Function at 0x180080eb0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x570]
sub rsp, 0x670
mov rax, qword [0x18009da48]
xor rax, rsp
mov qword [rbp + 0x560], rax
imul esi, ecx, 0xbd2
xor r9d, r9d
mov r11, r8
mov qword [rsp + 0x68], r8
mov rdi, rdx
mov qword [rbp - 0x70], rdx
mov edx, ecx
mov dword [rsp + 0x44], ecx
mov ebx, ecx
lea r8, [0x180000000]
cmp ecx, esi
ja 0x180081010
movzx r14d, word [0x18009579e]
mov r13d, ecx
movsd xmm0, qword [0x180095796]
movzx r15d, word [0x1800957f2]
mov r12d, dword [0x1800957ee]
mov r10, qword [rbp - 0x68]
mov r8d, dword [rsp + 0x58]
mov edx, dword [rsp + 0x58]
mov r9d, dword [rsp + 0x58]
movabs rax, 0x5f0047005f0055
cmp ebx, 0x3a92
ja 0x180081147
je 0x18008113e
cmp ebx, 0xae
ja 0x180081103
je 0x180081250
cmp ebx, 0x22
je 0x1800810f3
cmp ebx, 0x2a
je 0x1800810b7
cmp ebx, 0x48
je 0x1800810a9
cmp ebx, 0x70
jne 0x180080ff2
mov rcx, qword [rsp + 0x68]
xor eax, eax
mov r11d, eax
mov rdi, qword [rcx]
mov r10, rdi
test rdi, rdi
je 0x180081233
nop word [rax + rax]
mov rax, qword [rbp - 0x70]
movzx ecx, byte [rax + r11]
sub ecx, 0x22
je 0x180080fde
sub ecx, 4
je 0x180080fd8
sub ecx, 1
je 0x180080fde
sub ecx, 0x15
je 0x180080fd2
sub ecx, 2
jne 0x180080fe2
add r10, 3
jmp 0x180080fe2
add r10, 4
jmp 0x180080fe2
add r10, 5
inc r11
cmp r11, rdi
jb 0x180080fb0
mov rdi, rax
mov r11, qword [rsp + 0x68]
imul eax, r13d, 0xb2
add ebx, eax
cmp ebx, esi
jbe 0x180080f43
mov edx, r13d
lea r8, [0x180000000]
xor r9d, r9d
lea eax, [rdx + 0xcd1]
mov dword [rsp + 0x48], eax
cmp edx, eax
jae case.0x180081920.760
movzx ecx, word [rsp + 0x54]
mov r12, qword [rbp - 0x80]
movzx r14d, byte [rsp + 0x40]
movzx r15d, byte [rsp + 0x40]
mov r13, qword [rbp - 0x68]
mov rsi, qword [rbp - 0x78]
mov dword [rsp + 0x4c], ecx
mov r10d, 0x3338
movabs rbx, 0x5f0045004c0045
cmp edx, 0x650
ja 0x180081350
je 0x180081339
cmp edx, 0x34c
ja 0x1800812c5
je 0x1800812a9
cmp edx, 0x48
je 0x18008129f
cmp edx, 0x109
je 0x180081282
cmp edx, 0x1ca
je 0x180081279
cmp edx, 0x28b
je 0x18008171d
jmp 0x180081a69
mov dword [rbp - 0x40], r12d
mov word [rbp - 0x3c], r15w
jmp 0x180080ff2
movsxd rax, dword [rdi]
test eax, eax
je 0x18008123f
xor ecx, ecx
mov r9d, ecx
test eax, eax
jle 0x180080ff2
mov r11, rax
mov rax, qword [rdi + 0x10]
cmp dword [rax], 0
jne 0x180080fed
inc r9d
inc rcx
add rax, 4
cmp rcx, r11
jl 0x1800810d6
jmp 0x180080fed
mov rax, qword [r11]
mov ecx, dword [rdi + rax*4]
mov qword [rsp + 0x60], rcx
jmp 0x180080ff2
cmp ebx, 0x17c6
je case.0x180081920.760
cmp ebx, 0x1d5e
je 0x18008112e
cmp ebx, 0x3258
jne 0x180080ff2
xor eax, eax
mov word [rbp - 0x3a], ax
jmp 0x180080ff2
mov rax, qword [rdi + 0x10]
movsxd rcx, r9d
mov r8d, dword [rax + rcx*4]
jmp 0x180080ff2
imul r9d, r9d, 0x1c
jmp 0x180080ff2
cmp ebx, 0x9678
ja 0x1800811fe
je 0x1800811f3
cmp ebx, 0x4e50
je 0x1800811e9
cmp ebx, 0x57c6
je 0x180081195
cmp ebx, 0x6468
je 0x180081186
cmp ebx, 0x74fa
je case.0x180081920.760
jmp 0x180080ff2
movsd qword [rbp - 0x3a], xmm0
mov word [rbp - 0x32], r14w
jmp 0x180080ff2
test r8b, 1
jne 0x1800811df
nop dword [rax + rax]
mov ecx, 0x4e
mov eax, ecx
sub eax, 0x4d
je 0x1800811d0
cmp eax, 1
jne 0x1800811d4
mov edx, r8d
mov qword [rbp - 0x80], rcx
lea rcx, [0x180000000]
and edx, 0xf
add r9d, dword [rcx + rdx*4 + 0x90260]
mov rcx, qword [rbp - 0x80]
jmp 0x1800811d4
shr r8d, 4
dec ecx
cmp ecx, 0x4c
ja 0x1800811a5
test edx, edx
je 0x1800811a0
mov dword [rsp + 0x60], r9d
jmp 0x180080ff2
mov qword [rsp + 0x60], r10
jmp 0x180080ff2
xor eax, eax
mov word [rbp - 0x30], ax
jmp 0x180080ff2
cmp ebx, 0x9c30
je case.0x180081920.760
cmp ebx, 0xc888
je 0x180081227
cmp ebx, 0xfa98
jne 0x180080ff2
mov qword [rbp - 0x2c], rax
jmp 0x180080ff2
mov dword [rbp - 0x30], 0x44004c
jmp 0x180080ff2
mov rdi, qword [rbp - 0x70]
mov r11, rcx
jmp 0x180080ff2
xor eax, eax
mov dword [rsp + 0x60], eax
jmp case.0x180081920.760
xor eax, eax
mov dword [rsp + 0x28], 0x34
xor r9d, r9d
mov qword [rbp - 0x68], rax
mov r8, rdi
mov qword [rsp + 0x20], rax
xor edx, edx
lea rcx, [rbp - 0x68]
call fcn.180021cc0
jmp 0x180081a96
mov qword [rbp - 0x1a], rbx
jmp 0x180081a69
movsd xmm0, qword [0x1800959ca]
movzx eax, word [0x1800959d2]
movsd qword [rbp - 0x24], xmm0
mov word [rbp - 0x1c], ax
jmp 0x180081a65
mov word [rbp - 0x24], r9w
jmp 0x180081a69
mov r8d, 2
lea rdx, [0x18009585e]
lea rcx, [rbp - 0xe]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
jmp 0x180081a5a
cmp edx, 0x40d
je 0x180081318
cmp edx, 0x4ce
je 0x1800812ed
cmp edx, 0x58f
jne 0x180081a69
mov dword [rbp - 0x5c], 0x550074
jmp 0x180081a69
mov r8d, 1
lea rdx, [0x180095a02]
lea rcx, [rbp - 8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor r9d, r9d
mov dword [rbp - 0x60], 0x6f004e
mov word [rbp - 6], r9w
jmp 0x180081a5d
mov r8d, 1
mov word [rbp - 0xa], r9w
lea rdx, [0x1800958b8]
lea rcx, [rbp - 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp 0x180081a5a
mov r8d, 0x65
mov dword [rbp - 0x58], 0x72006e
mov word [rbp - 0x54], r8w
jmp 0x180081a69
cmp edx, 0xa15
ja 0x1800816ad
je 0x1800815f2
cmp edx, 0x711
je 0x1800815d4
cmp edx, 0x7d2
je 0x1800813b6
cmp edx, 0x893
je 0x18008139e
cmp edx, 0x954
jne 0x180081a69
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x74], eax
jmp 0x180081a5a
mov ecx, 0x100
mov byte [rsp + 0x50], 1
mov dword [rsp + 0x4c], ecx
mov dword [rsp + 0x78], r9d
jmp 0x180081a69
cmp qword [rdi + 0x18], 8
mov rcx, rdi
mov word [rbp - 0x48], r9w
jb 0x1800813c8
mov rcx, qword [rdi]
mov qword [rsp + 0x30], r9
mov edx, 0x80000000
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp - 0x78], rax
cmp rax, 0xffffffffffffffff
jne 0x180081a57
mov esi, 0xb9
mov ecx, esi
sub ecx, 0xb5
je 0x180081a8c
sub ecx, 1
je 0x1800815b7
sub ecx, 1
je 0x180081471
sub ecx, 1
je 0x180081435
cmp ecx, 1
jne 0x1800815bd
movzx r15d, cl
jmp 0x1800815bd
movups xmm0, xmmword [str.SettingsResetBubble.LearnMore]
mov eax, dword [0x180095918]
movups xmm1, xmmword [0x1800958f0]
mov dword [rbp + 0x38], eax
movups xmmword [rbp], xmm0
movups xmm0, xmmword [0x180095900]
movups xmmword [rbp + 0x10], xmm1
movsd xmm1, qword [0x180095910]
movups xmmword [rbp + 0x20], xmm0
movsd qword [rbp + 0x30], xmm1
jmp 0x1800815bd
xor r9d, r9d
lea rax, [rbp]
xor edx, edx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x100
lea r8d, [r9 + 4]
lea rcx, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rdi, rax
test rax, rax
jne 0x180081549
mov ebx, 0x73
xor r12d, r12d
nop dword [rax]
mov ecx, ebx
sub ecx, 0x73
je 0x180081533
sub ecx, 0x45
je 0x1800814fa
sub ecx, 0x45
je 0x1800814ed
sub ecx, 0x45
je 0x1800814d0
cmp ecx, 0x45
jne 0x180081536
xor r15b, r15b
jmp 0x180081536
test r14b, r14b
je 0x180081536
mov edx, 1
lea r9, [rbp + 0x40]
lea ecx, [rdx + 0x7e]
lea r8d, [rdx + 0x2f]
call qword [sym.imp.KERNEL32.dll_SetCalendarInfoA]
jmp 0x180081536
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHELL32.dll_ILFindLastID]
jmp 0x180081536
mov edx, 1
mov qword [rsp + 0x28], r12
lea r9, [rbp + 0x40]
mov dword [rsp + 0x20], 0x104
mov r8d, 0x80000000
lea ecx, [rdx + 0x7e]
call qword [sym.imp.KERNEL32.dll_GetCalendarInfoA]
xor ecx, ecx
mov word [rsp + 0x70], cx
mov byte [rsp + 0x72], cl
test eax, eax
jne 0x180081536
xor r14b, r14b
jmp 0x180081536
mov r14b, 1
add ebx, 0x45
cmp ebx, 0x1cc
jb 0x1800814b0
mov r12, qword [rbp - 0x80]
test r15b, r15b
je 0x1800815bd
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetCommBreak]
test eax, eax
je 0x1800815ac
mov ebx, 0x7a
cmp ebx, 0x31e
jbe 0x18008159e
cmp ebx, 0x3c7
je 0x18008159e
cmp ebx, 0x470
je 0x18008158b
cmp ebx, 0x519
jne 0x18008159e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ClearCommBreak]
jmp 0x18008159e
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x4000000
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
add ebx, 0xa9
cmp ebx, 0x5c2
jb 0x180081560
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800815bd
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
dec esi
cmp esi, 0xb4
ja 0x180081402
mov rsi, qword [rbp - 0x78]
jmp 0x180081a5a
mov r8d, 0x68
mov dword [rbp - 0x52], 0x630061
mov word [rbp - 0x4e], r8w
mov dword [rbp - 0x4c], 0x640065
jmp 0x180081a69
mov ecx, dword [rsp + 0x74]
mov r8, qword [r11 + 0x10]
cmp rcx, r8
ja 0x180081616
mov qword [r11 + 0x10], rcx
mov rax, r11
cmp qword [r11 + 0x18], 0x10
jb 0x180081610
mov rax, qword [r11]
mov byte [rax + rcx], 0
jmp 0x180081668
mov rdx, qword [r11 + 0x18]
mov rdi, rcx
mov rax, rdx
sub rdi, r8
sub rax, r8
cmp rdi, rax
ja 0x180081652
mov qword [r11 + 0x10], rcx
mov rax, r11
cmp rdx, 0x10
jb 0x18008163b
mov rax, qword [r11]
lea rbx, [rax + r8]
xor edx, edx
mov rcx, rbx
mov r8, rdi
call sub.VCRUNTIME140.dll_memset
mov byte [rbx + rdi], 0
jmp 0x180081668
mov r9, rdi
mov byte [rsp + 0x20], 0
xor r8d, r8d
mov rdx, rdi
mov rcx, r11
call fcn.180002c40
mov edx, 0x208
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rcx, qword [rsp + 0x68]
xor edx, edx
mov r12, rax
mov qword [rbp - 0x80], rax
call fcn.1800041b0
mov r8d, dword [rsp + 0x74]
lea r9, [rsp + 0x78]
mov rdx, rax
mov rcx, rsi
xor eax, eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x180081a5a
cmp edx, 0xad6
je 0x1800819ce
cmp edx, 0xb97
je 0x18008172e
cmp edx, 0xc58
jne 0x180081a69
mov ebx, 0x70
mov eax, ebx
sub eax, 0x6e
je case.0x180081920.760
sub eax, 1
je 0x180081702
cmp eax, 1
jne 0x180081707
cmp byte [rsp + 0x50], 0
je 0x180081707
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFlags]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x180081707
mov byte [rsp + 0x60], 1
dec ebx
cmp ebx, 0x6d
ja 0x1800816d2
mov eax, dword [rsp + 0x48]
xor r9d, r9d
mov ecx, dword [rsp + 0x4c]
mov edx, dword [rsp + 0x44]
mov dword [rbp - 0x12], 0x720061
mov word [rbp - 0xe], r9w
jmp 0x180081a69
mov eax, dword [rsp + 0x74]
cmp eax, dword [rsp + 0x78]
je 0x1800819af
mov ebx, 0x23
cmp ebx, 0x1e5
ja 0x180081842
je 0x180081823
cmp ebx, 0xf5
ja 0x1800817ec
je case.0x180081920.761
lea eax, [rbx - 0x23]
cmp eax, 0xb4
ja case.0x180081920.761
movzx eax, byte [r8 + rax + 0x81ad0]
mov ecx, dword [r8 + rax*4 + 0x81ac0]
add rcx, r8
jmp rcx
mov r8d, 2
lea rdx, [0x180095968]
lea rcx, [rbp]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
lea rcx, [rbp]
sub rcx, 2
nop dword [rax + rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x1800817b0
movsd xmm0, qword [str.eader]
mov eax, dword [0x180095978]
movsd qword [rcx], xmm0
movups xmm0, xmmword [str.s.getAl]
mov dword [rcx + 8], eax
movups xmmword [rbp + 0xc], xmm0
jmp 0x180081988
mov dword [rbp + 0x1a], 0x6c
jmp case.0x180081920.761
lea eax, [rbx - 0x113]
cmp eax, 0xb4
ja case.0x180081920.761
movzx eax, byte [r8 + rax + 0x81b94]
mov ecx, dword [r8 + rax*4 + 0x81b88]
add rcx, r8
jmp rcx
mov dword [rbp + 0x40], 0x5f534350
mov byte [rbp + 0x44], 0
jmp case.0x180081920.761
movzx eax, word [0x18009592d]
mov word [rbp + 0x44], ax
movzx eax, byte [0x18009592f]
mov byte [rbp + 0x46], al
mov word [rbp + 0x47], r10w
jmp case.0x180081920.761
cmp ebx, 0x2d5
ja 0x1800818fb
je 0x1800818f2
lea eax, [rbx - 0x203]
cmp eax, 0xb4
ja case.0x180081920.761
movzx eax, byte [r8 + rax + 0x81c6c]
mov ecx, dword [r8 + rax*4 + 0x81c4c]
add rcx, r8
jmp rcx
mov eax, 0x7865
mov byte [rbp + 0x4d], 0
mov word [rbp + 0x4b], ax
jmp case.0x180081920.761
movzx eax, word [0x18009594f]
mov word [rbp + 0x51], ax
movzx eax, byte [0x180095951]
mov byte [rbp + 0x53], al
mov byte [rbp + 0x54], 0
jmp case.0x180081920.761
mov byte [rbp + 0x4b], 0
jmp case.0x180081920.761
mov byte [rbp + 0x51], 0
jmp case.0x180081920.761
mov byte [rbp + 0x54], 0x68
jmp case.0x180081920.761
mov r8d, 2
mov byte [rbp + 0x49], 0
lea rdx, [0x18009599a]
lea rcx, [rbp + 0x49]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x180081988
mov dword [rbp + 0x4d], 0x4e5f7361
jmp case.0x180081920.761
mov byte [rbp + 0x55], 0
jmp case.0x180081920.761
lea eax, [rbx - 0x2f3]
cmp eax, 0x96
ja case.0x180081920.761
movzx eax, byte [r8 + rax + 0x81d40]
mov ecx, dword [r8 + rax*4 + 0x81d24]
add rcx, r8
jmp rcx
movzx ecx, word [rsp + 0x54]
lea rdx, [rbp + 0x350]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GlobalGetAtomNameW]
jmp 0x180081988
mov qword [r11 + 0x10], r9
mov rax, r11
cmp qword [r11 + 0x18], 0x10
jb 0x18008194d
mov rax, qword [r11]
mov byte [rax], 0
jmp case.0x180081920.761
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x4000000
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
mov byte [rsp + 0x60], 0
jmp 0x180081988
movzx ecx, word [rsp + 0x54]
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
jmp 0x180081988
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
mov word [rsp + 0x54], ax
mov r10d, 0x3338
mov r11, qword [rsp + 0x68]
lea r8, [0x180000000]
add ebx, 0x1e
mov r9d, 0
cmp ebx, 0x3a7
jb 0x180081741
mov r8d, dword [rsp + 0x58]
lea r9, [rbp - 0x40]
lea rdx, [rbp + 0x150]
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
jmp 0x180081a5a
movsx eax, cx
mov rcx, rsi
mov dword [rsp + 0x58], eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r12, r12
jne 0x180081a5a
movzx r12d, byte [rsp + 0x40]
mov ebx, 0x27
nop
mov eax, ebx
sub eax, 0x24
je 0x180081a3d
sub eax, 1
je 0x180081a2d
sub eax, 1
je 0x180081a17
cmp eax, 1
jne 0x180081a42
xor ecx, ecx
movzx r12d, al
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r13, rax
jmp 0x180081a42
xor r9d, r9d
movzx eax, r12b
test r13, r13
mov ecx, r9d
cmovne ecx, eax
movzx r12d, cl
jmp 0x180081a45
test r12b, r12b
je 0x180081a42
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
jmp 0x180081a42
mov byte [rsp + 0x50], 0
xor r9d, r9d
dec ebx
cmp ebx, 0x23
ja 0x1800819f0
mov byte [rsp + 0x40], r12b
mov r12, qword [rbp - 0x80]
jmp 0x180081a5d
mov rsi, rax
xor r9d, r9d
mov edx, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x4c]
mov eax, dword [rsp + 0x48]
add edx, 0xc1
mov dword [rsp + 0x44], edx
cmp edx, eax
jae case.0x180081920.760
mov rdi, qword [rbp - 0x70]
lea r8, [0x180000000]
mov r11, qword [rsp + 0x68]
jmp 0x180081043
mov byte [rsp + 0x60], 0
mov rax, qword [rsp + 0x60]
mov rcx, qword [rbp + 0x560]
xor rcx, rsp
call fcn.180083f10
mov rbx, qword [rsp + 0x6b0]
add rsp, 0x670
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret