Function at 0x180002880
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov rcx, r14
xor edx, edx
mov ebx, r15d
mov dword [rbp + 0x58], r15d
mov dword [rbp - 0x10], r15d
mov word [rbp + 0x50], r15w
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp eax, 0xa
jae 0x1800028c9
mov dword [rsi], eax
jmp 0x180002c1c
mov r9d, 2
xor r8d, r8d
mov rcx, r14
lea edx, [r9 - 0xc]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x1800028ee
mov ebx, 0xb
jmp 0x180002c1c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
lea r8d, [rdx + 0xc]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x180002916
mov dword [rax], r15d
mov word [rax + 4], r15w
mov dword [rax + 8], r15d
jmp 0x180002919
mov rax, r15
mov qword [rsi + 8], rax
test rax, rax
jne 0x18000292a
lea ebx, [rax + 8]
jmp 0x180002c1c
lea r9, [rbp + 0x58]
lea rdx, [rbp - 0x10]
mov r8d, 4
mov rcx, r14
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180002c17
cmp dword [rbp + 0x58], 4
jne 0x180002c17
mov rcx, qword [rsi + 8]
mov eax, dword [rbp - 0x10]
lea r9, [rbp + 0x58]
mov dword [rcx], eax
lea rdx, [rbp + 0x50]
mov r8d, 2
mov rcx, r14
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180002c17
cmp dword [rbp + 0x58], 2
jne 0x180002c17
mov rcx, qword [rsi + 8]
movzx eax, word [rbp + 0x50]
lea r9, [rbp + 0x58]
mov word [rcx + 4], ax
lea rdx, [rbp - 0x10]
mov r8d, 4
mov rcx, r14
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180002c17
cmp dword [rbp + 0x58], 4
jne 0x180002c17
mov rcx, qword [rsi + 8]
mov eax, dword [rbp - 0x10]
mov dword [rcx + 8], eax
mov rcx, qword [rsi + 8]
mov eax, dword [rcx + 8]
lea r12d, [rax + 0xa]
cmp r12d, eax
sbb ebx, ebx
and ebx, 0x80004005
jl 0x180002c1c
cmp dword [rcx], 0x53706158
jne 0x180002c13
cmp r12d, edi
ja 0x180002c13
sub edi, r12d
mov dword [rsi], edi
cmp r12d, 0x400000
ja 0x180002c17
movzx r13d, word [rcx + 4]
mov eax, 0x18
mul r13
mov rdi, rax
mov rax, 0xffffffffffffffff
cmovo rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdx, rax
test rax, rax
je 0x180002a76
lea ecx, [r13 - 1]
test ecx, ecx
js 0x180002a79
add rax, 4
nop dword [rax]
mov qword [rax - 4], r15
mov qword [rax + 4], r15
mov byte [rax + 0xc], r15b
add rax, 0x18
dec ecx
jns 0x180002a60
jmp 0x180002a79
mov rdx, r15
mov qword [rsi + 0x10], rdx
test rdx, rdx
jne 0x180002a8c
mov ebx, 8
jmp 0x180002c3d
neg r12d
mov r9d, 2
xor r8d, r8d
mov edx, r12d
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x180002ab3
mov ebx, 0x80004005
jmp 0x180002c3d
mov rax, qword [rsi + 8]
mov r13d, r15d
cmp r15w, word [rax + 4]
jae 0x180002c3d
mov r12, r15
nop dword [rax + rax]
lea r9, [rbp + 0x58]
lea rdx, [rbp + 0x50]
mov r8d, 2
mov rcx, r14
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180002aa9
cmp dword [rbp + 0x58], 2
jne 0x180002aa9
mov rcx, qword [rsi + 0x10]
movzx eax, word [rbp + 0x50]
lea r9, [rbp + 0x58]
mov word [r12 + rcx], ax
lea rdx, [rbp + 0x50]
mov r8d, 2
mov rcx, r14
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180002aa9
cmp dword [rbp + 0x58], 2
jne 0x180002aa9
mov rcx, qword [rsi + 0x10]
movzx eax, word [rbp + 0x50]
lea r9, [rbp + 0x58]
mov word [r12 + rcx + 2], ax
lea rdx, [rbp - 0x10]
mov r8d, 4
mov rcx, r14
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180002aa9
cmp dword [rbp + 0x58], 4
jne 0x180002aa9
mov eax, dword [rbp - 0x10]
mov rcx, qword [rsi + 0x10]
mov dword [r12 + rcx + 4], eax
mov rax, qword [rsi + 0x10]
mov edi, dword [r12 + rax + 4]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, edi
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdx, rax
mov rax, qword [rsi + 0x10]
mov qword [r12 + rax + 8], rdx
mov rax, qword [rsi + 0x10]
mov rdi, qword [r12 + rax + 8]
test rdi, rdi
je 0x180002a82
mov ecx, dword [r12 + rax + 4]
xor eax, eax
lea r9, [rbp + 0x58]
rep stosb byte [rdi], al
mov rax, qword [rsi + 0x10]
mov rcx, r14
mov byte [r12 + rax + 0x10], 1
mov rdx, qword [rsi + 0x10]
mov qword [rsp + 0x20], r15
mov r8d, dword [r12 + rdx + 4]
mov rdx, qword [r12 + rdx + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180002aa9
mov rax, qword [rsi + 0x10]
mov ecx, dword [r12 + rax + 4]
cmp dword [rbp + 0x58], ecx
jne 0x180002aa9
mov rax, qword [rsi + 8]
inc r13d
add r12, 0x18
movzx ecx, word [rax + 4]
cmp r13d, ecx
jl 0x180002ad0
jmp 0x180002c3d
mov dword [rsi], edi
jmp 0x180002c1c
mov ebx, 0x80004005
mov rdi, qword [rsi + 8]
test rdi, rdi
je 0x180002c3d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsi + 8], r15
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret