Function at 0x18001bdc0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1e8]
sub rsp, 0x2b0
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
mov rax, qword [0x1800a9e28]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov r15d, ecx
mov dword [rbp - 0x80], ecx
add ecx, 0x7f9
mov qword [rsp + 0x68], r8
mov qword [rbp - 0x48], rdx
mov r12, rdx
mov dword [rsp + 0x44], ecx
cmp r15d, ecx
jae 0x18001c5bf
movzx ebx, byte [rsp + 0x40]
xor edx, edx
mov r9d, dword [rsp + 0x5c]
mov ecx, dword [rsp + 0x5c]
movsd xmm6, qword [0x180086368]
movsd xmm7, qword [0x180086390]
mov r13, qword [rbp - 0x70]
mov rsi, qword [rbp - 0x48]
mov r14d, dword [rsp + 0x5c]
mov rdi, qword [rbp - 0x78]
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x58], ebx
mov qword [rsp + 0x60], r9
mov qword [rsp + 0x50], rcx
cmp r15d, 0x1f8
ja 0x18001c4d4
je 0x18001c2c4
cmp r15d, 0x108
ja 0x18001c229
je 0x18001c202
mov eax, r15d
sub eax, 0x6b
je 0x18001c1e0
sub eax, 0x53
je 0x18001bec9
cmp eax, 0x17
jne 0x18001c5a7
mov rax, qword [r8]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x18001c5a5
cmp qword [rdx + 0x10], r12
je 0x18001c5f8
mov rdx, qword [rdx + 8]
test rdx, rdx
jne 0x18001beb1
jmp 0x18001c5a5
cmp qword [r8 + 0x18], 8
mov rcx, r8
jb 0x18001bed6
mov rcx, qword [r8]
mov qword [rsp + 0x30], rdx
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp - 0x78], rax
cmp rax, 0xffffffffffffffff
jne 0x18001c593
mov edi, 0x98
mov dword [rsp + 0x74], edi
nop dword [rax]
nop dword [rax + rax]
mov eax, edi
sub eax, 0x95
je 0x18001c616
sub eax, 1
je 0x18001bf66
sub eax, 1
je 0x18001bf57
cmp eax, 1
jne 0x18001c1c5
movzx ebx, al
mov byte [rsp + 0x41], al
mov dword [rsp + 0x58], ebx
mov rsi, 0xffffffffffffffff
jmp 0x18001c1c5
call qword [sym.imp.dbghelp.dll_ImagehlpApiVersion]
mov qword [rbp - 0x68], rax
jmp 0x18001c1c5
movzx eax, byte [rsp + 0x41]
xor ecx, ecx
cmp qword [rbp - 0x68], rcx
cmovne ecx, eax
xor r8d, r8d
mov byte [rsp + 0x41], cl
xor edx, edx
mov rcx, rsi
call qword [sym.imp.dbghelp.dll_SymInitialize]
test eax, eax
movzx ebx, bl
mov eax, 0
cmove ebx, eax
mov dword [rsp + 0x58], ebx
cmp byte [rsp + 0x41], al
je 0x18001bfa7
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.dbghelp.dll_ImagehlpApiVersionEx]
test bl, bl
je 0x18001c1c5
mov ebx, 0x4c
lea r12d, [rbx + 1]
lea r15d, [rbx + 0x1d]
nop dword [rax]
cmp ebx, 0x40c
ja 0x18001c103
je 0x18001c0e2
cmp ebx, 0x22c
ja 0x18001c08c
je 0x18001c070
cmp ebx, 0x4c
je 0x18001c054
cmp ebx, 0xec
je 0x18001c01f
cmp ebx, 0x18c
jne 0x18001c196
mov r8d, 3
mov word [rbp + 0x1a], 0x33
lea rdx, [0x180085335]
lea rcx, [rbp + 0x1b]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x18001c196
mov r8d, 5
mov byte [rbp + 0x12], 0
lea rdx, [0x1800852fa]
lea rcx, [rbp + 0x10]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
movzx eax, word [0x18008531c]
mov word [rbp + 0x17], ax
movzx eax, byte [0x18008531e]
mov byte [rbp + 0x19], al
jmp 0x18001c196
mov r8d, 2
lea rdx, [0x180085395]
lea rcx, [rbp + 0x10]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x18001c196
mov eax, dword [0x1800853de]
mov dword [rbp + 0x1e], eax
movzx eax, byte [0x1800853e2]
mov byte [rbp + 0x22], al
mov byte [rbp + 0x23], 0
jmp 0x18001c196
cmp ebx, 0x2cc
je 0x18001c0d3
cmp ebx, 0x36c
jne 0x18001c196
mov r8d, 1
lea rdx, [0x180085350]
lea rcx, [rbp + 0x10]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov eax, 0x2f
mov dword [rbp + 0x28], 0x6c6176
mov word [rbp + 0x2b], ax
mov dword [rbp + 0x2c], 0x6c6c61
jmp 0x18001c196
mov word [rbp + 0x23], 0x4755
mov byte [rbp + 0x25], 0
jmp 0x18001c196
mov eax, 0x3f
mov word [rbp + 0x2f], ax
mov eax, 0x65
mov word [rbp + 0x30], r12w
mov word [rbp + 0x31], r12w
mov word [rbp + 0x32], ax
jmp 0x18001c196
cmp ebx, 0x4ac
je 0x18001c17d
cmp ebx, 0x54c
je 0x18001c161
cmp ebx, 0x5ec
je 0x18001c152
cmp ebx, 0x68c
je 0x18001c136
cmp ebx, 0x72c
jne 0x18001c196
mov rcx, rsi
call qword [sym.imp.dbghelp.dll_SymCleanup]
jmp 0x18001c196
lea r9, [rbp - 0x40]
mov dword [rsp + 0x20], r14d
lea r8, [rbp + 0x28]
mov rcx, rsi
lea rdx, [rbp + 0x10]
call qword [sym.imp.dbghelp.dll_SymGetFileLineOffsets64]
jmp 0x18001c196
mov dword [rbp + 0x40], 0x624d65
mov r14d, 0xa
jmp 0x18001c196
mov word [rbp + 0x3a], r15w
mov eax, 0x7a
mov dword [rbp + 0x3b], 0x732f74
mov word [rbp + 0x3e], r15w
mov word [rbp + 0x3f], ax
jmp 0x18001c196
mov eax, 0x6d
mov word [rbp + 0x33], ax
mov eax, 0x6d69
mov word [rbp + 0x38], ax
mov dword [rbp + 0x34], 0x4c79726f
add ebx, 0xa0
cmp ebx, 0x7cc
jb 0x18001bfc0
movzx eax, byte [rsp + 0x41]
mov edi, dword [rsp + 0x74]
mov r15d, dword [rbp - 0x80]
mov r12, qword [rbp - 0x48]
mov r13, qword [rbp - 0x70]
mov ebx, dword [rsp + 0x58]
mov byte [rsp + 0x41], al
dec edi
mov dword [rsp + 0x74], edi
cmp edi, 0x94
ja 0x18001bf20
mov rdi, qword [rbp - 0x78]
jmp 0x18001c596
movsd xmm0, qword [r8]
addsd xmm0, xmm6
mov byte [rsp + 0x40], 1
cvttsd2si r9, xmm0
movsd qword [r8], xmm0
mov qword [rsp + 0x60], r9
jmp 0x18001c5a7
movsd xmm0, qword [r8]
mov eax, 0x51eb851f
mulsd xmm0, xmm7
cvttsd2si rcx, xmm0
mul ecx
shr edx, 5
imul eax, edx, 0x64
sub ecx, eax
mov qword [rsp + 0x50], rcx
jmp 0x18001c5a5
mov eax, r15d
sub eax, 0x15b
je 0x18001c28e
cmp eax, 0x4a
jne 0x18001c5a7
lea r8d, [rax - 0x40]
mov qword [rbp - 0x50], 0xffffffffffffffff
mov rdx, r12
mov ecx, r9d
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itoa]
xor edx, edx
xor r8d, r8d
lea rcx, [rdx - 1]
call qword [sym.imp.dbghelp.dll_SymInitialize]
mov dword [rsp + 0x7c], eax
mov r13, 0xffffffffffffffff
nop
inc r13
cmp byte [r12 + r13], 0
jne 0x18001c270
add r13, r12
mov byte [r13], 0x2e
inc r13
mov qword [rbp - 0x70], r13
jmp 0x18001c596
mov dword [rsp + 0x78], edx
mov rcx, rdi
xor edx, edx
mov byte [rsp + 0x49], 1
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x70], eax
call qword [sym.imp.dbghelp.dll_ImagehlpApiVersion]
mov edx, dword [rsp + 0x70]
xor r8d, r8d
mov rcx, r12
mov qword [rbp - 0x58], rax
call fcn.18006e370
jmp 0x18001c596
xor edx, edx
mov rcx, r12
call fcn.180003500
mov r8d, dword [rsp + 0x70]
lea r9, [rsp + 0x78]
mov rdx, rax
mov rcx, rdi
xor eax, eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, byte [rsp + 0x49]
xor edx, edx
mov ecx, edx
cmp qword [rbp - 0x58], rcx
cmovne ecx, eax
mov eax, dword [rsp + 0x70]
mov byte [rsp + 0x49], cl
cmp eax, dword [rsp + 0x78]
je 0x18001c4c9
mov ebx, 0xb
nop dword [rax + rax]
cmp ebx, 0xb
ja case.default.0x18001c33d
lea r8, [0x180000000]
mov eax, ebx
mov ecx, dword [r8 + rax*4 + 0x1c620]
add rcx, r8
jmp rcx
cmp dword [rsp + 0x5c], 0
mov ecx, edx
movzx eax, byte [rsp + 0x48]
cmovne ecx, eax
mov byte [rsp + 0x48], cl
cmp cl, 0
je case.default.0x18001c33d
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.dbghelp.dll_SymCleanup]
jmp case.default.0x18001c33d
mov dword [rbp + 0x1e], 0x65697620
mov byte [rbp + 0x22], 0
jmp case.default.0x18001c33d
mov qword [r12 + 0x10], rdx
mov rax, r12
cmp qword [r12 + 0x18], 0x10
mov byte [rsp + 0x48], 1
mov qword [rbp - 0x60], 0xffffffffffffffff
jb 0x18001c39b
mov rax, qword [r12]
mov byte [rax], 0
jmp case.default.0x18001c33d
mov rcx, qword [rbp - 0x60]
lea rdx, [rbp + 0x10]
xor r8d, r8d
call qword [sym.imp.dbghelp.dll_SymInitialize]
mov dword [rsp + 0x5c], eax
jmp case.default.0x18001c33d
mov word [rbp + 0x24], 0x3a
mov dword [rbp + 0x58], 0x43414d48
jmp case.default.0x18001c33d
mov eax, 0x28
mov byte [rbp + 0x10], 0
mov word [rbp + 0x51], ax
lea rdx, [0x1800853ea]
mov eax, 0x3f
lea rcx, [rbp + 0x10]
mov word [rbp + 0x52], ax
lea r8d, [rax - 0x3d]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov eax, 0x7377
mov word [rbp + 0x12], ax
jmp case.default.0x18001c33d
mov eax, 0x4d
mov byte [rbp + 0x67], 0
mov word [rbp + 0x61], ax
mov eax, 0x44
mov word [rbp + 0x62], ax
mov dword [rbp + 0x63], 0x3036312d
jmp case.default.0x18001c33d
mov eax, 0x2d
mov word [rbp + 0x5c], ax
mov eax, 0x45
mov dword [rbp + 0x5d], 0x504952
mov word [rbp + 0x60], ax
jmp case.default.0x18001c33d
movzx eax, word [0x18008543f]
lea rdx, [0x180085471]
mov word [rbp + 0x14], ax
lea rcx, [rbp + 0x10]
movzx eax, byte [0x180085441]
mov r8d, 4
mov byte [rbp + 0x16], al
mov byte [rbp + 0x17], 0
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
movzx eax, word [0x1800854c2]
mov word [rbp + 0x1b], ax
movzx eax, byte [0x1800854c4]
mov byte [rbp + 0x1d], al
jmp case.default.0x18001c33d
mov eax, 0x70
mov dword [rbp + 0x48], 0x54797274
mov word [rbp + 0x50], ax
mov dword [rbp + 0x4c], 0x6d75506f
jmp case.default.0x18001c33d
mov eax, 0x2977
mov byte [rbp + 0x24], 0
mov word [rbp + 0x22], ax
dec ebx
mov edx, 0
lea eax, [rbx + 0x67]
cmp eax, 0x66
ja 0x18001c320
mov ebx, dword [rsp + 0x58]
call qword [sym.imp.dbghelp.dll_ImagehlpApiVersion]
jmp 0x18001c596
cmp r15d, 0x332
ja 0x18001c54a
je 0x18001c61a
mov eax, r15d
sub eax, 0x242
je 0x18001c530
sub eax, 0x53
je 0x18001c519
cmp eax, 0x4a
jne 0x18001c5a7
mov eax, dword [rsp + 0x44]
cmp ecx, 0xa
jae 0x18001c5ab
mov byte [r13], 0x30
inc r13
mov qword [rbp - 0x70], r13
jmp 0x18001c5ab
cmp byte [rsp + 0x49], 0
je 0x18001c5a7
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.dbghelp.dll_ImagehlpApiVersionEx]
jmp 0x18001c596
movzx eax, byte [rsp + 0x40]
mov ecx, edx
cmp dword [rsp + 0x7c], 0
cmovne ecx, eax
mov byte [rsp + 0x40], cl
mov rcx, qword [rsp + 0x50]
jmp 0x18001c5a7
cmp r15d, 0x37c
je 0x18001c56d
cmp r15d, 0x419
jne 0x18001c5ab
mov r8d, 0xa
mov rdx, r13
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itoa]
jmp 0x18001c596
cmp byte [rsp + 0x40], 0
je 0x18001c5ab
mov rcx, qword [rbp - 0x50]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.dbghelp.dll_SymEnumerateModules64]
mov rcx, qword [rbp - 0x50]
mov dword [rsp + 0x7c], eax
call qword [sym.imp.dbghelp.dll_SymCleanup]
jmp 0x18001c596
mov rdi, rax
mov r9, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x68]
xor edx, edx
mov eax, dword [rsp + 0x44]
add r15d, 0x9d
mov dword [rbp - 0x80], r15d
cmp r15d, eax
jb 0x18001be61
movzx eax, byte [rsp + 0x40]
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.18007e380
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rax, qword [r8 + 8]
mov rcx, r8
call qword [rax + 0x48]
jmp 0x18001c5bf
lea r8, [rbp + 0x70]
lea rdx, [rbp + 0x58]
lea rcx, [rbp + 0x48]
call qword [sym.imp.dbghelp.dll_SearchTreeForFile]
xor al, al
jmp 0x18001c5c4
mov al, 1
jmp 0x18001c5c4