Function at 0x180032e30
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x40]
sub rsp, 0x140
movzx eax, byte [rbp + 0x88]
mov r14, r9
movzx ebx, byte [rbp + 0x88]
mov rsi, rcx
mov r13d, dword [rbp + 0x88]
mov r15d, edx
movzx r12d, byte [rbp + 0x88]
mov dword [rsp + 0x54], eax
imul eax, edx, 0xb4
lea r10, [0x180000000]
xor r8d, r8d
movabs r11, 0x73006e00690067
movabs r9, 0x5300460045
cmp r15d, eax
ja case.0x180033112.5
cmp r15d, 0x1bc1
ja 0x1800331fb
je 0x1800331c9
cmp r15d, 0x6db
ja 0x180033092
je 0x18003306f
mov eax, r15d
sub eax, 0x87
je 0x180032f98
sub eax, 0xa
je 0x180032f3d
cmp eax, 0x6d
jne 0x1800336a1
mov rdi, qword [rbp + 0xa0]
movsxd r9, dword [rdi]
cmp r9d, 0x131
jge 0x1800336a1
mov rcx, qword [rbp + 0xa8]
mov rdx, r14
mov r8, qword [rbp + 0xb0]
mov qword [rsp + 0x20], rcx
mov rcx, rsi
call qword [r10 + r9*8 + 0x6d2a0]
mov edx, dword [rbp + 0x88]
lea eax, [rdx + rdx*2]
lea r15d, [r15 + rax*4]
jmp 0x180032e84
cmp qword [rsi + 0x18], 8
mov rcx, rsi
mov qword [rbp + 0x28], r8
jb 0x180032f4e
mov rcx, qword [rsi]
mov qword [rsp + 0x30], r8
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov edx, dword [rbp + 0x88]
mov qword [rsp + 0x60], rax
mov dword [rbp - 0x6c], 0x2d
mov byte [rsp + 0x50], 1
lea eax, [rdx + rdx*2]
lea r15d, [r15 + rax*4]
jmp 0x180032e84
test r14, r14
je 0x18003351e
mov rdi, qword [rbp + 0xa0]
test rdi, rdi
je 0x18003351e
test rsi, rsi
je 0x1800336a1
nop word [rax + rax]
mov rax, qword [rbp + 0xb0]
mov rax, qword [rax]
cmp qword [rsi + 0x20], rax
jne 0x180032ff5
mov qword [rbp - 0x68], rax
lea r9, [rbp - 0x68]
mov rax, qword [rsi + 0x10]
mov r8, r14
mov edx, 0xe9
mov qword [rsp + 0x20], rax
xor ecx, ecx
call fcn.180035f60
test rax, rax
je 0x18003300f
mov rsi, qword [rsi]
test rsi, rsi
jne 0x180032fc0
mov edx, dword [rbp + 0x88]
lea eax, [rdx + rdx*2]
lea r15d, [r15 + rax*4]
jmp 0x180032e84
mov rax, qword [rbp + 0xa8]
mov rax, qword [rax]
cmp qword [rsi + 0x48], rax
jne 0x180033045
mov rdx, qword [rbp + 0x90]
mov rcx, qword [rsi + 0x38]
cmp byte [rdx], 0
je 0x18003304e
mov rdx, rcx
mov r8, rax
mov rcx, rdi
call fcn.18004c1e0
test eax, eax
je 0x1800336ad
mov ecx, 0x112
inc ecx
jmp 0x180033074
mov qword [rsp + 0x20], rcx
lea r9, [rbp - 0x68]
xor ecx, ecx
mov qword [rbp - 0x68], rax
mov r8, rdi
mov edx, 0xe9
call fcn.180035f60
test rax, rax
jmp 0x18003303f
mov ecx, 0x112
cmp ecx, 0x114
jae 0x1800330c4
mov eax, ecx
sub eax, 0x112
je 0x180033045
cmp eax, 1
je 0x18003351e
inc ecx
jmp 0x180033074
cmp r15d, 0x75d
je 0x1800330de
cmp r15d, 0xe29
je 0x1800330cd
cmp r15d, 0x14f5
jne 0x1800336a1
lea eax, [rdx + rdx*2]
mov dword [rbp - 0x70], 0x64
lea r15d, [r15 + rax*4]
jmp 0x180032e84
mov edx, dword [rbp + 0x88]
xor r8d, r8d
lea eax, [rdx + rdx*2]
mov dword [rsp + 0x5c], r8d
lea r15d, [r15 + rax*4]
jmp 0x180032e84
cmp qword [rsp + 0x60], 0xffffffffffffffff
jne 0x1800331b7
mov edi, r8d
nop dword [rax]
cmp edi, 0xaf
ja case.0x180033112.6
mov eax, edi
movzx eax, byte [r10 + rax + 0x336d0]
mov ecx, dword [r10 + rax*4 + 0x336b4]
add rcx, r10
jmp rcx
xorps xmm0, xmm0
mov dword [rsp + 0x68], 0x2000000
movups xmmword [rbp + 0x30], xmm0
jmp case.0x180033112.6
mov r8d, dword [rsp + 0x68]
lea rax, [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
lea r9, [rbp + 0x30]
mov qword [rsp + 0x38], rax
lea rcx, [rbp - 0x30]
lea rax, [rbp + 0x14]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 8]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_AccessCheck]
lea r10, [0x180000000]
jmp case.0x180033112.6
xor bl, bl
jmp case.0x180033112.6
xorps xmm0, xmm0
mov qword [rbp + 0x18], 0xffffffffffffffff
xor eax, eax
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x10], rax
movups xmmword [rbp - 0x20], xmm0
jmp case.0x180033112.6
xorps xmm0, xmm0
mov dword [rsp + 0x6c], 0x14
xor eax, eax
movups xmmword [rbp - 8], xmm0
mov dword [rbp + 8], eax
add edi, 0x23
lea eax, [rdi + 0xec]
cmp eax, 0x1be
jb 0x1800330f0
mov edx, dword [rbp + 0x88]
lea eax, [rdx + rdx*2]
mov r13d, 0x36
lea r15d, [r15 + rax*4]
jmp 0x180032e84
mov rcx, qword [rsp + 0x60]
xor edx, edx
mov qword [rbp - 0x40], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [rbp + 0x88]
mov dword [rsp + 0x58], eax
mov dword [rbp - 0x74], 0x64
lea eax, [rdx + rdx*2]
lea r15d, [r15 + rax*4]
jmp 0x180032e84
cmp r15d, 0x36f1
ja 0x1800335f7
je 0x1800332d4
cmp r15d, 0x228d
je 0x1800332ac
cmp r15d, 0x2959
je 0x180033255
cmp r15d, 0x3025
jne 0x1800336a1
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [rbp + 0x88]
mov dword [rbp - 0x80], 0x50
lea eax, [rdx + rdx*2]
lea r15d, [r15 + rax*4]
jmp 0x180032e84
mov rcx, qword [rbp - 0x40]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.dbghelp.dll_SymInitialize]
cmp qword [r14 + 0x18], 0x10
mov rdx, r14
mov dword [rsp + 0x70], eax
jb 0x180033275
mov rdx, qword [r14]
mov r8d, dword [rsp + 0x58]
lea r9, [rsp + 0x5c]
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [rbp + 0x88]
mov dword [rbp - 0x7c], 0x3c
lea eax, [rdx + rdx*2]
lea r15d, [r15 + rax*4]
jmp 0x180032e84
mov edx, dword [rsp + 0x58]
xor r8d, r8d
mov rcx, r14
call fcn.1800385b0
mov edx, dword [rbp + 0x88]
mov dword [rbp - 0x78], 0x3c
lea eax, [rdx + rdx*2]
lea r15d, [r15 + rax*4]
jmp 0x180032e84
movzx eax, byte [rsp + 0x50]
mov ecx, r8d
cmp dword [rsp + 0x70], 0
cmovne ecx, eax
mov eax, dword [rsp + 0x58]
mov byte [rsp + 0x50], cl
cmp eax, dword [rsp + 0x5c]
je 0x1800335ad
mov edi, 0x89
nop dword [rax + rax]
cmp edi, 0x2b1d1
ja 0x18003343f
je 0x18003342e
cmp edi, 0x127f1
ja 0x1800333ce
je 0x18003339e
cmp edi, 0x89
je 0x180033368
cmp edi, 0x6301
je 0x18003335f
cmp edi, 0xc579
jne 0x18003359b
lea rax, [rbp - 0x30]
sub rax, 2
add rax, 2
cmp word [rax], 0
jne 0x180033344
movsd xmm0, qword [0x18006ec68]
movsd qword [rax], xmm0
jmp 0x18003359b
mov qword [rbp - 0x24], r9
jmp 0x18003359b
mov word [rbp - 0x30], r8w
lea rdx, [0x18006e5f0]
mov r8d, 1
lea rcx, [rbp - 0x30]
call fcn.18004bddc
movsd xmm0, qword [str.RROR_]
mov eax, dword [0x18006ec78]
movsd qword [rbp - 0x2e], xmm0
mov dword [rbp - 0x26], eax
jmp 0x180033584
movabs rax, 0x4c00420041
mov dword [rbp - 0x18], 0x53
mov r8d, 2
mov qword [rbp - 0x16], rax
lea rdx, [0x18006e5f0]
lea rcx, [rbp - 0x10]
call fcn.18004be24
jmp 0x180033584
cmp edi, 0x18a69
je 0x180033419
cmp edi, 0x1ece1
je 0x1800333f8
cmp edi, 0x24f59
jne 0x18003359b
mov qword [rbp - 0x5a], r11
mov word [rbp - 0x52], r8w
jmp 0x18003359b
mov eax, 0x6c
lea rdx, [0x18006ec8c]
lea rcx, [rbp - 0x5c]
mov dword [rbp - 0x5e], eax
lea r8d, [rax - 0x6b]
call fcn.18004be24
jmp 0x180033584
mov eax, 0x70
mov dword [rbp - 0xe], 0x44
mov word [rbp - 0x60], ax
jmp 0x18003359b
mov dword [rbp - 0x52], 0x6a002e
mov word [rbp - 0x4e], r8w
jmp 0x18003359b
cmp edi, 0x43bb1
ja 0x1800334eb
je 0x1800334b7
cmp edi, 0x31449
je 0x180033494
cmp edi, 0x376c1
je 0x180033484
cmp edi, 0x3d939
jne 0x18003359b
xorps xmm0, xmm0
mov dword [rsp + 0x74], r8d
xor eax, eax
mov dword [rsp + 0x78], r8d
movups xmmword [rbp - 8], xmm0
mov dword [rbp + 8], eax
jmp 0x18003359b
mov r12b, 1
movzx eax, r12b
mov dword [rsp + 0x54], eax
jmp 0x18003359b
mov r8d, 1
lea rdx, [0x18006ecce]
lea rcx, [rbp - 0x4e]
call fcn.18004be24
xor r8d, r8d
mov word [rbp - 0x4c], r8w
jmp 0x180033587
mov qword [r14 + 0x10], r8
mov rax, r14
cmp qword [r14 + 0x18], 0x10
jb 0x1800334c8
mov rax, qword [r14]
mov r8d, dword [rsp + 0x74]
lea r9, [rbp + 0x20]
mov edx, dword [rsp + 0x78]
lea rcx, [rbp - 0x30]
mov byte [rax], 0
call qword [sym.imp.ADVAPI32.dll_CredReadW]
mov dword [rsp + 0x7c], eax
jmp 0x180033584
cmp edi, 0x49e29
je 0x180033525
cmp edi, 0x500a1
jne 0x18003359b
cmp byte [rsp + 0x54], 0
je 0x18003351e
mov rcx, qword [rbp - 0x38]
lea rdx, [rbp - 8]
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x180033619
xor r9d, r9d
lea rax, [rbp - 0x60]
xor edx, edx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x100
lea r8d, [r9 + 4]
lea rcx, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
xor r8d, r8d
movzx ecx, r12b
cmp dword [rsp + 0x7c], r8d
mov edx, r8d
mov qword [rbp - 0x38], rax
cmovne edx, ecx
cmp rax, r8
movzx r12d, dl
mov edx, dword [rsp + 0x54]
movzx edx, dl
cmove edx, r8d
mov dword [rsp + 0x54], edx
test r12b, r12b
je 0x180033587
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ADVAPI32.dll_CredFree]
xor r8d, r8d
movabs r9, 0x5300460045
movabs r11, 0x73006e00690067
add edi, 0x6278
cmp edi, 0x56290
jbe 0x180033300
mov eax, dword [rbp - 0x80]
mov r8d, r13d
mov r9d, dword [rbp - 0x70]
mov edx, dword [rbp - 0x6c]
mov rcx, qword [rbp + 0x28]
mov dword [rsp + 0x40], 0x50
mov dword [rsp + 0x38], eax
mov eax, dword [rbp - 0x7c]
mov dword [rsp + 0x30], eax
mov eax, dword [rbp - 0x78]
mov dword [rsp + 0x28], eax
mov eax, dword [rbp - 0x74]
mov dword [rsp + 0x20], eax
call qword [sym.imp.GDI32.dll_Chord]
mov edx, dword [rbp + 0x88]
lea eax, [rdx + rdx*2]
lea r15d, [r15 + rax*4]
jmp 0x180032e84
cmp r15d, 0x3dbd
je 0x180033642
cmp r15d, 0x4489
je 0x180033634
cmp r15d, 0x4b55
jne 0x1800336a1
movzx eax, bl
mov rbx, qword [rsp + 0x180]
add rsp, 0x140
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea eax, [rdx + rdx*2]
mov bl, 1
lea r15d, [r15 + rax*4]
jmp 0x180032e84
cmp byte [rsp + 0x50], 0
je 0x1800336a1
mov r14, qword [rbp - 0x40]
mov edi, 0x104
mov eax, edi
sub eax, 0x103
je 0x180033674
cmp eax, 1
jne 0x18003368a
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x60], 0x20
movups xmmword [rbp - 0x50], xmm0
jmp 0x18003368a
lea rdx, [rbp - 0x60]
mov rcx, r14
call qword [sym.imp.dbghelp.dll_SymGetSymNext64]
mov rcx, r14
call qword [sym.imp.dbghelp.dll_SymCleanup]
dec edi
cmp edi, 0x102
ja 0x180033652
mov r14, qword [rbp + 0x98]
mov edx, dword [rbp + 0x88]
lea eax, [rdx + rdx*2]
lea r15d, [r15 + rax*4]
jmp 0x180032e84
mov al, 1
jmp 0x180033619