r8
jmp case.0x180050930.127
mov dword [rbp - 8], 0x24
mov qword [rbp - 6], r9
jmp case.0x180050930.127
mov r8d, 3
lea rdx, [0x18006e868]
lea rcx, [rbp + 0xe]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov eax, dword [0x18006e870]
mov dword [rbp + 0x12], eax
mov eax, dword [0x18006e878]
mov dword [rbp + 0x16], eax
movzx eax, word [0x18006e87c]
mov word [rbp + 0x1a], ax
jmp case.0x180050930.127
mov eax, dword [0x18006e880]
mov dword [rbp + 6], 0x64
mov dword [rbp + 2], eax
mov qword [rbp + 8], r10
jmp case.0x180050930.127
xor r9d, r9d
mov qword [rsp + 0x20], rbx
lea r8, sym.stdvcs32.dll_PA_FreezeProcess
mov edx, 0x91
xor ecx, ecx
call fcn.180042950
inc r15d
lea eax, [r14 + 0xb]
cmp r15d, eax
jae 0x180050e04
mov rdx, qword [rbp - 0x80]
lea rsi, [0x180000000]
mov r11d, 0x74
jmp 0x1800508f3
mov ebx, 0x11e
mov eax, ebx
sub eax, 0x11e
je 0x180050db1
sub eax, 1
je 0x180050daa
cmp eax, 1
je case.0x180050e5a.0
jmp 0x180050dc8
mov byte [rsp + 0x58], 1
jmp 0x180050dc8
mov r9, r12
lea rcx, [0x18005be58]
mov r8, rdi
mov edx, 0xeb
call fcn.18002d9c0
inc ebx
cmp ebx, 0x121
jb 0x180050d91
mov r9, r12
lea rcx, [0x18005be68]
mov r8, rdi
mov edx, 0xeb
call fcn.18002d9c0
mov byte [rsp + 0x58], 1
jmp case.0x180050e5a.0
mov rax, rbx
jmp 0x180050b2b
mov dword [rsp + 0x58], ebx
jmp case.0x180050e5a.0
lea esi, [r14 - 0xc]
mov dword [rsp + 0x50], esi
cmp r14d, esi
jbe case.0x180050e5a.0
mov r15, qword [rbp - 0x60]
lea esi, [r14 - 0x82]
movzx r14d, byte [rsp + 0x40]
mov r12d, dword [rsp + 0x64]
mov r13d, dword [rsp + 0x64]
mov eax, dword [rsp + 0x50]
mov ecx, dword [rsp + 0x48]
mov dword [rsp + 0x70], esi
nop dword [rax]
cmp esi, 0x16
ja case.default.0x180050e5a
lea rdx, [0x180000000]
mov ecx, dword [rdx + rsi*4 + 0x51364]
add rcx, rdx
jmp rcx
mov byte [rsp + 0x40], 1
mov rcx, rbx
mov dword [rsp + 0x78], ebx
nop dword [rax + rax]
movzx eax, word [rbp + rcx - 8]
mov word [rbp + rcx + 0x40], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x180050e70
jmp case.0x180050e5a.11
call qword [sym.imp.dbghelp.dll_SymGetOptions]
mov dword [rsp + 0x7c], eax
jmp case.0x180050e5a.11
mov byte [rsp + 0x58], 1
jmp case.0x180050e5a.11
mov edx, dword [rsp + 0x60]
xor r8d, r8d
mov rcx, rdi
call fcn.1800265a0
jmp case.0x180050e5a.11
lea rcx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_AddAtomW]
cmp qword [rdi + 0x18], 0x10
mov rdx, rdi
mov word [rsp + 0x54], ax
jb 0x180050ed1
mov rdx, qword [rdi]
mov r8d, dword [rsp + 0x60]
lea r9, [rsp + 0x78]
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x180050e5a.11
movzx ecx, word [rsp + 0x54]
lea rdx, [rbp + 0x40]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetAtomNameW]
movzx eax, byte [rsp + 0x40]
mov ecx, ebx
cmp dword [rsp + 0x7c], ebx
cmovne ecx, eax
mov byte [rsp + 0x40], cl
jmp case.0x180050e5a.11
mov rax, qword [rdi]
lea rcx, [rsp + 0x70]
mov r9, qword [rbp - 0x58]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x20], 0x31
call fcn.180044f10
jmp case.0x180050e5a.11
mov rax, qword [rbp - 0x58]
mov rcx, rax
cmp qword [rax + 0x18], 8
jb 0x180050f60
mov rcx, qword [rax]
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x68], rax
cmp rax, 0xffffffffffffffff
jne case.0x180050e5a.11
mov esi, 0xd3
nop dword [rax + rax]
cmp esi, 0x277
ja 0x180051079
je 0x18005106b
mov eax, esi
sub eax, 0xd3
je 0x18005103f
sub eax, 0x54
je 0x180051026
sub eax, 0x54
je 0x180050ff8
sub eax, 0x54
je 0x180050fe4
cmp eax, 0x54
jne 0x180051130
lea rax, [rbp - 0x18]
mov qword [rbp - 0x48], rax
jmp 0x180051130
mov byte [rsp + 0x4c], 1
mov r14b, 1
mov r15, 0xffffffffffffffff
jmp 0x180051130
mov r8d, 1
lea rdx, [0x18006e888]
lea rcx, [rbp - 0x18]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov eax, 0x72
mov word [rbp - 0x10], ax
mov eax, 0x74
mov word [rbp - 0xf], ax
jmp 0x180051130
movzx eax, word [0x18006e894]
mov word [rbp - 0x14], ax
mov eax, 0x74
mov word [rbp - 0x12], ax
jmp 0x180051130
mov eax, 0x63
lea rdx, [0x18006e890]
lea rcx, [rbp - 0x18]
mov word [rbp - 0x18], ax
lea r8d, [rax - 0x61]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov eax, 0x75
mov word [rbp - 0x15], ax
jmp 0x180051130
mov r12d, 2
mov dword [rbp - 0x78], ebx
jmp 0x180051130
mov eax, esi
sub eax, 0x2cb
je 0x1800510f9
sub eax, 0x54
je 0x1800510cb
sub eax, 0x54
je 0x1800510b3
sub eax, 0x54
je 0x18005109f
cmp eax, 0x54
je 0x180050b22
jmp 0x180051130
test r14b, r14b
je 0x180051130
mov rcx, qword [rbp - 0x50]
call sub.RPCRT4.dll_MesHandleFree
jmp 0x180051130
cmp byte [rsp + 0x4c], bl
je 0x180051130
lea r8, [rbp - 0x40]
mov edx, r12d
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_SetKernelObjectSecurity]
jmp 0x180051130
movzx eax, byte [rsp + 0x4c]
lea r8, [rbp - 0x50]
cmp dword [rbp - 0x74], ebx
lea rdx, [rbp - 0x78]
mov ecx, ebx
cmovne ecx, eax
mov byte [rsp + 0x4c], cl
lea rcx, [rbp - 0x48]
call sub.RPCRT4.dll_MesEncodeDynBufferHandleCreate
test eax, eax
movzx r14d, r14b
cmovne r14d, ebx
jmp 0x180051130
xor eax, eax
mov qword [rbp - 0x50], rbx
xorps xmm0, xmm0
mov qword [rbp - 0x20], rax
lea rax, [rbp - 0x80]
mov r9d, 0x28
lea r8, [rbp - 0x40]
mov qword [rsp + 0x20], rax
mov edx, r12d
mov rcx, r15
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
call qword [sym.imp.ADVAPI32.dll_GetKernelObjectSecurity]
mov dword [rbp - 0x74], eax
add esi, 0x54
cmp esi, 0x46f
jb 0x180050fa0
mov esi, dword [rsp + 0x70]
jmp case.0x180050e5a.11
mov rcx, qword [rsp + 0x68]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x60], eax
jmp case.0x180050e5a.11
mov eax, dword [rsp + 0x60]
cmp eax, dword [rsp + 0x78]
je 0x180051247
mov esi, 0xb9
cmp esi, 0x13268
ja 0x1800511d4
je 0x1800511b9
cmp esi, 0xb9
je 0x1800511b3
cmp esi, 0x669e
je 0x1800511a3
cmp esi, 0xcc83
jne 0x180051231
mov dword [rbp - 0x6c], 0x14
jmp 0x180051231
mov qword [rbp - 0x60], rbx
mov dword [rbp - 0x68], 0xa
jmp 0x180051231
mov dword [rsp + 0x64], ebx
jmp 0x180051231
mov qword [rdi + 0x10], rbx
mov rax, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x1800511ca
mov rax, qword [rdi]
mov byte [rax], bl
mov r13d, 0x1e
jmp 0x180051231
cmp esi, 0x1984d
je 0x18005120c
cmp esi, 0x1fe32
je 0x1800511f2
cmp esi, 0x26417
je case.0x180050e5a.0
jmp 0x180051231
mov r8d, dword [rbp - 0x70]
lea rdx, [rbp + 0x250]
mov rcx, qword [rbp - 0x60]
call sub.IMM32.dll_ImmGetIMEFileNameA
mov byte [rsp + 0x58], bl
jmp 0x180051231
mov r8d, dword [rbp - 0x6c]
mov r9d, r13d
mov edx, dword [rbp - 0x68]
mov ecx, dword [rsp + 0x64]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
mov dword [rbp - 0x70], 0x104
call qword [sym.imp.GDI32.dll_LineDDA]
add esi, 0x65e5
cmp esi, 0x2c943
jbe 0x180051171
mov esi, dword [rsp + 0x70]
movzx ecx, word [rsp + 0x54]
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
cmp byte [rsp + 0x40], bl
je case.0x180050e5a.11
mov ecx, dword [rsp + 0x7c]
call qword [sym.imp.dbghelp.dll_SymSetOptions]
jmp case.0x180050e5a.11
mov r8d, 0xa
mov dword [rbp + 0x20], 0x66
lea rdx, [rbp + 0x22]
lea ecx, [r8 + 0xd]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ltow]
mov eax, dword [0x18006e8a0]
movsd xmm0, qword [str.e_107_]
mov dword [rbp + 0x2e], eax
movzx eax, word [0x18006e8a4]
mov word [rbp + 0x32], ax
movsd qword [rbp + 0x26], xmm0
mov eax, dword [rsp + 0x50]
mov ecx, dword [rsp + 0x48]
dec ecx
dec esi
mov dword [rsp + 0x48], ecx
mov dword [rsp + 0x70], esi
cmp ecx, eax
ja 0x180050e40
jmp case.0x180050e5a.0