Function at 0x18002f820
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x840]
sub rsp, 0x940
mov rax, qword [0x180070310]
xor rax, rsp
mov qword [rbp + 0x830], rax
mov esi, r9d
mov dword [rbp - 0x30], r9d
mov qword [rbp - 0x20], r8
mov r13, rdx
mov qword [rbp + 0x38], rdx
mov qword [rbp + 0x40], rcx
mov rcx, qword [rbp + 0x8a0]
mov qword [rbp - 0x10], rcx
mov rcx, qword [rbp + 0x8a8]
mov qword [rbp + 0x48], rcx
mov rcx, qword [rbp + 0x8b0]
mov qword [rbp + 0x28], rcx
mov rcx, qword [rbp + 0x8b8]
mov qword [rbp - 0x18], rcx
mov rdx, qword [rbp + 0x8c0]
mov qword [rsp + 0x78], rdx
movdqa xmm0, xmmword [0x18006a460]
movdqa xmmword [rbp + 0xe0], xmm0
mov byte [rbp + 0xd0], 0
xor ebx, ebx
mov qword [rbp + 0x60], rbx
mov eax, 0xf
mov qword [rbp + 0x68], rax
mov byte [rbp + 0x50], bl
mov r15d, r9d
mov dword [rbp - 0x48], r9d
imul r14d, r9d, 0xdec
mov dword [rbp - 0x58], r14d
cmp r9d, r14d
ja 0x18003023a
lea r9d, [rbx + 0x74]
lea r8d, [rbx + 0x3b]
lea r10d, [rbx + 0x73]
mov r12, qword [rbp + 0x10]
mov r14, qword [rbp - 8]
mov ecx, 0x4d6e
mov eax, 0x70
cmp r15d, 0x532d
ja 0x18002fd69
je 0x18002fd22
cmp r15d, 0x1a5d
ja 0x18002f9ca
je 0x18002f9b3
cmp r15d, 0x11
je 0x18002f990
cmp r15d, 0x20
je 0x180030197
cmp r15d, 0x6b
je 0x18002f958
cmp r15d, 0xd37
jne 0x180030179
mov dword [rbp + 0x60c], 0x690075
jmp 0x180030179
mov byte [0x1800703e8], 0
lea r9, [rbp + 0xd0]
mov r8, rdx
lea rdx, [rbp + 0x50]
mov ecx, 0x24
call fcn.180034e60
test al, al
jne 0x180030166
mov byte [rbp - 0x80], 0
mov rbx, qword [rbp - 0x80]
mov rax, qword [rbp + 0x68]
jmp 0x18003023e
mov dword [rbp + 0x600], 0x700073
mov dword [rbp + 0x604], 0x640061
mov dword [rbp + 0x608], 0x730065
jmp 0x180030179
mov dword [rbp + 0x610], 0x3b0074
mov word [rbp + 0x614], r10w
jmp 0x180030179
cmp r15d, 0x2783
je 0x18002fd16
cmp r15d, 0x34a9
je 0x18002fd07
cmp r15d, 0x41cf
je 0x18002fcf8
cmp r15d, 0x4ef5
jne 0x180030179
mov rcx, rdx
cmp qword [rdx + 0x18], 8
jb 0x18002fa0b
mov rcx, qword [rdx]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp - 0x28], rax
cmp rax, 0xffffffffffffffff
jne 0x180030166
mov esi, 0x84
mov dword [rbp - 0x50], esi
nop dword [rax + rax]
cmp esi, 0x84
je 0x18002fcd3
cmp esi, 0x40f8
je 0x18002fcac
cmp esi, 0x816c
je 0x18002faaf
cmp esi, 0xc1e0
je 0x18002fa89
cmp esi, 0x10254
je 0x18002f983
jmp 0x18002fcdb
cmp byte [rsp + 0x72], 0
je 0x18002fa9a
mov rcx, qword [rbp + 8]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov edx, dword [rbp - 0x40]
mov ecx, dword [rbp - 0x34]
call qword [sym.imp.ADVAPI32.dll_AreAllAccessesGranted]
mov byte [rbp - 0x80], 0
jmp 0x18002fcdb
mov dword [rbp - 0x40], ebx
cmp qword [rbp + 8], 0
jne 0x18002fcdb
mov edi, 0x12
mov r13, qword [rbp + 0x30]
mov r12d, dword [rbp - 0x38]
movzx r15d, byte [rsp + 0x71]
lea r14, [0x180000000]
mov esi, 0x7361
nop dword [rax]
cmp ebx, 0x11
ja case.default.0x18002faf6
mov eax, ebx
mov ecx, dword [r14 + rax*4 + 0x302fc]
add rcx, r14
jmp rcx
lea rcx, [rbp + 0x110]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
xor ecx, ecx
movzx eax, r15b
test r12d, r12d
cmove ecx, eax
movzx r15d, cl
test cl, cl
je case.default.0x18002faf6
mov rcx, qword [rbp]
call sub.RPCRT4.dll_MesHandleFree
jmp case.default.0x18002faf6
mov byte [rbp + 0x5ea], 0
jmp case.default.0x18002faf6
mov dword [rbp - 0x3c], 0
jmp case.default.0x18002faf6
mov qword [rbp], 0
jmp case.default.0x18002faf6
mov byte [rbp + 0x5ed], 0
jmp case.default.0x18002faf6
mov eax, dword [0x180067f0f]
mov dword [rbp + 0x5f7], eax
movzx eax, byte [0x180067f13]
mov byte [rbp + 0x5fb], al
jmp case.default.0x18002faf6
mov dword [rbp + 0x5ed], 0x35783024
jmp case.default.0x18002faf6
lea r8, [rbp]
lea rdx, [rbp - 0x3c]
lea rcx, [rbp + 0x20]
call sub.RPCRT4.dll_MesEncodeDynBufferHandleCreate
mov r12d, eax
jmp case.default.0x18002faf6
mov r8d, 5
lea rdx, [0x180067f19]
lea rcx, [rbp + 0x5e1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp case.default.0x18002faf6
xor edx, edx
mov r8d, 0x4d0
lea rcx, [rbp + 0x110]
call sub.VCRUNTIME140.dll_memset
xor r13d, r13d
jmp case.default.0x18002faf6
mov word [rbp + 0x5ea], si
mov byte [rbp + 0x5ec], 0x73
jmp case.default.0x18002faf6
mov byte [rbp + 0x5fd], 0
mov r15b, 1
lea rax, [rbp + 0x5e0]
mov qword [rbp + 0x20], rax
jmp case.default.0x18002faf6
mov byte [rbp + 0x5f7], 0
jmp case.default.0x18002faf6
mov byte [rbp + 0x5fc], 0x24
jmp case.default.0x18002faf6
mov byte [rbp + 0x5f1], 0
mov r8d, 3
lea rdx, [0x180067f40]
lea rcx, [rbp + 0x5e0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
movzx eax, word [0x180067f60]
mov word [rbp + 0x5f4], ax
movzx eax, byte [0x180067f62]
mov byte [rbp + 0x5f6], al
jmp case.default.0x18002faf6
mov dword [rbp + 0x5e6], 0x6c436465
jmp case.default.0x18002faf6
mov word [rbp + 0x5e0], 0x24
jmp case.default.0x18002faf6
mov rcx, r13
call qword [sym.imp.SHELL32.dll_DragFinish]
mov byte [rsp + 0x72], 0
inc ebx
sub rdi, 1
jne 0x18002fae0
mov byte [rsp + 0x71], r15b
mov dword [rbp - 0x38], r12d
mov qword [rbp + 0x30], r13
mov esi, dword [rbp - 0x50]
mov r14, qword [rbp - 8]
mov r15d, dword [rbp - 0x48]
mov r12, qword [rbp + 0x10]
mov r13, qword [rbp + 0x38]
xor ebx, ebx
jmp 0x18002fcdb
xor edx, edx
mov r8d, 0x1a4
lea rcx, [rbp + 0x620]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x620]
call qword [sym.imp.GDI32.dll_CreateFontIndirectExW]
mov qword [rbp + 8], rax
jmp 0x18002fcdb
mov byte [rsp + 0x72], 1
mov dword [rbp - 0x34], ebx
add esi, 0x4074
mov dword [rbp - 0x50], esi
cmp esi, 0x14244
jbe 0x18002fa50
mov esi, dword [rbp - 0x30]
jmp 0x180030166
mov dword [rbp + 0x61c], 0x3b
jmp 0x180030179
mov dword [rbp + 0x618], 0x720061
jmp 0x180030179
mov word [rbp + 0x616], ax
jmp 0x180030179
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x9d
lea rcx, [rbp + 0xd0]
call fcn.18002b810
test al, al
je 0x18002f97f
lea rdx, [rbp + 0x50]
mov ecx, 0x32
call fcn.180030690
mov r12, rax
mov qword [rbp + 0x10], rax
test rax, rax
je 0x18002f97f
jmp 0x180030166
cmp r15d, 0x90b3
ja 0x1800300b8
je 0x18003009d
cmp r15d, 0x5c1b
je 0x180030095
cmp r15d, 0x6941
je 0x180030074
cmp r15d, 0x7667
je 0x18003003b
cmp r15d, 0x838d
jne 0x180030179
mov eax, dword [rbp - 0x78]
cmp eax, dword [rbp - 0x4c]
je 0x180030179
mov edi, 0x26
cmp edi, 0x26
je 0x180030010
cmp edi, 0x130
je 0x18002ffdc
cmp edi, 0x23a
je 0x18002ffbc
cmp edi, 0x344
je 0x18002fdfb
cmp edi, 0x44e
je 0x18002f983
jmp 0x180030024
cmp byte [rsp + 0x70], 0
je 0x18002ff99
mov ebx, 0x126
nop dword [rax + rax]
cmp ebx, 0x142b6
ja 0x18002fee7
je 0x18002fec2
cmp ebx, 0x126
je 0x18002fe81
cmp ebx, 0x4176
je 0x18002fe72
cmp ebx, 0x81c6
je 0x18002fe66
cmp ebx, 0xc216
je 0x18002fe5a
cmp ebx, 0x10266
jne 0x18002ff85
mov byte [rbp + 0x5eb], 0
jmp 0x18002ff85
mov word [rbp + 0x5e9], cx
jmp 0x18002ff85
mov byte [rbp + 0x5e8], 0x72
jmp 0x18002ff85
mov dword [rbp + 0x5e4], 0x61654c6f
jmp 0x18002ff85
movzx eax, word [0x180067e60]
mov word [rbp + 0x5e0], ax
movzx eax, byte [0x180067e62]
mov byte [rbp + 0x5e2], al
mov byte [rbp + 0x5e3], 0
mov r8d, 1
lea rdx, [0x180067e71]
lea rcx, [rbp + 0x5e3]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x18002ff80
mov eax, dword [0x180067eef]
mov dword [rbp + 0x5eb], eax
movzx eax, byte [0x180067ef3]
mov byte [rbp + 0x5ef], al
mov byte [rbp + 0x5f0], 0
jmp 0x18002ff85
cmp ebx, 0x18306
je 0x18002ff34
cmp ebx, 0x1c356
je 0x18002ff28
cmp ebx, 0x203a6
je 0x18002ff12
cmp ebx, 0x243f6
jne 0x18002ff85
mov rcx, r14
call qword [sym.imp.dbghelp.dll_SymCleanup]
jmp 0x18002ff80
lea r8, [rbp + 0x70]
lea rdx, [rbp + 0x5e0]
mov rcx, r14
call qword [sym.imp.dbghelp.dll_SymFromName]
jmp 0x18002ff80
mov dword [rbp + 0xc0], 0x7d0
jmp 0x18002ff85
mov r8d, 1
lea rdx, [0x180067e1f]
lea rcx, [rbp + 0x5e0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x74], xmm0
movups xmmword [rbp + 0x84], xmm0
movups xmmword [rbp + 0x94], xmm0
movups xmmword [rbp + 0xa4], xmm0
movups xmmword [rbp + 0xb4], xmm0
mov dword [rbp + 0xc4], eax
mov dword [rbp + 0x70], 0x58
mov ecx, 0x4d6e
add ebx, 0x4050
cmp ebx, 0x28320
jbe 0x18002fe10
xor ebx, ebx
mov r9d, dword [rbp - 0x70]
lea r8, [rbp + 0x620]
mov edx, dword [rbp - 0x68]
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.SHELL32.dll_DragQueryFileW]
mov byte [rbp - 0x80], 0
mov ecx, 0x4d6e
jmp 0x180030024
mov dword [rbp - 0x70], 0x104
mov ecx, ebx
movzx eax, byte [rsp + 0x70]
cmp dword [rbp - 0x60], 0
cmovne ecx, eax
mov byte [rsp + 0x70], cl
mov ecx, 0x4d6e
jmp 0x180030024
mov dword [rbp - 0x68], 0xffffffff
mov qword [r13 + 0x10], rbx
mov rax, r13
cmp qword [r13 + 0x18], 0x10
jb 0x18002fff5
mov rax, qword [r13]
mov byte [rax], 0
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.dbghelp.dll_SymInitialize]
mov dword [rbp - 0x60], eax
mov ecx, 0x4d6e
jmp 0x180030024
mov byte [rsp + 0x70], 1
mov qword [rbp + 0x18], rbx
mov r14, 0xffffffffffffffff
mov qword [rbp - 8], r14
add edi, 0x10a
cmp edi, 0x532
jbe 0x18002fdc1
jmp 0x180030166
mov rdx, r13
cmp qword [r13 + 0x18], 0x10
jb 0x180030049
mov rdx, qword [r13]
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x4c]
mov r8d, dword [rbp - 0x78]
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov byte [rsp + 0x73], 0
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180030166
xor edx, edx
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rbp - 0x78], eax
mov edx, eax
xor r8d, r8d
mov rcx, r13
call fcn.180063830
jmp 0x180030166
mov dword [rbp - 0x4c], ebx
jmp 0x180030179
movzx edx, byte [rsp + 0x73]
lea rcx, [rbp + 0x600]
call qword [sym.imp.ADVAPI32.dll_SaferiIsExecutableFileType]
mov byte [rbp - 0x80], 1
jmp 0x180030166
cmp r15d, 0x9dd9
je 0x18002f983
cmp r15d, 0xa5ef
je 0x1800300f3
cmp r15d, 0xf8b1
jne 0x180030179
mov byte [0x1800703e8], 1
mov byte [rbp - 0x80], 1
mov rbx, qword [rbp - 0x80]
mov rax, qword [rbp + 0x68]
jmp 0x18003023e
mov rbx, qword [0x180070458]
cmp rbx, qword [0x180070460]
je 0x180030179
mov rcx, r12
call qword [rbx]
test al, al
jne 0x180030159
mov edi, 0x116
mov eax, edi
sub eax, 0x114
je 0x18002f983
sub eax, 1
je 0x18003014b
cmp eax, 1
jne 0x18003014f
mov qword [rbp - 0x48], r12
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x48]
xor r8d, r8d
xor edx, edx
lea ecx, [rax + 0xc]
call fcn.1800258c0
jmp 0x18003014f
mov byte [rbp - 0x80], 0
dec edi
cmp edi, 0x113
ja 0x180030111
add rbx, 8
cmp rbx, qword [0x180070460]
jne 0x180030103
mov rdx, qword [rsp + 0x78]
mov r8d, 0x3b
lea r9d, [r8 + 0x39]
lea r10d, [r8 + 0x38]
imul eax, esi, 0xc6
add r15d, eax
mov dword [rbp - 0x48], r15d
cmp r15d, dword [rbp - 0x58]
ja 0x180030236
xor ebx, ebx
jmp 0x18002f8f6
mov dword [rbp - 0x70], ebx
mov rax, qword [rbp - 0x20]
mov rax, qword [rax]
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x58], 1
mov rax, qword [rbp + 0x28]
mov eax, dword [rax]
mov dword [rbp - 0x68], eax
mov rax, qword [rbp - 0x18]
mov eax, dword [rax]
mov dword [rbp - 0x60], eax
mov rax, qword [rbp - 0x10]
mov rax, qword [rax]
mov qword [rbp - 0x10], rax
mov rax, qword [r13]
mov qword [rbp - 0x18], rax
lea rax, [rbp - 0x58]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rbx
mov rax, qword [rbp + 0x40]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], 0xbb
lea rax, [rbp - 0x10]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x68]
xor r8d, r8d
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x70]
call fcn.18003d3a0
mov rbx, rax
mov rax, qword [rbp + 0x68]
jmp 0x18003023e
mov rax, qword [rbp + 0x68]
mov rbx, qword [rbp - 0x80]
cmp rax, 0x10
jb 0x180030279
lea rdx, [rax + 1]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180030274
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180030274
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800639bc
xor eax, eax
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x68], 0xf
mov byte [rbp + 0x50], al
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0x10
jb 0x1800302ce
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800302c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800302c9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800639bc
mov rax, rbx
mov rcx, qword [rbp + 0x830]
xor rcx, rsp
call fcn.1800643d0
mov rbx, qword [rsp + 0x998]
add rsp, 0x940
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret