Function at 0x180001170
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
push rbp
sub rsp, 0xe8
mov rcx, qword [str.KERNEL32.dll]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, dword [0x1800bdde4]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
mov rcx, rbx
mov edx, dword [0x1800bdde4]
call fcn.180001560
xor ecx, ecx
mov rdx, rbx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movzx eax, word [rbx]
xor r9d, r9d
mov r10, qword [str.amboceptor.iso]
test eax, eax
je 0x1800010d9
xor eax, eax
add eax, 8
lea r9d, [rax - 7]
movzx esi, word [rbx + r9*2]
test esi, esi
je 0x1800010d9
lea r9d, [rax - 6]
movzx esi, word [rbx + r9*2]
test esi, esi
je 0x1800010d9
lea r9d, [rax - 5]
movzx esi, word [rbx + r9*2]
test esi, esi
je 0x1800010d9
lea r9d, [rax - 4]
movzx esi, word [rbx + r9*2]
test esi, esi
je 0x1800010d9
lea r9d, [rax - 3]
movzx esi, word [rbx + r9*2]
test esi, esi
je 0x1800010d9
lea r9d, [rax - 2]
movzx esi, word [rbx + r9*2]
test esi, esi
je 0x1800010d9
lea r9d, [rax - 1]
movzx esi, word [rbx + r9*2]
test esi, esi
je 0x1800010d9
mov r9d, eax
movzx esi, word [rbx + rax*2]
test esi, esi
jne 0x180001070
mov r8d, r9d
lea eax, [r9 - 1]
movzx esi, word [rbx + rax*2]
cmp esi, 0x5c
je 0x1800011d4
xor edi, edi
xor eax, eax
inc edi
lea esi, [rdi*8]
neg esi
add esi, r9d
lea r8d, [rsi + 8]
mov word [rbx + r8*2], ax
lea r12d, [rsi + 6]
mov r13d, r12d
movzx r11d, word [rbx + r13*2]
lea r8d, [rsi + 7]
cmp r11d, 0x5c
je 0x1800011d4
mov word [rbx + r8*2], ax
mov r8d, r12d
lea r12d, [rsi + 5]
mov r14d, r12d
movzx r11d, word [rbx + r14*2]
cmp r11d, 0x5c
je 0x1800011d4
mov r8d, r12d
lea r12d, [rsi + 4]
mov word [rbx + r13*2], ax
mov r13d, r12d
movzx r11d, word [rbx + r13*2]
cmp r11d, 0x5c
je 0x1800011d4
mov r8d, r12d
lea r12d, [rsi + 3]
add esp, dword [rsi + 0x42]
mov dword [rbx + rsi*2], eax
mov r14d, r12d
movzx r11d, word [rbx + r14*2]
cmp r11d, 0x5c
je 0x1800011d4
mov r8d, r12d
lea r12d, [rsi + 2]
mov word [rbx + r13*2], ax
mov r13d, r12d
movzx r11d, word [rbx + r13*2]
cmp r11d, 0x5c
je 0x1800011d4
mov r8d, r12d
lea r12d, [rsi + 1]
mov word [rbx + r14*2], ax
mov r14d, r12d
movzx r11d, word [rbx + r14*2]
cmp r11d, 0x5c
je 0x1800011d4
mov r8d, r12d
mov word [rbx + r13*2], ax
movzx r11d, word [rbx + rsi*2]
cmp r11d, 0x5c
je 0x1800011d4
mov r8d, esi
dec esi
mov word [rbx + r14*2], ax
movzx r11d, word [rbx + rsi*2]
cmp r11d, 0x5c
jne 0x1800010f1
cmp byte [r10], 0
je 0x180001298
xor eax, eax
add eax, 8
lea esi, [rax - 8]
movsx r9d, byte [rsi + r10]
lea edi, [r8 + rax - 8]
mov word [rbx + rdi*2], r9w
lea r11d, [rax - 7]
movsx edi, byte [r11 + r10]
test edi, edi
je 0x180001298
lea esi, [r8 + rax - 7]
mov word [rbx + rsi*2], di
lea edi, [rax - 6]
movsx edi, byte [rdi + r10]
test edi, edi
je 0x180001298
lea esi, [r8 + rax - 6]
mov word [rbx + rsi*2], di
lea edi, [rax - 5]
movsx edi, byte [rdi + r10]
test edi, edi
je 0x180001298
lea esi, [r8 + rax - 5]
mov word [rbx + rsi*2], di
lea edi, [rax - 4]
movsx edi, byte [rdi + r10]
test edi, edi
je 0x180001298
lea esi, [r8 + rax - 4]
mov word [rbx + rsi*2], di
lea edi, [rax - 3]
movsx edi, byte [rdi + r10]
test edi, edi
je 0x180001298
lea esi, [r8 + rax - 3]
mov word [rbx + rsi*2], di
lea edi, [rax - 2]
movsx edi, byte [rdi + r10]
test edi, edi
je 0x180001298
lea esi, [r8 + rax - 2]
mov word [rbx + rsi*2], di
lea edi, [rax - 1]
movsx edi, byte [rdi + r10]
test edi, edi
je 0x180001298
lea esi, [r8 + rax - 1]
mov word [rbx + rsi*2], di
cmp byte [rax + r10], 0
jne 0x1800011e0
mov edx, 0x68
lea rcx, [rsp + 0x40]
call fcn.180001560
mov edx, 0x18
lea rcx, [rsp + 0xc0]
call fcn.180001560
mov rax, rsp
mov edx, 1
mov rcx, rbx
mov r8d, edx
xor r9d, r9d
mov dword [rax + 0x20], 3
mov dword [rax + 0x28], 0x80
mov qword [rax + 0x30], 0
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rsi, 0xffffffffffffffff
je 0x180001537
mov rcx, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, dword [0x1800bddc4]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
mov rcx, rbx
mov edx, dword [0x1800bddc4]
call fcn.180001560
mov rax, rsp
mov rcx, rsi
mov rdx, rbx
mov r8d, edi
mov dword [rsp + 0xdc], 0
lea r9, [rsp + 0xdc]
mov qword [rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180001537
mov edi, dword [0x1800bddf8]
mov esi, dword [rsp + 0xdc]
add rsi, rbx
lea rax, [rbx + rdi]
mov r9d, dword [rax]
mov r8d, dword [rax + 4]
test r9d, r9d
jbe 0x180001423
cmp r9d, 4
jb 0x18000154b
lea rdi, [rbx + rdi + 8]
and rdi, 0xf
test edi, edi
je 0x1800013db
test edi, 3
invalid