Function at 0x180061410
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x180087e88]
xor rax, rsp
mov qword [rbp + 8], rax
mov edi, r9d
mov qword [rsp + 0x48], rdx
lea r14d, [r9 + 0xa]
mov r13d, r9d
lea r9, [0x180000000]
mov r12, r8
mov rsi, rcx
cmp edi, r14d
jae 0x1800615e1
mov r8, qword [rsp + 0x48]
lea ebx, [rdi - 0xc]
mov eax, dword [rsp + 0x40]
mov r10d, 0x6c
mov r15, qword [rsp + 0x48]
mov qword [rsp + 0x58], r8
mov dword [rsp + 0x50], eax
nop
cmp ebx, 0x19
ja case.0x18006149d.1
movzx eax, byte [r9 + rbx + 0x61980]
mov ecx, dword [r9 + rax*4 + 0x61958]
add rcx, r9
jmp rcx
mov dword [rbp], 0x6c64746e
jmp case.0x18006149d.1
lea rdx, str.NtQuerySystemInformation
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, qword [rsp + 0x48]
test rax, rax
mov qword [rdx + 0x20], rax
setne al
mov byte [rsi], al
jmp 0x1800615b7
cmp r8, 0xffffffffffffffff
jne case.0x18006149d.1
xor eax, eax
nop dword [rax]
cmp eax, 7
ja case.0x1800614f0.0
mov edx, dword [r9 + rax*4 + 0x6199c]
add rdx, r9
jmp rdx
mov byte [rsi], 0
inc eax
lea ecx, [rax + 0x122]
cmp ecx, 0x12a
jb 0x1800614e0
mov rdx, qword [rsp + 0x48]
jmp case.0x18006149d.1
cmp qword [rdx + 0x18], 8
mov rcx, rdx
jb 0x18006151c
mov rcx, qword [rdx]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdx, qword [rsp + 0x48]
mov r8, rax
mov qword [rsp + 0x58], rax
jmp 0x1800615bc
mov eax, dword [rdx]
lea rcx, [rbp - 0x78]
mov r8, rdx
mov dword [rbp - 0x50], eax
mov edx, 0x91
mov r9, r12
call fcn.18004a3b0
movups xmm0, xmmword [rbp - 0x78]
mov eax, dword [rbp - 0x58]
movups xmm1, xmmword [rbp - 0x68]
mov dword [rbp - 8], eax
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm1
jmp 0x1800615b2
lea rcx, [rbp]
mov word [rbp + 4], r10w
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r15, rax
jmp 0x1800615b2
xor edx, edx
mov dword [rsp + 0x40], 0
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x50], eax
mov rdx, qword [rsp + 0x48]
mov r8, qword [rsp + 0x58]
lea r9, [0x180000000]
mov r10d, 0x6c
inc edi
inc ebx
cmp edi, r14d
jb 0x180061480
mov ebx, dword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
jmp 0x1800615f3
mov rdi, qword [rsp + 0x48]
mov ebx, dword [rsp + 0x40]
mov qword [rsp + 0x58], rdi
mov dword [rsp + 0x50], ebx
lea r15d, [r13 + 0x344]
cmp r13d, r15d
jae case.0x1800618e2.0
mov r14d, dword [rsp + 0x40]
nop dword [rax + rax]
cmp r13d, 0xaf
ja 0x18006177f
je 0x180061774
mov eax, r13d
sub eax, 0xc
je 0x1800616ee
sub eax, 0xb
je 0x1800616ab
sub eax, 0x41
je 0x180061676
cmp eax, 0xb
jne 0x18006190e
lea r9, [rbp - 0x28]
mov edx, 0x91
lea r8, [rbp - 0x50]
lea rcx, [rsp + 0x60]
call fcn.18004a3b0
movups xmm0, xmmword [rsp + 0x60]
mov eax, dword [rbp - 0x80]
movups xmm1, xmmword [rsp + 0x70]
mov dword [rbp - 0x58], eax
movups xmmword [rbp - 0x78], xmm0
movups xmmword [rbp - 0x68], xmm1
jmp 0x18006190e
xor edx, edx
mov rcx, r12
call fcn.180046670
mov rdx, rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, ebx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18006190e
mov edx, 0xc4
lea rcx, [rbp - 0x28]
call fcn.180077740
mov r8, qword [rsp + 0x48]
lea rcx, [rsp + 0x60]
mov r9d, 0x1b
mov rdx, r12
call fcn.180064170
movups xmm0, xmmword [rsp + 0x60]
mov eax, dword [rbp - 0x80]
movups xmm1, xmmword [rsp + 0x70]
mov dword [rbp - 0x30], eax
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm1
jmp 0x18006190e
mov rdx, qword [r12 + 0x10]
mov ecx, ebx
cmp rcx, rdx
ja 0x180061717
mov qword [r12 + 0x10], rcx
mov rax, r12
cmp qword [r12 + 0x18], 0x10
jb 0x18006170e
mov rax, qword [r12]
mov byte [rax + rcx], 0
jmp 0x18006190e
mov r8, qword [r12 + 0x18]
mov rdi, rcx
mov rax, r8
sub rdi, rdx
sub rax, rdx
cmp rdi, rax
ja 0x180061759
mov qword [r12 + 0x10], rcx
mov rax, r12
cmp r8, 0x10
jb 0x18006173f
mov rax, qword [r12]
lea rbx, [rax + rdx]
mov r8, rdi
mov rcx, rbx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov byte [rbx + rdi], 0
jmp 0x18006190e
mov r9, rdi
mov byte [rsp + 0x20], 0
xor r8d, r8d
mov rdx, rdi
mov rcx, r12
call fcn.180044e90
jmp 0x18006190e
mov r14d, 1
jmp 0x18006190e
mov eax, r13d
sub eax, 0xf0
je 0x1800618c2
sub eax, 0xb
je 0x1800617b6
sub eax, 0x41
je 0x18006190e
sub eax, 0x4c
je 0x1800617ae
cmp eax, 0x4c
je case.0x1800618e2.0
jmp 0x18006190e
mov byte [rsi], 1
jmp 0x18006190e
xor edx, edx
nop dword [rax + rax]
xor ecx, ecx
cmp byte [rbp + rdx - 0x74], cl
cmove ecx, r14d
xor eax, eax
cmp byte [rbp + rdx - 0x73], al
cmove eax, ecx
xor ecx, ecx
cmp byte [rbp + rdx - 0x72], cl
cmove ecx, eax
xor r14d, r14d
cmp byte [rbp + rdx - 0x71], r14b
cmove r14d, ecx
add rdx, 4
cmp rdx, 0x20
jl 0x1800617c0
test r14d, r14d
je 0x180061866
mov ebx, 0x37
nop dword [rax]
mov eax, ebx
sub eax, 0x36
je case.0x1800618e2.0
cmp eax, 1
jne 0x18006185a
lea rax, [rbp - 0x50]
mov qword [rsp + 0x28], 0
lea r9, [rbp - 0x28]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rcx, [rsp + 0x60]
mov edx, pe_nt_image_headers64
call fcn.180067e10
movups xmm1, xmmword [rsp + 0x60]
mov eax, dword [rbp - 0x80]
movups xmm0, xmmword [rsp + 0x70]
mov dword [rbp - 0x30], eax
movups xmmword [rsi], xmm1
movups xmmword [rsi + 0x10], xmm0
mov dword [rsi + 0x20], eax
movups xmmword [rbp - 0x50], xmm1
movups xmmword [rbp - 0x40], xmm0
dec ebx
cmp ebx, 0x35
ja 0x180061800
jmp 0x18006190e
mov ebx, ILRemoveLastID
nop dword [rax + rax]
cmp ebx, 0xe
je 0x180061883
cmp ebx, 0x3fe
je case.0x1800618e2.0
jmp 0x1800618b2
lea r9, [rbp - 0x50]
mov r8d, 0xcf
lea rdx, [rbp - 0x28]
lea rcx, [rsp + 0x60]
call fcn.180059860
movups xmm0, xmmword [rsp + 0x60]
mov eax, dword [rbp - 0x80]
movups xmm1, xmmword [rsp + 0x70]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
mov dword [rsi + 0x20], eax
add ebx, 0x3f0
cmp ebx, 0x7e0
jbe 0x180061870
jmp 0x18006190e
cmp ebx, dword [rsp + 0x40]
je 0x18006190e
mov edx, 6
nop dword [rax]
cmp edx, 6
ja case.0x1800618e2.2
mov eax, edx
mov ecx, dword [r9 + rax*4 + 0x619bc]
add rcx, r9
jmp rcx
mov byte [rsi], 0
jmp case.0x1800618e2.2
mov qword [r12 + 0x10], 0
mov rax, r12
cmp qword [r12 + 0x18], 0x10
jb 0x180061901
mov rax, qword [r12]
mov byte [rax], 0
dec edx
lea eax, [rdx + 0x2f]
cmp eax, 0x2e
ja 0x1800618d0
mov ebx, dword [rsp + 0x50]
lea r9, [0x180000000]
mov rdi, qword [rsp + 0x58]
add r13d, 0x4c
cmp r13d, r15d
jb 0x180061610
mov rax, rsi
mov rcx, qword [rbp + 8]
xor rcx, rsp
call fcn.180079740
mov rbx, qword [rsp + 0x150]
add rsp, 0x110
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret