Function at 0x180093a20
Capabilities:
Get file size
Read file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 8], ecx
mov rax, rsp
sub rsp, 0x1a8
cmp ecx, 6
mov qword [rax - 0x18], rsi
mov qword [rax - 0x28], r12
mov r12d, r8d
mov eax, ecx
mov r10d, r9d
mov rsi, rdx
ja 0x180093a7d
cmp eax, 1
je 0x180093ed5
cmp eax, 2
je 0x180093ed5
cmp eax, 5
je 0x180093ecd
cmp eax, 3
je 0x180093ecd
test ecx, ecx
je 0x180093a86
cmp eax, 6
je 0x180093a86
cmp eax, 4
je 0x180093a86
mov ax, 0xa
jmp 0x180093bd8
mov r9, qword [rsp + 0x1e0]
mov ecx, dword [rsp + 0x1d0]
lea rdx, [rsp + 0x50]
mov r8d, 1
call fcn.180093030
test rax, rax
jne 0x180093ab3
mov ax, 0x1f
jmp 0x180093bd8
mov qword [rsp + 0x1a0], rbx
mov qword [rsp + 0x198], rbp
xor ebp, ebp
mov qword [rsp + 0x30], rbp
lea r8d, [rbp + 1]
xor r9d, r9d
mov edx, 0x80000000
mov rcx, rax
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x180093b01
mov ax, 0x1f
jmp 0x180093bc8
lea rdx, [rsp + 0x40]
mov rcx, rax
mov qword [rsp + 0x178], r13
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp dword [rsp + 0x40], ebp
mov r13d, eax
mov dword [rsp + 0x48], eax
je 0x180093b31
mov r13d, 0xffffffff
mov dword [rsp + 0x48], r13d
jmp 0x180093b3e
test eax, eax
jne 0x180093b3e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [r13 + 0x10]
mov qword [rsp + 0x188], rdi
xor ecx, ecx
movsxd rdi, eax
mov qword [rsp + 0x170], r14
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
test rax, rax
mov r14, rax
jne 0x180093b77
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ax, reloc.WSOCK32.dll_ioctlsocket
jmp 0x180093bb0
mov rdx, rdi
xor ecx, ecx
mov qword [rsp + 0x168], r15
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
test rax, rax
mov r15, rax
jne 0x180093bf0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ax, reloc.WSOCK32.dll_ioctlsocket
mov r15, qword [rsp + 0x168]
mov rdi, qword [rsp + 0x188]
mov r14, qword [rsp + 0x170]
mov r13, qword [rsp + 0x178]
mov rbx, qword [rsp + 0x1a0]
mov rbp, qword [rsp + 0x198]
mov r12, qword [rsp + 0x180]
mov rsi, qword [rsp + 0x190]
add rsp, 0x1a8
ret
lea r9, [rsp + 0x40]
mov r8d, r13d
mov rdx, r14
mov rcx, rbx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r13d, dword [rsp + 0x40]
mov rcx, rbx
test eax, eax
cmove r13d, ebp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r13d, r13d
mov r11d, ebp
mov r8d, ebp
mov rcx, rbp
je 0x180093c65
mov rdx, r15
nop
movzx eax, byte [rcx + r14]
mov byte [rdx], al
cmp byte [rcx + r14], 0xd
jne 0x180093c57
lea eax, [r13 - 1]
cmp r11d, eax
jae 0x180093c54
cmp byte [rcx + r14 + 1], 0xa
jne 0x180093c54
inc r8d
jmp 0x180093c5a
mov byte [rdx], 0xa
inc rdx
inc r11d
inc rcx
cmp r11d, r13d
jb 0x180093c30
mov r9d, dword [rsp + 0x48]
sub r13d, r8d
mov ebx, ebp
sub r9d, r8d
test r13d, r13d
mov r8, rbp
je 0x180093d5d
lea r10, [0x180000000]
cmp byte [r8 + r15], 0x42
lea rdx, [r8 + r15]
jne 0x180093ccf
mov ecx, ebx
mov eax, r9d
add rcx, 0x2d
cmp rcx, rax
ja 0x180093d5d
mov rcx, rbp
nop
nop
nop
movzx eax, byte [rcx + r10 + 0x117600]
cmp byte [rdx + rcx], al
jne 0x180093ccf
inc rcx
cmp rcx, 0x2b
jl 0x180093cb0
cmp byte [r8 + r15 + 0x2b], 0xa
je 0x180093cde
inc ebx
inc r8
cmp ebx, r13d
jb 0x180093c85
jmp 0x180093d5d
mov edi, ebx
add ebx, 0x2d
cmp ebx, r13d
movsxd rax, ebx
jae 0x180093d5d
lea r8, [rax + r15]
nop
cmp byte [r8], 0x45
jne 0x180093d2f
lea eax, [r9 + 1]
mov edx, ebx
mov ecx, eax
add rdx, 0x2d
cmp rdx, rcx
ja 0x180093d5d
mov rcx, rbp
nop
nop
movzx eax, byte [rcx + r10 + 0x117780]
cmp byte [r8 + rcx], al
jne 0x180093d2f
inc rcx
cmp rcx, 0x2b
jl 0x180093d10
cmp byte [r8 + 0x2b], 0xa
je 0x180093d3b
inc ebx
inc r8
cmp ebx, r13d
jb 0x180093cf0
jmp 0x180093d5d
mov r8, qword [rsp + 0x1e0]
mov edx, dword [rsp + 0x1d0]
add edi, 0x2c
mov ecx, edi
sub ebx, edi
add rcx, r15
call fcn.180090100
test eax, eax
jne 0x180093d78
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ax, reloc.WSOCK32.dll_setsockopt
jmp 0x180093ba8
test ebx, ebx
movsxd rax, edi
je 0x180093d5d
add rax, r15
cmp byte [rax], 0xa
je 0x180093d93
inc edi
inc rax
add ebx, 0xffffffff
jne 0x180093d82
jmp 0x180093d5d
inc edi
add ebx, 0xffffffff
je 0x180093d5d
test ebx, ebx
movsxd rax, edi
je 0x180093dc7
mov rcx, r14
add rax, r15
mov r8d, ebx
nop
nop
movzx edx, byte [rax]
cmp dl, 0xa
je 0x180093dbf
mov byte [rcx], dl
inc ebp
inc rcx
inc rax
dec r8
jne 0x180093db0
lea eax, [rbp + rbp*2]
xor ecx, ecx
shr eax, 2
add eax, 0x10
movsxd rdx, eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
test rax, rax
mov rdi, rax
jne 0x180093dff
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ax, reloc.WSOCK32.dll_ioctlsocket
jmp 0x180093ba8
test ebp, ebp
je 0x180093e0d
cmp byte [rbp + r14 - 1], 0xa
jne 0x180093e0d
dec ebp
lea rdx, [rsp + 0x44]
mov r9d, ebp
mov r8, r14
mov rcx, rax
call fcn.18008a3a0
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
test ebx, ebx
je 0x180093e4a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ax, reloc.WSOCK32.dll_setsockopt
jmp 0x180093ba8
cmp dword [rsp + 0x1b0], 4
je 0x180093eb0
mov ecx, dword [rsp + 0x1c8]
lea eax, [r12 + rcx]
cmp eax, dword [rsp + 0x44]
jbe 0x180093e77
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ax, 0xa
jmp 0x180093ba8
test r12d, r12d
mov rax, rcx
je 0x180093ebc
sub rax, rsi
lea rcx, [rax + rdi]
nop
nop
nop
movzx eax, byte [rcx + rsi]
inc rsi
dec r12d
mov byte [rsi - 1], al
jne 0x180093e90
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor ax, ax
jmp 0x180093ba8
cmp r12d, 4
jne 0x180093e65
mov eax, dword [rsp + 0x44]
mov dword [rsi], eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor ax, ax
jmp 0x180093ba8
xor ax, ax
jmp 0x180093bd8
mov rax, qword [rsp + 0x1e0]
mov r9d, dword [rsp + 0x1d0]
mov r8d, r10d
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x1d8]
mov edx, r12d
mov rcx, rsi
mov dword [rsp + 0x20], eax
call fcn.1800935e0
jmp 0x180093bd8