Function at 0x18000d8d0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4a0]
sub rsp, 0x5a0
mov rax, qword [0x1801eef68]
xor rax, rsp
mov qword [rbp + 0x490], rax
mov ebx, edx
mov dword [rsp + 0x58], edx
lea edi, [rdx + 0xb]
mov qword [rsp + 0x78], r8
xor r9d, r9d
lea rdx, [0x180000000]
mov r14, rcx
mov r11d, 0x65
cmp ebx, edi
jae 0x18000da9f
mov rsi, qword [rbp - 0x80]
lea r15d, [r11 + 0x11]
add ebx, 0xffffff56
mov r12d, 0x6f54
nop dword [rax]
cmp ebx, 0xd
ja case.0x18000d953.8
mov ecx, dword [rdx + rbx*4 + 0xe3bc]
add rcx, rdx
jmp rcx
mov byte [rbp - 0x16], 0
mov word [rbp + 8], r15w
jmp case.0x18000d953.8
mov word [rbp + 0xa], r11w
jmp case.0x18000d953.8
mov rax, qword [r8]
mov rsi, qword [rax + 0x18]
mov eax, dword [r14]
cmp eax, dword [rsi + 4]
ja 0x18000daea
lea rcx, [rax + rax*2]
mov rax, qword [rsi + 0x18]
cmp dword [rax + rcx*4], 0
jne case.0x18000d953.8
mov eax, 2
jmp 0x18000e392
mov eax, dword [0x1801de119]
mov dword [rbp - 0x1b], eax
movzx eax, byte [0x1801de11d]
mov byte [rbp - 0x17], al
jmp case.0x18000d953.8
mov r8d, 1
lea rdx, [0x1801de12f]
lea rcx, [rbp - 0x28]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
movzx eax, word [0x1801de187]
mov word [rbp - 0x27], ax
movzx eax, byte [0x1801de189]
mov byte [rbp - 0x25], al
jmp 0x18000da76
mov r8d, 1
mov byte [rbp - 0x24], 0
lea rdx, [0x1801de1a5]
lea rcx, [rbp - 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov word [rbp - 0x23], r12w
jmp 0x18000da76
mov r8d, 2
mov byte [rbp - 0x2b], 0
lea rdx, [0x1801de228]
lea rcx, [rbp - 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov word [rbp - 0x29], 0x52
jmp 0x18000da76
mov eax, dword [r14]
mov dword [rsi + 8], eax
mov dword [rsi + 0xc], r9d
mov dword [rsp + 0x60], r9d
jmp case.0x18000d953.8
mov eax, dword [0x1801de26e]
mov dword [rbp - 0x30], eax
movzx eax, byte [0x1801de272]
mov byte [rbp - 0x2c], al
jmp case.0x18000d953.8
mov r8d, 2
mov byte [rbp - 0x21], 0
lea rdx, [0x1801de2c7]
lea rcx, [rbp - 0x21]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov dword [rbp - 0x1f], 0x206f6564
mov byte [rbp - 0x1b], 0
mov r8, qword [rsp + 0x78]
lea rdx, [0x180000000]
mov r11d, 0x65
xor r9d, r9d
inc ebx
lea eax, [rbx + 0xaa]
cmp eax, edi
jb 0x18000d940
mov ebx, dword [rsp + 0x58]
lea edi, [rbx - 0xb]
mov dword [rsp + 0x54], edi
cmp ebx, edi
jbe case.0x18000dae8.0
mov esi, dword [rsp + 0x68]
lea edi, [rbx - 0xa0]
movzx r15d, byte [rsp + 0x50]
mov r10d, PathMakeUniqueName
mov r13d, dword [rsp + 0x68]
mov r12, qword [rbp - 0x80]
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x5c], edi
cmp edi, 0xa
ja case.default.0x18000dae8
mov ecx, dword [rdx + rdi*4 + 0xe3f4]
add rcx, rdx
jmp rcx
mov eax, 0x7f2bb747
jmp 0x18000e392
xor edx, edx
mov rcx, r14
call fcn.180004d20
mov rcx, qword [rbp - 0x68]
lea r9, [rsp + 0x6c]
mov rdx, rax
mov r8d, esi
xor eax, eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
xor r9d, r9d
lea rax, [rbp - 0x30]
xor edx, edx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x100
lea r8d, [r9 + 4]
lea rcx, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
xor r9d, r9d
xor edx, edx
mov qword [rbp - 0x50], rax
lea rax, [rbp + 8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x100
lea rcx, [rdx - 1]
lea r8d, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [rbp - 0x74], 0x200
mov r10d, PathMakeUniqueName
mov qword [rsp + 0x70], rax
jmp 0x18000e10b
mov rsi, qword [rbp - 0x68]
mov byte [rsp + 0x50], 1
cmp rsi, 0xffffffffffffffff
jne 0x18000dd85
mov edi, 0x66
nop word [rax + rax]
cmp edi, 0x177
ja 0x18000dc4e
je 0x18000dc3d
lea eax, [rdi - 0x66]
cmp eax, 0xea
ja case.0x18000dc71.421
movzx eax, byte [rdx + rax + 0xe440]
mov ecx, dword [rdx + rax*4 + 0xe420]
add rcx, rdx
jmp rcx
mov eax, 0x7a
mov dword [rbp - 5], 0x2e3631
mov word [rbp - 2], ax
jmp case.0x18000dc71.421
mov word [rbp - 0xc], r10w
jmp case.0x18000dc71.421
mov dword [rbp - 0x10], 0x74737573
jmp case.0x18000dc71.421
mov dword [rbp], 0x206f72
jmp case.0x18000dc71.421
mov word [rbp - 1], r11w
jmp case.0x18000dc71.421
mov eax, 0x62
mov word [rbp - 0xb], ax
jmp case.0x18000dc71.421
mov dword [rbp - 0xa], 0x64322e
mov eax, 0x62
mov word [rbp - 7], r10w
mov word [rbp - 6], ax
jmp case.0x18000dc71.421
mov dword [rbp + 0x30], 0x610070
mov word [rbp + 0x34], r9w
jmp case.0x18000dc71.421
lea eax, [rdi - 0x19e]
cmp eax, 0xea
ja case.0x18000dc71.421
movzx eax, byte [rdx + rax + 0xe54c]
mov ecx, dword [rdx + rax*4 + 0xe52c]
add rcx, rdx
jmp rcx
mov eax, dword [0x1801de320]
mov r15b, 1
mov dword [rbp + 0x42], eax
mov r13d, 0x182aa
movzx eax, word [0x1801de324]
mov word [rbp + 0x46], ax
mov word [rbp + 0x48], r9w
jmp case.0x18000dc71.421
mov word [rbp + 0x42], r9w
jmp case.0x18000dc71.421
xor r8d, r8d
mov dword [rbp - 0x78], r9d
lea r9, [rbp - 0x10]
xor ecx, ecx
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventA]
xor r9d, r9d
mov r12, rax
mov qword [rbp - 0x58], r9
jmp 0x18000dd5b
mov rcx, r12
jmp 0x18000dd52
movsd xmm0, qword [0x1801de3a4]
movzx eax, word [0x1801de3ac]
movsd qword [rbp + 0x34], xmm0
mov word [rbp + 0x3c], ax
mov dword [rbp + 0x3e], 0x65006d
jmp case.0x18000dc71.421
xor r9d, r9d
lea rax, [rbp + 0x30]
xor edx, edx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x100
lea r8d, [r9 + 4]
lea rcx, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbx, rax
test rax, rax
jne 0x18000dd24
xor r15b, r15b
jmp 0x18000dd58
test r15b, r15b
je 0x18000dd58
mov r8d, dword [rbp - 0x78]
lea rax, [rbp - 0x58]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x5c]
lea rax, [rbp - 0x60]
mov edx, r13d
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_BackupSeek]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
lea rdx, [0x180000000]
mov r10d, PathMakeUniqueName
add edi, 0x27
mov r11d, 0x65
cmp edi, 0x2af
jb 0x18000dba0
mov ebx, dword [rsp + 0x58]
mov edi, dword [rsp + 0x5c]
xor edx, edx
mov dword [rsp + 0x6c], r9d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
mov r10d, PathMakeUniqueName
jmp 0x18000e10b
mov byte [rsp + 0x60], 1
jmp 0x18000e10b
movzx eax, byte [rsp + 0x50]
mov edx, r9d
mov r10, qword [rsp + 0x70]
test r10, r10
cmovne edx, eax
mov byte [rsp + 0x50], dl
cmp esi, dword [rsp + 0x6c]
je 0x18000df0f
mov ecx, 0xd0
mov eax, ecx
sub eax, 0xd0
je 0x18000def9
sub eax, 1
je 0x18000ded6
cmp eax, 1
jne 0x18000df01
mov edx, dword [rbp - 0x6c]
mov rcx, qword [rbp - 0x48]
call sub.SHELL32.dll_SHTestTokenMembership
mov r8d, dword [rsp + 0x68]
lea rax, [rbp - 0x80]
mov rdx, qword [rbp - 0x38]
xor r13d, r13d
mov qword [rsp + 0x40], rax
xor r9d, r9d
mov rax, qword [rbp - 0x40]
xor ecx, ecx
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x30], r13d
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_CDefFolderMenu_Create2]
test eax, eax
jne case.0x18000dc71.420
movzx r12d, word [rsp + 0x50]
mov ebx, 0xfa
mov r15, qword [rbp - 0x80]
movabs rcx, 0x61004d0077
movzx edi, byte [rsp + 0x50]
mov rsi, qword [rbp - 0x80]
movzx r14d, byte [rsp + 0x50]
nop word [rax + rax]
cmp ebx, 0x361
ja 0x18000e263
je 0x18000e218
mov eax, ebx
sub eax, 0xfa
je 0x18000e1a1
sub eax, 0x7b
je 0x18000e198
sub eax, 0x7b
je 0x18000e17f
sub eax, 0x7b
je 0x18000e13b
cmp eax, 0x7b
jne 0x18000e37a
mov eax, dword [0x1801de3e8]
mov dword [rbp + 0x74], 0x6f
mov dword [rbp + 0x7a], 0x3a
mov dword [rbp + 0x76], eax
mov dword [rbp + 0x7c], 0x4f
jmp 0x18000e37a
mov qword [r14 + 0x10], r9
mov rax, r14
cmp qword [r14 + 0x18], 0x10
mov dword [rsp + 0x68], r9d
jb 0x18000deec
mov rax, qword [r14]
mov byte [rax], 0
mov qword [rbp - 0x40], r9
mov dword [rbp - 0x6c], r9d
jmp 0x18000df01
mov qword [rbp - 0x38], r9
mov qword [rbp - 0x48], r9
inc ecx
cmp ecx, 0xd3
jb 0x18000ddd2
test dl, dl
je 0x18000dfb4
mov byte [rsp + 0x50], dl
mov r8d, 0x400
mov qword [rsp + 0x20], r9
lea rdx, [rbp + 0x90]
lea r9, [rsp + 0x64]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x18000df57
cmp dword [rsp + 0x64], eax
ja 0x18000df57
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [rsp + 0x50], 0
jmp 0x18000dfb4
mov rcx, qword [rsp + 0x70]
mov r9d, 2
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov r9d, dword [rsp + 0x64]
xor r8d, r8d
mov rcx, qword [rsp + 0x70]
mov ebx, eax
xor eax, eax
mov edx, ebx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_LockFile]
mov r9d, dword [rsp + 0x64]
xor eax, eax
mov rcx, qword [rsp + 0x70]
xor r8d, r8d
mov edx, ebx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rsp + 0x58]
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [rbp - 0x74]
lea rcx, [rbp - 0x70]
call qword [sym.imp.SHELL32.dll_SHGetSettings]
mov r10d, PathMakeUniqueName
jmp 0x18000e10b
mov rdx, qword [r14 + 0x10]
mov ecx, esi
mov dword [rbp - 0x70], r9d
cmp rcx, rdx
ja 0x18000dfff
mov qword [r14 + 0x10], rcx
mov rax, r14
cmp qword [r14 + 0x18], 0x10
jb 0x18000dff6
mov rax, qword [r14]
mov byte [rax + rcx], 0
jmp 0x18000e10b
mov r8, qword [r14 + 0x18]
mov rdi, rcx
mov rax, r8
sub rdi, rdx
sub rax, rdx
cmp rdi, rax
ja 0x18000e04c
mov qword [r14 + 0x10], rcx
mov rax, r14
cmp r8, 0x10
jb 0x18000e024
mov rax, qword [r14]
lea rbx, [rax + rdx]
mov r8, rdi
mov rcx, rbx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov byte [rdi + rbx], 0
mov r10d, PathMakeUniqueName
mov ebx, dword [rsp + 0x58]
mov edi, dword [rsp + 0x5c]
jmp 0x18000e10b
mov r9, rdi
mov byte [rsp + 0x20], 0
xor r8d, r8d
mov rdx, rdi
mov rcx, r14
call fcn.180003800
mov edi, dword [rsp + 0x5c]
mov r10d, PathMakeUniqueName
jmp 0x18000e10b
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r10d, PathMakeUniqueName
jmp 0x18000e10b
mov eax, 0x67
mov dword [rbp + 0xc], 0x650072
mov word [rbp + 0x14], ax
mov dword [rbp + 0x10], 0x69006e
mov dword [rbp + 0x16], 0x650064
jmp 0x18000e10b
cmp qword [r8 + 0x18], 8
mov rcx, r8
mov dword [rbp + 0x24], 0x730065
mov word [rbp + 0x28], r9w
jb 0x18000e0bf
mov rcx, qword [r8]
mov qword [rsp + 0x30], r9
mov edx, 0x80000000
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp - 0x68], rax
mov r10d, PathMakeUniqueName
jmp 0x18000e10b
mov dword [rbp + 0x1a], 0x6e0020
mov dword [rbp + 0x1e], 0x730061
jmp 0x18000e10b
mov eax, 0x69
mov word [rbp + 0x22], ax
mov eax, dword [rsp + 0x54]
dec ebx
dec edi
mov dword [rsp + 0x58], ebx
mov dword [rsp + 0x5c], edi
cmp ebx, eax
jbe case.0x18000dae8.0
mov r8, qword [rsp + 0x78]
lea rdx, [0x180000000]
xor r9d, r9d
lea r11d, [r9 + 0x65]
jmp 0x18000dad5
mov eax, 0x69
mov dword [rbp + 0x6c], 0x57
mov dword [rbp + 0x6e], eax
lea rax, [rbp + 0x50]
sub rax, 2
cmp word [rax + 2], r13w
lea rax, [rax + 2]
jne 0x18000e152
mov ecx, dword [0x1801de3cc]
mov dword [rax], ecx
movzx ecx, word [0x1801de3d0]
mov word [rax + 4], cx
movabs rcx, 0x61004d0077
jmp 0x18000e37a
mov eax, dword [0x1801de3c0]
mov dword [rbp + 0x68], eax
movzx eax, word [0x1801de3c4]
mov word [rbp + 0x6c], ax
jmp 0x18000e37a
mov qword [rbp + 0x62], rcx
jmp 0x18000e37a
mov eax, dword [0x1801de3f0]
mov dword [rbp + 0x50], eax
movzx eax, word [0x1801de3f4]
mov word [rbp + 0x54], ax
lea rax, [rbp + 0x50]
sub rax, 2
nop dword [rax]
cmp word [rax + 2], r13w
lea rax, [rax + 2]
jne 0x18000e1c0
movsd xmm0, qword [0x1801de3f8]
lea rdx, [0x1801de3e0]
mov r8d, 1
movsd qword [rax], xmm0
lea rcx, [rbp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov eax, dword [0x1801de400]
movabs rcx, 0x61004d0077
mov dword [rbp + 0x5c], 0x56
mov dword [rbp + 0x5e], eax
movzx eax, word [0x1801de404]
mov word [rbp + 0x62], ax
jmp 0x18000e37a
mov eax, 0x6e
lea rdx, [0x1801de3e0]
mov dword [rbp + 0x7e], eax
lea rcx, [rbp + 0x84]
mov eax, dword [0x1801de3d8]
mov r8d, 2
mov dword [rbp + 0x80], eax
movzx eax, word [0x1801de3dc]
mov word [rbp + 0x84], ax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
movabs rcx, 0x61004d0077
jmp 0x18000e37a
mov eax, ebx
sub eax, 0x3dc
je 0x18000e369
sub eax, 0x7b
je 0x18000e35e
sub eax, 0x7b
je 0x18000e33f
sub eax, 0x7b
je 0x18000e2f0
cmp eax, 0x7b
jne 0x18000e37a
test dil, dil
je 0x18000e2c9
movsx rax, r12w
xor r9d, r9d
mov qword [rsp + 0x28], r13
xor r8d, r8d
mov edx, 0xf001f
mov qword [rsp + 0x20], rax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14b, r14b
je 0x18000e2d7
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp - 0x80]
mov rax, qword [rcx]
call qword [rax + reloc.SHELL32.dll_ILFindLastID]
movabs rcx, 0x61004d0077
jmp 0x18000e37a
xor r9d, r9d
movsx eax, r12w
xor edx, edx
lea rcx, [rbp + 0x50]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], eax
lea r8d, [r9 + 4]
lea rcx, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
movzx ecx, r14b
mov edx, r13d
test rax, rax
movzx edi, dil
mov r15, rax
cmove edi, r13d
test rsi, rsi
cmovne edx, ecx
movabs rcx, 0x61004d0077
movzx r14d, dl
jmp 0x18000e37a
mov edx, 0x208
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
movabs rcx, 0x61004d0077
jmp 0x18000e37a
mov r12d, 0x100
mov rsi, r13
jmp 0x18000e37a
mov dil, 1
mov dword [rbp + 0x86], 0x72
movzx r14d, dil
add ebx, 0x7b
cmp ebx, 0x643
jb 0x18000de70
mov byte [rsp + 0x60], 0
mov eax, dword [rsp + 0x60]
mov rcx, qword [rbp + 0x490]
xor rcx, rsp
call fcn.1800d7250
mov rbx, qword [rsp + 0x5e8]
add rsp, 0x5a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret