Function at 0x180080270
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x630]
sub rsp, 0x730
mov rax, qword [0x180357660]
xor rax, rsp
mov qword [rbp + 0x610], rax
imul eax, r8d, 0x896
xor r9d, r9d
mov r14d, r8d
mov dword [rsp + 0x54], r8d
mov rdi, rdx
mov qword [rsp + 0x70], rdx
mov rbx, rcx
mov qword [rsp + 0x58], rcx
mov r12d, r8d
mov dword [rsp + 0x48], eax
cmp r8d, eax
ja 0x1800805d4
mov r13d, dword [rsp + 0x4c]
lea rdx, [0x180000000]
imul ecx, r14d, 0x9d
lea esi, [r9 + 0x5f]
movaps xmmword [rsp + 0x720], xmm6
lea r14d, [r9 + 0x70]
lea r15d, [r9 + 0x75]
xorps xmm6, xmm6
lea r10d, [r9 + 0x6e]
lea r11d, [r9 + 0x4d]
mov dword [rsp + 0x44], ecx
lea r8d, [r9 + 0x74]
nop dword [rax]
cmp r12d, 0xb574
ja 0x1800807fa
je 0x18008079b
cmp r12d, 0x126
ja 0x18008073c
je 0x1800806ad
cmp r12d, 0x6c
je 0x18008067b
cmp r12d, 0x77
je 0x18008066f
cmp r12d, 0xff
jne 0x1800805a2
mov r14, qword [rdi + 0x20]
test r14, r14
je 0x18008059c
mov r15d, 0x113
nop word [rax + rax]
mov eax, r15d
sub eax, 0x110
je 0x18008055c
sub eax, 1
je 0x180080520
sub eax, 1
je 0x1800804b2
cmp eax, 1
jne 0x180080565
cmp dword [r14 + 8], 0
mov edi, r9d
jle 0x1800803cb
lea rbx, [r14 + 0x20]
mov rcx, qword [rbx]
test rcx, rcx
je 0x1800803b5
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
inc edi
add rbx, 8
cmp edi, dword [r14 + 8]
jl 0x1800803a7
xor r9d, r9d
lea rdx, [0x180000000]
cmp dword [r14 + 0xc], 0
mov esi, r9d
jle 0x180080413
lea rdi, [r14 + 0x220]
lea rbx, [r14 + 0x320]
mov rcx, qword [rbx]
test rcx, rcx
je 0x1800803f9
movsxd rax, dword [rdi]
mov rax, qword [rdx + rax*8 + 0xc2a28]
call qword [rax + ILClone]
inc esi
lea rdx, [0x180000000]
add rbx, 8
add rdi, 4
cmp esi, dword [r14 + 0xc]
jl 0x1800803e3
xor r9d, r9d
cmp dword [r14 + 0x10], 0
mov esi, r9d
jle 0x180080460
lea rdi, [r14 + 0x520]
lea rbx, [r14 + 0x620]
nop dword [rax + rax]
mov rcx, qword [rbx]
test rcx, rcx
je 0x18008044d
movsxd rax, dword [rdi]
lea rdx, [0x180000000]
mov rax, qword [rdx + rax*8 + 0xc2978]
call qword [rax + 0x18]
inc esi
add rbx, 8
add rdi, 4
cmp esi, dword [r14 + 0x10]
jl 0x180080430
xor r9d, r9d
cmp dword [r14 + 0x14], 0
mov esi, r9d
jle 0x180080565
lea rdi, [r14 + 0x820]
lea rbx, [r14 + 0x920]
nop dword [rax]
mov rcx, qword [rbx]
test rcx, rcx
je 0x18008049d
movsxd rax, dword [rdi]
lea rdx, [0x180000000]
mov rax, qword [rdx + rax*8 + 0xc2988]
call qword [rax + 0x18]
inc esi
add rbx, 8
add rdi, 4
cmp esi, dword [r14 + 0x14]
jl 0x180080480
jmp 0x180080565
cmp dword [r14 + 0x18], 0
mov ebx, r9d
jle 0x180080512
lea rdi, [r14 + 0xb20]
mov rdx, qword [rdi]
test rdx, rdx
je 0x1800804da
xor r9d, r9d
xor r8d, r8d
lea ecx, [r9 + 0x2d]
call fcn.1800345c0
mov rdx, qword [r14 + 0x1320]
test rdx, rdx
je 0x180080506
mov eax, ebx
xor r9d, r9d
imul rcx, rax, 0x58
xor r8d, r8d
add rcx, rdx
xor edx, edx
mov qword [rsp + 0x20], rcx
mov ecx, 0xee
call fcn.180076390
inc ebx
add rdi, 8
cmp ebx, dword [r14 + 0x18]
jl 0x1800804c3
mov rcx, qword [r14 + 0x1320]
test rcx, rcx
je 0x180080565
jmp 0x18008055f
cmp dword [r14 + 0x1c], 0
mov edi, r9d
jle 0x180080565
lea rbx, [r14 + 0x1328]
mov rdx, qword [rbx]
xor r8d, r8d
mov qword [rsp + 0x20], r9
xor r9d, r9d
lea ecx, [r9 + 0x7f]
call fcn.180025220
inc edi
lea rbx, [rbx + 8]
mov r9d, 0
cmp edi, dword [r14 + 0x1c]
jl 0x180080531
jmp 0x180080565
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
dec r15d
lea rdx, [0x180000000]
mov r9d, 0
cmp r15d, 0x10f
ja 0x180080370
mov eax, dword [rsp + 0x48]
lea esi, [r9 + 0x5f]
mov ecx, dword [rsp + 0x44]
lea r15d, [r9 + 0x75]
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x70]
mov r14d, 0x70
mov r9d, 0
lea rdx, [0x180000000]
add r12d, ecx
lea r8d, [r9 + 0x74]
lea r10d, [r9 + 0x6e]
lea r11d, [r9 + 0x4d]
cmp r12d, eax
jbe 0x180080310
mov r14d, dword [rsp + 0x54]
movaps xmm6, xmmword [rsp + 0x720]
movzx ebx, byte [rsp + 0x40]
mov esi, r14d
imul eax, r14d, 0x80a
mov dword [rsp + 0x60], eax
cmp r14d, eax
ja 0x180080ac5
movzx r14d, byte [rsp + 0x40]
movabs rcx, 0x7800650064006e
mov r12d, dword [rsp + 0x4c]
movabs rdx, 0x41006400650068
mov r13, qword [rsp + 0x78]
mov r8d, 0x43
movzx r15d, byte [rsp + 0x40]
cmp esi, 0x1deca
ja 0x1800809be
je 0x1800809b4
cmp esi, 0xcd76
ja 0x180080969
je 0x180080958
cmp esi, 0x77
je 0x18008094c
cmp esi, 0x44cc
je 0x18008091e
cmp esi, 0x8921
jne 0x180080c8f
mov word [rbp - 0x12], r8w
jmp 0x180080c8f
mov dword [rbp - 0x68], 0x750041
jmp 0x1800805a2
cmp dword [rbx], 0
mov ecx, r9d
jle 0x1800806a4
mov rax, rdi
nop word [rax + rax]
mov dword [rax], 6
lea rax, [rax + 4]
inc ecx
cmp ecx, dword [rbx]
jl 0x180080690
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x44]
jmp 0x1800805a2
movss xmm1, dword [rdi + 0x98]
comiss xmm1, xmm6
ja 0x1800806ca
movss xmm0, dword [rdi + 0xa0]
mov r13d, r9d
comiss xmm0, xmm6
jbe 0x1800806d0
mov r13d, 1
movss xmm0, dword [rbx]
addss xmm0, dword [rdi + 0x9c]
comiss xmm0, xmm1
movss dword [rdi + 0x9c], xmm0
jae 0x1800806fa
ucomiss xmm1, xmm6
jp 0x1800806f0
je 0x1800806fa
cmp qword [rdi + 0x90], 0
jne 0x180080723
comiss xmm1, xmm6
jbe 0x180080723
mov dword [rsp + 0x28], 0x147
mov r8, rdi
mov qword [rsp + 0x20], r9
xor edx, edx
xor r9d, r9d
xor ecx, ecx
call fcn.18009b030
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x44]
movss xmm0, dword [rbx]
addss xmm0, dword [rdi + 0xa4]
movss dword [rdi + 0xa4], xmm0
jmp 0x1800805a2
cmp r12d, 0x4972
je 0x180080783
cmp r12d, 0x926d
je 0x180080770
cmp r12d, 0x9d62
jne 0x1800805a2
xorps xmm0, xmm0
xor edx, edx
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
mov qword [rdi + 0x20], rdx
jmp 0x1800805a2
mov dword [rbp - 0x5a], 0x750070
mov dword [rbp - 0x56], 0x480074
jmp 0x1800805a2
mov dword [rbp - 0x64], 0x690064
mov dword [rbp - 0x60], 0x49006f
mov word [rbp - 0x5c], r10w
jmp 0x1800805a2
movss xmm1, dword [rdi + 0xa0]
movss xmm0, dword [rdi + 0xa4]
comiss xmm0, xmm1
jae 0x1800807b7
ucomiss xmm1, xmm6
jp 0x1800807c2
jne 0x1800807c2
mov qword [rdi + 0xa0], 0
test r13d, r13d
je 0x1800805a2
mov qword [rsp + 0x30], r9
xor r8d, r8d
mov dword [rsp + 0x28], 0x5b
mov rdx, rdi
mov qword [rsp + 0x20], r9
xor ecx, ecx
xor r9d, r9d
call fcn.18007f1d0
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x44]
jmp 0x1800805a2
cmp r12d, 0x16d5e
ja 0x1800808c9
je 0x1800808b9
cmp r12d, 0xdb68
je 0x1800808a8
cmp r12d, 0x12463
je 0x180080897
cmp r12d, 0x169c2
jne 0x1800805a2
cmp dword [rdi + 0xac], 0
je 0x1800805a2
movss xmm0, dword [rdi + 0xb0]
movaps xmm1, xmm0
addss xmm1, dword [rbx]
cvttss2si ecx, xmm0
cvttss2si eax, xmm1
movss dword [rdi + 0xb0], xmm1
cmp ecx, eax
je 0x1800806a0
mov rax, qword [rdi + 0xb8]
lea rdx, [0x180341909]
mov r8, qword [rdi + 0xc0]
test rax, rax
mov ecx, PathMakeUniqueName
cmovne rdx, rax
call fcn.1800484f0
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x44]
jmp 0x1800805a2
mov word [rbp - 0x4c], r11w
mov dword [rbp - 0x4a], 0x670073
jmp 0x1800805a2
mov dword [rbp - 0x52], 0x73006f
mov word [rbp - 0x4e], r8w
jmp 0x1800805a2
mov word [rbp - 0x46], si
mov dword [rbp - 0x44], 0x6c0043
jmp 0x1800805a2
cmp r12d, 0x1b659
je 0x1800808ff
cmp r12d, 0x21e10
jne 0x1800805a2
xor r9d, r9d
xor r8d, r8d
mov edx, 0xd5
mov rcx, rdi
call fcn.180023780
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x44]
jmp 0x1800805a2
mov dword [rbp - 0x40], 0x73006f
mov dword [rbp - 0x3c], 0x530065
mov word [rbp - 0x38], r8w
mov dword [rbp - 0x36], 0x650072
jmp 0x1800805a2
movsd xmm0, qword [0x180345e6a]
movzx eax, word [0x180345e72]
movsd qword [rbp - 0x20], xmm0
mov word [rbp - 0x18], ax
mov word [rbp - 0x2e], r9w
mov dword [rbp - 0x16], 0x740065
mov word [rbp - 0x12], r9w
jmp 0x180080c8f
mov dword [rbp - 0x32], 0x6d0061
jmp 0x180080c8f
mov dword [rbp - 0x10], 0x630061
mov word [rbp - 0xc], r9w
jmp 0x180080c8f
cmp esi, 0x111cb
je 0x1800809ab
cmp esi, 0x15620
je 0x18008098e
cmp esi, 0x19a75
jne 0x180080c8f
mov qword [rbp + 6], rcx
jmp 0x180080c8f
movsd xmm0, qword [0x180345dfc]
movzx eax, word [0x180345e04]
movsd qword [rbp - 4], xmm0
mov word [rbp + 4], ax
jmp 0x180080c8f
mov qword [rbp - 0xc], rdx
jmp 0x180080c8f
mov word [rbp + 0xe], r9w
jmp 0x180080c8f
cmp esi, 0x2f01e
ja 0x180080c31
je 0x180080b70
cmp esi, 0x2231f
je 0x180080a3a
cmp esi, 0x26774
jne 0x180080c8f
mov rdi, qword [rsp + 0x68]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, qword [rsp + 0x58]
xor r8d, r8d
mov edx, eax
mov dword [rsp + 0x48], eax
call fcn.18009c340
mov rax, qword [rsp + 0x58]
mov rdx, rax
cmp qword [rax + 0x18], 0x10
jb 0x180080a19
mov rdx, qword [rax]
mov r8d, dword [rsp + 0x48]
lea r9, [rsp + 0x50]
mov rcx, rdi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x180080c72
mov r8d, 1
lea rdx, [0x180345d4c]
lea rcx, [rbp - 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
cmp qword [rdi + 0x18], 8
mov rcx, rdi
jb 0x180080a5e
mov rcx, qword [rdi]
mov eax, 3
mov qword [rsp + 0x30], 0
mov r8d, eax
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov dword [rsp + 0x20], eax
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x68], rax
cmp rax, 0xffffffffffffffff
jne 0x180080b63
mov edi, SHSetFolderPathW
nop dword [rax]
mov ecx, edi
sub ecx, 0xe5
je 0x180080b51
sub ecx, 0x1b
je 0x180080b3d
sub ecx, 0x1b
je 0x180080af2
cmp ecx, 0x1b
jne 0x180080b54
movzx eax, bl
mov rcx, qword [rbp + 0x610]
xor rcx, rsp
call fcn.1800bfa40
mov rbx, qword [rsp + 0x780]
add rsp, 0x730
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [rbp - 0x78]
lea rax, [rbp + 0x1f0]
mov dword [rsp + 0x28], 0x104
lea r9, [rbp - 0x70]
lea r8, [rbp - 0x80]
mov qword [rsp + 0x20], rax
xor edx, edx
call sub.SHELL32.dll_SHGetUnreadMailCountW
test eax, eax
je 0x180080b24
xor r14b, r14b
xor bl, bl
jmp 0x180080b54
test r14b, r14b
je 0x180080b39
lea r8, [rbp + 0x1f0]
xor edx, edx
xor ecx, ecx
call sub.SHELL32.dll_SHSetUnreadMailCountW
xor bl, bl
jmp 0x180080b54
xor eax, eax
xor ecx, ecx
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
call qword [sym.imp.SHELL32.dll_DragFinish]
jmp 0x180080b54
mov r14b, 1
add edi, 0x1b
cmp edi, 0x151
jb 0x180080aa0
xor r9d, r9d
mov dword [rsp + 0x50], r9d
jmp 0x180080c75
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x48]
cmp eax, dword [rsp + 0x50]
je 0x180080c72
mov edi, SHTestTokenMembership
nop
mov eax, edi
sub eax, 0xee
je 0x180080cad
sub eax, 1
je 0x180080bed
sub eax, 1
je 0x180080bb8
xor r9d, r9d
cmp eax, 1
jne 0x180080c21
movzx r15d, al
mov r13d, r9d
jmp 0x180080c21
mov rcx, qword [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x78], r9
mov rax, rcx
mov byte [rsp + 0x46], r9b
mov qword [rcx + 0x10], r9
cmp qword [rcx + 0x18], 0x10
jb 0x180080bdb
mov rax, qword [rcx]
mov byte [rax], r9b
mov r12d, r9d
mov eax, 3
mov word [rsp + 0x44], ax
jmp 0x180080c21
mov r8d, r12d
mov dword [rsp + 0x4c], 0
lea rdx, [rsp + 0x44]
mov rcx, r13
call qword [sym.imp.SHELL32.dll_ILAppendID]
test rax, rax
jne 0x180080c10
xor r15b, r15b
jmp 0x180080c1e
test r15b, r15b
je 0x180080c1e
mov rcx, rax
call qword [sym.imp.SHELL32.dll_ILFree]
xor r9d, r9d
dec edi
cmp edi, 0xed
ja 0x180080b90
jmp 0x180080c75
cmp esi, 0x33473
je 0x180080c48
cmp esi, 0x378c8
jne 0x180080c8f
mov al, 1
jmp 0x180080ac8
xor r9d, r9d
lea rdx, [rbp - 0x68]
xor r8d, r8d
lea rcx, [rbp + 0x400]
call qword [sym.imp.SHELL32.dll_PathYetAnotherMakeUniqueName]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x4000000
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
xor r9d, r9d
movabs rcx, 0x7800650064006e
movabs rdx, 0x41006400650068
mov r8d, 0x43
imul eax, dword [rsp + 0x54], 0x93
add esi, eax
cmp esi, dword [rsp + 0x60]
ja 0x180080ac5
mov rdi, qword [rsp + 0x70]
jmp 0x180080620
mov edx, dword [rsp + 0x4c]
mov rcx, qword [rsp + 0x78]
call sub.SHELL32.dll_SHTestTokenMembership
xor al, al
jmp 0x180080ac8