Function at 0x18004c960
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x180121650]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov r11, qword [rbp + 0x1e8]
mov rbx, rcx
mov rax, qword [rbp + 0x1f0]
mov r10, rdx
mov r12, qword [rbp + 0x1e0]
mov r13, r9
mov r9d, dword [rsp + 0x48]
mov r14d, r8d
mov qword [rsp + 0x70], rcx
imul ecx, r8d, 0x596
mov qword [rbp - 0x80], rdx
mov rdx, qword [rbp + 0x1f8]
mov dword [rsp + 0x54], r8d
mov qword [rsp + 0x68], r11
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov dword [rsp + 0x44], ecx
cmp r8d, ecx
ja 0x18004cec4
mov eax, dword [rbp - 0x28]
movsd xmm0, qword [rbp - 0x30]
mov rcx, qword [rsp + 0x58]
mov r8d, dword [rsp + 0x48]
mov edi, dword [rsp + 0x48]
mov r15, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x58]
mov ebx, dword [rsp + 0x48]
mov dword [rbp - 0x60], eax
mov rax, qword [rsp + 0x58]
mov qword [rbp - 0x50], rax
movzx eax, byte [rsp + 0x41]
mov byte [rsp + 0x40], al
mov eax, dword [rsp + 0x44]
movsd qword [rbp - 0x48], xmm0
mov qword [rbp - 0x58], rcx
mov dword [rsp + 0x78], r8d
mov dword [rsp + 0x50], r9d
mov dword [rsp + 0x60], edi
cmp r14d, 0x2fd0
ja 0x18004cc85
je 0x18004cc6d
mov eax, r14d
sub eax, 0x55
je 0x18004cb3d
sub eax, 0x26
je 0x18004cb31
sub eax, 0x30
je 0x18004caba
sub eax, 0x15
je 0x18004caa2
movzx r8d, byte [rsp + 0x40]
cmp eax, 0x5a
jne 0x18004ce20
mov rax, qword [rbp - 0x20]
mov rsi, r11
mov r15, qword [rsp + 0x58]
mov qword [r11], r10
mov qword [r11 + 8], r10
mov eax, dword [rax]
add rax, r10
mov qword [r11 + 0x10], rax
jmp 0x18004ce20
xor eax, eax
mov qword [rbp - 0x30], rax
movsd xmm0, qword [rbp - 0x30]
movsd qword [rbp - 0x48], xmm0
mov dword [rbp - 0x60], eax
jmp 0x18004ce1a
cmp dword [r13], 0
jne 0x18004cb13
mov rcx, qword [r11]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x128
call fcn.1800fb560
mov rdi, rax
test rax, rax
je 0x18004ceb4
test r12, r12
je 0x18004cb01
mov r9d, 0x69
mov qword [rsp + 0x20], 0
mov r8, r12
xor edx, edx
mov rcx, rax
call fcn.18007e870
mov edi, dword [rdi + 0x40]
mov r11, qword [rsp + 0x68]
mov r10, qword [rbp - 0x80]
mov dword [rsp + 0x50], edi
jmp 0x18004cb19
mov eax, dword [rdx]
mov dword [rsp + 0x50], eax
mov rax, qword [rbp - 0x20]
mov rcx, r10
mov edx, dword [rax]
call qword [r11 + 0x38]
mov edi, eax
mov dword [rsp + 0x60], eax
jmp 0x18004ce0c
xor r10d, r10d
mov qword [rbp - 0x80], r10
jmp 0x18004ce1a
cmp qword [r11 + 0x18], 8
mov rcx, r11
jb 0x18004cb4a
mov rcx, qword [r11]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp - 0x58], rax
cmp rax, 0xffffffffffffffff
jne 0x18004cc52
xor edx, edx
mov edi, edx
nop word [rax + rax]
cmp edi, 0x8c
ja case.0x18004cbb9.1
lea r8, [0x180000000]
mov ecx, edi
movzx ecx, byte [r8 + rcx + 0x4d4cc]
mov eax, dword [r8 + rcx*4 + 0x4d4b0]
add rax, r8
jmp rax
mov qword [rsp + 0x58], rdx
mov qword [rbp - 0x40], rdx
jmp case.0x18004cbb9.1
xor edx, edx
lea rcx, [rbp + 0x60]
mov r8d, 0xd0
call sub.VCRUNTIME140.dll_memset
mov r9d, dword [rbp - 0x74]
xor eax, eax
mov rcx, qword [rbp - 0x40]
xor r8d, r8d
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rsp + 0x20], rax
call sub.IMM32.dll_ImmEnumRegisterWordW
xor edx, edx
mov dword [rbp + 0x60], 0xd0
jmp case.0x18004cbb9.1
mov r8d, dword [rbp - 0x78]
lea r9, [rbp + 0x60]
mov rcx, qword [rsp + 0x58]
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], rdx
mov edx, dword [rbp - 0x10]
call sub.IMM32.dll_ImmGetImeMenuItemsW
mov rax, qword [rsp + 0x70]
xor edx, edx
mov byte [rax], 0
jmp case.0x18004cbb9.1
mov dword [rbp - 0x10], 1
mov dword [rbp - 0x78], 0x10
jmp case.0x18004cbb9.1
mov dword [rbp - 0x74], edx
add edi, 0x1c
lea eax, [rdi + 0x4e]
cmp eax, 0xf6
jb 0x18004cb90
mov edi, dword [rsp + 0x60]
mov r11, qword [rsp + 0x68]
mov r8b, 1
mov r10, qword [rbp - 0x80]
mov r9d, dword [rsp + 0x50]
mov byte [rsp + 0x40], r8b
jmp 0x18004ce20
xor edx, edx
mov dword [rbp - 0x5c], 0
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x78], eax
jmp 0x18004ce0c
cmp r14d, 0x6030
je 0x18004cdba
cmp r14d, 0x6c00
je 0x18004ce53
cmp r14d, 0x9ea0
je 0x18004ccc0
cmp r14d, 0x13c26
je case.0x18004d0fc.0
movzx r8d, byte [rsp + 0x40]
jmp 0x18004ce24
mov edi, 0x4d
cmp edi, 0x4d
je 0x18004cd1e
cmp edi, 0xbbb
je 0x18004ccea
cmp edi, 0x1729
jne 0x18004cd44
cmp r15, qword [rsi + 8]
jb 0x18004cd44
lea rax, [r15 + 1]
mov qword [rsi + 8], rax
jmp 0x18004cd44
test ebx, ebx
je 0x18004ccf8
cmp ebx, 0xffffffe7
jne 0x18004cd5b
inc dword [rsi + 0x1c]
jmp 0x18004cd44
mov rdx, qword [r11 + 0x38]
test rdx, rdx
je 0x18004cd44
mov r8d, 0x10d
lea rcx, [rbp + 0x40]
call fcn.1800d3940
mov r11, qword [rsp + 0x68]
mov rbx, rax
test eax, eax
jne 0x18004cd64
jmp 0x18004cd44
mov rax, qword [rsi + 8]
cmp rax, qword [rsi + 0x10]
jae 0x18004cd64
mov r8, qword [r11 + 0x30]
lea rdx, [rbp + 0x40]
mov r9, r12
mov rcx, rsi
mov r15, rax
call qword [r11 + 0x28]
mov r11, qword [rsp + 0x68]
mov ebx, eax
add edi, 0xb6e
cmp edi, 0x224a
jbe 0x18004ccc5
jmp 0x18004ccc0
cmp ebx, 0xfffffff6
je 0x18004ce43
mov rdx, qword [rbp - 0x18]
mov r14d, 0x9ea0
mov r10, qword [rdx]
test r10, r10
je 0x18004cdad
mov rax, qword [r11 + 0x38]
test rax, rax
je 0x18004cdad
mov r9, qword [r13]
mov rcx, qword [rax + 8]
test r9, r9
jne 0x18004cda1
lea rax, [0x18008ba00]
mov qword [r13], rax
mov r9, rax
mov rax, qword [r11 + 0x38]
mov r10, qword [rdx]
mov edx, dword [rax + 0x10]
mov r8d, 0x20
call r10
mov rax, qword [rsp + 0x70]
mov dword [rax], 0
jmp 0x18004ce08
mov rax, qword [rbp - 0x20]
lea r8, [rbp - 0x68]
mov dword [rsp + 0x48], r9d
lea rdx, [rsp + 0x48]
mov r9d, 0x112
mov dword [rbp - 0x68], edi
mov rcx, r11
mov eax, dword [rax]
mov dword [rbp - 0x70], eax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r10
call fcn.180048b20
mov qword [rbp - 0x50], rax
test rax, rax
je 0x18004ceb4
cmp dword [r13], 0
je 0x18004ce08
or dword [rax + 0x30], 1
mov edi, dword [rsp + 0x60]
mov r11, qword [rsp + 0x68]
mov r10, qword [rbp - 0x80]
mov r9d, dword [rsp + 0x50]
movzx r8d, byte [rsp + 0x40]
mov eax, dword [rsp + 0x44]
mov edx, dword [rsp + 0x54]
imul ecx, edx, 0x8f
add r14d, ecx
cmp r14d, eax
ja 0x18004cea8
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x58]
jmp 0x18004ca40
mov rax, qword [rsp + 0x70]
mov dword [rax], 0xfffffff6
jmp 0x18004d486
mov eax, dword [rbp - 0x60]
xor r9d, r9d
movsd xmm0, qword [rbp - 0x48]
xor r8d, r8d
mov dword [rbp - 0x28], eax
mov rdx, r10
lea rax, [rbp - 0x30]
movsd qword [rbp - 0x30], xmm0
mov qword [rsp + 0x30], rax
mov rcx, r11
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], 0x111
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x58], 0
call fcn.18005e480
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
mov rax, rcx
jmp 0x18004d486
mov rbx, qword [rsp + 0x70]
mov r9d, dword [rsp + 0x78]
jmp 0x18004cef9
mov rax, qword [rsp + 0x70]
mov dword [rax], 0xffffffff
jmp 0x18004d486
mov rax, qword [rsp + 0x58]
mov edx, r14d
movzx r8d, byte [rsp + 0x41]
mov qword [rbp - 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rbp - 0x50], rax
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x78], r9d
mov byte [rsp + 0x40], r8b
lea esi, [rdx + 0xa]
mov dword [rbp - 0x78], esi
cmp edx, esi
jae case.0x18004d0fc.0
mov r14, qword [rsp + 0x58]
lea edi, [rdx - 0x55]
mov r15d, dword [rsp + 0x48]
mov r12, qword [rsp + 0x58]
mov r13, qword [rbp - 0x48]
mov dword [rsp + 0x44], edi
cmp edi, 0x58
ja case.0x18004cf4a.5
lea rcx, [0x180000000]
movzx eax, byte [rcx + rdi + 0x4d584]
mov ecx, dword [rcx + rax*4 + 0x4d55c]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
xor r9d, r9d
mov dword [rsp + 0x20], 0x117
mov r8, r11
xor edx, edx
xor ecx, ecx
call fcn.18008e0d0
mov rcx, qword [rbp - 0x50]
mov ebx, eax
test eax, eax
jne 0x18004d3b5
mov rbx, qword [rsp + 0x68]
lea r8, [rsp + 0x48]
mov r9d, 0xe9
xor edx, edx
mov eax, dword [rbx + 0x28]
dec eax
and eax, dword [rsp + 0x60]
mov dword [rsp + 0x48], eax
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call fcn.18008a0b0
mov eax, dword [rsp + 0x50]
lea r8, [rbp - 0x68]
mov r9, qword [rbp - 0x50]
mov edx, 0xe5
mov dword [rsp + 0x48], eax
xor ecx, ecx
mov rax, qword [rbx]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x68], 0
call fcn.180062a00
mov rbx, qword [rsp + 0x70]
jmp 0x18004d384
mov rdx, qword [r10 + 0x10]
xor eax, eax
mov ecx, r9d
mov qword [rbp - 0x40], 0xffffffffffffffff
mov qword [rsp + 0x58], rax
cmp rcx, rdx
ja 0x18004d017
mov qword [r10 + 0x10], rcx
mov rax, r10
cmp qword [r10 + 0x18], 0x10
jb 0x18004d011
mov rax, qword [r10]
mov byte [rax + rcx], 0
jmp 0x18004d06d
mov r8, qword [r10 + 0x18]
mov rdi, rcx
mov rax, r8
sub rdi, rdx
sub rax, rdx
cmp rdi, rax
ja 0x18004d053
mov qword [r10 + 0x10], rcx
mov rax, r10
cmp r8, 0x10
jb 0x18004d03c
mov rax, qword [r10]
lea rbx, [rax + rdx]
mov r8, rdi
mov rcx, rbx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov byte [rbx + rdi], 0
jmp 0x18004d069
mov r9, rdi
mov byte [rsp + 0x20], 0
xor r8d, r8d
mov rdx, rdi
mov rcx, r10
call fcn.180007550
mov edi, dword [rsp + 0x44]
xor edx, edx
xor r8d, r8d
lea rcx, [rdx - 1]
call qword [sym.imp.dbghelp.dll_SymInitialize]
mov rbx, qword [rsp + 0x70]
mov dword [rbp - 0x70], eax
jmp 0x18004d384
xor eax, eax
mov dword [rbx], eax
jmp case.0x18004cf4a.5
mov r9, r11
mov dword [rsp + 0x48], 0x10
xor edx, edx
lea rcx, [rsp + 0x48]
mov r8d, 0xfe
call fcn.1800dee70
jmp 0x18004d384
xor r11d, r11d
movzx eax, r8b
cmp dword [rbp - 0x70], r11d
mov ecx, r11d
cmovne ecx, eax
movzx r8d, cl
mov byte [rsp + 0x40], cl
cmp r9d, dword [rbp - 0x5c]
je case.0x18004cf4a.5
mov esi, 0xb
nop dword [rax]
cmp esi, 0xb
ja case.default.0x18004d0fc
lea rdx, [0x180000000]
mov eax, esi
mov ecx, dword [rdx + rax*4 + 0x4d5e0]
add rcx, rdx
jmp rcx
mov eax, 0x5f
mov dword [rbp + 0x156], 0x380033
mov word [rbp + 0x154], ax
mov eax, 0x30
mov word [rbp + 0x15a], ax
jmp case.default.0x18004d0fc
lea rcx, [rbp + 0x130]
call qword [sym.imp.SHLWAPI.dll_PathIsFileSpecW]
movzx eax, byte [rsp + 0x41]
xor r11d, r11d
cmp dword [rbp - 0x74], r11d
mov ecx, r11d
cmovne ecx, eax
mov byte [rsp + 0x41], cl
cmp cl, r11b
je 0x18004d1b9
mov edi, 6
mov eax, edi
sub eax, 6
je 0x18004d1a0
cmp eax, 0x7e
jne 0x18004d1a9
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 3
mov qword [rsp + 0x20], r12
mov r8d, r15d
mov rdx, r14
mov rcx, r13
mov rbx, rax
call qword [sym.imp.dbghelp.dll_SymGetTypeInfo]
lea r8, [rbp - 0x18]
mov rcx, rbx
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcessWorkingSetSize]
mov rcx, r13
call qword [sym.imp.dbghelp.dll_SymCleanup]
xor r11d, r11d
jmp 0x18004d1a9
mov r14, r11
mov r15d, r11d
mov r12, r11
add edi, 0x7e
cmp edi, 0x102
jb 0x18004d152
mov rbx, qword [rsp + 0x70]
mov byte [rbx], 0
jmp case.default.0x18004d0fc
mov dword [rbp + 0x146], 0x75006f
jmp case.default.0x18004d0fc
mov eax, 0x56
mov dword [rbp + 0x132], 0x350034
mov word [rbp + 0x130], ax
mov eax, 0x37
mov word [rbp + 0x136], ax
mov dword [rbp + 0x138], 0x4e005f
jmp case.default.0x18004d0fc
mov eax, 0x72
mov dword [rbp + 0x14c], 0x65004c
mov word [rbp + 0x14a], ax
mov dword [rbp + 0x150], 0x740066
jmp case.default.0x18004d0fc
mov eax, 0x62
mov dword [rbp + 0x13c], 0x690065
mov word [rbp + 0x144], ax
mov dword [rbp + 0x140], 0x680067
jmp case.default.0x18004d0fc
mov dword [rbp + 0x168], 0x36
mov byte [rsp + 0x41], 1
jmp case.default.0x18004d0fc
mov eax, 0x56
mov dword [rbp + 0x15e], 0x5f0035
mov word [rbp + 0x162], ax
jmp case.default.0x18004d0fc
mov dword [rbp + 0x164], 0x300038
jmp case.default.0x18004d0fc
mov eax, 0x34
mov word [rbp + 0x15c], ax
jmp case.default.0x18004d0fc
mov r13, 0xffffffffffffffff
mov qword [r10 + 0x10], r11
cmp qword [r10 + 0x18], 0x10
mov rax, r10
mov qword [rbp - 0x48], r13
jb 0x18004d2a7
mov rax, qword [r10]
xor r8d, r8d
mov byte [rax], 0
xor edx, edx
mov rcx, r13
call qword [sym.imp.dbghelp.dll_SymInitialize]
mov dword [rbp - 0x74], eax
xor r11d, r11d
mov r10, qword [rbp - 0x80]
dec esi
lea ecx, [rsi + 0xf9]
cmp ecx, 0xf8
ja 0x18004d0e0
mov edi, dword [rsp + 0x44]
mov esi, dword [rbp - 0x78]
jmp 0x18004d384
mov rcx, qword [rsp + 0x58]
call sub.IMM32.dll_ImmIsIME
movzx r8d, byte [rsp + 0x40]
test r8b, r8b
je 0x18004d34e
mov r13, qword [rbp - 0x40]
mov ebx, 0x1c
cmp ebx, 0x1c
je 0x18004d318
cmp ebx, 0xa9c
jne 0x18004d331
mov rcx, r13
call qword [sym.imp.dbghelp.dll_SymCleanup]
jmp 0x18004d331
xor eax, eax
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
mov rcx, r13
lea r9d, [rax + 3]
call qword [sym.imp.dbghelp.dll_SymGetTypeInfo]
add ebx, 0xa80
cmp ebx, 0x1500
jbe 0x18004d300
mov r13, qword [rbp - 0x48]
mov rbx, qword [rsp + 0x70]
movzx r8d, byte [rsp + 0x40]
mov byte [rbx], 1
jmp 0x18004d38a
xor edx, edx
mov rcx, r10
call fcn.180008b90
mov r8d, dword [rsp + 0x78]
lea r9, [rbp - 0x5c]
mov rcx, qword [rbp - 0x58]
mov rdx, rax
xor eax, eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx r8d, byte [rsp + 0x40]
mov edx, dword [rsp + 0x54]
inc edx
inc edi
mov dword [rsp + 0x54], edx
mov dword [rsp + 0x44], edi
cmp edx, esi
jae case.0x18004d0fc.0
mov r11, qword [rsp + 0x68]
mov r10, qword [rbp - 0x80]
mov r9d, dword [rsp + 0x78]
jmp 0x18004cf21
mov rdx, qword [rsp + 0x68]
mov r8d, 0x68
mov rdx, qword [rdx]
call fcn.1800b2040
mov rax, qword [rsp + 0x70]
mov dword [rax], ebx
jmp 0x18004d486
movups xmm0, xmmword [r11]
lea r8, [rbp]
mov eax, dword [r11 + 0x18]
movsd xmm1, qword [r11 + 0x10]
lea rcx, [rbp + 0x20]
xor r9d, r9d
movaps xmmword [rbp], xmm0
xor edx, edx
movsd qword [rbp + 0x10], xmm1
mov dword [rbp + 0x18], eax
mov dword [rsp + 0x20], 0xee
call fcn.18007d740
mov rcx, qword [rsp + 0x68]
lea r9, [rbp + 0x20]
mov eax, dword [rbp + 0x38]
lea r8, [rsp + 0x58]
movups xmm2, xmmword [rbp + 0x20]
lea rdx, [rbp - 0x40]
mov dword [rbp + 0x38], eax
movsd xmm1, qword [rbp + 0x30]
movups xmmword [rcx], xmm2
mov dword [rsp + 0x20], pe_nt_image_headers64
movsd qword [rcx + 0x10], xmm1
mov dword [rcx + 0x18], eax
lea rcx, [rbp]
mov rax, qword [rbp - 0x20]
movaps xmmword [rbp + 0x20], xmm2
movsd qword [rbp + 0x30], xmm1
mov rax, qword [rax]
mov qword [rsp + 0x58], rax
mov rax, qword [rbp - 0x80]
mov rax, qword [rax]
mov qword [rbp - 0x40], rax
call fcn.180065a90
mov eax, dword [rbp + 0x18]
movups xmm0, xmmword [rbp]
movsd xmm1, qword [rbp + 0x10]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
mov dword [rbx + 0x18], eax
mov rax, rbx
jmp 0x18004d486
mov rax, qword [rsp + 0x70]
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.1800fd9d0
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x280
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret