Function at 0x140018aa0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x140001200]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov r12, r8
mov qword [rbp - 0x50], r8
mov r14, rdx
mov qword [rbp - 0x78], rcx
mov qword [rbp - 0x40], rdx
mov dword [rbp - 0x80], 1
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rdx + 8], xmm0
xor r13d, r13d
mov qword [rdx + 0x18], r13
lea edx, [r13 + 0xf]
mov qword [r14 + 0x20], rdx
mov byte [r14 + 8], r13b
lea r15, [r14 + 0x30]
vmovups xmmword [r15], xmm0
mov qword [r15 + 0x10], r13
mov qword [r15 + 0x18], rdx
mov byte [r15], r13b
mov qword [r14 + 0x50], r13
mov qword [r14 + 0x58], r13
mov qword [r14 + 0x60], r13
mov qword [r14 + 0x68], r13
mov qword [r14 + 0x70], r13
mov qword [r14 + 0x78], r13
mov dword [rbp - 0x80], 1
mov byte [r14], r13b
mov byte [rsp + 0x40], r13b
lea rcx, [r8 + 0x10]
cmp qword [rcx + 0x18], rdx
jbe 0x140018b4d
mov rcx, qword [rcx]
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140018c40
mov r8d, dword [r12]
xor edx, edx
lea ecx, [rdx + 0x10]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
mov qword [rbp - 0x60], rax
mov rcx, rdi
test rax, rax
jne 0x140018baa
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140018c40
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
vpxor xmm0, xmm0, xmm0
xor eax, eax
vmovups xmmword [rbp + 0x68], xmm0
mov qword [rbp + 0x78], rax
mov edx, ebx
lea rcx, [rbp + 0x68]
call fcn.14001979c
nop
mov dword [rbp + 0x40], r13d
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x40]
mov r8d, ebx
mov rbx, qword [rbp + 0x68]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rdi
test eax, eax
jne 0x140018c6d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
test rbx, rbx
je 0x140018c40
mov rdx, qword [rbp + 0x78]
sub rdx, rbx
cmp rdx, 0x1000
mov rax, rbx
jb 0x140018c37
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140019339
mov rcx, rbx
call fcn.140022fd0
nop
mov rax, r14
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.140022fb0
mov rbx, qword [rsp + 0x2f8]
add rsp, 0x2a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov qword [rsp + 0x20], r13
mov r9d, 0x40
lea r8, [rbp]
mov rdx, qword [r12 + 8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movsxd rdx, dword [rbp + 0x3c]
add rdx, qword [r12 + 8]
mov qword [rsp + 0x20], r13
mov r9d, 0x108
lea r8, [rbp + 0x80]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ecx, r13d
mov dword [rsp + 0x70], ecx
mov r13d, 0x1000
xor r8d, r8d
cmp r8w, word [rbp + 0x86]
jae 0x140019232
movsxd rax, ecx
lea rcx, [rax + rax*4]
movsxd rax, dword [rbp + 0x3c]
lea rdx, [rax + rcx*8]
mov rax, qword [r12 + 8]
add rax, 0x108
add rdx, rax
mov qword [rsp + 0x20], r8
mov r9d, 0x28
lea r8, [rbp - 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test dword [rbp - 0xc], 0x20000000
je 0x140019216
vpxor xmm0, xmm0, xmm0
xor eax, eax
vmovups xmmword [rbp + 0x48], xmm0
mov qword [rbp + 0x58], rax
mov edx, dword [rbp - 0x28]
lea rcx, [rbp + 0x48]
call fcn.14001979c
nop
mov edx, dword [rbp - 0x24]
add rdx, qword [r12 + 8]
mov r9d, dword [rbp - 0x28]
and qword [rsp + 0x20], 0
mov rdi, qword [rbp + 0x48]
mov qword [rbp - 0x58], rdi
mov r8, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [rbp + 0x50]
sub rcx, rdi
mov qword [rsp + 0x78], rcx
lea rax, [rcx - 0xa]
mov qword [rbp - 0x68], rax
xor r8d, r8d
test rax, rax
je 0x1400191e1
mov r12, rdi
mov rsi, rdi
neg rsi
mov qword [rsp + 0x48], rsi
mov rax, qword [rbp - 0x78]
mov rdi, qword [rax]
cmp rdi, qword [rax + 8]
je 0x140018e1b
lea r15, [r12 + rsi]
mov rsi, qword [rdi + 8]
sub rsi, qword [rdi]
lea rax, [rsi + r15]
cmp rax, rcx
ja 0x140018dfe
mov r8, rsi
mov rdx, r12
mov rcx, qword [rdi]
call fcn.1400465e0
xor r8d, r8d
test eax, eax
jne 0x140018df9
mov r13d, dword [rbp - 0x1c]
add r13, qword [rsp + 0x48]
add r13, r12
mov rcx, qword [rbp + 0x70]
sub rcx, rbx
mov qword [rbp - 0x70], rcx
lea rax, [rsi + r13]
cmp rax, rcx
ja 0x140018df9
lea rdx, [rbx + r13]
mov r8, rsi
mov rcx, qword [rdi]
call fcn.1400465e0
xor r8d, r8d
test eax, eax
jne 0x140018f0f
mov rcx, qword [rsp + 0x78]
add rdi, 0x38
mov rax, qword [rbp - 0x78]
cmp rdi, qword [rax + 8]
jne 0x140018d9a
lea r15, [r14 + 0x30]
mov r13d, 0x1000
mov rsi, qword [rsp + 0x48]
mov edi, dword [rbp - 0x1c]
add rdi, rsi
add rdi, r12
mov rcx, qword [rbp + 0x70]
sub rcx, rbx
lea rax, [rdi + 0xa]
cmp rax, rcx
ja 0x1400191b5
mov rax, qword [rdi + rbx]
cmp rax, qword [r12]
jne 0x140018e53
movzx eax, word [rdi + rbx + 8]
cmp ax, word [r12 + 8]
je 0x1400191b5
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r8
mov r8d, 8
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x50]
call fcn.140016368
lea rdx, [rsp + 0x50]
lea rcx, [r14 + 8]
call fcn.140015c24
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140018ec2
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, r13
jb 0x140018ebd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001934b
call fcn.140022fd0
mov eax, dword [rbp - 0x24]
add rax, rsi
add rax, r12
mov qword [r14 + 0x28], rax
mov eax, 0xc
cmp qword [r15 + 0x18], rax
jb 0x140019106
mov rsi, r15
cmp qword [r15 + 0x18], 0xf
jbe 0x140018eeb
mov rsi, qword [r15]
mov qword [r15 + 0x10], rax
mov r8, rax
lea rdx, [0x14000e2b0]
mov rcx, rsi
call fcn.140045b00
mov byte [rsi + 0xc], 0
mov rsi, qword [rsp + 0x48]
jmp 0x140019118
mov byte [r14], 1
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r8
mov r8d, 8
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x50]
call fcn.140016368
lea rdx, [rsp + 0x50]
lea rcx, [r14 + 8]
call fcn.140015c24
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140018f86
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018f81
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001934b
call fcn.140022fd0
mov eax, dword [rbp - 0x24]
mov rsi, qword [rsp + 0x48]
add rax, rsi
add rax, r12
mov qword [r14 + 0x28], rax
lea r9, [rdi + 0x18]
lea rcx, [r14 + 0x30]
cmp rcx, r9
je 0x140018fec
mov rsi, qword [r9 + 0x10]
cmp qword [r9 + 0x18], 0xf
jbe 0x140018fb3
mov r9, qword [r9]
cmp rsi, qword [rcx + 0x18]
ja 0x140018fdf
mov r15, rcx
cmp qword [rcx + 0x18], 0xf
jbe 0x140018fc6
mov r15, qword [rcx]
mov qword [rcx + 0x10], rsi
mov r8, rsi
mov rdx, r9
mov rcx, r15
call fcn.140045b00
mov byte [r15 + rsi], 0
jmp 0x140018fe7
mov rdx, rsi
call fcn.140016d00
mov rsi, qword [rsp + 0x48]
mov r8, qword [rdi + 8]
sub r8, qword [rdi]
lea rax, [r8 + r13]
cmp rax, qword [rbp - 0x70]
ja 0x14001900a
lea rdx, [rbx + r13]
lea rcx, [r14 + 0x50]
call fcn.14001a314
mov r8, qword [rdi + 8]
sub r8, qword [rdi]
lea rax, [rsi + r12]
add rax, r8
cmp rax, qword [rsp + 0x78]
ja 0x14001902b
mov rdx, r12
lea rcx, [r14 + 0x68]
call fcn.14001a314
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x50], xmm0
and qword [rsp + 0x60], 0
and qword [rsp + 0x68], 0
mov r8d, 8
lea rdx, [0x14000e2a0]
lea rcx, [rsp + 0x50]
call fcn.140016368
nop
mov r9b, 1
mov r8, r14
lea rdx, [rsp + 0x50]
call fcn.140017f18
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1400190a7
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400190a2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140019345
call fcn.140022fd0
xor r8d, r8d
cmp byte [rsp + 0x40], r8b
jne 0x1400191b5
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdi, [0x140001e60]
mov rdx, qword [rdi]
lea rcx, [0x14004bf90]
call fcn.1400198dc
mov rcx, rax
call fcn.140019aec
add rdi, 8
lea rax, [0x140001e80]
cmp rdi, rax
jne 0x1400190d5
mov byte [rsp + 0x40], 1
jmp 0x1400191b2
lea r9, [0x14000e2b0]
mov rdx, rax
mov rcx, r15
call fcn.140016d00
lea rdx, [rdi + rbx]
mov edi, 0xa
mov r8d, edi
lea rcx, [r14 + 0x50]
call fcn.14001a314
mov r8d, edi
mov rdx, r12
lea rcx, [r14 + 0x68]
call fcn.14001a314
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x50], xmm0
and qword [rsp + 0x60], 0
and qword [rsp + 0x68], 0
lea r8d, [rdi - 2]
lea rdx, [0x14000e2a0]
lea rcx, [rsp + 0x50]
call fcn.140016368
nop
xor r9d, r9d
mov r8, r14
lea rdx, [rsp + 0x50]
call fcn.140017f18
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1400191b2
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, r13
jb 0x1400191ad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140019351
call fcn.140022fd0
xor r8d, r8d
inc r12
lea rax, [rsi + r12]
cmp rax, qword [rbp - 0x68]
lea r15, [r14 + 0x30]
mov r13d, 0x1000
mov rcx, qword [rsp + 0x78]
jb 0x140018d85
mov rsi, qword [rbp - 0x60]
mov rdi, qword [rbp - 0x58]
mov r12, qword [rbp - 0x50]
test rdi, rdi
je 0x140019219
mov rdx, qword [rbp + 0x58]
sub rdx, rdi
mov rax, rdi
cmp rdx, r13
jb 0x14001920e
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140019333
mov rcx, rdi
call fcn.140022fd0
xor r8d, r8d
mov ecx, dword [rsp + 0x70]
inc ecx
mov dword [rsp + 0x70], ecx
movzx eax, word [rbp + 0x86]
cmp ecx, eax
jl 0x140018cd3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [r14], 0
jne 0x14001931b
lea rdx, [0x14000e2fc]
lea rcx, [0x14004bf90]
call fcn.140019b24
mov rcx, rax
lea rdx, [0x14000e2c8]
call fcn.1400198dc
lea rdx, [r12 + 0x30]
cmp qword [rdx + 0x18], 0xf
jbe 0x140019276
mov rdx, qword [rdx]
mov rcx, rax
call fcn.140019b24
mov rcx, rax
lea rdx, [0x14000e2c0]
call fcn.1400198dc
mov rcx, rax
lea rdx, [0x14000ddf8]
call fcn.140019b24
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x48], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x58], xmm1
mov r8d, 0x50
mov dl, 0x3d
lea rcx, [rbp + 0x48]
call fcn.1400162a4
nop
lea rdx, [rbp + 0x48]
cmp qword [rbp + 0x60], 0xf
cmova rdx, qword [rbp + 0x48]
mov r8, qword [rbp + 0x58]
lea rcx, [0x14004bd90]
call fcn.14001756c
mov rcx, rax
call fcn.140015e48
nop
mov rdx, qword [rbp + 0x60]
cmp rdx, 0xf
jbe 0x14001931b
inc rdx
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, r13
jb 0x140019315
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001933f
call fcn.140022fd0
nop
test rbx, rbx
je 0x140018c40
mov rdx, qword [rbp + 0x78]
sub rdx, rbx
cmp rdx, r13
jmp 0x140018c19
call fcn.14002d6bc
nop
call fcn.14002d6bc
nop
call fcn.14002d6bc
nop
call fcn.14002d6bc
int3
call fcn.14002d6bc
int3
call fcn.14002d6bc
int3