Function at 0x18001f040
Capabilities:
Get file size
Read file on windows

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov r13, r8
mov r12, rdx
mov r14, rcx
xor ebp, ebp
mov qword [rax - 0x68], rbp
mov dword [rax - 0x70], ebp
mov dword [rax - 0x78], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rbp + 1]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x18001f0a7
call fcn.180003180
nop
jmp 0x18001f378
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x18001f0d0
call fcn.180003180
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x18001f378
mov rax, qword [rsp + 0x40]
cmp rax, 0x100000
jle 0x18001f0f0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xe00e1001
jmp 0x18001f378
lea ecx, [rax + 2]
lea rdx, [0x180106f48]
call fcn.18006aaa4
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x18001f11f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x8007000e
jmp 0x18001f378
mov r8d, dword [rsp + 0x40]
add r8d, 2
xor edx, edx
mov rcx, rax
call fcn.18006cf60
mov dword [rsp + 0xb8], ebp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0xb8]
mov r8d, dword [rsp + 0x40]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x18001f17b
call fcn.180003180
mov esi, eax
mov rcx, rbx
call fcn.18006aaac
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x18001f378
mov rsi, rbp
mov qword [rsp + 0x48], rbp
movzx eax, byte [rbx]
or r15, 0xffffffffffffffff
cmp al, 0xff
jne 0x18001f19d
cmp byte [rbx + 1], 0xee
jne 0x18001f19d
lea rbp, [rbx + 2]
jmp 0x18001f339
cmp al, 0xef
jne 0x18001f27b
cmp byte [rbx + 1], 0xbb
jne 0x18001f27b
cmp byte [rbx + 2], 0xbf
jne 0x18001f27b
mov ecx, dword [rsp + 0x40]
mov eax, 2
mul rcx
cmovo rax, r15
lea rdx, [0x180106f48]
mov rcx, rax
call fcn.18006aaa4
mov rsi, rax
mov qword [rsp + 0x48], rax
test rax, rax
jne 0x18001f201
mov rcx, rbx
call fcn.18006aaac
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x8007000e
jmp 0x18001f378
mov r8d, dword [rsp + 0x40]
add r8, r8
xor edx, edx
mov rcx, rax
call fcn.18006cf60
mov r11, qword [rsp + 0x40]
lea r9d, [r11 - 3]
lea r8, [rbx + 3]
mov dword [rsp + 0x28], r11d
mov qword [rsp + 0x20], rsi
mov edx, 8
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x18001f263
mov rcx, rsi
call fcn.18006aaac
nop
mov rcx, rbx
call fcn.18006aaac
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xe00e1001
jmp 0x18001f378
mov rcx, rbx
call fcn.18006aaac
mov rbx, rbp
mov qword [rsp + 0x50], rbx
mov rbp, rsi
jmp 0x18001f339
mov ecx, dword [rsp + 0x40]
inc ecx
mov eax, 2
mul rcx
cmovo rax, r15
lea rdx, [0x180106f48]
mov rcx, rax
call fcn.18006aaa4
mov rsi, rax
mov qword [rsp + 0x48], rax
test rax, rax
jne 0x18001f2c5
mov rcx, rbx
call fcn.18006aaac
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x8007000e
jmp 0x18001f378
mov r8d, dword [rsp + 0x40]
inc r8d
add r8, r8
xor edx, edx
mov rcx, rax
call fcn.18006cf60
mov r11, qword [rsp + 0x40]
mov dword [rsp + 0x28], r11d
mov qword [rsp + 0x20], rsi
mov r9d, r11d
mov r8, rbx
mov edx, 8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x18001f326
call fcn.180003180
mov ebp, eax
mov rcx, rsi
call fcn.18006aaac
nop
mov rcx, rbx
call fcn.18006aaac
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebp
jmp 0x18001f378
mov rcx, rbx
call fcn.18006aaac
mov rbx, rbp
mov qword [rsp + 0x50], rbx
mov rbp, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x60], r15
mov r9, r13
mov r8, r12
mov rdx, rbp
mov rcx, r14
call fcn.18001f700
mov edi, eax
test rsi, rsi
je 0x18001f368
mov rcx, rsi
call fcn.18006aaac
nop
test rbx, rbx
je 0x18001f376
mov rcx, rbx
call fcn.18006aaac
nop
mov eax, edi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret