Function at 0x18004f5f0
Capabilities:
Get file size
Parse pe header

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f8]
sub rsp, 0x2f8
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov rax, qword [0x18012c3a8]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
mov qword [rbp - 0x68], r9
mov r12, r8
mov qword [rsp + 0x68], r8
mov rdi, rdx
mov rdx, qword [rcx + 0x188]
mov qword [rbp - 0x58], rdx
mov rdx, qword [rcx + 0x180]
mov qword [rbp - 0x60], rdx
mov rdx, qword [rcx + 0x1b8]
mov qword [rbp - 0x70], rdx
mov rdx, qword [rcx + 0x1c0]
mov qword [rbp - 0x78], rdx
mov rdx, qword [rcx + 0x1c8]
mov qword [rbp - 0x80], rdx
xor r13d, r13d
mov qword [r8], r13
mov qword [r9], r13
mov ebx, dword [rcx + 0x5c]
lea rax, vtable.CQHSimpleFile.0
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 0xffffffffffffffff
mov dword [rbp + 0x1d8], ebx
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x30]
call fcn.1800abaa0
test ebx, ebx
je 0x18004f6ab
call fcn.18005d170
nop
test rdi, rdi
je 0x18004fb03
mov rdx, rdi
lea rcx, [rbp - 0x40]
call fcn.18005bfd0
test eax, eax
je 0x18004fb03
mov rsi, qword [rbp - 0x38]
cmp rsi, 0xffffffffffffffff
jne 0x18004f6d7
mov r15, rsi
jmp 0x18004f729
xor eax, eax
mov qword [rsp + 0x30], rax
cmp dword [rbp + 0x1d8], eax
je 0x18004f6ff
lea ecx, [rax + 0x28]
call fcn.180033710
lea rdx, [rsp + 0x30]
mov rcx, rsi
test rax, rax
je 0x18004f707
call rax
jmp 0x18004f70d
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x18004f71a
mov r15, 0xffffffffffffffff
jmp 0x18004f729
mov r15, qword [rsp + 0x30]
cmp r15, 0x40
jbe 0x18004fb07
mov ebx, 0xa00000
cmp r15d, ebx
cmovl ebx, r15d
lea rax, vtable.CQHSimpleSmartBuffer.0
mov qword [rsp + 0x50], rax
mov r14d, r13d
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x60], r13
test ebx, ebx
jg 0x18004f75d
mov r14d, ebx
mov dword [rsp + 0x58], ebx
xor edi, edi
jmp 0x18004f7a3
movsxd r12, ebx
mov rcx, r12
call fcn.1800aebfc
mov r13, rax
test rax, rax
jne 0x18004f779
lea ecx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov qword [rsp + 0x60], r13
mov rdi, r13
test r13, r13
je 0x18004f79e
mov dword [rsp + 0x5c], ebx
mov r14d, ebx
mov dword [rsp + 0x58], ebx
mov r8, r12
xor edx, edx
mov rcx, r13
call fcn.1800abaa0
mov r12, qword [rsp + 0x68]
test rdi, rdi
je 0x18004fadd
cmp rsi, 0xffffffffffffffff
jne 0x18004f7b6
mov eax, esi
jmp 0x18004f7c5
mov r8d, r14d
mov rdx, r13
lea rcx, [rbp - 0x40]
call fcn.18005c0f0
cmp eax, r14d
jne 0x18004fadd
test rdi, rdi
je 0x18004fadd
mov eax, 0x5a4d
cmp word [rdi], ax
jne 0x18004fadd
movsxd rcx, dword [rdi + 0x3c]
movsxd r8, r15d
lea rax, [rcx + 0xf8]
cmp r8, rax
jbe 0x18004fadd
lea rdx, [rcx + rdi]
cmp dword [rdx], 0x4550
jne 0x18004fadd
movzx eax, word [rdx + 4]
mov r9d, 0x14c
cmp ax, r9w
jne 0x18004f871
mov eax, 0xe0
cmp word [rdx + 0x14], ax
jne 0x18004fadd
movzx eax, word [rdx + 6]
test ax, ax
je 0x18004fadd
movzx eax, ax
lea rcx, [rax + rax*4]
shl rcx, 3
sub rcx, rdi
lea rax, [rdx + 0xf8]
add rax, rcx
cmp r8, rax
jb 0x18004fadd
mov eax, 0x10b
cmp word [rdx + 0x18], ax
jne 0x18004fadd
add rdx, 0x98
jmp 0x18004f8f0
mov r9d, 0x8664
cmp ax, r9w
je 0x18004f88d
mov r9d, 0x200
cmp ax, r9w
jne 0x18004fadd
lea rax, [rcx + 0x108]
cmp r8, rax
jbe 0x18004fadd
mov eax, 0xf0
cmp word [rdx + 0x14], ax
jne 0x18004fadd
movzx eax, word [rdx + 6]
test ax, ax
je 0x18004fadd
movzx eax, ax
lea rcx, [rax + rax*4]
shl rcx, 3
sub rcx, rdi
lea rax, [rdx + 0x108]
add rax, rcx
cmp r8, rax
jb 0x18004fadd
mov eax, 0x20b
cmp word [rdx + 0x18], ax
jne 0x18004fadd
add rdx, 0xa8
test rdx, rdx
je 0x18004fadd
movsxd rdi, dword [rdx + 4]
mov r14d, dword [rdx]
test edi, edi
je 0x18004fadd
test r14d, r14d
je 0x18004fadd
lea rax, [r14 + 0xc]
cmp rax, r15
ja 0x18004fadd
lea rax, vtable.CQHSimpleSmartBuffer.0
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 0
xor ebx, ebx
mov qword [rsp + 0x48], rbx
test edi, edi
jg 0x18004f946
mov dword [rsp + 0x40], edi
xor eax, eax
jmp 0x18004f984
mov rcx, rdi
call fcn.1800aebfc
mov rbx, rax
test rax, rax
jne 0x18004f95f
lea ecx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov qword [rsp + 0x48], rbx
mov rax, rbx
test rbx, rbx
je 0x18004f984
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x40], edi
mov r8, rdi
xor edx, edx
mov rcx, rbx
call fcn.1800abaa0
mov rax, rbx
test rax, rax
je 0x18004fab7
cmp rsi, 0xffffffffffffffff
je 0x18004fab7
cmp dword [rbp + 0x1d8], 0
je 0x18004f9bf
mov ecx, 0xf
call fcn.180033710
xor r9d, r9d
xor r8d, r8d
mov edx, r14d
mov rcx, rsi
test rax, rax
je 0x18004f9cb
call rax
jmp 0x18004f9d1
xor r9d, r9d
xor r8d, r8d
mov edx, r14d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x18004fab7
mov r8d, edi
mov rdx, rbx
lea rcx, [rbp - 0x40]
call fcn.18005c0f0
cmp eax, edi
jne 0x18004fab7
mov ecx, dword [rbx]
cmp ecx, edi
ja 0x18004fab7
mov edx, 0x100
movzx eax, word [rbx + 4]
sub ax, dx
mov edx, 0xfeff
test dx, ax
jne 0x18004fab7
cmp word [rbx + 6], 2
jne 0x18004fab7
lea eax, [rcx - 8]
mov dword [rsp + 0x70], eax
lea rax, [rbx + 8]
mov qword [rsp + 0x78], rax
xor edi, edi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10001
lea ecx, [rdi + 5]
call qword [rbp - 0x80]
mov r15, rax
test rax, rax
je 0x18004fab9
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 2]
mov ecx, 0x10001
call qword [rbp - 0x78]
mov r14, rax
test rax, rax
je 0x18004faa2
lea r9d, [rdi + 1]
mov r8d, dword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
mov rcx, rax
call qword [rbp - 0x70]
test eax, eax
je 0x18004faa2
mov qword [r12], r15
mov rax, qword [rbp - 0x68]
mov qword [rax], r14
mov edi, 1
jmp 0x18004fab9
xor edx, edx
mov rcx, r15
call qword [rbp - 0x60]
test r14, r14
je 0x18004fab9
mov rcx, r14
call qword [rbp - 0x58]
jmp 0x18004fab9
xor edi, edi
lea r14, vtable.CQHSimpleSmartBuffer.0
mov qword [rsp + 0x38], r14
test rbx, rbx
je 0x18004fae6
mov rcx, rbx
call fcn.1800aea38
mov qword [rsp + 0x48], 0
jmp 0x18004fae6
xor edi, edi
lea r14, vtable.CQHSimpleSmartBuffer.0
mov qword [rsp + 0x50], r14
test r13, r13
je 0x18004fb0a
mov rcx, r13
call fcn.1800aea38
mov qword [rsp + 0x60], 0
jmp 0x18004fb0a
mov rsi, qword [rbp - 0x38]
mov edi, r13d
lea rax, vtable.CQHSimpleFile.0
mov qword [rbp - 0x40], rax
cmp rsi, 0xffffffffffffffff
je 0x18004fb4b
cmp dword [rbp + 0x1d8], 0
je 0x18004fb3a
mov ecx, 0x16
call fcn.180033710
mov rcx, rsi
test rax, rax
je 0x18004fb3d
call rax
jmp 0x18004fb43
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x38], 0xffffffffffffffff
mov eax, edi
mov rcx, qword [rbp + 0x1e0]
xor rcx, rsp
call fcn.18008f850
add rsp, 0x2f8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret