Function at 0x18004f860
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2f8]
sub rsp, 0x3f8
mov rax, qword [0x1800923a0]
xor rax, rsp
mov qword [rbp + 0x2e0], rax
mov ebx, dword [rbp + 0x360]
mov r10, r9
mov rax, qword [rbp + 0x368]
mov r11, qword [rbp + 0x370]
mov qword [rbp + 0x20], rax
lea eax, [rbx + 0x8f0]
mov qword [rsp + 0x68], r9
mov qword [rbp + 0x58], r8
mov r9, r8
mov qword [rbp + 0x50], rdx
mov r8, rdx
mov qword [rbp + 0x48], rcx
mov rdx, rcx
mov qword [rbp - 8], r11
mov dword [rsp + 0x44], eax
cmp ebx, eax
jae 0x1800500f7
movzx ecx, byte [rsp + 0x40]
xor r12d, r12d
mov rdi, qword [rbp + 0x10]
mov esi, dword [rbp - 0x78]
movzx r15d, byte [rsp + 0x40]
mov r13d, dword [rbp - 0x80]
movzx r14d, byte [rsp + 0x40]
mov dword [rsp + 0x60], ecx
nop dword [rax + rax]
cmp ebx, 0x1ba
ja 0x18004fe6e
je 0x18004ff82
cmp ebx, 0x124
ja 0x18004fa91
je 0x18004fa38
mov eax, ebx
sub eax, 0x3d
je 0x18004f9a9
sub eax, 0x8c
je 0x18004f967
sub eax, 3
je 0x1800500f7
cmp eax, 0xb
jne 0x1800501c1
mov r9d, 0xa8
mov r8, r10
mov rdx, r11
xor ecx, ecx
call fcn.18000d780
test eax, eax
sete r12b
mov dword [rsp + 0x58], r12d
jmp 0x1800500f7
cmp qword [r11 + 0x18], 8
mov rcx, r11
jb 0x18004f974
mov rcx, qword [r11]
xor r9d, r9d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp - 0x70], rax
mov byte [rsp + 0x42], 1
jmp 0x1800501bc
movsd xmm0, qword [r11]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x30], 0xc0
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r12
xor ecx, ecx
movsd qword [rsp + 0x58], xmm0
call fcn.180012ad0
mov qword [rsp + 0x78], rax
xor r9d, r9d
mov rax, qword [rsp + 0x68]
xor r8d, r8d
mov dword [rsp + 0x30], 0xc0
xor edx, edx
xor ecx, ecx
movsd xmm0, qword [rax]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
movsd qword [rsp + 0x58], xmm0
call fcn.180012ad0
movsd xmm1, qword [rsp + 0x78]
mov qword [rsp + 0x58], rax
movsd xmm0, qword [rsp + 0x58]
addsd xmm0, xmm1
divsd xmm1, xmm0
movsd qword [rsp + 0x58], xmm1
jmp 0x1800501bc
mov rax, qword [r8]
mov rcx, r11
mov r8, qword [rbp + 0x20]
mov qword [rsp + 0x78], rax
mov rax, qword [r9]
lea r9, [rsp + 0x50]
mov qword [rbp + 0x28], rax
mov rax, qword [rdx]
lea rdx, [rbp + 0x28]
mov qword [rbp + 0x18], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x18]
mov qword [rsp + 0x30], r10
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x123
mov dword [rsp + 0x50], r12d
call fcn.180041ef0
mov dword [rsp + 0x58], eax
jmp 0x1800501bc
mov eax, ebx
sub eax, 0x12b
je 0x18004fde6
sub eax, 0x2d
je 0x18004fab1
cmp eax, 0x5b
je 0x1800500f7
jmp 0x1800501c1
cmp qword [rbp - 0x70], 0xffffffffffffffff
jne 0x18004fdd5
mov esi, 0x120
mov dword [rsp + 0x50], esi
nop word [rax + rax]
cmp esi, 0x1a1
ja 0x18004fc4a
je 0x18004fb3e
mov eax, esi
sub eax, 0x120
je 0x18004fb2e
sub eax, 0x2b
je 0x18004fafe
cmp eax, 0x2b
jne 0x18004fdb7
mov qword [rbp - 0x28], r12
jmp 0x18004fdb7
xor edx, edx
mov qword [rbp - 0x10], r12
xor r8d, r8d
mov qword [rbp - 0x18], 0xffffffffffffffff
lea rcx, [rdx - 1]
call qword [sym.imp.dbghelp.dll_SymInitialize]
mov dword [rbp - 0x38], eax
call qword [sym.imp.WINMM.dll_midiOutGetNumDevs]
mov ecx, dword [rsp + 0x60]
mov dword [rbp - 0x34], eax
jmp 0x18004fdb7
mov cl, 1
mov byte [rsp + 0x41], 1
movzx r15d, cl
jmp 0x18004fdb3
movzx eax, byte [rsp + 0x41]
lea rdx, [rbp - 0x28]
cmp dword [rbp - 0x38], r12d
mov ecx, r12d
mov qword [rbp + 0x38], r12
cmovne ecx, eax
cmp dword [rbp - 0x34], r12d
mov byte [rsp + 0x41], cl
mov ecx, r12d
movzx eax, r15b
cmovne ecx, eax
movzx r15d, cl
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.GDI32.dll_GetBitmapDimensionEx]
mov dword [rbp - 0x5c], eax
cmp byte [rsp + 0x41], r12b
je 0x18004fc41
movzx esi, byte [rsp + 0x48]
mov ebx, 0x21
mov r13d, dword [rbp - 0x68]
mov ecx, ebx
sub ecx, 0x1f
je 0x18004fbe2
sub ecx, 1
je 0x18004fbc7
cmp ecx, 1
jne 0x18004fc25
xorps xmm0, xmm0
mov qword [rbp - 0x20], 0xffffffffffffffff
xor eax, eax
movzx esi, cl
movups xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x80], rax
movups xmmword [rbp + 0x70], xmm0
jmp 0x18004fc25
mov rcx, qword [rbp - 0x20]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.dbghelp.dll_SymInitialize]
mov r13d, eax
mov dword [rbp + 0x60], 0x28
jmp 0x18004fc25
movzx eax, sil
lea rdx, [rbp + 0x60]
mov ecx, r12d
test r13d, r13d
cmovne ecx, eax
movzx esi, cl
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.dbghelp.dll_SymGetLineNext64]
test sil, sil
je 0x18004fc1b
mov rcx, qword [rbp - 0x20]
xor edx, edx
call qword [sym.imp.dbghelp.dll_SymFunctionTableAccess64]
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.dbghelp.dll_SymCleanup]
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.dbghelp.dll_SymCleanup]
dec ebx
cmp ebx, 0x1e
ja 0x18004fb91
mov dword [rbp - 0x68], r13d
mov r13d, dword [rbp - 0x80]
mov byte [rsp + 0x48], sil
mov esi, dword [rsp + 0x50]
mov ecx, dword [rsp + 0x60]
jmp 0x18004fdb7
mov eax, esi
sub eax, 0x1cc
je 0x18004fda8
sub eax, 0x2b
je 0x18004fc6a
cmp eax, 0x2b
je 0x1800500f2
jmp 0x18004fdb7
test r15b, r15b
je 0x18004fd89
mov esi, dword [rbp - 0x60]
mov edi, 0x102
nop dword [rax + rax]
mov eax, edi
sub eax, 0x102
je 0x18004fd5e
cmp eax, 1
jne 0x18004fd70
test esi, esi
jne 0x18004fd42
mov ebx, 0x5d
cmp ebx, 0x5d
je 0x18004fd29
cmp ebx, 0x1ee1
je 0x18004fd1f
cmp ebx, 0x3d65
je 0x18004fd13
cmp ebx, 0x5be9
jne 0x18004fd2c
mov rcx, qword [rbp + 0x30]
lea r8, [rbp - 0x30]
mov edx, r13d
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x18004fce1
xor r14b, r14b
xor r15b, r15b
jmp 0x18004fd2c
test r14b, r14b
je 0x18004fd0e
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rcx, qword [rbp - 0x30]
cmp rcx, 0xffffffffffffffff
jne 0x18004fd08
xor r14b, r14b
xor r15b, r15b
jmp 0x18004fd2c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r15b, r15b
jmp 0x18004fd2c
mov r13d, 0x20008
mov qword [rbp - 0x30], r12
jmp 0x18004fd2c
mov qword [rbp + 0x30], 0xffffffffffffffff
jmp 0x18004fd2c
mov r14b, 1
add ebx, 0x1e84
cmp ebx, 0x7a10
jbe 0x18004fca3
mov dword [rbp - 0x80], r13d
test r15b, r15b
je 0x18004fd70
mov r8d, 0x104
lea rdx, [rbp + 0xd0]
mov ecx, esi
call qword [sym.imp.WINMM.dll_midiOutGetErrorTextW]
jmp 0x18004fd70
lea rdx, [rbp - 0x64]
mov dword [rbp - 0x64], r12d
xor ecx, ecx
call qword [sym.imp.WINMM.dll_midiOutGetID]
mov esi, eax
inc edi
cmp edi, 0x104
jb 0x18004fc80
mov ecx, dword [rsp + 0x60]
mov dword [rbp - 0x60], esi
mov esi, dword [rsp + 0x50]
test cl, cl
je 0x18004fdb7
mov r8d, dword [rbp - 0x24]
lea r9, [rbp + 0x38]
mov edx, dword [rbp - 0x28]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.GDI32.dll_SetBitmapDimensionEx]
mov ecx, dword [rsp + 0x60]
jmp 0x18004fdb7
cmp dword [rbp - 0x5c], r12d
movzx ecx, cl
cmove ecx, r12d
mov dword [rsp + 0x60], ecx
add esi, 0x2b
mov dword [rsp + 0x50], esi
cmp esi, 0x24d
jb 0x18004fad0
mov ebx, dword [rbp + 0x360]
mov r10, qword [rsp + 0x68]
mov rdi, r12
mov dword [rbp - 0x7c], r12d
mov esi, 0xa
jmp 0x1800501c1
mov eax, dword [r10]
lea r8, [rsp + 0x50]
mov r9d, 0x66
mov dword [rsp + 0x78], eax
lea rdx, [rsp + 0x78]
mov dword [rsp + 0x50], 2
mov rcx, r11
call fcn.18000c820
test eax, eax
je 0x18004f95d
mov r10, qword [rsp + 0x68]
mov ecx, dword [r10]
test ecx, ecx
je 0x18004fe2a
cmp ecx, 1
jne 0x1800501c1
mov eax, dword [r10 + 8]
lea r8, [rsp + 0x78]
mov rcx, qword [rbp - 8]
lea rdx, [rsp + 0x50]
mov r9d, 0x66
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x78], 4
call fcn.18000c820
test eax, eax
je 0x18004f95d
mov eax, dword [rsp + 0x44]
mov ebx, 0x1ba
mov r10, qword [rsp + 0x68]
jmp 0x1800501c5
cmp ebx, 0x2d8
ja 0x18004fee2
je 0x1800500f7
mov eax, ebx
sub eax, 0x1e7
je 0x18004febb
sub eax, 0x62
je 0x18004feae
cmp eax, 0x2d
jne 0x1800501c1
mov edx, dword [rsp + 0x70]
xor r8d, r8d
mov rcx, r10
call fcn.18006a470
mov dword [rbp - 0x54], 0x32
jmp 0x1800501bc
mov dword [rsp + 0x58], 1
jmp 0x1800501c1
mov rcx, qword [rbp - 0x70]
xor edx, edx
mov dword [rbp - 0x3c], 0x14
mov qword [rbp + 0x40], r12
mov dword [rbp - 0x50], 0x28
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x70], eax
jmp 0x1800501bc
cmp ebx, 0x305
je 0x180050175
cmp ebx, 0x394
je 0x18004ff8c
cmp ebx, 0x423
jne 0x1800501c5
mov ebx, 0x122
nop dword [rax + rax]
cmp ebx, 0x122
je 0x18004ff3b
cmp ebx, 0x1a5
jne 0x18004ff6b
cmp byte [rsp + 0x42], r12b
je 0x18004ff31
mov rcx, qword [rbp]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov byte [rsp + 0x58], 1
jmp 0x1800500f7
mov eax, dword [rbp - 0x58]
lea r9, [rbp + 0xa8]
mov rdx, qword [rbp + 0x40]
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x20], eax
call sub.ADVAPI32.dll_LsaRemoveAccountRights
movzx eax, byte [rsp + 0x42]
mov ecx, r12d
cmp qword [rbp], rcx
cmovne ecx, eax
mov byte [rsp + 0x42], cl
add ebx, 0x83
cmp ebx, 0x228
jb 0x18004ff10
mov eax, dword [rsp + 0x44]
mov r10, qword [rsp + 0x68]
mov ebx, 0x1ba
jmp 0x1800501c5
mov eax, dword [rbp - 0x78]
mov ecx, esi
mov r9d, dword [rbp - 0x54]
mov r8d, dword [rbp - 0x50]
mov edx, dword [rbp - 0x3c]
mov dword [rsp + 0x28], 0xa
mov dword [rsp + 0x20], eax
mov dword [rbp - 0x58], 1
call qword [sym.imp.GDI32.dll_CreateRoundRectRgn]
mov qword [rbp], rax
mov eax, dword [rsp + 0x70]
cmp eax, dword [rbp - 0x7c]
je 0x180050166
mov ebx, 0x128
nop dword [rax + rax]
cmp ebx, 0x20e
ja 0x1800500c0
je 0x1800500b0
mov eax, ebx
sub eax, 0x128
je 0x180050091
sub eax, 0x2e
je 0x180050068
sub eax, 0x2e
je 0x18005002e
cmp eax, 0x5c
jne 0x180050151
mov rcx, qword [rsp + 0x68]
mov dword [rbp - 0x44], 0x14
mov rax, rcx
mov dword [rbp - 0x48], 0x28
mov qword [rcx + 0x10], r12
cmp qword [rcx + 0x18], 0x10
jb 0x180050026
mov rax, qword [rcx]
mov byte [rax], r12b
jmp 0x180050151
movzx eax, word [0x18007a784]
mov word [rbp + 0xc5], ax
movzx eax, word [0x180089ac8]
mov word [rbp + 0xc6], ax
movzx eax, byte [0x180089aca]
mov byte [rbp + 0xc8], al
mov byte [rsp + 0x40], 1
mov dword [rbp - 0x40], 0xa
jmp 0x180050151
movzx eax, word [0x180089ab8]
mov word [rbp + 0xbf], ax
mov eax, 0x5c
mov dword [rbp + 0xc1], 0x3a6935
mov word [rbp + 0xc4], ax
jmp 0x180050151
mov r8d, 8
lea rdx, str.EUonUxs
lea rcx, [rbp + 0xb8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x180050151
mov dword [rbp - 0x4c], 0x32
mov qword [rbp + 0x10], r12
jmp 0x180050151
mov eax, ebx
sub eax, 0x23c
je 0x180050144
sub eax, 0x2e
je 0x18005011f
cmp eax, 0x2e
jne 0x180050151
cmp byte [rsp + 0x40], r12b
je 0x1800500f2
mov rdx, qword [rbp + 0x10]
mov rcx, qword [rbp + 8]
call qword [sym.imp.GDI32.dll_EqualRgn]
mov rcx, qword [rbp + 8]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov byte [rsp + 0x58], r12b
mov rax, qword [rsp + 0x58]
mov rcx, qword [rbp + 0x2e0]
xor rcx, rsp
call fcn.180077c10
add rsp, 0x3f8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov r9d, dword [rbp - 0x4c]
mov r8d, dword [rbp - 0x48]
mov edx, dword [rbp - 0x44]
mov ecx, dword [rbp - 0x40]
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov qword [rbp + 8], rax
cmp rax, 0
jne 0x180050151
mov byte [rsp + 0x40], r12b
jmp 0x180050151
lea rcx, [rbp + 0xb8]
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionA]
add ebx, 0x2e
cmp ebx, 0x2c6
jb 0x18004ffd0
mov ebx, dword [rbp + 0x360]
lea rcx, [rbp + 0x88]
call qword [sym.imp.ADVAPI32.dll_GetTrusteeFormA]
jmp 0x1800501bc
cmp qword [r10 + 0x18], 0x10
mov rdx, r10
jb 0x180050182
mov rdx, qword [r10]
mov r8d, dword [rsp + 0x70]
lea r9, [rbp - 0x7c]
mov rcx, qword [rbp - 0x70]
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, qword [rbp - 0x70]
xorps xmm0, xmm0
movups xmmword [rbp + 0x88], xmm0
mov dword [rbp - 0x78], 0xa
movups xmmword [rbp + 0x98], xmm0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r10, qword [rsp + 0x68]
mov eax, dword [rsp + 0x44]
add ebx, 0x8f
mov dword [rbp + 0x360], ebx
cmp ebx, eax
jae 0x1800500f7
mov ecx, dword [rsp + 0x60]
mov r11, qword [rbp - 8]
mov rdx, qword [rbp + 0x48]
mov r8, qword [rbp + 0x50]
mov r9, qword [rbp + 0x58]
jmp 0x18004f900