Function at 0x180024330
Capabilities:
Get file size
Read file on windows

Disassembly:
mov r11, rsp
push rbx
push rdi
push r12
push r13
push r14
sub rsp, 0x80
xor eax, eax
xor r14d, r14d
mov rdi, rcx
mov dword [r11 - 0x58], r14d
mov dword [r11 - 0x60], r14d
mov ecx, 0x100000
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x5c], eax
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x64], eax
mov r13d, r8d
mov ebx, edx
mov dword [r11 + 0x20], r14d
mov dword [r11 - 0x68], r14d
mov qword [r11 - 0x40], r14
mov qword [r11 - 0x38], rax
mov qword [r11 - 0x30], rax
call fcn.180036df8
mov r12, rax
test rax, rax
jne 0x1800243aa
mov eax, 0x8007000e
add rsp, 0x80
pop r14
pop r13
pop r12
pop rdi
pop rbx
ret
xor edx, edx
mov r8d, 0x100000
mov rcx, rax
mov qword [rsp + 0xb0], rbp
mov qword [rsp + 0xb8], rsi
call fcn.180037390
xor r9d, r9d
mov qword [rsp + 0x30], r14
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, rdi
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x180024437
call qword [sym.imp.KERNEL32.dll_GetLastError]
bt eax, 0x1d
mov edi, eax
jae 0x180024421
test eax, eax
jle 0x180024687
movzx edi, ax
or edi, 0xa0070000
jmp 0x180024687
test eax, eax
jle 0x180024687
movzx edi, ax
or edi, 0x80070000
jmp 0x180024687
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x180024483
call qword [sym.imp.KERNEL32.dll_GetLastError]
bt eax, 0x1d
mov edi, eax
jae 0x18002446d
test eax, eax
jle 0x180024687
movzx edi, ax
or edi, 0xa0070000
jmp 0x180024687
test eax, eax
jle 0x180024687
movzx edi, ax
or edi, 0x80070000
jmp 0x180024687
cmp dword [rsp + 0x4c], r14d
jne 0x180024682
test ebx, ebx
je 0x18002449c
cmp dword [rsp + 0x48], ebx
ja 0x180024682
lea r9, [rsp + 0xc8]
mov r8d, 0x1000
mov rdx, r12
mov rcx, rbp
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1800244f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
bt eax, 0x1d
mov edi, eax
jae 0x1800244e3
test eax, eax
jle 0x180024687
movzx edi, ax
or edi, 0xa0070000
jmp 0x180024687
test eax, eax
jle 0x180024687
movzx edi, ax
or edi, 0x80070000
jmp 0x180024687
mov edx, dword [rsp + 0x48]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x50]
mov rcx, r12
call fcn.18001a6a0
mov edi, eax
test eax, eax
js 0x180024687
mov ebx, dword [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r9, [rsp + 0xc8]
mov r8d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov rdx, r12
mov rcx, rbp
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x18002458b
call qword [sym.imp.KERNEL32.dll_GetLastError]
bt eax, 0x1d
mov edi, eax
jae 0x180024575
test eax, eax
jle 0x180024687
movzx edi, ax
or edi, 0xa0070000
jmp 0x180024687
test eax, eax
jle 0x180024687
movzx edi, ax
or edi, 0x80070000
jmp 0x180024687
cmp word [r12 + 6], 2
je 0x18002459e
mov edi, 0x8007000d
jmp 0x180024687
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov r8d, dword [r12]
lea r9, [rsp + 0xc8]
add r8d, 0xc
mov rdx, r12
mov rcx, rbp
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x18002460b
call qword [sym.imp.KERNEL32.dll_GetLastError]
bt eax, 0x1d
mov edi, eax
jae 0x1800245f8
test eax, eax
jle 0x180024687
movzx edi, ax
or edi, 0xa0070000
jmp 0x180024687
test eax, eax
jle 0x180024687
movzx edi, ax
or edi, 0x80070000
jmp 0x180024687
lea rax, [rsp + 0x50]
mov qword [rsp + 0x68], rbp
mov dword [rsp + 0x78], 6
mov qword [rsp + 0x70], rax
mov edx, dword [r12]
lea rcx, [r12 + 8]
call fcn.18001cb00
mov rsi, rax
test rax, rax
jne 0x18002463f
mov edi, 0x8007000d
jmp 0x18002465f
lea r8, [rsp + 0x68]
lea rdx, [0x180022000]
mov r9d, r13d
mov rcx, rax
call fcn.180023b60
mov edi, eax
test eax, eax
js 0x18002465f
mov edi, r14d
test rsi, rsi
je 0x180024687
mov rcx, qword [rsi + 8]
mov rbx, rsi
call fcn.18001cc60
mov rsi, qword [rsi]
mov rcx, rbx
call fcn.180036ed0
test rsi, rsi
jne 0x180024664
jmp 0x180024687
mov edi, 0x800700df
mov rsi, qword [rsp + 0xb8]
test rbp, rbp
je 0x1800246a3
cmp rbp, 0xffffffffffffffff
je 0x1800246a3
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
call fcn.18003747c
mov rbp, qword [rsp + 0xb0]
mov eax, edi
add rsp, 0x80
pop r14
pop r13
pop r12
pop rdi
pop rbx
ret