Function at 0x180012380
Capabilities:
Get file size
Move file
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2d0]
sub rsp, 0x3e0
mov rax, qword [0x18002e518]
xor rax, rsp
mov qword [rbp + 0x2c0], rax
movzx ebx, byte [rbp - 0x80]
lea esi, [rcx + 0x9e6]
mov qword [rbp - 0x30], r8
mov r9, r8
mov dword [rbp - 0x78], ecx
mov r12, rdx
mov r8d, ecx
mov edi, ecx
cmp ecx, esi
jae 0x180012486
mov r14d, 0x6e
mov ecx, 0x7550
mov edx, 0x536b
mov eax, 0x656c
mov r8d, 0x6974
lea r15d, [r14 - 0xd]
lea r13d, [r14 - 8]
lea r9d, [r14 - 0x1a]
lea r10d, [r14 + 0xb]
lea r11d, [r14 + 1]
cmp edi, 0x35d
ja 0x18001256b
je 0x18001255e
cmp edi, 0x13e
ja 0x180012520
je 0x180012511
mov eax, edi
sub eax, 0x89
je 0x180012502
sub eax, 0x51
je 0x1800124e0
cmp eax, 0x16
jne 0x18001246f
cmp byte [0x18002e671], 0
je 0x18001246f
call qword [0x18002e658]
mov r9d, 0x54
mov ecx, 0x7550
mov edx, 0x536b
mov r8d, 0x6974
lea r10d, [r9 + 0x25]
lea r11d, [r9 + 0x1b]
mov eax, 0x656c
add edi, 0xb5
cmp edi, esi
jb 0x180012403
mov r8d, dword [rbp - 0x78]
mov r9, qword [rbp - 0x30]
lea eax, [r8 + 0xf]
mov dword [rbp - 0x7c], eax
cmp r8d, eax
jae case.0x180012a6d.0
movzx eax, byte [rbp - 0x80]
lea edx, [r8 - 0x89]
movzx esi, byte [rbp - 0x80]
xor r10d, r10d
mov r13, qword [rbp - 0x28]
movzx r14d, byte [rbp - 0x80]
mov r15d, dword [rbp - 0x60]
mov dword [rbp - 0x70], eax
mov eax, dword [rbp - 0x7c]
mov dword [rbp - 0x74], edx
lea r11, [0x180000000]
mov edi, 0x6570
cmp edx, 0xe
ja case.default.0x1800124de
mov ecx, dword [r11 + rdx*4 + 0x12ee4]
add rcx, r11
jmp rcx
cmp qword [0x18002e618], 0
je 0x1800124fb
cmp qword [0x18002e610], 0
je 0x1800124fb
mov bl, 1
jmp 0x18001246f
xor bl, bl
jmp 0x18001246f
mov dword [rbp + 0x288], 0x6e7550
jmp 0x18001246f
mov dword [rbp + 0x28b], 0x61536b
jmp 0x180012474
mov eax, edi
sub eax, 0x18f
je case.0x180012a6d.0
sub eax, 0x64
je 0x180012551
cmp eax, 0xb5
mov eax, 0x656c
jne 0x180012474
mov dword [rbp + 0x28f], 0x614865
jmp 0x180012474
mov word [rbp + 0x28e], r13w
jmp 0x18001246f
mov word [rbp + 0x292], r14w
jmp 0x180012474
cmp edi, 0x631
ja 0x180012623
je 0x180012604
cmp edi, 0x412
je 0x1800125eb
cmp edi, 0x4c7
je 0x1800125d8
cmp edi, 0x57c
jne 0x180012474
mov r11d, 0x64
mov dword [rbp + 0x2a8], 0x613f52
mov word [rbp + 0x2ab], r11w
mov r11d, 0x41
mov word [rbp + 0x2ac], r11w
mov r11d, 0x6c
mov word [rbp + 0x2ad], r11w
mov r11d, 0x6f
jmp 0x180012474
mov word [rbp + 0x294], ax
mov byte [rbp + 0x296], 0
jmp 0x180012474
mov r10d, 0x64
mov word [rbp + 0x293], r10w
mov r10d, 0x79
jmp 0x180012474
mov dword [rbp + 0x2ae], 0x636f6c
mov word [rbp + 0x2b1], r15w
mov word [rbp + 0x2b2], r8w
jmp 0x180012474
cmp edi, 0x6e6
je 0x18001264c
cmp edi, 0x79b
jne 0x180012474
mov word [rbp + 0x2ba], r9w
mov word [rbp + 0x2bb], r10w
jmp 0x180012474
mov word [rbp + 0x2b4], r11w
mov word [rbp + 0x2b5], r14w
mov dword [rbp + 0x2b6], 0x65736142
jmp 0x180012474
cmp qword [r12 + 0x18], 0x10
mov rdx, r12
jb 0x18001267a
mov rdx, qword [r12]
mov r8d, dword [rbp - 0x6c]
lea r9, [rbp - 0x64]
mov rcx, qword [rbp - 0x58]
mov qword [rsp + 0x20], r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [rbp - 0x74]
xor r10d, r10d
mov r8d, dword [rbp - 0x78]
jmp case.0x1800124de.10
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
jmp case.0x1800124de.10
cmp qword [r9 + 0x18], 8
mov rcx, r9
mov word [rbp + 0x2bc], di
mov byte [rbp + 0x2be], 0
jb 0x1800126c7
mov rcx, qword [r9]
mov qword [rsp + 0x30], r10
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov edx, dword [rbp - 0x74]
xor r10d, r10d
mov r8d, dword [rbp - 0x78]
mov qword [rbp - 0x58], rax
mov byte [rbp - 0x70], 1
jmp case.0x1800124de.10
mov edi, 0x65
nop word [rax + rax]
cmp edi, 0x65
je 0x18001274a
cmp edi, 0xefe
jne 0x18001276a
movzx eax, bl
mov rcx, qword [rbp + 0x2c0]
xor rcx, rsp
call fcn.1800250d0
mov rbx, qword [rsp + 0x420]
add rsp, 0x3e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
test sil, sil
je 0x180012758
mov ecx, dword [rbp - 0x68]
call qword [sym.imp.GDI32.dll_GdiSetBatchLimit]
cmp byte [rbp - 0x70], 0
je 0x180012768
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov bl, 1
add edi, 0xe99
cmp edi, 0x1d32
jbe 0x180012710
lea r11, [0x180000000]
cmp qword [rbp - 0x58], 0xffffffffffffffff
jne 0x180012964
mov edi, 0xb
nop
cmp edi, 0xb
ja case.default.0x1800127a6
mov eax, edi
mov ecx, dword [r11 + rax*4 + 0x12f20]
add rcx, r11
jmp rcx
movzx eax, word [0x180028f08]
lea rdx, [0x180028f59]
mov word [rbp + 0x260], ax
lea rcx, [rbp + 0x263]
movzx eax, byte [0x180028f0a]
mov r8d, 3
mov byte [rbp + 0x262], al
mov byte [rbp + 0x263], 0
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp case.default.0x1800127a6
lea r8, [rbp - 0x20]
mov edx, 0x40
lea rcx, [rbp + 0x50]
call qword [sym.imp.ADVAPI32.dll_QueryAllTracesW]
xor r9d, r9d
mov dword [rsp + 0x20], 2
xor r8d, r8d
lea rdx, [rbp + 0x270]
lea rcx, [rbp + 0x250]
call qword [sym.imp.KERNEL32.dll_MoveFileWithProgressA]
jmp case.default.0x1800127a6
mov r8d, 3
lea rdx, [0x180028f7d]
lea rcx, [rbp + 0x250]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp case.default.0x1800127a6
mov dword [rbp + 0x254], 0x6965575f
mov byte [rbp + 0x258], 0
jmp case.default.0x1800127a6
mov eax, dword [0x180028f98]
mov dword [rbp + 0x258], eax
movzx eax, byte [0x180028f9c]
mov byte [rbp + 0x25c], al
mov byte [rbp + 0x25d], 0
jmp case.default.0x1800127a6
mov eax, dword [0x180028fe4]
mov dword [rbp + 0x270], eax
movzx eax, byte [0x180028fe8]
mov byte [rbp + 0x274], al
jmp case.default.0x1800127a6
mov byte [rbp + 0x266], 0
jmp case.default.0x1800127a6
mov eax, 0x3238
mov byte [rbp + 0x251], 0x36
mov word [rbp + 0x252], ax
mov byte [rbp + 0x254], 0
jmp case.default.0x1800127a6
mov eax, 0x7864
mov byte [rbp + 0x268], 0
xor edx, edx
mov word [rbp + 0x266], ax
mov r8d, 0x200
lea rcx, [rbp + 0x50]
call sub.VCRUNTIME140.dll_memset
jmp case.default.0x1800127a6
mov r8d, 3
mov byte [rbp + 0x275], 0
lea rdx, [0x180028ffb]
lea rcx, [rbp + 0x275]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov r8d, 5
mov byte [rbp + 0x278], 0
lea rdx, [0x18002903f]
lea rcx, [rbp + 0x270]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp case.default.0x1800127a6
mov dword [rbp + 0x27d], 0x73657079
mov byte [rbp + 0x281], 0
mov word [rbp + 0x250], 0x56
dec edi
lea r11, [0x180000000]
lea eax, [rdi + 0xed]
cmp eax, 0xec
ja 0x180012790
mov edx, dword [rbp - 0x74]
mov sil, 1
mov r8d, dword [rbp - 0x78]
xor r10d, r10d
jmp case.0x1800124de.10
mov eax, 0x64
mov dword [rbp + 0x30], eax
jmp case.0x1800124de.10
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rbp + 0x288]
xor ecx, ecx
lea r8, [rbp + 0x28]
lea rdx, [rbp + 0x2a8]
call qword [sym.imp.GDI32.dll_CreateEnhMetaFileA]
mov edx, dword [rbp - 0x74]
xor r10d, r10d
mov r8d, dword [rbp - 0x78]
mov qword [rbp - 0x38], rax
jmp case.0x1800124de.10
mov dword [rbp + 0x2c], 0x14
call qword [sym.imp.GDI32.dll_GdiGetBatchLimit]
mov edx, dword [rbp - 0x74]
xor r10d, r10d
mov r8d, dword [rbp - 0x78]
mov dword [rbp - 0x68], eax
jmp case.0x1800124de.10
cmp dword [rbp - 0x68], 0
mov ecx, r10d
movzx eax, sil
cmovne ecx, eax
movzx esi, cl
jmp case.0x1800124de.10
mov edx, dword [rbp - 0x6c]
xor r8d, r8d
mov rcx, r12
call fcn.1800187c0
mov edx, dword [rbp - 0x74]
xor r10d, r10d
mov r8d, dword [rbp - 0x78]
jmp case.0x1800124de.10
mov dword [rbp - 0x64], r10d
mov dword [rbp + 0x28], 0xa
jmp case.0x1800124de.10
mov rcx, qword [rbp - 0x58]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [rbp - 0x74]
xor r10d, r10d
mov r8d, dword [rbp - 0x78]
mov dword [rbp - 0x6c], eax
jmp case.0x1800124de.10
mov dword [rbp + 0x34], 0x78
jmp case.0x1800124de.10
mov eax, dword [rbp - 0x6c]
cmp eax, dword [rbp - 0x64]
je 0x180012ea8
mov edi, 0x1d
cmp edi, 0x1d
ja case.default.0x180012a6d
mov eax, edi
mov ecx, dword [r11 + rax*4 + 0x12f50]
add rcx, r11
jmp rcx
mov qword [r12 + 0x10], r10
mov rax, r12
cmp qword [r12 + 0x18], 0x10
jb 0x180012a83
mov rax, qword [r12]
mov byte [rax], 0
jmp case.default.0x180012a6d
xorps xmm0, xmm0
mov qword [rbp - 0x40], r10
movups xmmword [rbp + 0x38], xmm0
jmp case.default.0x180012a6d
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
jmp case.default.0x180012a6d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp], xmm0
mov qword [rbp + 0x20], rax
mov r13, 0xffffffffffffffff
movups xmmword [rbp + 0x10], xmm0
jmp case.default.0x180012a6d
mov eax, 0x56
mov word [rbp + 0x286], 0x29
mov word [rbp + 0x298], ax
jmp case.default.0x180012a6d
mov r8d, 2
lea rdx, [0x18002908d]
lea rcx, [rbp + 0x250]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov r8d, 3
mov byte [rbp + 0x252], 0
lea rdx, [0x18002909a]
lea rcx, [rbp + 0x252]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
xor r10d, r10d
mov byte [rbp + 0x255], 0
lea r11, [0x180000000]
jmp case.default.0x180012a6d
mov byte [rbp + 0x27b], 0
jmp case.default.0x180012a6d
test r14b, r14b
je 0x180012b70
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rcx, qword [rbp - 0x40]
cmp rcx, 0xffffffffffffffff
jne 0x180012b5f
xor r14b, r14b
jmp 0x180012b65
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r10d, r10d
nop dword [rax + rax]
mov r8, qword [rbp - 0x28]
lea rax, [rbp - 0x1c]
mov qword [rsp + 0x80], rax
lea r9, [rbp + 0x270]
lea rax, [rbp - 0x18]
xor edx, edx
mov qword [rsp + 0x78], rax
lea rcx, [rbp + 0x250]
lea rax, [rbp - 0x14]
mov qword [rsp + 0x70], rax
mov eax, dword [rbp - 0x50]
mov dword [rsp + 0x68], eax
lea rax, [rbp + 0x38]
mov qword [rsp + 0x60], rax
lea rax, [rbp - 0x10]
mov dword [rsp + 0x58], 1
mov qword [rsp + 0x50], rax
mov eax, dword [rbp - 0x48]
mov dword [rsp + 0x48], eax
mov eax, dword [rbp - 0x4c]
mov dword [rsp + 0x40], r10d
mov dword [rsp + 0x38], eax
lea rax, [rbp]
mov qword [rsp + 0x30], r10
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x298]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_AccessCheckByTypeResultListAndAuditAlarmByHandleA]
xor r10d, r10d
lea r11, [0x180000000]
jmp case.default.0x180012a6d
mov byte [rbp + 0x284], 0
jmp case.default.0x180012a6d
mov r8d, 2
lea rdx, [0x1800290ab]
lea rcx, [rbp + 0x270]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
xor r10d, r10d
lea r11, [0x180000000]
jmp case.default.0x180012a6d
mov eax, 0x6739
mov word [rbp + 0x255], ax
jmp case.default.0x180012a6d
mov word [rbp + 0x267], 0x64
jmp case.default.0x180012a6d
mov r8d, 1
lea rdx, [0x180029107]
lea rcx, [rbp + 0x270]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov eax, 0x6520
lea r11, [0x180000000]
mov word [rbp + 0x27c], ax
xor r10d, r10d
jmp case.default.0x180012a6d
mov byte [rbp + 0x262], 0x23
jmp case.default.0x180012a6d
lea rdx, [0x180029136]
lea rcx, [rbp + 0x260]
mov r8d, 2
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
xor r10d, r10d
lea r11, [0x180000000]
jmp case.default.0x180012a6d
mov r8d, 2
mov byte [rbp + 0x27e], 0
lea rdx, [0x18002916b]
lea rcx, [rbp + 0x270]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r8d, 3
lea rdx, [0x180029173]
lea rcx, [rbp + 0x270]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
xor r10d, r10d
mov byte [rbp + 0x283], 0x28
lea r11, [0x180000000]
jmp case.default.0x180012a6d
mov dword [rbp + 0x263], 0x322d3025
jmp case.default.0x180012a6d
xor bl, bl
jmp case.default.0x180012a6d
lea r8, [rbp - 0x40]
mov edx, r15d
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor r10d, r10d
mov dword [rbp - 0x60], eax
mov dword [rbp - 0x50], r10d
lea r11, [0x180000000]
jmp case.default.0x180012a6d
mov r8d, 5
mov byte [rbp + 0x257], 0
lea rdx, [0x1800291ce]
lea rcx, [rbp + 0x250]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
xor r10d, r10d
mov dword [rbp + 0x25c], 0x7235312d
lea r11, [0x180000000]
mov byte [rbp + 0x260], 0
jmp case.default.0x180012a6d
mov r15d, 0x20008
mov dword [rbp - 0x4c], 0x2000000
mov dword [rbp - 0x48], r10d
jmp case.default.0x180012a6d
mov dword [rbp + 0x2a0], 0x6b726d5a
mov byte [rbp + 0x2a4], 0
jmp case.default.0x180012a6d
mov qword [rbp - 0x28], 0xffffffffffffffff
mov r14b, 1
jmp case.default.0x180012a6d
mov r8d, 1
lea rdx, [0x1800291e8]
lea rcx, [rbp + 0x270]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
xor r10d, r10d
mov word [rbp + 0x285], 0x33
lea r11, [0x180000000]
jmp case.default.0x180012a6d
mov byte [rbp + 0x262], 0
jmp case.default.0x180012a6d
mov eax, 0x50
mov word [rbp + 0x299], ax
mov eax, 0x4451
mov word [rbp + 0x29e], ax
mov dword [rbp + 0x29a], 0x53564f4d
jmp case.default.0x180012a6d
mov eax, 0x7672
mov dword [rbp + 0x270], 0x65736552
mov word [rbp + 0x274], ax
mov byte [rbp + 0x276], 0
jmp case.default.0x180012a6d
mov r8d, 1
lea rdx, [0x18002922f]
lea rcx, [rbp + 0x278]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
lea rdx, [0x180029259]
mov byte [rbp + 0x279], 0
lea rcx, [rbp + 0x279]
jmp 0x180012ca8
cmp dword [rbp - 0x60], 0
movzx r14d, r14b
cmove r14d, r10d
dec edi
lea eax, [rdi + 0xd9]
cmp eax, 0xd8
ja 0x180012a57
mov edx, dword [rbp - 0x74]
mov r8d, dword [rbp - 0x78]
mov eax, dword [rbp - 0x70]
cmp qword [rbp - 0x38], 0
movzx eax, al
cmove eax, r10d
mov dword [rbp - 0x70], eax
mov eax, dword [rbp - 0x7c]
inc r8d
inc edx
mov dword [rbp - 0x78], r8d
mov dword [rbp - 0x74], edx
cmp r8d, eax
jae case.0x180012a6d.0
mov r9, qword [rbp - 0x30]
jmp 0x1800124be
xor al, al
jmp 0x180012720