Function at 0x18002b2ec
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rdi, rcx
or r14, 0xffffffffffffffff
add rcx, 0x10
xor ebx, ebx
mov rsi, rdx
test rdx, rdx
jne 0x18002b31c
mov eax, ebx
jmp 0x18002b328
mov rax, r14
inc rax
cmp word [rdx + rax*2], bx
jne 0x18002b31f
mov r8d, eax
call fcn.180005498
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov rcx, rsi
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, r14
je 0x18002b85d
lea rdx, [rbp + 0x48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x18002b854
mov rax, qword [rbp + 0x48]
cmp rax, 0x80000
jg 0x18002b854
lea r13d, [rax + 4]
movsxd r14, r13d
mov rcx, r14
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov r8d, dword [rbp + 0x48]
lea r9, [rbp + 0x40]
mov rdx, rax
mov dword [rbp + 0x40], ebx
mov rcx, r12
mov qword [rsp + 0x20], rbx
mov r15, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [rbp + 0x40], 4
ja 0x18002b3dc
mov rcx, r15
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x18002b85f
mov eax, dword [rbp + 0x40]
mov rcx, r14
mov byte [rax + r15], bl
mov eax, dword [rbp + 0x40]
inc eax
mov byte [rax + r15], bl
mov eax, dword [rbp + 0x40]
add eax, 2
mov byte [rax + r15], bl
mov eax, dword [rbp + 0x40]
add eax, 3
mov byte [rax + r15], bl
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov r8, r14
mov rdx, r15
mov rcx, rax
mov rsi, rax
call sub.msvcrt.dll_memcpy
movzx ecx, word [rsi]
cmp cx, word [0x18008dd14]
jne 0x18002b466
lea r14, [rsi + 2]
lea rdx, str._script
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
cmp dword [rdi + 8], ebx
jne 0x18002b448
test rax, rax
setne bl
mov dword [rdi + 8], ebx
mov rdx, r14
mov rcx, rdi
call fcn.180031364
mov rdx, r14
mov rcx, rdi
call fcn.18003168c
mov rdx, r14
jmp 0x18002b83e
cmp cx, word [0x18008d34c]
movzx eax, cx
jne 0x18002b4b3
mov ecx, dword [rbp + 0x40]
lea r14, [rsi + 2]
dec ecx
mov rdx, r14
shr rcx, 1
mov r8, rbx
lea rax, [rcx + 1]
lea rax, [rsi + rax*2]
cmp r14, rax
cmova rcx, rbx
test rcx, rcx
je 0x18002b42a
movzx eax, word [rdx]
inc r8
rol ax, 8
mov word [rdx], ax
lea rdx, [rdx + 2]
cmp r8, rcx
jne 0x18002b498
jmp 0x18002b42a
cmp ax, word [0x18008d350]
jne 0x18002b50f
mov al, byte [rsi + 2]
cmp al, byte [0x18008d352]
jne 0x18002b50f
lea r14, [rsi + 3]
mov rcx, r14
lea rdx, [0x18008dd58]
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
cmp dword [rdi + 8], ebx
jne 0x18002b4e9
test rax, rax
setne bl
mov dword [rdi + 8], ebx
mov rdx, r14
mov rcx, rdi
call fcn.180031b28
mov rdx, r14
mov rcx, rdi
call fcn.180031e40
mov rdx, r14
mov rcx, rdi
call fcn.180031fd4
jmp 0x18002b846
mov eax, dword [rsi]
cmp eax, dword [0x18008dd18]
jne 0x18002b5b0
mov ecx, dword [rbp + 0x40]
lea r14, [rsi + 4]
mov r8, r14
mov r9, rbx
lea edx, [rcx - 1]
shr rdx, 2
lea rax, [r14 + rdx*4]
cmp r14, rax
cmova rdx, rbx
test rdx, rdx
je 0x18002b571
mov eax, dword [r8]
inc r9
mov ecx, eax
shr ecx, 8
or ecx, eax
shr eax, 0x10
and ecx, 0xff00
or ecx, eax
movzx eax, byte [r8]
shr ecx, 8
or ecx, eax
mov dword [r8], ecx
lea r8, [r8 + 4]
cmp r9, rdx
jne 0x18002b541
mov ecx, dword [rbp + 0x40]
dec ecx
mov rdx, r14
shr rcx, 2
mov r8, r14
mov r9, rbx
lea rax, [r14 + rcx*4]
cmp r14, rax
cmova rcx, rbx
test rcx, rcx
je 0x18002b42a
movzx eax, word [rdx]
inc r9
mov word [r8], ax
lea r8, [r8 + 2]
lea rdx, [rdx + 4]
cmp r9, rcx
jne 0x18002b594
jmp 0x18002b42a
cmp eax, dword [0x18008dd20]
jne 0x18002b602
mov ecx, dword [rbp + 0x40]
lea r14, [rsi + 4]
dec ecx
mov rdx, r14
shr rcx, 2
mov r8, r14
mov r9, rbx
lea rax, [rcx + 1]
lea rax, [rsi + rax*4]
cmp r14, rax
cmova rcx, rbx
test rcx, rcx
je 0x18002b42a
movzx eax, word [rdx]
inc r9
mov word [r8], ax
lea r8, [r8 + 2]
lea rdx, [rdx + 4]
cmp r9, rcx
jne 0x18002b5e6
jmp 0x18002b42a
cmp cx, word [0x18008d354]
jne 0x18002b6cf
mov al, byte [rsi + 2]
cmp al, byte [str.v.ShellClassInfo]
jne 0x18002b6cf
cmp byte [rsi + 3], 0x39
ja 0x18002b846
movzx eax, byte [rsi + 3]
movabs rcx, 0x300880000000000
bt rcx, rax
jae 0x18002b846
mov rcx, 0xffffffffffffffff
mov eax, 2
mul r14
cmovo rax, rcx
mov rcx, rax
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
lea r8, [r15 + 4]
mov dword [rsp + 0x28], r13d
or r9, 0xffffffffffffffff
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde8
mov r14, rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x18002b6c1
lea rdx, str._script
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
cmp dword [rdi + 8], ebx
jne 0x18002b6a0
test rax, rax
setne bl
mov dword [rdi + 8], ebx
mov rdx, r14
mov rcx, rdi
call fcn.180031364
mov rdx, r14
mov rcx, rdi
call fcn.18003168c
mov rdx, r14
mov rcx, rdi
call fcn.180031840
mov rcx, r14
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
jmp 0x18002b846
cmp cx, word [0x18008dd28]
jne 0x18002b6e7
mov al, byte [rsi + 2]
cmp al, byte [0x18008dd2a]
je 0x18002b846
mov eax, dword [rsi]
cmp eax, dword [0x18008dd2c]
je 0x18002b846
cmp cx, word [0x18008dd34]
jne 0x18002b70d
mov al, byte [rsi + 2]
cmp al, byte [0x18008dd36]
je 0x18002b846
cmp cx, word [0x18008dd38]
jne 0x18002b725
mov al, byte [rsi + 2]
cmp al, byte [0x18008dd3a]
je 0x18002b846
mov r8, r14
mov rdx, r15
mov rcx, rsi
call sub.msvcrt.dll_memcpy
lea rdx, [0x18008dd58]
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
cmp dword [rdi + 8], ebx
jne 0x18002b753
mov ecx, ebx
test rax, rax
setne cl
mov dword [rdi + 8], ecx
mov rdx, rsi
mov rcx, rdi
call fcn.180031b28
mov rdx, rsi
mov rcx, rdi
call fcn.180031e40
mov rdx, rsi
mov rcx, rdi
call fcn.180031fd4
mov r8, r14
mov rdx, r15
mov rcx, rsi
call sub.msvcrt.dll_memcpy
lea rdx, str._script
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
cmp dword [rdi + 8], ebx
jne 0x18002b7a2
mov ecx, ebx
test rax, rax
setne cl
mov dword [rdi + 8], ecx
mov rdx, rsi
mov rcx, rdi
call fcn.180031364
mov rdx, rsi
mov rcx, rdi
call fcn.18003168c
mov rdx, rsi
mov rcx, rdi
call fcn.180031840
mov r8, r14
mov rdx, r15
mov rcx, rsi
call sub.msvcrt.dll_memcpy
mov r8d, dword [rbp + 0x40]
mov rcx, rsi
inc r8d
mov rdx, rbx
shr r8, 1
lea rax, [rsi + r8*2]
cmp rsi, rax
cmova r8, rbx
test r8, r8
je 0x18002b807
movzx eax, word [rcx]
inc rdx
rol ax, 8
mov word [rcx], ax
lea rcx, [rcx + 2]
cmp rdx, r8
jne 0x18002b7f1
lea rdx, str._script
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
cmp dword [rdi + 8], ebx
jne 0x18002b825
test rax, rax
setne bl
mov dword [rdi + 8], ebx
mov rdx, rsi
mov rcx, rdi
call fcn.180031364
mov rdx, rsi
mov rcx, rdi
call fcn.18003168c
mov rdx, rsi
mov rcx, rdi
call fcn.180031840
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
jmp 0x18002b3c0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rbx, qword [rsp + 0x90]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret