Function at 0x18004b000
Capabilities:
Check if file exists
Get file attributes
Get file size
Read file on windows

Disassembly:
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x290
mov rax, qword [0x1800f7050]
xor rax, rsp
mov qword [rsp + 0x270], rax
xor esi, esi
mov rax, rdx
mov r15, r8
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x50], rdx
mov r12, rcx
mov qword [rsp + 0x30], rsi
lea r8d, [rsi + 1]
mov r14d, 3
xor r9d, r9d
mov edx, 0x80000000
mov rcx, rax
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x18004b073
call fcn.1800030e0
jmp 0x18004b624
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x280], r13
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r13d, eax
cmp eax, 0xffffffff
jne 0x18004b0a1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x80004005
jmp 0x18004b61c
cmp r13d, 0xa00000
jbe 0x18004b0bd
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xe00e1001
jmp 0x18004b61c
lea eax, [r13 + 2]
lea rdx, [0x1800fee28]
mov qword [rsp + 0x2d8], rbx
mov ecx, eax
mov qword [rsp + 0x288], rbp
mov ebp, eax
call fcn.1800626b4
mov rbx, rax
test rax, rax
jne 0x18004b0fc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x8007000e
jmp 0x18004b60c
mov r8, rbp
xor edx, edx
mov rcx, rax
call fcn.1800644c0
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x18004b12b
call fcn.1800030e0
mov esi, eax
jmp 0x18004b2a0
lea r9, [rsp + 0x40]
mov r8d, r13d
mov rdx, rbx
mov rcx, rdi
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x18004b158
call fcn.1800030e0
mov esi, eax
jmp 0x18004b2a0
mov rdx, qword [rbx]
lea r8, [0x180000000]
cmp rdx, qword [r8 + 0xdcce8]
jne 0x18004b17c
mov rdx, qword [rbx + 8]
cmp rdx, qword [r8 + 0xdccf0]
jne 0x18004b17c
mov eax, esi
jmp 0x18004b181
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x18004b1a0
mov rcx, rbx
call fcn.1800626bc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xe00e1001
jmp 0x18004b60c
cmp byte [rbx + 0x10], 2
jb 0x18004b2db
lea rcx, [rsp + 0x62]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x60], si
call fcn.1800644c0
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
lea rdx, [0x1800dcd00]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18004b24b
xor r9d, r9d
mov qword [rsp + 0x30], rsi
lea rcx, [rsp + 0x60]
lea r8d, [r9 + 1]
mov edx, 0x80000000
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x18004b233
call fcn.1800030e0
mov esi, eax
jmp 0x18004b2a0
mov rdx, rax
mov rcx, r12
call fcn.18004ce80
test eax, eax
je 0x18004b266
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call fcn.1800626bc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xe003200a
jmp 0x18004b60c
test r15, r15
je 0x18004b279
lea rdx, [rsp + 0x60]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0x50]
mov rcx, rbp
mov qword [rsp + 0x50], rsi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x18004b2b8
call fcn.1800030e0
mov rcx, rbp
mov esi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call fcn.1800626bc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x18004b60c
mov eax, dword [r12 + 0x2c]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov qword [r12 + 0x368], rcx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18004b5cb
mov ebp, dword [rbx + 0x50]
lea rax, [rbp + 0x18]
cmp rax, r13
ja case.0x18004b388.6
cmp word [rbx + 0x14], si
je case.0x18004b388.6
movzx eax, word [rbx + rbp + 0xe]
lea rcx, [rax + rax*4]
mov eax, dword [rbx + rbp + 0x14]
shl rcx, 4
add rcx, rax
cmp rcx, r13
ja case.0x18004b388.6
mov eax, dword [rbx + rbp]
add eax, 0x96
imul eax, eax, 0x930
mov dword [r12 + 0x2c], eax
mov r11d, dword [rbx + rbp + 0x14]
movzx ecx, byte [rbx + rbp + 0xa]
add r11, rbx
mov eax, esi
test ecx, ecx
jle 0x18004b349
cmp byte [r11 + 4], 1
je 0x18004b349
inc eax
add r11, 0x50
cmp eax, ecx
jl 0x18004b338
cmp eax, ecx
jge case.0x18004b388.6
movzx eax, word [r11 + 0x10]
mov dword [r12 + 0x20], eax
mov ecx, dword [rbx + rbp + 4]
imul rcx, rax
mov qword [r12 + 0x368], rcx
movzx eax, byte [r11]
and eax, 7
cmp eax, 7
ja case.0x18004b388.6
cdqe
mov ecx, dword [r8 + rax*4 + 0x4b644]
add rcx, r8
jmp rcx
mov r14d, 1
jmp case.0x18004b388.0
mov r14d, 2
jmp case.0x18004b388.0
mov r14d, 4
jmp case.0x18004b388.0
mov r14d, 5
mov r8d, dword [r12 + 0x20]
mov edx, r14d
mov rcx, r12
call fcn.18004c0b0
mov r13d, eax
test eax, eax
js 0x18004b5e0
cmp eax, 1
je 0x18004b5e0
mov r8, qword [rsp + 0x48]
mov r15d, dword [r11 + 0x34]
test r8, r8
je 0x18004b419
cmp byte [rbx + 0x10], 1
jne 0x18004b3ed
cmp byte [rbx + 0x11], 5
jb 0x18004b3ed
mov eax, 1
jmp 0x18004b3ef
mov eax, esi
mov rdx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
mov r9, rbx
mov dword [rsp + 0x20], r15d
call fcn.18004b670
mov r13d, eax
test eax, eax
js 0x18004b5e0
cmp eax, 1
je 0x18004b5e0
cmp dword [r12 + 0x35c], esi
jne 0x18004b5cb
cmp r14d, 1
jne 0x18004b43e
mov dword [r12 + 0x34], r14d
mov dword [r12 + 0x370], 0x930
mov edx, dword [rbx + rbp + 0x14]
xor eax, eax
mov r8d, esi
add rdx, rbx
mov qword [rsp + 0x50], rax
cmp byte [rbx + rbp + 0xa], al
jbe 0x18004b5c3
movzx r10d, byte [rsp + 0x57]
movzx r11d, byte [rsp + 0x56]
movzx r13d, byte [rsp + 0x55]
movzx r14d, byte [rsp + 0x52]
movzx r9d, byte [rsp + 0x51]
add rdx, 4
nop dword [rax + rax]
movzx eax, byte [rdx]
cmp al, 0xa2
jne 0x18004b49f
mov r9b, byte [rdx - 2]
mov r13b, byte [rdx + 5]
mov r11b, byte [rdx + 6]
mov r10b, byte [rdx + 7]
mov r14b, 0xaa
mov esi, 1
cmp al, 0x99
ja 0x18004b546
movzx eax, word [rdx + 0xc]
cmp eax, dword [r12 + 0x20]
jne case.0x18004b388.6
cmp dword [rdx + 0x30], r15d
jne case.0x18004b388.6
mov ecx, dword [r12 + 0x35c]
movzx eax, byte [r12 + rcx*8 + 0x3d]
xor al, byte [rdx - 2]
and al, 0xf
xor byte [r12 + rcx*8 + 0x3d], al
mov ecx, dword [r12 + 0x35c]
movzx eax, byte [r12 + rcx*8 + 0x3d]
xor al, byte [rdx - 2]
and al, 0xf
xor al, byte [rdx - 2]
mov byte [r12 + rcx*8 + 0x3d], al
movzx ecx, byte [r12 + 0x35c]
mov eax, dword [r12 + 0x35c]
inc cl
mov byte [r12 + rax*8 + 0x3e], cl
mov ecx, dword [r12 + 0x35c]
movzx eax, byte [rdx + 5]
mov byte [r12 + rcx*8 + 0x41], al
mov ecx, dword [r12 + 0x35c]
movzx eax, byte [rdx + 6]
mov byte [r12 + rcx*8 + 0x42], al
mov ecx, dword [r12 + 0x35c]
movzx eax, byte [rdx + 7]
mov byte [r12 + rcx*8 + 0x43], al
inc dword [r12 + 0x35c]
movzx eax, byte [rbx + rbp + 0xa]
inc r8d
add rdx, 0x50
cmp r8d, eax
jl 0x18004b480
test esi, esi
je 0x18004b5c3
mov ecx, dword [r12 + 0x35c]
movzx eax, r9b
and r9b, 0xf0
and byte [r12 + rcx*8 + 0x3d], 0xf0
and al, 0xf
or byte [r12 + rcx*8 + 0x3d], al
mov eax, dword [r12 + 0x35c]
and byte [r12 + rax*8 + 0x3d], 0xf
or byte [r12 + rax*8 + 0x3d], r9b
mov eax, dword [r12 + 0x35c]
mov byte [r12 + rax*8 + 0x3e], r14b
mov eax, dword [r12 + 0x35c]
mov byte [r12 + rax*8 + 0x41], r13b
mov eax, dword [r12 + 0x35c]
mov byte [r12 + rax*8 + 0x42], r11b
mov eax, dword [r12 + 0x35c]
mov byte [r12 + rax*8 + 0x43], r10b
mov rcx, r12
call fcn.18004c2e0
mov rcx, rbx
call fcn.1800626bc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x18004b60c
mov rcx, rbx
call fcn.1800626bc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r13d
jmp 0x18004b60c
mov rcx, rbx
call fcn.1800626bc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x80004005
mov rbp, qword [rsp + 0x288]
mov rbx, qword [rsp + 0x2d8]
mov r13, qword [rsp + 0x280]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.180062100
add rsp, 0x290
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret