Function at 0x18000d290
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x270]
sub rsp, 0x370
mov rax, qword [0x18007b358]
xor rax, rsp
mov qword [rbp + 0x260], rax
xor r15d, r15d
mov dword [rsp + 0x4c], ecx
mov esi, ecx
mov qword [rsp + 0x50], r8
lea r14d, [rcx + 0xb]
mov qword [rsp + 0x70], rdx
mov r13d, ecx
mov r10, r8
lea edi, [r15 + 0x54]
mov r12, rdx
lea rcx, [0x180000000]
cmp esi, r14d
jae 0x18000d3b5
lea ebx, [r15 + 0x52]
lea edx, [rbx + 0xd]
lea edi, [rsi - 0x119]
lea r8d, [r15 + 0x49]
lea r9d, [r15 + 0x43]
lea r10d, [r15 + 0x41]
lea r11d, [r15 + 0x4e]
cmp edi, 0x12
ja case.default.0x18000d32b
mov ecx, dword [rcx + rdi*4 + 0xdbd8]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
mov word [rbp - 0x40], r8w
jmp case.0x18000d32b.3
xor edx, edx
xor ecx, ecx
mov r8d, 0x100
call fcn.18001df50
xor edx, edx
mov r8, r12
cmp rax, 2
je 0x18000d73e
mov qword [rsp + 0x28], r15
xor r9d, r9d
mov ecx, 0x12b
mov qword [rsp + 0x20], r15
call fcn.18003cdd0
test al, al
je 0x18000d46e
mov r8, r12
xor edx, edx
mov ecx, 0xc7
call fcn.180049d30
mov edx, 0x5f
mov r11d, 0x4e
lea r10d, [r11 - 0xd]
lea r9d, [r11 - 0xb]
lea r8d, [r11 - 5]
lea rcx, [0x180000000]
inc esi
inc edi
cmp esi, r14d
jb 0x18000d311
mov r10, qword [rsp + 0x50]
mov edi, 0x54
movzx ebx, byte [rsp + 0x40]
mov r15d, r13d
imul esi, r13d, 0x35c
mov dword [rsp + 0x44], esi
cmp r13d, esi
ja case.0x18000d46c.0
mov r12, qword [rsp + 0x68]
mov edx, 0x27
mov r14d, dword [rsp + 0x4c]
mov r8d, 0x7640
movzx r13d, byte [rsp + 0x40]
lea r9d, [rdx + 0x2e]
lea r11d, [rdx + 0x49]
mov eax, 0x44
cmp r15d, 0x1eb9c
ja 0x18000da5b
je 0x18000d9b1
cmp r15d, 0x124
je 0x18000d99d
cmp r15d, 0x633c
je 0x18000d992
cmp r15d, 0xc554
je 0x18000d94d
cmp r15d, 0x1276c
jne 0x18000dbaa
cmp r12, 0xffffffffffffffff
jne 0x18000d932
mov edi, ILRemoveLastID
nop
cmp edi, 0xe
ja case.default.0x18000d46c
mov eax, edi
mov ecx, dword [rcx + rax*4 + 0xdc24]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
mov r8d, 0x139
mov rdx, r12
xor ecx, ecx
call fcn.180049900
jmp 0x18000d380
mov dword [rbp - 0x24], 0x500050
mov dword [rbp - 0x20], 0x4f0052
jmp case.0x18000d32b.3
mov eax, 0x54
mov dword [rbp - 0x3a], 0x4e005f
mov word [rbp - 0x3c], ax
mov eax, 0x56
mov word [rbp - 0x36], ax
jmp case.0x18000d32b.3
mov eax, 0x46
mov dword [rbp - 0x1c], 0x5f0058
mov word [rbp - 0x18], ax
jmp case.0x18000d32b.3
mov dword [rbp - 0x30], 0x52005f
mov word [rbp - 0x2c], r9w
jmp case.0x18000d32b.3
xor eax, eax
lock cmpxchg dword [r12 + 0x11c], r15d
cmp eax, 1
jne case.0x18000d32b.3
mov ebx, 0x36
cmp ebx, 0x36
je 0x18000d507
cmp ebx, 0x17a
je 0x18000d748
jmp 0x18000d521
mov r8, r12
xor edx, edx
mov ecx, 0xc7
call fcn.180049d30
mov eax, r15d
xchg dword [r12 + 0x11c], eax
add ebx, 0x144
cmp ebx, 0x288
jbe 0x18000d4f4
mov ebx, 0x52
jmp 0x18000d380
mov dword [rbp - 0x34], 0x4d0056
jmp case.0x18000d32b.3
xor eax, eax
lock cmpxchg dword [r12 + 0x120], r15d
xor r8d, r8d
xor ecx, ecx
cmp eax, 1
je 0x18000d760
mov r9d, 0xd5
xor edx, edx
call fcn.18001f460
test al, al
jne 0x18000d380
mov ebx, 0x12b
nop dword [rax]
cmp ebx, 0x431
ja 0x18000d683
je 0x18000d651
cmp ebx, 0x2ae
ja 0x18000d61f
je 0x18000d616
cmp ebx, 0x12b
je 0x18000d604
cmp ebx, 0x1ac
je 0x18000d5d3
mov edx, 0x5f
cmp ebx, 0x22d
jne 0x18000d5ec
mov eax, dword [0x18006fae8]
mov dword [rbp - 0x4c], eax
movzx eax, word [0x18006faec]
mov word [rbp - 0x48], ax
jmp 0x18000d5ec
mov eax, dword [0x18006fba4]
mov dword [rbp - 0x52], eax
movzx eax, word [0x18006fba8]
mov word [rbp - 0x4e], ax
mov edx, 0x5f
add ebx, 0x81
cmp ebx, 0x7b8
jb 0x18000d580
mov ebx, 0x52
jmp 0x18000d385
mov eax, 0x38
mov dword [rbp - 0x58], 0x470073
mov word [rbp - 0x54], ax
jmp 0x18000d5e7
mov dword [rbp - 0x46], 0x47
jmp 0x18000d5e7
cmp ebx, 0x32f
je 0x18000d638
cmp ebx, 0x3b0
jne 0x18000d5e7
mov dword [rbp - 8], 0x64
jmp 0x18000d5e7
mov r8d, 1
lea rdx, [0x18006fc0e]
lea rcx, [rbp - 0x58]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp 0x18000d5e7
mov r8d, 2
lea rdx, [0x18006faa4]
lea rcx, [rbp - 8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
movsd xmm0, qword [str.ian10]
mov eax, dword [0x18006fab8]
movsd qword [rbp - 2], xmm0
mov dword [rbp + 6], eax
jmp 0x18000d5e7
cmp ebx, 0x4b2
je 0x18000d715
cmp ebx, 0x533
je 0x18000d70b
cmp ebx, 0x5b4
je 0x18000d6e0
cmp ebx, 0x6b6
je 0x18000d6b8
cmp ebx, 0x737
je 0x18000d748
jmp 0x18000d5e7
mov r8, r12
xor edx, edx
mov ecx, 0xc7
call fcn.180049d30
mov r8d, 8
lea rdx, [rbp - 8]
lea rcx, [rbp - 0x58]
call qword [sym.imp.SHLWAPI.dll_StrCmpNICW]
jmp 0x18000d5e7
movsd xmm0, qword [str.uest]
movabs rax, 0x4700340036
mov qword [rbp + 0xa], rax
movzx eax, word [0x18006faa0]
mov word [rbp + 0x18], ax
movsd qword [rbp + 0x10], xmm0
jmp 0x18000d5e7
mov word [rbp + 0xa], r15w
jmp 0x18000d5e7
mov edx, 0x5f
mov word [rbp + 8], dx
jmp 0x18000d5ec
mov dword [rbp - 0x2a], 0x5f0050
mov word [rbp - 0x26], r10w
jmp case.0x18000d32b.3
mov word [rbp - 0x3e], r11w
jmp case.0x18000d32b.3
mov ecx, 0xc7
call fcn.180049d30
movzx eax, byte [rsp + 0x40]
jmp 0x18000da8a
mov qword [rsp + 0x30], r15
mov r9d, 0xa2
mov qword [rsp + 0x28], r15
mov rdx, r12
mov qword [rsp + 0x20], r15
call fcn.18002a4e0
movzx eax, byte [rsp + 0x40]
xchg dword [r12 + 0x120], r15d
jmp 0x18000da8a
mov word [rbp - 0x66], r8w
jmp case.default.0x18000d46c
mov word [rbp - 0x5f], r9w
mov word [rbp - 0x5e], r11w
jmp case.default.0x18000d46c
mov dword [rbp + 0x24], 0x75
mov dword [rbp + 0x26], 0x64
jmp case.default.0x18000d46c
mov eax, dword [str.tStr]
mov dword [rbp - 0x7e], eax
movzx eax, byte [0x18006fc34]
mov byte [rbp - 0x7a], al
jmp case.default.0x18000d46c
mov eax, dword [str.VixTe]
mov dword [rsp + 0x78], eax
movzx eax, word [0x18006fc3c]
mov word [rsp + 0x7c], ax
movzx eax, word [0x18006f200]
mov dword [rsp + 0x7d], 0x5f6d61
mov word [rbp - 0x80], ax
movzx eax, byte [0x18006f202]
mov byte [rbp - 0x7e], al
jmp case.default.0x18000d46c
mov dword [rbp - 0x63], 0x764055
mov word [rbp - 0x60], dx
jmp case.default.0x18000d46c
mov dword [rbp - 0x74], 0x72653f
jmp case.default.0x18000d46c
mov word [rbp - 0x64], dx
jmp case.default.0x18000d46c
mov eax, dword [0x18006fc40]
mov dword [rbp + 0x20], eax
movzx eax, word [0x18006fc44]
mov word [rbp + 0x24], ax
jmp case.default.0x18000d46c
xor bl, bl
jmp case.default.0x18000d46c
mov eax, 0x69
lea rdx, str.ngPro
lea rcx, [rbp - 0x79]
mov word [rbp - 0x7a], ax
lea r8d, [rax - 0x63]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x18000d909
lea rax, [rbp + 0x20]
mov dword [rbp + 0x28], 0x74
sub rax, 2
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x18000d882
movups xmm0, xmmword [str.51l_curr_]
mov ecx, dword [0x18006fc60]
movups xmmword [rax], xmm0
mov dword [rax + 0x10], ecx
mov eax, dword [0x18006fc70]
movsd xmm0, qword [str.ig.res]
mov dword [rbp + 0x44], eax
movzx eax, word [0x18006fc74]
mov word [rbp + 0x48], ax
movsd qword [rbp + 0x3c], xmm0
jmp case.default.0x18000d46c
movzx eax, word [0x18006fc78]
mov word [rbp - 0x71], ax
movzx eax, byte [0x18006fc7a]
mov byte [rbp - 0x6f], al
mov eax, 0x5526
mov word [rbp - 0x68], ax
jmp case.default.0x18000d46c
xor r8d, r8d
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_CreateHardLinkA]
mov r8d, 0x104
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov r11d, 0x70
mov r8d, 0x7640
lea r9d, [r11 - 0x1b]
lea edx, [r11 - 0x49]
dec edi
lea rcx, [0x180000000]
lea eax, [rdi + 0x35]
cmp eax, 0x34
ja 0x18000d450
xor edx, edx
mov dword [rsp + 0x48], 0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r14d, eax
jmp 0x18000db96
mov rax, qword [rsp + 0x70]
mov rcx, rax
cmp qword [rax + 0x18], 8
jb 0x18000d95f
mov rcx, qword [rax]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
jmp 0x18000db96
xor eax, eax
mov word [rbp - 0xe], ax
jmp 0x18000dbaa
mov word [rbp - 0x16], di
mov dword [rbp - 0x14], 0x5f005a
mov word [rbp - 0x10], ax
jmp 0x18000dbaa
mov rdx, qword [r10 + 0x10]
mov ecx, r14d
cmp rcx, rdx
ja 0x18000d9d4
mov qword [r10 + 0x10], rcx
mov rax, r10
cmp qword [r10 + 0x18], 0x10
jb 0x18000d9ce
mov rax, qword [r10]
mov byte [rax + rcx], 0
jmp 0x18000da2f
mov r8, qword [r10 + 0x18]
mov rsi, rcx
mov rax, r8
sub rsi, rdx
sub rax, rdx
cmp rsi, rax
ja 0x18000da10
mov qword [r10 + 0x10], rcx
mov rax, r10
cmp r8, 0x10
jb 0x18000d9f9
mov rax, qword [r10]
lea rdi, [rax + rdx]
mov r8, rsi
mov rcx, rdi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov byte [rsi + rdi], 0
jmp 0x18000da26
mov r9, rsi
mov byte [rsp + 0x20], 0
xor r8d, r8d
mov rdx, rsi
mov rcx, r10
call fcn.180008690
mov r10, qword [rsp + 0x50]
mov esi, dword [rsp + 0x44]
xor edx, edx
mov rcx, r10
call fcn.180009bd0
mov rdx, rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, r14d
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x18000db96
cmp r15d, 0x24db4
je 0x18000db8d
cmp r15d, 0x2afcc
je 0x18000dac5
cmp r15d, 0x311e4
je 0x18000dab4
cmp r15d, 0x373fc
jne 0x18000dbaa
movzx eax, bl
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.180069d20
mov rbx, qword [rsp + 0x3b0]
add rsp, 0x370
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, [rbp - 0x40]
call qword [sym.imp.SHLWAPI.dll_PathGetArgsW]
mov bl, 1
jmp 0x18000db96
cmp r14d, dword [rsp + 0x48]
je 0x18000dbaa
mov edi, 5
cmp edi, 5
ja case.default.0x18000daf1
mov eax, edi
mov ecx, dword [rcx + rax*4 + 0xdc60]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
xor eax, eax
mov qword [r10 + 0x10], rax
cmp qword [r10 + 0x18], 0x10
mov dword [rsp + 0x58], eax
mov rax, r10
jb 0x18000db0a
mov rax, qword [r10]
mov byte [rax], 0
jmp case.default.0x18000daf1
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
movups xmmword [rbp - 0x78], xmm0
test r13b, r13b
je 0x18000db2b
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.GDI32.dll_DeleteMetaFile]
mov edx, dword [rsp + 0x58]
lea r8, [rsp + 0x78]
mov rcx, qword [rsp + 0x68]
call sub.IMM32.dll_ImmGetCandidateWindow
jmp case.default.0x18000daf1
mov qword [rsp + 0x60], 0
jmp case.default.0x18000daf1
mov r13b, 1
mov qword [rsp + 0x68], 0
jmp case.default.0x18000daf1
cmp qword [rsp + 0x60], 0
mov eax, 0
movzx r13d, r13b
cmove r13d, eax
mov r10, qword [rsp + 0x50]
lea rcx, [0x180000000]
dec edi
lea eax, [rdi + 0x105]
cmp eax, 0x104
ja 0x18000dad5
jmp 0x18000db96
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r11d, 0x70
mov r8d, 0x7640
lea r9d, [r11 - 0x1b]
lea edx, [r11 - 0x49]
imul eax, dword [rsp + 0x4c], 0x56
add r15d, eax
cmp r15d, esi
ja case.0x18000d46c.0
mov r10, qword [rsp + 0x50]
lea rcx, [0x180000000]
mov edi, 0x54
jmp 0x18000d3f4
xor al, al
jmp 0x18000da8a