Function at 0x180019890
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x130]
sub rsp, 0x230
mov rax, qword [0x1800a3d18]
xor rax, rsp
mov qword [rbp + 0x120], rax
lea ebx, [r9 - 0xc]
mov dword [rsp + 0x68], r9d
mov edi, dword [rsp + 0x68]
mov r15, r8
mov r8, qword [rbp - 0x80]
mov r13d, r9d
mov qword [rsp + 0x58], r8
mov r14, rdx
mov dword [rsp + 0x60], r9d
mov r12, rcx
mov dword [rsp + 0x40], ebx
mov esi, r9d
cmp r9d, ebx
jbe 0x180019d79
mov rax, qword [rbp - 0x80]
lea rdx, str.InstallFunctions
mov ebx, dword [rsp + 0x68]
mov r10d, 0x5c
mov qword [rsp + 0x48], rax
add r13d, 0xffffff83
mov eax, dword [rsp + 0x40]
lea r11d, [r10 + 0xd]
nop dword [rax]
lea r9, [0x180000000]
cmp r13d, 0x3c
ja case.default.0x180019945
movzx eax, byte [r9 + r13 + 0x19fcc]
mov ecx, dword [r9 + rax*4 + 0x19f98]
add rcx, r9
jmp rcx
mov eax, dword [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x48], r9
jmp 0x180019d57
cmp r8, 0xffffffffffffffff
jne case.0x180019945.6
mov esi, 0x11
cmp esi, 0x11
ja case.0x18001997d.2
mov eax, esi
mov ecx, dword [r9 + rax*4 + 0x1a00c]
add rcx, r9
jmp rcx
mov r8d, 2
lea rdx, [0x1800950e0]
lea rcx, [rbp + 0x26]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov r10d, 0x5c
lea r9, [0x180000000]
lea r11d, [r10 + 0xd]
jmp case.0x18001997d.2
mov word [rbp + 0x27], r10w
mov dword [rbp + 0x28], 0x3d2074
jmp case.0x18001997d.2
movzx eax, word [0x1800950e4]
mov word [rbp + 0x2b], ax
mov word [rbp + 0x2d], r11w
jmp case.0x18001997d.2
movzx eax, word [0x1800950ec]
mov word [rbp], ax
movzx eax, byte [0x1800950ee]
mov byte [rbp + 2], al
jmp case.0x18001997d.2
movzx eax, word [0x1800950f0]
mov word [rbp + 0x21], ax
mov dword [rbp + 0x23], 0x6e756f
jmp case.0x18001997d.2
movzx eax, word [0x1800950f4]
mov word [rbp - 0x10], ax
movzx eax, byte [0x1800950f6]
mov byte [rbp - 0xe], al
jmp case.0x18001997d.2
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x10]
call qword [sym.imp.SHLWAPI.dll_PathRenameExtensionA]
mov byte [rsp + 0x50], 0
jmp 0x180019996
lea rcx, [rbp - 0x10]
dec rcx
nop dword [rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x180019a40
movzx eax, word [0x1800950f8]
mov word [rcx], ax
mov eax, dword [str.ltTo]
mov dword [rbp - 0xb], eax
movzx eax, byte [0x180095100]
mov byte [rbp - 7], al
jmp case.0x18001997d.2
mov r8d, 6
lea rdx, str.s:_re
lea rcx, [rbp + 0x1c]
jmp 0x180019990
mov eax, dword [str.Machi]
mov dword [rbp + 0x10], eax
movzx eax, word [0x180095110]
mov word [rbp + 0x14], ax
movzx eax, byte [0x180095112]
mov byte [rbp + 0x16], al
jmp case.0x18001997d.2
mov r8d, 6
lea rdx, str.neHook
lea rcx, [rbp + 0x10]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x180019996
movzx eax, word [0x18009511c]
mov word [rbp - 0xe], ax
movzx eax, byte [0x18009511e]
mov byte [rbp - 0xc], al
jmp case.0x18001997d.2
lea rcx, [rbp - 0x10]
dec rcx
nop dword [rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x180019ae0
mov eax, dword [0x180095120]
lea rdx, [0x180095124]
mov dword [rcx], eax
mov r8d, 1
lea rcx, [rbp - 0x10]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x180019996
mov dword [rbp - 3], 0x657263
dec esi
lea eax, [rsi + 0x2b]
cmp eax, 0x2a
ja 0x180019967
mov esi, dword [rsp + 0x60]
jmp 0x180019d42
mov rax, qword [r14]
mov qword [0x1800a4168], rdx
test rax, rax
je 0x180019b93
nop dword [rax + rax]
dec rax
mov ecx, 0x55
mov qword [r14], rax
nop dword [rax + rax]
cmp ecx, 0x55
je 0x180019b67
cmp ecx, 0x1496
jne 0x180019b7a
movzx eax, byte [r12]
and eax, 0xf
jmp 0x180019b70
movzx eax, byte [r12]
shr rax, 4
movzx eax, byte [rax + rdx]
mov byte [r15], al
inc r15
add ecx, 0x1441
cmp ecx, 0x2882
jbe 0x180019b50
mov rax, qword [r14]
inc r12
test rax, rax
jne 0x180019b40
dec rax
mov qword [r14], rax
jmp case.0x180019945.6
mov rax, qword [r12]
lea r8, [rbp - 0x78]
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
mov rax, qword [r15]
mov edx, 0x16
mov qword [rbp - 0x78], rax
call fcn.180054e50
mov rbx, rax
jmp 0x180019d42
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov edx, 0x100
mov qword [rsp + 0x20], rax
xor ecx, ecx
call fcn.180009980
jmp 0x180019d42
mov ecx, dword [r15]
lea eax, [rcx - 0x61]
cmp eax, 0x19
jbe 0x180019c0c
lea eax, [rcx - 0x41]
cmp eax, 0x19
jbe 0x180019c0c
mov dword [rsp + 0x50], 0
jmp case.0x180019945.6
mov dword [rsp + 0x50], 1
jmp case.0x180019945.6
cmp qword [r15 + 0x18], 8
mov rcx, r15
jb 0x180019c26
mov rcx, qword [r15]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r8, rax
mov qword [rsp + 0x58], rax
jmp 0x180019d47
test ebx, ebx
jns 0x180019ccc
mov edi, 0x10d
cmp edi, 0x10d
je 0x180019c7d
cmp edi, 0x1d3
je case.0x180019945.2
jmp 0x180019cbe
lea rax, [rsp + 0x60]
mov dword [rsp + 0x60], 1
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r8, [0x180092c27]
mov dword [rsp + 0x50], 0x16
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x70], 0
mov ecx, 0xe3
call fcn.18000a640
mov dword [rsp + 0x50], eax
add edi, 0xc6
cmp edi, 0x299
jb 0x180019c67
mov rax, qword [r15]
lea r8, [rsp + 0x70]
mov r9, r14
mov dword [rsp + 0x70], ebx
mov edx, SHRegGetIntW
mov rcx, qword [rax]
lea rax, [rbp - 0x80]
mov qword [rbp - 0x80], rcx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.180010940
mov rdi, rax
jmp 0x180019d42
mov rcx, qword [r15 + 0x10]
call fcn.18008eb9c
jmp 0x180019d42
test edi, edi
je case.0x180019945.6
lea rax, [rsp + 0x70]
mov dword [rsp + 0x70], 1
lea r9, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r8, [0x180092c27]
mov dword [rsp + 0x60], edi
lea rdx, [rbp - 0x78]
mov dword [rbp - 0x78], 0
mov ecx, 0xe3
call fcn.18000a640
mov r8, qword [rsp + 0x58]
lea rdx, str.InstallFunctions
mov eax, dword [rsp + 0x40]
mov r9, qword [rsp + 0x48]
dec esi
mov r10d, 0x5c
dec r13d
mov dword [rsp + 0x60], esi
lea r11d, [r10 + 0xd]
cmp esi, eax
ja 0x180019920
mov r13d, dword [rsp + 0x68]
jmp 0x180019d82
mov r9, qword [rbp - 0x80]
mov qword [rsp + 0x48], r9
imul r14d, r13d, 0x3b4
mov ebx, r13d
cmp r13d, r14d
ja case.0x180019945.2
mov esi, dword [rsp + 0x68]
nop dword [rax]
cmp ebx, 0xd639
ja 0x180019e99
je 0x180019e4b
cmp ebx, 0x3610
ja 0x180019e2d
je 0x180019e1b
mov eax, ebx
sub eax, 0x7d
je 0x180019e12
sub eax, 0x30
je 0x180019e05
cmp eax, 0xc
jne 0x180019f5b
mov ecx, 0xe0
nop word [rax + rax]
mov eax, ecx
sub eax, 0xdf
je case.0x180019945.2
cmp eax, 1
jne 0x180019df6
mov dword [rsp + 0x50], edi
dec ecx
cmp ecx, 0xde
ja 0x180019de0
jmp 0x180019f5b
mov dword [rsp + 0x78], 0
jmp 0x180019f5b
mov byte [r15], 0
jmp 0x180019f5b
xor edx, edx
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
jmp 0x180019f51
cmp ebx, 0xa0d6
jne 0x180019f5b
mov edx, esi
xor r8d, r8d
mov rcx, r12
call fcn.180071f30
jmp 0x180019f51
xor edx, edx
mov rcx, r12
call fcn.180003510
mov rcx, qword [rsp + 0x58]
lea r9, [rsp + 0x78]
mov rdx, rax
mov qword [rsp + 0x20], 0
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x20], rax
movups xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x18], eax
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
jmp 0x180019f51
cmp ebx, 0x10b9c
je 0x180019f48
cmp ebx, 0x140ff
je 0x180019f5b
cmp ebx, 0x17662
je 0x180019edc
cmp ebx, 0x1abc5
je 0x180019ed2
cmp ebx, 0x1e128
je case.0x180019945.2
jmp 0x180019f5b
mov byte [rsp + 0x50], 1
jmp 0x180019f5b
cmp esi, dword [rsp + 0x78]
je 0x180019f3a
mov eax, 0x77
cmp eax, 0x7007
ja 0x180019f12
cmp eax, 0x4ad7
jne 0x180019f2e
mov qword [r12 + 0x10], 0
mov rcx, r12
cmp qword [r12 + 0x18], 0x10
jb 0x180019f0d
mov rcx, qword [r12]
mov byte [rcx], 0
jmp 0x180019f2e
cmp eax, 0x9537
je 0x180019f2e
cmp eax, 0xba67
je 0x180019f29
cmp eax, 0xdf97
je case.0x180019945.2
jmp 0x180019f2e
mov byte [rsp + 0x50], 0
add eax, 0x2530
cmp eax, 0x10450
jbe 0x180019ee7
lea rdx, [rbp - 0x70]
mov rcx, r9
call sub.IMM32.dll_ImmGetCompositionFontW
jmp 0x180019f51
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8, qword [rsp + 0x58]
mov r9, qword [rsp + 0x48]
imul eax, r13d, 0x4f
add ebx, eax
cmp ebx, r14d
jbe 0x180019da0
mov eax, dword [rsp + 0x50]
mov rcx, qword [rbp + 0x120]
xor rcx, rsp
call fcn.18008f350
mov rbx, qword [rsp + 0x288]
add rsp, 0x230
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret