Function at 0x180015850
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x28], 0
mov rbx, rcx
je 0x18001140e
cmp dword [rcx + 0x24], 0
jne 0x18001140e
mov rax, qword [rcx + 0xc8]
sub rax, qword [rcx + 0xc0]
test rax, 0xfffffffffffffff8
jne 0x18001138e
mov eax, 0x80004005
add rsp, 0x20
pop rbx
ret
xor ecx, ecx
mov qword [rsp + 0x30], rdi
call fcn.180062784
mov rcx, rax
call fcn.1800627e4
call fcn.1800627fc
mov edi, eax
call fcn.1800627fc
add edi, eax
call fcn.1800627fc
imul edi, eax
call fcn.1800627fc
mov rcx, qword [rbx + 0xc8]
sub rcx, qword [rbx + 0xc0]
add edi, eax
sar rcx, 3
test rcx, rcx
jne 0x1800113db
call fcn.18006265c
mov rax, qword [rbx + 0xc0]
mov rcx, qword [rax]
cmp qword [rcx + 0x50], 0
jne 0x1800113fd
mov edx, edi
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
jmp 0x180015bd0
mov edx, edi
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
jmp 0x180015850
xor eax, eax
add rsp, 0x20
pop rbx
ret
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0xa0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0xe0], rbx
mov rax, qword [0x1800f7050]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov r13d, edx
mov r12, rcx
cmp qword [rcx + 0x58], 8
jb 0x180015895
mov rcx, qword [rcx + 0x40]
jmp 0x180015899
add rcx, 0x40
xor esi, esi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [rsi + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x60], rax
cmp rax, 0xffffffffffffffff
jne 0x1800158d7
call fcn.1800030e0
nop
jmp 0x180015b9e
mov qword [rsp + 0x48], rsi
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x180015905
call fcn.1800030e0
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x180015b9e
mov rax, qword [rsp + 0x48]
cmp rax, 0x100000
jle 0x180015925
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x80004005
jmp 0x180015b9e
lea ecx, [rax + 0x200]
lea rdx, [0x1800fee28]
call fcn.1800626b4
mov rbp, rax
mov qword [rsp + 0x58], rax
test rax, rax
jne 0x180015957
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x8007000e
jmp 0x180015b9e
mov r8d, dword [rsp + 0x48]
add r8d, 0x200
xor edx, edx
mov rcx, rax
call fcn.1800644c0
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x40]
mov r8d, dword [rsp + 0x48]
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1800159b0
call fcn.1800030e0
mov edi, eax
mov rcx, rbp
call fcn.1800626bc
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x180015b9e
cmp dword [rsp + 0x40], 0
jne 0x1800159d3
mov rcx, rbp
call fcn.1800626bc
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x80004005
jmp 0x180015b9e
mov qword [rsp + 0x88], 0xf
mov qword [rsp + 0x80], rsi
mov byte [rsp + 0x70], 0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbp
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbp
lea rcx, [rsp + 0x68]
call fcn.180002410
nop
mov r8d, r13d
lea rdx, [rsp + 0x68]
mov rcx, r12
call fcn.180015e80
mov edi, eax
test eax, eax
js 0x180015b5c
cmp eax, 1
je 0x180015b5c
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x180015a93
call fcn.1800030e0
mov edi, eax
cmp qword [rsp + 0x88], 0x10
jb 0x180015a61
mov rcx, qword [rsp + 0x70]
call fcn.1800620e0
mov qword [rsp + 0x88], 0xf
mov qword [rsp + 0x80], rsi
mov byte [rsp + 0x70], 0
mov rcx, rbp
call fcn.1800626bc
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x180015b9e
mov dword [rsp + 0x40], esi
lea rdx, [rsp + 0x70]
cmp qword [rsp + 0x88], 0x10
cmovae rdx, qword [rsp + 0x70]
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x40]
mov r8d, dword [rsp + 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x180015b18
call fcn.1800030e0
mov edi, eax
cmp qword [rsp + 0x88], 0x10
jb 0x180015ae6
mov rcx, qword [rsp + 0x70]
call fcn.1800620e0
mov qword [rsp + 0x88], 0xf
mov qword [rsp + 0x80], rsi
mov byte [rsp + 0x70], 0
mov rcx, rbp
call fcn.1800626bc
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x180015b9e
cmp qword [rsp + 0x88], 0x10
jb 0x180015b2d
mov rcx, qword [rsp + 0x70]
call fcn.1800620e0
mov qword [rsp + 0x88], 0xf
mov qword [rsp + 0x80], rsi
mov byte [rsp + 0x70], 0
mov rcx, rbp
call fcn.1800626bc
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x180015b9e
cmp qword [rsp + 0x88], 0x10
jb 0x180015b71
mov rcx, qword [rsp + 0x70]
call fcn.1800620e0
mov qword [rsp + 0x88], 0xf
mov qword [rsp + 0x80], rsi
mov byte [rsp + 0x70], 0
mov rcx, rbp
call fcn.1800626bc
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.180062100
mov rbx, qword [rsp + 0xe0]
add rsp, 0xa0
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0xe0], rbx
mov rax, qword [0x1800f7050]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r14d, edx
mov rbp, rcx
mov rax, qword [rcx + 0x20]
sub rax, qword [rcx + 0x18]
sar rax, 3
test rax, rax
jne 0x180015c22
call fcn.18006265c
mov rax, qword [rbp + 0x18]
mov rsi, qword [rax]
cmp dword [rsi + 0x5c], 0
je 0x180015e48
cmp qword [rsi + 0x10], 0xffffffffffffffff
je 0x180015e48
mov r13d, dword [rsi + 0x60]
lea rdx, [0x1800fee28]
mov rcx, r13
call fcn.1800626b4
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x180015c68
mov eax, 0x8007000e
jmp 0x180015e4d
mov r8, r13
xor edx, edx
mov rcx, rax
call fcn.1800644c0
mov eax, dword [rsi + 0x5c]
test eax, eax
je 0x180015e37
mov rdx, qword [rsi + 0x10]
cmp rdx, 0xffffffffffffffff
je 0x180015e37
mov ecx, dword [rsi + 0x60]
cmp r13d, ecx
jae 0x180015ca0
mov edi, 0x80004005
jmp 0x180015e3c
mov qword [rsp + 0x40], rax
xor r15d, r15d
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ecx
lea r9, [rsp + 0x40]
lea r8d, [r15 + 1]
mov rcx, rsi
call fcn.1800039e0
mov edi, eax
test eax, eax
js 0x180015e3c
cmp eax, 1
je 0x180015e3c
mov qword [rsp + 0x78], 0xf
mov qword [rsp + 0x70], r15
mov byte [rsp + 0x60], r15b
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.180002410
nop
mov r8d, r14d
lea rdx, [rsp + 0x58]
mov rcx, rbp
call fcn.180015e80
mov edi, eax
test eax, eax
js 0x180015e06
cmp eax, 1
je 0x180015e06
mov r8, r13
xor edx, edx
mov rcx, rbx
call fcn.1800644c0
mov r8, qword [rsp + 0x70]
cmp r8, r13
jbe 0x180015d7e
cmp qword [rsp + 0x78], 0x10
jb 0x180015d59
mov rcx, qword [rsp + 0x60]
call fcn.1800620e0
mov qword [rsp + 0x78], 0xf
mov qword [rsp + 0x70], r15
mov byte [rsp + 0x60], 0
mov rcx, rbx
call fcn.1800626bc
mov eax, 0x80004005
jmp 0x180015e4d
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rdx, qword [rsp + 0x60]
mov rcx, rbx
call fcn.180063290
mov edx, dword [rsi + 0x60]
cmp r13d, edx
jb 0x180015dd0
mov eax, dword [rsi + 0x5c]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], edx
lea r9, [rsp + 0x40]
mov r8d, 1
mov rdx, qword [rsi + 0x10]
mov rcx, rsi
call fcn.180003b50
mov edi, eax
jmp 0x180015dd5
mov edi, 0x80070057
cmp qword [rsp + 0x78], 0x10
jb 0x180015de7
mov rcx, qword [rsp + 0x60]
call fcn.1800620e0
mov qword [rsp + 0x78], 0xf
mov qword [rsp + 0x70], r15
mov byte [rsp + 0x60], 0
mov rcx, rbx
call fcn.1800626bc
mov eax, edi
jmp 0x180015e4d
cmp qword [rsp + 0x78], 0x10
jb 0x180015e18
mov rcx, qword [rsp + 0x60]
call fcn.1800620e0
mov qword [rsp + 0x78], 0xf
mov qword [rsp + 0x70], r15
mov byte [rsp + 0x60], 0
mov rcx, rbx
call fcn.1800626bc
mov eax, edi
jmp 0x180015e4d
mov edi, 0x80004005
mov rcx, rbx
call fcn.1800626bc
mov eax, edi
jmp 0x180015e4d
mov eax, 0x80004005
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.180062100
mov rbx, qword [rsp + 0xe0]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret