Function at 0x140045813
Capabilities:
Get file size
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
xor r10d, r10d
mov rbx, rcx
lea rcx, str.Disk_image_analysis:
mov qword [rsp + 0x48], r10
call fcn.140036717
mov r9d, 3
mov edx, 0x80000000
mov rcx, rbx
mov r8d, 1
call fcn.1400454fc
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140045873
mov rdx, rbx
lea rcx, str.__Could_not_open_image__s
mov sil, 0xff
call fcn.140036717
jmp 0x1400459e4
mov rbp, qword [0x1400b1a80]
mov rcx, rbx
mov byte [rbp + 0x442], 0
call sub.msvcrt.dll_strlen
lea r13, [rbx + rax - 1]
cmp byte [r13], 0x2e
je 0x1400458a3
cmp rbx, r13
je 0x14004594e
dec r13
jmp 0x14004588e
cmp rbx, r13
je 0x14004594e
lea r14, str..zip
xor r12d, r12d
mov r15, r14
mov rdx, qword [r14]
mov rcx, r13
call sub.msvcrt.dll_strcmp
mov esi, eax
test eax, eax
jne 0x140045976
movsxd r12, r12d
mov ecx, 0x200
shl r12, 4
mov r13d, dword [r15 + r12 + 8]
mov byte [rbp + 0x442], r13b
call sub.msvcrt.dll_malloc
mov r12, rax
test rax, rax
je 0x14004594e
mov rax, qword [0x1400b1100]
xor r8d, r8d
xor r9d, r9d
xor edx, edx
mov rcx, qword [fcn.140036717]
mov dword [rax], r8d
xor r8d, r8d
mov qword [rsp + 0x20], r9
xor r9d, r9d
mov qword [rsp + 0x28], rax
call fcn.140049e76
mov rcx, rbx
mov r9d, r13d
mov rdx, r12
mov r8d, 0x200
call fcn.140049ab6
mov rbx, rax
call fcn.140049ec0
cmp rbx, 0x200
je 0x140045952
mov rcx, r12
call sub.msvcrt.dll_free
xor esi, esi
jmp 0x140045989
cmp byte [r12 + 0x1fe], 0x55
jne 0x14004596c
xor esi, esi
cmp byte [r12 + 0x1ff], 0xaa
sete sil
mov rcx, r12
call sub.msvcrt.dll_free
jmp 0x140045989
inc r12d
add r14, 0x10
cmp r12d, 7
jne 0x1400458b9
jmp 0x14004594e
cmp byte [rbp + 0x442], 0
jne 0x1400459bb
xor r8d, r8d
lea rdx, str.__Image
mov rcx, rdi
mov sil, 1
call fcn.14000ea08
test eax, eax
jne 0x1400459bb
mov rax, qword [0x1400b1a40]
cmp dword [rax], 0
setne sil
add esi, esi
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_GetFileSizeEx]
test eax, eax
jne 0x1400459eb
call fcn.140036bd7
lea rcx, str.__Could_not_get_image_size:__s
mov sil, 0xfe
mov rdx, rax
call fcn.140036717
xor ebx, ebx
jmp 0x140045b7a
mov rax, qword [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x3c], 8
lea r14, [rsp + 0x3c]
mov r15, qword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
mov qword [rbp + 0x400], rax
call r15
xor ecx, ecx
mov r8d, dword [rsp + 0x3c]
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x20], rcx
mov r13, qword [sym.imp.KERNEL32.DLL_ReadFile]
mov r9, r14
mov rcx, rdi
call r13
test eax, eax
je 0x140045a58
movabs rax, 0x4d4957534d
cmp qword [rsp + 0x48], rax
jne 0x140045a58
mov byte [rbp + 0x427], 1
jmp 0x1400459e4
cmp byte [rbp + 0x442], 0
mov byte [rbp + 0x427], 0
mov dword [rsp + 0x3c], 0x200
jne 0x1400459e4
mov r12, qword [rbp + 0x400]
cmp r12, 0x3ff
jbe 0x1400459e4
mov ecx, 0x200
call sub.msvcrt.dll_malloc
lea rdx, [r12 - 0x200]
mov rbx, rax
test rax, rax
jne 0x140045ab6
lea rcx, str.__Could_not_read_VHD_footer
mov sil, 0xfd
call fcn.140036717
jmp 0x140045b7a
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
call r15
test eax, eax
je 0x140045aa2
xor edx, edx
mov r8d, dword [rsp + 0x3c]
mov r9, r14
mov rcx, rdi
mov qword [rsp + 0x20], rdx
mov rdx, rbx
call r13
test eax, eax
je 0x140045aa2
cmp dword [rsp + 0x3c], 0x200
jne 0x140045aa2
mov r8d, 8
lea rdx, str.conectix
mov rcx, rbx
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x140045b7a
sub qword [rbp + 0x400], 0x200
cmp dword [rbx + 0xc], 0x100
jne 0x140045b22
cmp dword [rbx + 0x3c], 0x2000000
je 0x140045b32
lea rcx, str.__Unsupported_type_of_VHD_image
xor esi, esi
call fcn.140036717
jmp 0x140045b7a
mov edx, dword [rbx + 0x40]
xor eax, eax
xor r8d, r8d
mov dword [rbx + 0x40], eax
xor eax, eax
bswap edx
movzx ecx, byte [rbx + rax]
inc rax
add r8d, ecx
cmp rax, 0x200
jne 0x140045b41
not r8d
cmp edx, r8d
je 0x140045b67
lea rcx, str.__Warning:_VHD_footer_seems_corrupted__checksum:__04X__expected:__04X_
call fcn.140036717
lea rcx, str.__Image_is_a_Fixed_Hard_Disk_VHD_file
call fcn.140036717
mov byte [rbp + 0x426], 1
mov rcx, rbx
call sub.msvcrt.dll_free
lea rax, [rdi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140045b95
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, esi
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret