Function at 0x1000173bc
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r13
push r15
sub rsp, 0xb0
mov rbx, rcx
xor ecx, ecx
mov rax, rdx
and dword [rsp + 0x58], ecx
mov dword [rsp + 0x34], ecx
mov dword [rsp + 0x5c], ecx
lea rdx, [rsp + 0x30]
xor edi, edi
xor esi, esi
and dword [rsp + 0x30], edi
xor r13d, r13d
mov rcx, rax
mov rbp, r8
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x44], r13d
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x10001766e
lea rdx, [rsp + 0x58]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x10001766e
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x30], rax
jne 0x10001766e
and dword [rsp + 0x38], esi
and qword [rsp + 0x48], rsi
and qword [rsp + 0x50], rsi
and qword [rsp + 0x80], rsi
xor eax, eax
and qword [rsp + 0x60], rax
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
test rbx, rbx
je 0x10001766e
mov rax, qword [rbx + 0xd8]
mov r15, qword [rbx + 0xe0]
mov qword [rsp + 0xa0], rax
test rax, rax
je 0x10001766e
test r15, r15
je 0x10001766e
lea r9, [rsp + 0xf8]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x48]
lea edi, [rsi + 1]
mov qword [rsp + 0x20], rbx
call fcn.1000199ec
test eax, eax
je 0x10001766e
cmp qword [rsp + 0x48], rsi
je 0x10001766e
cmp qword [rsp + 0x50], rsi
je 0x10001766e
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
test rax, rax
je 0x10001766e
mov ecx, dword [rsp + 0x38]
mov ebp, dword [rsp + 0x38]
mov rdx, qword [rsp + 0x48]
cmp rcx, rax
mov rcx, qword [rsp + 0xe8]
mov rax, rbx
cmovg ebp, dword [rsp + 0x30]
and dword [rsp + 0xf8], 0
shr rax, 0x20
mov dword [rsp + 0x94], eax
mov rax, qword [rsp + 0xa0]
xor edi, edi
and qword [rsp + 0x80], rdi
and qword [rsp + 0x88], rdi
mov qword [rsp + 0x98], rax
lea rax, [rsp + 0x80]
lea r9, [rsp + 0xf8]
mov r8d, ebp
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x90], esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100017599
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x100017645
mov rdx, qword [rsp + 0x50]
and qword [rsp + 0x60], rdi
and qword [rsp + 0x68], rdi
mov dword [rsp + 0x70], esi
mov rsi, qword [rsp + 0xf0]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0xf8]
mov r8d, ebp
mov rcx, rsi
mov dword [rsp + 0x74], r13d
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1000175ed
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x100017645
mov rcx, qword [rsp + 0xe8]
mov r13d, 1
lea r8, [rsp + 0xf8]
lea rdx, [rsp + 0x80]
mov r9d, r13d
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
lea r8, [rsp + 0xf8]
lea rdx, [rsp + 0x60]
mov r9d, r13d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
mov r8d, ebp
call sub.msvcrt.dll_memcmp
test eax, eax
cmove edi, r13d
mov rax, qword [rsp + 0x30]
mov ecx, ebp
sub rax, rcx
add rbx, rcx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rbx
test edi, edi
je 0x10001766e
mov r13d, dword [rsp + 0x44]
mov esi, dword [rsp + 0x40]
jmp 0x100017501
mov eax, edi
mov rbx, qword [rsp + 0xe0]
add rsp, 0xb0
pop r15
pop r13
pop rdi
pop rsi
pop rbp
ret