Function at 0x18000b260
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x430]
sub rsp, 0x530
mov rax, qword [0x1800529c8]
xor rax, rsp
mov qword [rbp + 0x420], rax
movzx ebx, byte [rsp + 0x44]
lea esi, [rcx - 0xa]
mov r9, rdx
mov qword [rbp - 0x58], rdx
xor edx, edx
mov qword [rsp + 0x50], r8
mov dword [rbp - 0x64], ecx
mov r14d, ecx
lea r10, [0x180000000]
cmp ecx, esi
jbe 0x18000b52b
lea edi, [rcx - 0xb5]
movabs r12, 0x2800650070
movabs r15, 0x7400650047
cmp edi, 0x11
ja case.0x18000b2e9.8
mov ecx, dword [r10 + rdi*4 + 0xbc50]
add rcx, r10
jmp rcx
movsd xmm0, qword [str._ot]
movzx eax, word [0x180043210]
movsd qword [rbp + 0xbe], xmm0
mov word [rbp + 0xc6], ax
jmp case.0x18000b2e9.8
mov dword [rbp + 0xb0], 0x79
lea rdx, [0x180040b04]
mov r8d, 1
mov qword [rbp + 0xb2], r12
lea rcx, [rbp + 0xa8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov eax, dword [0x180043214]
lea r10, [0x180000000]
mov r8, qword [rsp + 0x50]
xor edx, edx
mov dword [rbp + 0xba], eax
movzx eax, word [0x180043218]
mov word [rbp + 0xbe], ax
jmp case.0x18000b2e9.8
mov qword [rbp + 0xa8], r15
mov dword [rbp + 0xae], 0x54
jmp case.0x18000b2e9.8
mov r8d, 2
lea rdx, [0x1800432b0]
lea rcx, [rbp + 0x7a]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor eax, eax
lea rdx, [0x1800432cc]
lea rcx, [rbp + 0x70]
mov word [rbp + 0x7e], ax
lea r8d, [rax + 4]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov eax, dword [0x180043356]
lea r10, [0x180000000]
mov r8, qword [rsp + 0x50]
xor edx, edx
mov dword [rbp + 0x86], eax
movzx eax, word [0x18004335a]
mov word [rbp + 0x8a], ax
jmp case.0x18000b2e9.8
movups xmm0, xmmword [str.GetType_]
mov word [rbp + 0x70], dx
lea rcx, [rbp + 0x70]
mov r8d, 5
mov dword [rbp + 0xde], 0x29
lea rdx, [0x1800433c6]
movups xmmword [rbp + 0xce], xmm0
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov r8, qword [rsp + 0x50]
lea r10, [0x180000000]
xor edx, edx
jmp case.0x18000b2e9.8
mov r8d, 4
lea rdx, [0x180043446]
lea rcx, [rbp + 0x8c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov r8, qword [rsp + 0x50]
lea r10, [0x180000000]
xor edx, edx
mov dword [rbp + 0x94], 0x69
jmp case.0x18000b2e9.8
mov rax, qword [0x180054ee0]
cmp qword [0x180054ed8], rax
jne 0x18000b47e
mov edx, 7
lea rcx, [0x180054ed8]
call fcn.180007c60
mov r8, qword [rsp + 0x50]
lea rbx, [r8 + 0x60]
xor r8d, r8d
mov rcx, rbx
lea edx, [r8 + 0x5a]
call fcn.18000e2f0
mov r8, rbx
lea rcx, [0x180054ed8]
mov edx, 0xd2
call fcn.180011a10
mov r8, qword [rsp + 0x50]
lea r10, [0x180000000]
movzx ebx, al
xor edx, edx
jmp case.0x18000b2e9.8
mov r8d, 2
lea rdx, [0x18004345c]
lea rcx, [rbp + 0xc6]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov r8d, 1
lea rdx, [0x180040b24]
lea rcx, [rbp + 0xa8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov r8, qword [rsp + 0x50]
lea r10, [0x180000000]
mov dword [rbp + 0xca], 0x72
xor edx, edx
mov dword [rbp + 0xcc], 0x2e
jmp case.0x18000b2e9.8
mov word [rbp + 0x8c], dx
dec edi
lea eax, [rdi + 0xb5]
cmp eax, esi
ja 0x18000b2d5
mov r9, qword [rbp - 0x58]
imul eax, r14d, 0x762
mov esi, r14d
mov dword [rsp + 0x70], r14d
mov dword [rsp + 0x74], eax
cmp r14d, eax
ja case.0x18000b2e9.16
movzx eax, word [rsp + 0x44]
movzx edi, word [rsp + 0x44]
movzx r15d, byte [rsp + 0x44]
mov r14, qword [rbp - 0x40]
mov r13, qword [rbp - 0x38]
mov r12d, dword [rsp + 0x74]
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x4c], edi
mov r11d, 0x6e
cmp esi, 0x2b6b8
ja 0x18000b791
je 0x18000b788
cmp esi, 0xbc
je 0x18000b765
cmp esi, 0x8b88
je 0x18000b717
cmp esi, 0x11654
je 0x18000b5e5
cmp esi, 0x1a120
je 0x18000b5cc
cmp esi, 0x22bec
jne 0x18000bc15
mov edx, dword [rsp + 0x58]
xor r8d, r8d
mov rcx, r9
call fcn.1800279a0
jmp 0x18000bc11
mov rcx, qword [rbp - 0x80]
mov dword [rsp + 0x6c], edx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x58], eax
jmp 0x18000bc11
cmp qword [rbp - 0x80], 0xffffffffffffffff
jne 0x18000b709
mov edi, edx
cmp edi, 5
ja case.default.0x18000b608
mov eax, edi
mov ecx, dword [r10 + rax*4 + 0xbc98]
add rcx, r10
jmp rcx
cmp qword [rsp + 0x60], 0
jne 0x18000b619
mov byte [rsp + 0x44], 0
jmp 0x18000b67d
cmp byte [rsp + 0x44], 0
je 0x18000b67d
mov r9d, dword [rbp - 0x74]
lea rax, [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
lea r8, [rbp + 0x100]
mov edx, 3
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_SaferGetLevelInformation]
mov rcx, qword [rsp + 0x60]
test eax, eax
jne 0x18000b65b
call qword [sym.imp.ADVAPI32.dll_SaferCloseLevel]
mov byte [rsp + 0x44], 0
jmp 0x18000b67d
mov r9d, dword [rsp + 0x68]
lea r8, [rbp + 0x100]
mov edx, 3
call qword [sym.imp.ADVAPI32.dll_SaferSetLevelInformation]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_SaferCloseLevel]
mov edx, dword [rbp - 0x78]
lea r8, [rbp + 0x210]
mov rcx, qword [rbp - 0x38]
mov r9d, 0x104
call sub.IMM32.dll_ImmGetGuideLineW
jmp 0x18000b6ed
mov dword [rbp - 0x70], 1
jmp case.default.0x18000b608
mov dword [rbp - 0x78], 3
mov qword [rsp + 0x60], rdx
jmp case.default.0x18000b608
mov byte [rsp + 0x44], 1
mov dword [rbp - 0x68], 2
mov qword [rbp - 0x38], rdx
mov dword [rbp - 0x6c], 0x40000
jmp case.default.0x18000b608
mov r8d, dword [rbp - 0x70]
lea r9, [rsp + 0x60]
mov ecx, dword [rbp - 0x68]
mov dword [rsp + 0x68], edx
mov qword [rsp + 0x20], rdx
mov edx, dword [rbp - 0x6c]
mov dword [rbp - 0x74], 0x104
call qword [sym.imp.ADVAPI32.dll_SaferCreateLevel]
xor edx, edx
inc edi
lea r10, [0x180000000]
lea eax, [rdi + 0xac]
cmp eax, 0xb2
jb 0x18000b5f2
mov eax, 0x100
mov dword [rsp + 0x48], eax
jmp 0x18000bc15
cmp qword [r8 + 0x18], 8
mov rcx, r8
mov word [rbp + 0xa0], dx
jb 0x18000b72b
mov rcx, qword [r8]
mov qword [rsp + 0x30], rdx
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp - 0x80], rax
mov byte [rsp + 0x41], 1
mov byte [rsp + 0x42], 1
jmp 0x18000bc11
movsd xmm0, qword [0x180043488]
movzx eax, word [0x180043490]
movsd qword [rbp + 0x96], xmm0
mov word [rbp + 0x9e], ax
jmp 0x18000bc11
mov qword [rbp - 0x50], rdx
jmp 0x18000bc15
cmp esi, 0x34184
je 0x18000bbd6
cmp esi, 0x3cc50
je 0x18000bb92
cmp esi, 0x4571c
je 0x18000b7d5
cmp esi, 0x4e1e8
jne 0x18000bc15
cmp byte [rsp + 0x42], 0
je 0x18000b7ce
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov al, 1
jmp 0x18000b93f
movzx eax, byte [rsp + 0x42]
mov ecx, edx
cmp qword [rbp - 0x50], 0
cmovne ecx, eax
mov eax, dword [rsp + 0x58]
mov byte [rsp + 0x42], cl
cmp eax, dword [rsp + 0x6c]
je 0x18000badb
mov esi, 0xd1
nop dword [rax + rax]
cmp esi, 0x26d49
ja 0x18000b910
je 0x18000b8d7
cmp esi, 0xd1
je 0x18000b8ba
cmp esi, 0x9bef
je 0x18000b891
cmp esi, 0x1370d
je 0x18000b87d
cmp esi, 0x1d22b
jne 0x18000bab8
mov eax, dword [0x1800434d8]
mov edi, 0x100
movups xmm0, xmmword [str.terinmatni_g_av_skivan]
mov dword [rbp + 0xf8], eax
movzx eax, word [0x1800434dc]
mov word [rbp + 0xfc], ax
movzx eax, byte [0x1800434de]
mov byte [rbp + 0xfe], al
movups xmmword [rbp + 0xe8], xmm0
mov dword [rsp + 0x4c], edi
jmp 0x18000bab8
mov r15b, 1
mov dword [rbp + 0x6a], 0x64
mov byte [rsp + 0x40], r15b
jmp 0x18000bab8
mov eax, dword [0x180043494]
movsd xmm0, qword [str.NotF]
mov dword [rbp + 0x58], eax
mov eax, dword [0x1800434ac]
mov dword [rbp + 0x64], eax
movsd qword [rbp + 0x5c], xmm0
mov word [rbp + 0x68], r11w
jmp 0x18000bab8
movsd xmm0, qword [str.Devi]
movzx eax, word [0x1800434c0]
movsd qword [rbp + 0x50], xmm0
mov word [rbp + 0x58], ax
jmp 0x18000bab8
xorps xmm0, xmm0
mov qword [r9 + 0x10], rdx
xor eax, eax
cmp qword [r9 + 0x18], 0x10
mov dword [rbp + 0x40], eax
mov rax, r9
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
jb 0x18000b908
mov rax, qword [r9]
mov byte [rax], 0
jmp 0x18000bab8
cmp esi, 0x30867
je 0x18000ba76
cmp esi, 0x3a385
je 0x18000b9bf
cmp esi, 0x43ea3
je 0x18000b969
cmp esi, 0x4d9c1
jne 0x18000bab8
movzx eax, bl
mov rcx, qword [rbp + 0x420]
xor rcx, rsp
call fcn.18003bee0
mov rbx, qword [rsp + 0x570]
add rsp, 0x530
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp byte [rsp + 0x40], 0
je 0x18000b9b8
movsx rax, di
xor r9d, r9d
mov rdi, qword [rbp - 0x48]
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x20], rax
mov edx, 0xf001f
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.dbghelp.dll_GetTimestampForLoadedLibrary]
test rbx, rbx
je 0x18000b9ab
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [rsp + 0x4c]
xor bl, bl
jmp 0x18000bab8
test r14, r14
movzx eax, r15b
mov ecx, edx
cmovne ecx, eax
cmp qword [rbp - 0x48], 0
movzx eax, byte [rsp + 0x40]
movzx r15d, cl
mov ecx, edx
cmovne ecx, eax
mov byte [rsp + 0x40], cl
test r15b, r15b
je 0x18000bab8
mov edi, 0xa8
mov eax, edi
sub eax, 0xa8
je 0x18000ba47
cmp eax, 1
jne 0x18000ba5d
cmp r12d, 0xffffffff
jne 0x18000ba15
lea edx, [rax + 0xf]
mov rcx, r14
call qword [sym.imp.WINMM.dll_mmioClose]
xor r15b, r15b
jmp 0x18000ba5b
test r15b, r15b
je 0x18000ba5d
xor r8d, r8d
mov rdx, r13
mov rcx, r14
call qword [sym.imp.WINMM.dll_mmioWrite]
mov edx, 0x10
mov rcx, r14
call qword [sym.imp.WINMM.dll_mmioFlush]
mov edx, 0x10
mov rcx, r14
call qword [sym.imp.WINMM.dll_mmioClose]
jmp 0x18000ba5b
mov r13, rdx
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.WINMM.dll_mmioRead]
mov r12d, eax
xor edx, edx
inc edi
cmp edi, 0xaa
jb 0x18000b9f0
movzx eax, byte [rsp + 0x40]
mov edi, dword [rsp + 0x4c]
mov byte [rsp + 0x40], al
jmp 0x18000bab8
xor r8d, r8d
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0xe8]
call qword [sym.imp.WINMM.dll_mmioOpenA]
xor r9d, r9d
movsx ecx, di
mov r14, rax
mov qword [rbp - 0x40], rax
xor edx, edx
lea rax, [rbp + 0x50]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
lea r8d, [r9 + 4]
lea rcx, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rbp - 0x48], rax
mov r9, qword [rbp - 0x58]
mov edx, 0
add esi, 0x9b1e
lea r11d, [rdx + 0x6e]
cmp esi, 0x5740e
jbe 0x18000b800
mov esi, dword [rsp + 0x70]
movzx edx, byte [rsp + 0x41]
test dl, dl
je 0x18000bc11
movsxd r14, dword [rsp + 0x48]
mov edi, 0x20
mov eax, edi
sub eax, 0x1e
je 0x18000bb42
sub eax, 1
je 0x18000bb28
cmp eax, 1
jne 0x18000bb76
mov rcx, qword [rsp + 0x78]
xor r9d, r9d
movsx rax, r14w
xor r8d, r8d
mov edx, 0xf001f
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbp - 0x60], rax
jmp 0x18000bb71
cmp qword [rbp - 0x60], 0
jne 0x18000bb76
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor dl, dl
mov byte [rsp + 0x41], dl
jmp 0x18000bb76
test dl, dl
je 0x18000bb76
mov rcx, qword [rbp - 0x60]
lea r9, [rbp - 0x30]
mov r8d, 9
xor edx, edx
call qword [sym.imp.dbghelp.dll_ImageDirectoryEntryToData]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx edx, byte [rsp + 0x41]
dec edi
cmp edi, 0x1d
ja 0x18000baf2
movzx r8d, byte [rsp + 0x42]
mov r14, qword [rbp - 0x40]
mov byte [rsp + 0x42], r8b
jmp 0x18000bc11
xor r9d, r9d
cwde
xor edx, edx
lea rcx, [rbp + 0x70]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], eax
lea r8d, [r9 + 4]
lea rcx, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rcx, qword [rbp - 0x80]
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x78], 0
mov eax, dword [rsp + 0x48]
jne 0x18000bc15
xor cl, cl
mov byte [rsp + 0x41], cl
jmp 0x18000bc15
xor edx, edx
mov rcx, r9
call fcn.180003860
mov r8d, dword [rsp + 0x58]
lea r9, [rsp + 0x6c]
mov rcx, qword [rbp - 0x80]
mov rdx, rax
xor eax, eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
lea rdx, [rbp + 0xa8]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov qword [rbp - 0x50], rax
mov eax, dword [rsp + 0x48]
imul ecx, dword [rbp - 0x64], 0xbd
add esi, ecx
mov dword [rsp + 0x70], esi
cmp esi, dword [rsp + 0x74]
ja case.0x18000b2e9.16
mov r9, qword [rbp - 0x58]
lea r10, [0x180000000]
mov edi, dword [rsp + 0x4c]
xor edx, edx
mov r8, qword [rsp + 0x50]
jmp 0x18000b56c
xor al, al
jmp 0x18000b93f