Function at 0x180085ba0
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push r13
push rbp
push r12
push r14
push r15
sub rsp, 0x360
lea r13, [rsp + 0x40]
mov qword [r13 + 0x350], rbx
mov qword [r13 + 0x358], rsi
mov qword [r13 + 0x360], rdi
lea rbp, [rsp + 0x60]
and rbp, 0xffffffffffffffe0
mov rcx, qword [0x180186e90]
mov rax, qword [0x180186e80]
mov rdx, qword [rcx + rax*8]
lea rax, [rbp + 0xf0]
movzx ecx, word [0x180188fe0]
test cx, cx
je 0x180085c20
lea rdi, [0x180188fe0]
lea rsi, [rbp + 0xf0]
sub rdi, rsi
nop dword [rax]
mov word [rax], cx
add rax, 2
movzx ecx, word [rdi + rax]
test cx, cx
jne 0x180085c10
xor esi, esi
mov word [rax], si
movzx ecx, word [rdx]
test cx, cx
je 0x180085c40
sub rdx, rax
mov word [rax], cx
add rax, 2
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x180085c30
mov word [rax], si
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
mov r8d, 1
lea rcx, [rbp + 0xf0]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rbp + 0xd0], rax
cmp rax, 0xffffffffffffffff
je 0x180085ca2
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp eax, 0xffffffff
jne 0x180085e1f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movabs rax, 0xc88abb4ed4776e8f
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x60], rax
movabs rax, 0xdfb3ec67ef4fc2a9
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x68], rax
movabs rax, 0x239db31ab2c44b4c
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x70], rax
movabs rax, 0x73907fe8462da4bc
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x78], rax
movabs rax, 0x2ba663e76319a738
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x80], rax
movabs rdi, 0x99752ce222fdf1fa
mov qword [rbp + 8], rdi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x88], rax
movabs rdx, 0xbcaadf2bb81e0fe9
mov qword [rbp + 8], rdx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x20], rax
movabs rcx, 0xbc9388068023e2c6
mov qword [rbp + 8], rcx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x28], rax
movabs rax, 0x42efc67ddba22523
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x30], rax
movabs rax, 0x1ff919c82842cdc8
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x38], rax
movabs rax, 0x2ba663e741399d5d
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x40], rax
mov qword [rbp + 8], rdi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x48], rax
vmovdqu ymm0, ymmword [rbp + 0x20]
vpxor ymm1, ymm0, ymmword [rbp + 0x60]
vmovdqa ymmword [rbp + 0x60], ymm1
vmovdqa xmm2, xmmword [rbp + 0x80]
vxorps xmm2, xmm2, xmmword [rbp + 0x40]
vmovdqa xmmword [rbp + 0x80], xmm2
movabs rax, 0xbcaadf2bb81e0fcb
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 8], rcx
mov rax, qword [rbp + 8]
mov qword [rbp + 8], rdx
mov rax, qword [rbp + 8]
mov qword [rbp + 8], rcx
mov rax, qword [rbp + 8]
xor al, al
vzeroupper
mov rbx, qword [r13 + 0x350]
mov rsi, qword [r13 + 0x358]
mov rdi, qword [r13 + 0x360]
lea rsp, [r13 + 0x320]
pop r15
pop r14
pop r12
pop rbp
pop r13
ret
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rbp + 0xc8], rdi
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r12, rax
mov qword [rbp + 0x10], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov r8d, edi
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x180085e87
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r12, r12
je 0x180085ca2
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r12
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x180085ca2
movabs rsi, 0xcbf29ce484222325
mov rdx, rsi
lea rcx, str.version
call fcn.18005f770
mov rdi, rax
mov rdx, rsi
lea rcx, [0x18010ae2c]
call fcn.18005f770
mov dword [rbp], 0x3e8
lea r9, [rbp]
mov r8, rax
mov rdx, rdi
lea rcx, [rbp + 0xa0]
call fcn.180061b60
nop
mov rax, qword [r12]
mov qword [rbp + 0xa0], rax
lea rdx, [r12 + 8]
mov rcx, qword [rdx]
mov qword [rbp + 0xa8], rcx
add rdx, 8
movabs rax, 0x8cb0c9a388179fe5
movabs rsi, 0x2b9fff192bd4c83e
movabs rdi, 0x26efb703382e92fd
movabs r10, 0x889f8b4975721ba3
movabs r8, 0x566c1c811e86d8fd
movabs r9, 0x8012fbb270cb163d
movabs r11, 0xa00a62a942b20165
movabs r14, 0xbaaedcff023465cb
movabs r15, 0xbf1d25349b935bb7
cmp rcx, rax
ja 0x180085f82
je 0x180086073
cmp rcx, rdi
je 0x180086077
cmp rcx, rsi
je 0x180086077
cmp rcx, r8
je 0x180086073
cmp rcx, r9
je 0x180086073
cmp rcx, r10
je 0x180086077
jmp 0x180085fc3
cmp rcx, r11
je 0x180086077
cmp rcx, r14
je 0x180086077
cmp rcx, r15
je 0x180086073
movabs rax, 0xcd2fd49bc6b014bd
cmp rcx, rax
je 0x180086077
movabs rax, 0xfb0ce58f438fe2a6
cmp rcx, rax
je 0x180086073
lea r9, [rbp + 0xc0]
cmp qword [rbp + 0xb8], 8
cmova r9, qword [rbp + 0xc0]
mov rax, qword [0x180186ea8]
mov rdi, qword [0x180186eb0]
cmp rax, rdi
je 0x180086083
cmp qword [rax], rcx
je 0x180086004
add rax, 0x20
cmp rax, rdi
jne 0x180085ff1
jmp 0x180086083
add rdx, 8
mov r8, qword [rax + 8]
mov r10, qword [rax + 0x10]
cmp r8, r10
je 0x180086083
nop word [rax + rax]
mov rax, qword [rdx]
mov rcx, qword [rdx + 8]
add rdx, 0x10
cmp rax, qword [r8]
jne 0x180086083
cmp rcx, qword [r8 + 8]
jne 0x180086083
mov rcx, qword [r8 + 0x10]
mov rdi, qword [r8 + 0x18]
add rdi, r9
mov rax, rcx
and eax, 3
mov rsi, rdx
jne 0x180086054
shr rcx, 2
rep movsd dword [rdi], dword [rsi]
jmp 0x180086064
cmp rax, 2
jne 0x180086062
shr rcx, 1
rep movsw word [rdi], word [rsi]
jmp 0x180086064
rep movsb byte [rdi], byte [rsi]
add rdx, qword [r8 + 0x10]
add r8, 0x20
cmp r8, r10
jne 0x180086020
jmp 0x180086083
add rdx, 8
lea rcx, [rbp + 0xa0]
call fcn.180083e30
mov r14, qword [0x180186ec0]
mov rax, qword [0x180186ec8]
mov qword [rbp + 8], rax
movabs rsi, 0xbcaadf2bb81e0fe9
movabs r15, 0xbc9388068023e2c6
cmp r14, rax
je 0x180086755
mov rax, qword [r14]
mov qword [rbp + 0xd8], rax
mov rax, qword [r14 + 8]
mov qword [rbp + 0xe0], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0x10
lea r9, [rbp + 0xd8]
mov r8, qword [rbp + 0xc8]
mov rdx, r12
lea rcx, [rbp + 0x20]
call fcn.1800aac50
nop
mov rdi, qword [rbp + 0x20]
mov rax, qword [rbp + 0x28]
cmp rdi, rax
je 0x18008648f
sub rax, rdi
sar rax, 3
cmp rax, 1
jbe 0x1800862c8
movabs rax, 0xd3c7ff4fd66b608f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
movabs rax, 0x9cfde96ef40387b4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
movabs rax, 0x2b9da70bfbc74b4c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x70], rax
movabs rax, 0x7e916de84d2eafa9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
movabs rax, 0x4ece00932054bd29
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
movabs rax, 0xa33061a36ca6d189
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
movabs rax, 0x78ccd8c90c2e64c7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
movabs rcx, 0x371aa474a03e96bc
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
movabs rax, 0x42efc67ddba22523
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x70], rax
movabs rax, 0x1ff919c82842cdc8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
movabs rax, 0x2ba663e741399d5d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
movabs rax, 0x99752ce222fdf1fa
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
movabs rax, 0x78ccd8c90c2e64e7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
movabs rax, 0x9c909a7be14a2fc5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp], r15
mov rax, qword [rbp]
movabs rax, 0xcfcfb758d9762fb4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp], r15
mov rax, qword [rbp]
mov rdi, qword [rbp + 0x20]
mov rdi, qword [rdi]
lea rcx, [rbp + 0x20]
call fcn.1800752e0
test rdi, rdi
je 0x180086498
mov rax, qword [rdi]
mov qword [r14], rax
lea rdx, [rdi + 8]
mov rax, qword [rdx]
mov qword [r14 + 8], rax
add rdx, 8
movabs rcx, 0x8cb0c9a388179fe5
cmp rax, rcx
ja 0x180086368
je 0x18008647e
movabs rcx, 0x26efb703382e92fd
cmp rax, rcx
je 0x180086482
movabs rcx, 0x2b9fff192bd4c83e
cmp rax, rcx
je 0x180086482
movabs rcx, 0x566c1c811e86d8fd
cmp rax, rcx
je 0x18008647e
movabs rcx, 0x8012fbb270cb163d
cmp rax, rcx
je 0x18008647e
movabs rcx, 0x889f8b4975721ba3
cmp rax, rcx
je 0x180086482
jmp 0x1800863c7
movabs rcx, 0xa00a62a942b20165
cmp rax, rcx
je 0x180086482
movabs rcx, 0xbaaedcff023465cb
cmp rax, rcx
je 0x180086482
movabs rcx, 0xbf1d25349b935bb7
cmp rax, rcx
je 0x18008647e
movabs rcx, 0xcd2fd49bc6b014bd
cmp rax, rcx
je 0x180086482
movabs rcx, 0xfb0ce58f438fe2a6
cmp rax, rcx
je 0x18008647e
lea r10, [r14 + 0x20]
cmp qword [r14 + 0x18], 8
jbe 0x1800863d5
mov r10, qword [r10]
mov rax, qword [0x180186ea8]
mov rcx, qword [0x180186eb0]
cmp rax, rcx
je 0x18008673d
mov rdi, qword [r14 + 8]
cmp qword [rax], rdi
je 0x180086403
add rax, 0x20
cmp rax, rcx
jne 0x1800863f0
jmp 0x18008673d
add rdx, 8
mov r8, qword [rax + 8]
mov r9, qword [rax + 0x10]
cmp r8, r9
je 0x18008673d
nop dword [rax + rax]
mov rax, qword [rdx]
mov rcx, qword [rdx + 8]
add rdx, 0x10
cmp rax, qword [r8]
jne 0x18008673d
cmp rcx, qword [r8 + 8]
jne 0x18008673d
mov rcx, qword [r8 + 0x10]
mov rdi, qword [r8 + 0x18]
add rdi, r10
mov rax, rcx
and eax, 3
mov rsi, rdx
jne 0x18008645c
shr rcx, 2
rep movsd dword [rdi], dword [rsi]
jmp 0x18008646c
cmp rax, 2
jne 0x18008646a
shr rcx, 1
rep movsw word [rdi], word [rsi]
jmp 0x18008646c
rep movsb byte [rdi], byte [rsi]
add rdx, qword [r8 + 0x10]
add r8, 0x20
cmp r8, r9
jne 0x180086420
jmp 0x18008673d
add rdx, 8
mov rcx, r14
call fcn.180083e30
jmp 0x18008673d
lea rcx, [rbp + 0x20]
call fcn.1800752e0
lea rax, [rbp + 0xc0]
cmp qword [rbp + 0xb8], 8
cmova rax, qword [rbp + 0xc0]
cmp dword [rax], 0x3e8
jge 0x18008673d
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x18008673d
mov rcx, r14
call fcn.180083ef0
add rax, 0x10
lea rcx, [rax + 0x10]
xor edi, edi
mov edx, edi
cmp rcx, rax
cmova rdx, rcx
test rdx, rdx
je 0x18008659d
mov rcx, r14
call fcn.180083ef0
add rax, 0x10
lea rcx, [rax + 0x10]
mov edx, edi
cmp rcx, rax
cmova rdx, rcx
mov rcx, r14
cmp rdx, 0x400
ja 0x18008656d
call fcn.180083ef0
add rax, 0x10
lea rcx, [rax + 0x10]
mov edx, edi
cmp rcx, rax
cmova rdx, rcx
lea rax, [rdx + 0xf]
cmp rax, rdx
ja 0x18008654a
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.1800cc620
sub rsp, rax
lea r15, [rsp + 0x40]
test r15, r15
je 0x1800865a0
mov dword [r15], 0xcccc
add r15, 0x10
jmp 0x1800865a0
call fcn.180083ef0
add rax, 0x10
lea rdx, [rax + 0x10]
mov rcx, rdi
cmp rdx, rax
cmova rcx, rdx
call fcn.1800bb348
mov r15, rax
test rax, rax
je 0x1800865a0
mov dword [rax], 0xdddd
add r15, 0x10
jmp 0x1800865a0
mov r15, rdi
mov rax, qword [r14]
mov qword [r15], rax
lea rbx, [r15 + 8]
mov rax, qword [r14 + 8]
mov qword [rbx], rax
add rbx, 8
mov rax, qword [r14 + 8]
movabs rcx, 0x8cb0c9a388179fe5
cmp rax, rcx
ja 0x18008662f
je 0x1800868c2
movabs rcx, 0x26efb703382e92fd
cmp rax, rcx
je 0x1800868cd
movabs rcx, 0x2b9fff192bd4c83e
cmp rax, rcx
je 0x1800868cd
movabs rcx, 0x566c1c811e86d8fd
cmp rax, rcx
je 0x1800868c2
movabs rcx, 0x8012fbb270cb163d
cmp rax, rcx
je 0x1800868c2
movabs rcx, 0x889f8b4975721ba3
cmp rax, rcx
je 0x1800868cd
jmp 0x18008668e
movabs rcx, 0xa00a62a942b20165
cmp rax, rcx
je 0x1800868cd
movabs rcx, 0xbaaedcff023465cb
cmp rax, rcx
je 0x1800868cd
movabs rcx, 0xbf1d25349b935bb7
cmp rax, rcx
je 0x1800868c2
movabs rcx, 0xcd2fd49bc6b014bd
cmp rax, rcx
je 0x1800868cd
movabs rcx, 0xfb0ce58f438fe2a6
cmp rax, rcx
je 0x1800868c2
lea r12, [r14 + 0x20]
cmp qword [r14 + 0x18], 8
jbe 0x18008669d
mov r12, qword [r12]
mov rdi, qword [0x180186ea8]
mov rcx, qword [0x180186eb0]
cmp rdi, rcx
je 0x1800866c2
cmp qword [rdi], rax
je 0x18008684c
add rdi, 0x20
cmp rdi, rcx
jne 0x1800866b0
mov r12, qword [rbp + 0x10]
sub rbx, r15
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, ebx
mov rdx, r15
mov rbx, qword [rbp + 0xd0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x180086733
mov dword [rbp], 0x3e8
lea rcx, [rbp + 0xa0]
call fcn.180083ef0
mov r8, rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea rdx, [rbp]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
movabs r15, 0xbc9388068023e2c6
add r14, 0x28
cmp r14, qword [rbp + 8]
movabs rsi, 0xbcaadf2bb81e0fe9
jne 0x1800860b2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r12
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
lea rcx, [rbp + 0xa0]
call fcn.18005fe30
movabs rax, 0xdf8abb4edc7f6085
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x20], rax
movabs rax, 0xdde1fd61e9458ca9
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x28], rax
movabs rax, 0x2e86a05db5cd4c57
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x30], rax
movabs rax, 0x1ff919c80a62f7ad
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x38], rax
mov qword [rbp + 8], rsi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x20], rax
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0x28], rax
movabs rax, 0x42efc67ddba22523
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x30], rax
movabs rax, 0x1ff919c82842cdc8
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x38], rax
movabs rax, 0xbcaadf2bb81e0fcb
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 8], rsi
mov rax, qword [rbp + 8]
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov al, 1
jmp 0x180085df9
mov rcx, r14
call fcn.180083ef0
mov qword [rbx], rax
add rbx, 8
mov r8, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
cmp rdx, r8
je 0x1800866c2
nop dword [rax]
mov rax, qword [rdx]
mov qword [rbx], rax
mov rax, qword [rdx + 8]
mov qword [rbx + 8], rax
add rbx, 0x10
mov rcx, qword [rdx + 0x10]
mov rsi, qword [rdx + 0x18]
add rsi, r12
mov rax, rcx
and eax, 3
mov rdi, rbx
jne 0x1800868a0
shr rcx, 2
rep movsd dword [rdi], dword [rsi]
jmp 0x1800868b0
cmp rax, 2
jne 0x1800868ae
shr rcx, 1
rep movsw word [rdi], word [rsi]
jmp 0x1800868b0
rep movsb byte [rdi], byte [rsi]
add rbx, qword [rdx + 0x10]
add rdx, 0x20
cmp rdx, r8
jne 0x180086870
jmp 0x1800866c2
mov rax, qword [r14 + 0x18]
mov qword [rbx], rax
add rbx, 8
mov rcx, qword [r14 + 0x18]
cmp rcx, 8
lea rsi, [r14 + 0x20]
jbe 0x1800868de
mov rsi, qword [rsi]
mov rax, rcx
and eax, 3
mov rdi, rbx
jne 0x180086903
shr rcx, 2
rep movsd dword [rdi], dword [rsi]
add rbx, qword [r14 + 0x18]
jmp 0x1800866c6
rep movsb byte [rdi], byte [rsi]
add rbx, qword [r14 + 0x18]
jmp 0x1800866c6
cmp rax, 2
jne 0x1800868f8
shr rcx, 1
rep movsw word [rdi], word [rsi]
add rbx, qword [r14 + 0x18]
jmp 0x1800866c6