Function at 0x180014880
Capabilities:
Check for software breakpoints
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe8
mov ebx, edx
mov r12, r8
add edx, 7
mov r8, rcx
mov dword [rsp + 0x40], edx
cmp ebx, edx
jae 0x180014ac8
mov r15d, dword [rsp + 0x138]
lea edi, [rbx - 0x3b]
movzx r13d, byte [rsp + 0x138]
lea r10, [0x180000000]
mov rsi, qword [rsp + 0x148]
xor r9d, r9d
movzx r14d, byte [rsp + 0x138]
mov rbp, qword [rsp + 0x148]
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x44], edi
mov edx, dword [rsp + 0x44]
movzx edi, byte [rsp + 0x148]
cmp edx, 0xc
ja case.default.0x180014919
mov eax, edx
mov ecx, dword [r10 + rax*4 + 0x14d54]
add rcx, r10
jmp rcx
mov rcx, qword [rsp + 0x60]
xor edx, edx
mov dword [rsp + 0x58], r9d
mov qword [rsp + 0x98], r9
call qword [sym.imp.KERNEL32.dll_GetFileSize]
xor r9d, r9d
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x80], r9d
jmp 0x180014cf9
cmp qword [r8 + 0x18], 8
mov rcx, r8
jb 0x180014956
mov rcx, qword [r8]
mov qword [rsp + 0x30], r9
mov edx, 0x80000000
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x148], 1
cmp rax, 0xffffffffffffffff
jne 0x180014cee
mov edi, 0x11a
nop dword [rax]
cmp edi, 0x2ee2a
ja 0x180014aa8
je 0x180014a5a
cmp edi, 0x11a
je 0x180014a3e
cmp edi, 0xbc5e
je 0x180014a34
cmp edi, 0x177a2
je 0x180014a0c
cmp edi, 0x232e6
jne 0x1800149e7
xor eax, eax
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0xa8], eax
xor r9d, r9d
add edi, 0xbb44
cmp edi, 0x5da20
jbe 0x1800149a0
movzx edi, byte [rsp + 0x148]
mov ebx, dword [rsp + 0x138]
jmp 0x180014cf9
xor eax, eax
mov dword [rsp + 0x68], 1
mov rsi, 0xffffffffffffffff
mov dword [rsp + 0x6c], eax
mov rcx, rsi
xor r8d, r8d
xor edx, edx
call qword [sym.imp.dbghelp.dll_SymInitialize]
mov r15d, eax
jmp 0x1800149e7
mov dword [rsp + 0x70], 0x2381f
jmp 0x1800149e7
mov r14b, 1
mov dword [rsp + 0x74], 1
xor r9d, r9d
movzx r13d, r14b
mov qword [rsp + 0x90], r9
jmp 0x1800149ea
mov r9d, dword [rsp + 0x6c]
lea rax, [rsp + 0xa0]
mov r8d, dword [rsp + 0x70]
mov edx, dword [rsp + 0x74]
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x20], eax
call qword [sym.imp.SHELL32.dll_SHChangeNotifyRegister]
xor r9d, r9d
mov dword [rsp + 0x54], eax
movzx eax, r13b
test r15d, r15d
mov ecx, r9d
cmovne ecx, eax
movzx r13d, cl
jmp 0x1800149ea
cmp edi, 0x3a96e
je 0x180014b88
cmp edi, 0x464b2
je 0x180014ae0
cmp edi, 0x51ff6
jne 0x1800149e7
mov eax, dword [rsp + 0x48]
add rsp, 0xe8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
test r14b, r14b
je 0x180014aef
mov ecx, dword [rsp + 0x54]
call qword [sym.imp.SHELL32.dll_SHChangeNotifyDeregister]
test r13b, r13b
je 0x180014b7e
mov ebx, 0xcd
xor r12d, r12d
mov eax, ebx
sub eax, 0xcd
je 0x180014b47
sub eax, 1
je 0x180014b1e
cmp eax, 1
jne 0x180014b6c
mov rcx, rsi
call qword [sym.imp.dbghelp.dll_SymCleanup]
jmp 0x180014b6c
lea r9, [rsp + 0xb0]
mov dword [rsp + 0xb0], PathMakeUniqueName
lea r8, [rsp + 0x78]
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.dbghelp.dll_SymGetLineFromAddr64]
mov r15d, eax
jmp 0x180014b6c
xorps xmm0, xmm0
mov dword [rsp + 0x78], r12d
xor eax, eax
mov rbp, r12
movups xmmword [rsp + 0xb0], xmm0
mov qword [rsp + 0xd0], rax
movups xmmword [rsp + 0xc0], xmm0
inc ebx
cmp ebx, 0xd0
jb 0x180014b00
mov r12, qword [rsp + 0x140]
mov byte [rsp + 0x48], 0
jmp 0x1800149e7
cmp dword [rsp + 0x54], 0
mov r9d, 0
movzx r14d, r14b
cmove r14d, r9d
jmp 0x1800149ea
cmp qword [rsp + 0x88], 0
mov ecx, r9d
movzx eax, dil
cmovne ecx, eax
movzx edi, cl
jmp case.0x180014919.1
mov edx, dword [rsp + 0x50]
xor r8d, r8d
mov rcx, r12
call fcn.1800512c0
xor eax, eax
mov rdx, r12
cmp qword [r12 + 0x18], 0x10
mov dword [rsp + 0x7c], eax
jb 0x180014bdf
mov rdx, qword [r12]
mov r8d, dword [rsp + 0x50]
lea r9, [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x180014cf6
mov ebx, 0xcc
cmp ebx, 0xcc
je 0x180014c19
cmp ebx, 0x14b8
je 0x180014ac8
jmp 0x180014c31
test dil, dil
je 0x180014c2c
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.SHELL32.dll_SHChangeNotification_Unlock]
mov byte [rsp + 0x48], 1
add ebx, 0x13ec
cmp ebx, 0x27d8
jbe 0x180014c03
mov ebx, dword [rsp + 0x138]
mov edx, dword [rsp + 0x80]
lea r9, [rsp + 0x7c]
mov rcx, qword [rsp + 0x98]
xor r8d, r8d
call qword [sym.imp.SHELL32.dll_SHChangeNotification_Lock]
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x88], rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x50]
cmp eax, dword [rsp + 0x58]
je 0x180014cf6
mov ebx, 6
mov eax, ebx
sub eax, 6
je 0x180014cc4
sub eax, 1
je 0x180014cb4
sub eax, 1
je 0x180014ca4
cmp eax, 1
je 0x180014d2c
xor r9d, r9d
jmp 0x180014cde
lea rcx, [rsp + 0x4c]
call qword [sym.imp.SHELL32.dll_ILFindLastID]
xor r9d, r9d
jmp 0x180014cde
xor eax, eax
mov word [rsp + 0x4c], ax
xor r9d, r9d
mov byte [rsp + 0x4e], al
jmp 0x180014cde
xor r9d, r9d
mov rax, r12
mov qword [r12 + 0x10], r9
cmp qword [r12 + 0x18], 0x10
jb 0x180014cdb
mov rax, qword [r12]
mov byte [rax], r9b
inc ebx
cmp ebx, 0xa
jb 0x180014c85
mov ebx, dword [rsp + 0x138]
jmp 0x180014cf9
movzx edi, byte [rsp + 0x148]
xor r9d, r9d
mov r8, qword [rsp + 0x130]
lea r10, [0x180000000]
mov edx, dword [rsp + 0x44]
mov eax, dword [rsp + 0x40]
inc ebx
inc edx
mov dword [rsp + 0x138], ebx
mov dword [rsp + 0x44], edx
cmp ebx, eax
jb 0x180014903
jmp 0x180014ac8
mov byte [rsp + 0x48], 0
jmp 0x180014ac8
mov ecx, dword [r8 + 0x14]
test cl, 0x40
je 0x180014d47
mov eax, r9d
jmp 0x180014acc
mov eax, 1
jmp 0x180014acc