Function at 0x180002300
Capabilities:
Get file size
Read file on windows
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rbp, rcx
mov edx, 0x18
mov ecx, 1
call fcn.18009e5f8
mov rdi, rax
test rax, rax
je 0x180002623
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rbx + rbp], 0
jne 0x180002340
inc ebx
mov r14d, ebx
lea rcx, [rbx + rbx]
call fcn.18009e614
xor r15d, r15d
mov rsi, rax
test rax, rax
je 0x1800024e3
mov dword [rsp + 0x28], ebx
mov r9d, 0xffffffff
mov r8, rbp
mov qword [rsp + 0x20], rax
mov edx, 8
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jg 0x18000239a
mov r8d, r14d
mov rdx, rbp
mov rcx, rsi
call fcn.18009e900
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov dword [rsp + 0x28], 0x40000080
mov edx, 0x80000000
mov r8d, 1
mov dword [rsp + 0x20], 3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, rsi
mov rbx, rax
call fcn.18009e600
cmp rbx, 0xffffffffffffffff
je 0x1800024e3
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
xor r9d, r9d
mov qword [rsp + 0x28], r15
xor edx, edx
mov dword [rdi + 8], eax
mov r8d, 2
mov dword [rsp + 0x20], r15d
mov rcx, rbx
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov qword [rdi + 0x10], rax
test rax, rax
je 0x1800024da
xor r9d, r9d
mov qword [rsp + 0x20], r15
xor r8d, r8d
mov edx, 4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rdi], rax
mov rsi, rax
test rax, rax
je 0x1800024da
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp r14d, 0x80000000
jae 0x1800024b4
mov edx, 0x30
mov ecx, 1
call fcn.18009e5f8
mov rcx, rax
test rax, rax
je 0x1800024b4
mov qword [rax], r15
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], r15
mov qword [rax + 0x20], r15
mov qword [rax + 0x28], r15
mov dword [rax], 1
mov dword [rax + 4], 1
mov qword [rax + 8], r15
mov eax, dword [rax]
lea rax, [0x180002010]
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x28], rax
mov rax, rcx
mov dword [rcx + 0x18], r14d
mov dword [rcx + 0x1c], 3
mov qword [rcx + 0x20], rdi
jmp 0x180002625
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call fcn.18009e600
mov rcx, r15
mov rax, rcx
jmp 0x180002625
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call fcn.18009e600
mov ebx, 0x2000
mov edi, r15d
mov ecx, ebx
call fcn.18009e614
mov rsi, rax
test rax, rax
je 0x180002623
lea rdx, [0x1800b64d4]
mov rcx, rbp
call fcn.18009ec6c
mov rbp, rax
test rax, rax
je 0x18000261b
mov rcx, rax
call fcn.18009eb58
test eax, eax
jne 0x1800025a0
nop dword [rax]
mov eax, ebx
sub eax, edi
cmp eax, 0x200
jae 0x180002561
lea eax, [rbx + rbx]
mov ebx, eax
cmp eax, 0x20000000
ja 0x180002613
mov edx, ebx
mov rcx, rsi
call fcn.18009e61c
test rax, rax
je 0x180002613
mov rsi, rax
mov r8d, ebx
mov ecx, edi
sub r8d, edi
add rcx, rsi
mov r9, rbp
mov edx, 1
call fcn.18009eed8
mov rcx, rbp
mov r14, rax
call fcn.18009eb84
cmp eax, 4
je 0x180002594
test eax, eax
jne 0x180002613
add edi, r14d
mov rcx, rbp
call fcn.18009eb58
test eax, eax
je 0x180002530
mov rcx, rbp
call fcn.18009eac0
cmp edi, 0x80000000
jae 0x18000263e
mov edx, 0x30
mov ecx, 1
call fcn.18009e5f8
mov rcx, rax
test rax, rax
je 0x18000263e
mov qword [rax], r15
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], r15
mov qword [rax + 0x20], r15
mov qword [rax + 0x28], r15
mov dword [rax], 1
mov dword [rax + 4], 1
mov qword [rax + 8], r15
mov eax, dword [rax]
lea rax, [fcn.18009e600]
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x28], rax
mov rax, rcx
mov dword [rcx + 0x18], edi
mov dword [rcx + 0x1c], 2
mov qword [rcx + 0x20], rsi
jmp 0x180002625
mov rcx, rbp
call fcn.18009eac0
mov rcx, rsi
call fcn.18009e600
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
mov rcx, rsi
call fcn.18009e600
mov rcx, r15
mov rax, rcx
jmp 0x180002625