Function at 0x512d90
Capabilities:
Get file size
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
test rcx, rcx
mov rsi, rcx
mov rdi, rdx
mov qword [rsp + 0x58], r8
mov dword [rsp + 0x64], r9d
je 0x513313
mov rax, qword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
lea rcx, [0x007f0240]
mov qword [rsp + 0x48], rax
call rax
mov rbp, qword [0x007f0268]
test rbp, rbp
jne 0x512def
jmp 0x513060
mov rbp, qword [rbp]
test rbp, rbp
je 0x513060
lea rcx, [rbp + 0x28]
mov rdx, rsi
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x512de2
mov rbx, qword [rbp + 0x20]
mov eax, dword [rbp + 0x18]
test rbx, rbx
jne 0x5133be
test eax, eax
jne 0x513060
mov rbp, qword [rbp + 0x10]
test rbp, rbp
je 0x513060
mov rcx, rbp
call sub.msvcrt.dll_strlen
lea r12, [rax + 1]
mov rcx, r12
call sub.msvcrt.dll_malloc
test rax, rax
mov r15, rax
mov qword [rsp + 0x68], rax
je 0x513060
mov rdx, rbp
mov r8, r12
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov rax, qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
lea rcx, [0x007f0240]
mov qword [rsp + 0x78], rax
call rax
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
mov r8d, 2
mov edx, 0x80000000
mov rcx, r15
call qword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp rax, 0xffffffffffffffff
mov rbp, rax
je 0x512ecd
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetFileSize]
cmp eax, 0xffffffff
mov r12d, eax
je 0x512ec4
lea eax, [rax + rax]
cmp r12d, eax
jb 0x513194
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rcx, qword [rsp + 0x68]
call sub.msvcrt.dll_free
lea rcx, [0x007f0240]
mov rax, qword [rsp + 0x48]
call rax
mov rbp, qword [0x007f0268]
test rbp, rbp
jne 0x512f0d
jmp 0x513113
mov rbp, qword [rbp]
test rbp, rbp
je 0x513113
lea rcx, [rbp + 0x28]
mov rdx, rsi
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x512f00
test rbx, rbx
je 0x513372
mov qword [rbp + 0x20], rbx
lea rcx, [0x007f0240]
mov rax, qword [rsp + 0x78]
call rax
test rbx, rbx
je 0x51306d
mov ebp, dword [rbx + 0x38]
cmp ebp, 2
jbe 0x5130a0
mov r15, qword [rbx + 0x40]
test r15, r15
je 0x5130a0
mov rcx, rdi
call sub.msvcrt.dll_strlen
xor r8d, r8d
mov dword [rsp + 0x48], eax
mov rax, rdi
nop dword [rax]
movsx edx, byte [rax]
test dl, dl
je 0x512f9d
shl r8d, 4
add rax, 1
add r8d, edx
mov edx, r8d
and edx, 0xf0000000
je 0x512f70
xor r8d, edx
shr edx, 0x18
xor r8d, edx
movsx edx, byte [rax]
test dl, dl
jne 0x512f77
mov eax, r8d
xor edx, edx
lea ecx, [rbp - 2]
div ebp
mov eax, r8d
movzx r14d, word [rbx + 0x14]
mov r12d, ebp
mov r13d, dword [rbx + 0x10]
mov qword [rsp + 0x68], rdi
mov esi, edx
xor edx, edx
div ecx
mov eax, r14d
mov r14, rbx
mov ebx, eax
lea r8d, [rdx + 1]
mov r10d, r8d
sub r12d, r8d
mov edi, r8d
sub r10d, ebp
jmp 0x513017
mov edx, dword [rcx + r11*8 + 4]
bswap edx
mov edx, edx
mov rcx, qword [rsp + 0x68]
add rdx, rax
mov dword [rsp + 0x50], r10d
call sub.msvcrt.dll_strcmp
test eax, eax
mov r10d, dword [rsp + 0x50]
je 0x513350
lea eax, [rsi + r10]
lea edx, [rsi + rdi]
cmp esi, r12d
cmovb eax, edx
mov esi, eax
mov eax, esi
test r13d, r13d
mov eax, dword [r15 + rax*4]
je 0x513024
bswap eax
test eax, eax
je 0x513183
lea ebp, [rax - 1]
cmp ebp, ebx
jae 0x513008
mov rcx, qword [r14 + 0x28]
mov r11d, ebp
test r13d, r13d
mov eax, dword [rcx + r11*8]
je 0x513045
bswap eax
cmp eax, dword [rsp + 0x48]
jb 0x513008
test r13d, r13d
mov rax, qword [r14]
jne 0x512fe0
mov edx, dword [rcx + r11*8 + 4]
jmp 0x512fe9
lea rcx, [0x007f0240]
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
cmp qword [rsp + 0x58], 0
je 0x513095
cmp dword [rsp + 0x64], 1
je 0x513095
mov rax, qword [rsp + 0x58]
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rax, rdi
jmp 0x513081
movzx esi, word [rbx + 0x14]
xor r15d, r15d
jmp 0x5130d2
mov edx, dword [r13 + rax*8 + 4]
mov rcx, rdi
bswap edx
mov edx, edx
add rdx, rbp
call sub.msvcrt.dll_strcmp
test eax, eax
js 0x513105
je 0x513160
lea r15d, [r14 + 1]
cmp esi, r15d
jbe 0x51306d
mov r12d, dword [rbx + 0x10]
mov rbp, qword [rbx]
mov r13, qword [rbx + 0x28]
lea r14d, [rsi + r15]
shr r14d, 1
test r12d, r12d
mov eax, r14d
jne 0x5130b0
mov edx, dword [r13 + rax*8 + 4]
mov rcx, rdi
add rdx, rbp
call sub.msvcrt.dll_strcmp
test eax, eax
jns 0x5130c8
cmp r14d, r15d
jbe 0x51306d
mov esi, r14d
jmp 0x5130e2
mov rax, qword [rsp + 0x78]
lea rcx, [0x007f0240]
call rax
mov rcx, qword [rbx]
call sub.msvcrt.dll_free
mov rcx, qword [rbx + 0x18]
call sub.msvcrt.dll_free
mov rcx, qword [rbx + 0x20]
test rcx, rcx
jne 0x513143
jmp 0x513150
mov rcx, rsi
mov rsi, qword [rcx]
call sub.msvcrt.dll_free
test rsi, rsi
jne 0x513140
mov rcx, rbx
call sub.msvcrt.dll_free
jmp 0x51306d
cmp qword [rsp + 0x58], 0
mov r9d, dword [rsp + 0x64]
mov edx, r14d
mov rcx, rbx
setne r8b
movzx r8d, r8b
call fcn.005129a0
jmp 0x513081
mov eax, ebx
mov rdi, qword [rsp + 0x68]
mov rbx, r14
mov esi, eax
jmp 0x5130a4
mov ecx, eax
call sub.msvcrt.dll_malloc
test rax, rax
mov r14, rax
mov qword [rsp + 0x50], rax
je 0x512ec4
mov eax, r12d
lea r13, [rsp + 0x8c]
mov r12, qword [sym.imp.KERNEL32.DLL_ReadFile]
mov qword [rsp + 0x70], rax
mov r15, rax
jmp 0x5131e4
mov eax, dword [rsp + 0x8c]
cmp r15, rax
ja 0x513200
add r14, rax
sub r15, rax
je 0x513220
mov qword [rsp + 0x20], 0
mov r9, r13
mov r8d, r15d
mov rdx, r14
mov rcx, rbp
call r12
test eax, eax
jne 0x5131d0
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rcx, qword [rsp + 0x50]
call sub.msvcrt.dll_free
jmp 0x512ecd
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rax, qword [rsp + 0x50]
mov eax, dword [rax]
cmp eax, 0x950412de
setne bpl
cmp eax, 0xde120495
jne 0x513395
mov edx, 0x48
mov ecx, 1
call sub.msvcrt.dll_calloc
test rax, rax
mov r12, rax
je 0x5133ad
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x70]
movzx ebp, bpl
mov dword [r12 + 0x10], ebp
add rcx, rax
mov qword [r12], rax
mov rax, qword [rsp + 0x50]
test ebp, ebp
mov qword [r12 + 8], rcx
mov eax, dword [rax + 4]
je 0x51328c
bswap eax
test eax, eax
jne 0x51337e
mov rax, qword [rsp + 0x50]
test ebp, ebp
mov eax, dword [rax + 8]
je 0x5132a2
bswap eax
cmp eax, 0xfffe
ja 0x51337e
test ebp, ebp
mov word [r12 + 0x14], ax
mov rcx, qword [rsp + 0x50]
je 0x51332d
mov edx, dword [rcx + 0xc]
bswap edx
mov edx, edx
add rdx, rcx
mov qword [r12 + 0x28], rdx
mov edx, dword [rcx + 0x10]
bswap edx
mov edx, edx
add rdx, rcx
mov qword [r12 + 0x30], rdx
mov edx, dword [rcx + 0x14]
bswap edx
mov dword [r12 + 0x38], edx
mov edx, dword [rcx + 0x18]
bswap edx
mov edx, edx
add rdx, qword [rsp + 0x50]
mov ecx, eax
mov qword [r12 + 0x40], rdx
mov edx, 2
call sub.msvcrt.dll_calloc
test rax, rax
mov qword [r12 + 0x18], rax
je 0x51337e
mov rbx, r12
jmp 0x512ecd
mov rsi, qword [0x007f0228]
lea rax, [0x0078024b]
test rsi, rsi
cmove rsi, rax
jmp 0x512dbc
mov edx, dword [rcx + 0xc]
add rdx, rcx
mov qword [r12 + 0x28], rdx
mov edx, dword [rcx + 0x10]
add rdx, rcx
mov qword [r12 + 0x30], rdx
mov edx, dword [rcx + 0x14]
mov dword [r12 + 0x38], edx
mov edx, dword [rcx + 0x18]
jmp 0x5132eb
cmp qword [rsp + 0x58], 0
mov r9d, dword [rsp + 0x64]
mov edx, ebp
mov rcx, r14
setne r8b
movzx r8d, r8b
call fcn.005129a0
jmp 0x513081
mov dword [rbp + 0x18], 1
jmp 0x512f2a
mov rcx, qword [rsp + 0x50]
call sub.msvcrt.dll_free
mov rcx, r12
call sub.msvcrt.dll_free
jmp 0x512ecd
test bpl, bpl
je 0x513244
mov rcx, qword [rsp + 0x50]
call sub.msvcrt.dll_free
jmp 0x512ecd
mov rcx, qword [rsp + 0x50]
xor ebx, ebx
call sub.msvcrt.dll_free
jmp 0x512ecd
lea rcx, [0x007f0240]
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
jmp 0x512f41
xor r9d, r9d
xor r8d, r8d
jmp 0x512d90