Function at 0x417870
Capabilities:
Get file size
Read file on windows

Disassembly:
mov rax, rsp
sub rsp, 0x1e8
mov qword [rsp + 0x98], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax - 8], rdi
mov qword [rax - 0x10], r12
mov qword [rax - 0x18], r13
mov qword [rax - 0x20], r14
mov qword [rax - 0x28], r15
mov rax, qword [0x0044d028]
mov qword [rsp + 0x1b0], rax
mov r15, rcx
lea rcx, [rsp + 0x60]
call fcn.0041d160
mov ecx, dword [rax]
mov dword [r15 + 0xac], ecx
mov rcx, r15
call fcn.00411930
mov rcx, r15
call fcn.00412480
mov r8d, 0x104
lea rdx, [rsp + 0xa0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov rax, qword [r15 + 0x28]
xor edx, edx
lea rcx, [r15 + 0x28]
call qword [rax + 8]
lea rdx, [rsp + 0xa0]
mov qword [rsp + 0x70], rdx
lea rax, [0x0043d780]
mov qword [rsp + 0x68], rax
xor r12d, r12d
mov edi, r12d
mov dword [rsp + 0x78], r12d
cmp byte [rsp + 0xa0], dil
je 0x417943
nop
inc edi
movsxd rax, edi
cmp byte [rsp + rax + 0xa0], r12b
jne 0x417930
mov dword [rsp + 0x78], edi
movsxd rbx, dword [r15 + 0x38]
mov eax, dword [r15 + 0x38]
lea edx, [rdi + rax]
mov rax, qword [r15 + 0x28]
lea rcx, [r15 + 0x28]
call qword [rax + 8]
cmp ebx, ebx
jge 0x417976
mov rdx, qword [r15 + 0x30]
add rdx, rbx
movsxd rcx, edi
add rcx, rdx
mov eax, ebx
sub eax, ebx
movsxd r8, eax
call fcn.004254c0
movsxd r8, edi
mov rcx, rbx
add rcx, qword [r15 + 0x30]
lea rdx, [rsp + 0xa0]
call fcn.004254c0
nop
mov r8d, dword [r15 + 0x38]
dec r8d
movsxd rdi, r8d
js 0x4179c6
mov r9, qword [r15 + 0x30]
nop
movzx edx, byte [r9 + rdi]
mov al, 0x2f
lea rcx, [0x0043da00]
nop
cmp al, dl
je 0x4179cc
inc rcx
movzx eax, byte [rcx]
test al, al
jne 0x4179b0
dec r8d
dec rdi
jns 0x4179a0
mov r8d, 0xffffffff
inc r8d
lea rdx, [rsp + 0x40]
lea rcx, [r15 + 0x28]
call fcn.00411de0
mov rdi, rax
mov rax, qword [r15 + 0x48]
xor edx, edx
lea rcx, [r15 + 0x48]
call qword [rax + 8]
movsxd rsi, dword [rdi + 0x10]
mov rbp, qword [rdi + 8]
movsxd rdi, dword [r15 + 0x58]
mov eax, dword [r15 + 0x58]
lea edx, [rsi + rax]
mov rax, qword [r15 + 0x48]
lea rcx, [r15 + 0x48]
call qword [rax + 8]
cmp edi, edi
jge 0x417a26
mov rdx, qword [r15 + 0x50]
add rdx, rdi
lea rcx, [rdx + rsi]
mov eax, edi
sub eax, edi
movsxd r8, eax
call fcn.004254c0
mov r8, rsi
mov rcx, rdi
add rcx, qword [r15 + 0x50]
mov rdx, rbp
call fcn.004254c0
nop
lea rax, [0x0043d608]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x48]
xor esi, esi
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x50], esi
mov dword [rsp + 0x58], esi
test rcx, rcx
je 0x417a63
call fcn.00425490
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, [rsp + 0xa0]
repne scasb al, byte [rdi]
not rcx
lea rbx, [rsp + rcx + 0x9f]
lea edx, [rax + 0x2e]
lea rcx, [rsp + 0xa0]
call fcn.004296d0
mov rdi, rax
mov edx, 0x2f
lea rcx, [rsp + 0xa0]
call fcn.004296d0
test rdi, rdi
je 0x417ab5
test rax, rax
je 0x417ab8
cmp rax, rdi
jbe 0x417ab8
mov rdi, rbx
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x90], rdi
mov r13d, esi
lea rax, str..cfg
mov qword [rsp + 0x68], rax
lea rax, str..config
mov qword [rsp + 0x70], rax
lea r12, [rsp + 0x88]
nop
nop
mov edi, esi
mov rbp, qword [r12]
lea rbx, [rsp + 0x68]
nop
nop
mov rcx, qword [rbx]
mov rdx, rbp
sub rdx, rcx
nop
nop
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
inc rcx
test al, al
jne 0x417b10
mov edx, 4
lea rcx, [rsp + 0xa0]
call fcn.0043b870
lea r14, [0x0043d648]
test eax, eax
jne 0x417b74
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rax + 3]
lea rcx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x417b95
xor esi, esi
inc edi
add rbx, 8
cmp edi, 2
jb 0x417b00
inc r13d
add r12, 8
cmp r13d, 2
jae 0x417cab
jmp 0x417af0
xor r12d, r12d
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x50], r12d
lea r13, [0x0043d608]
mov qword [rsp + 0x40], r13
mov dword [rsp + 0x58], r12d
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [0x0043d610]
nop
mov qword [rsp + 0x40], r14
movsxd rdi, dword [rsp + 0x50]
mov edx, edi
lea rcx, [rsp + 0x40]
call qword [0x0043d650]
cmp edi, edi
jge 0x417bf4
mov rcx, qword [rsp + 0x48]
add rcx, rdi
mov eax, edi
sub eax, edi
movsxd r8, eax
mov rdx, rcx
call fcn.004254c0
nop
lea rbp, [0x0043d698]
mov qword [rsp + 0x40], rbp
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
movsxd rdi, eax
movsxd rbx, dword [rsp + 0x50]
lea edx, [rbx + rdi]
lea rcx, [rsp + 0x40]
mov rax, qword [rsp + 0x40]
call qword [rax + 8]
cmp ebx, ebx
jge 0x417c43
mov rax, qword [rsp + 0x48]
lea rdx, [rax + rbx]
lea rcx, [rax + rdi]
add rcx, rbx
mov eax, ebx
sub eax, ebx
movsxd r8, eax
call fcn.004254c0
mov rdi, rbx
add rdi, qword [rsp + 0x48]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r8d, eax
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x60]
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x40]
mov rcx, r15
call fcn.00413ba0
nop
mov qword [rsp + 0x40], r13
mov rcx, qword [rsp + 0x48]
xor esi, esi
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x50], esi
mov dword [rsp + 0x58], esi
test rcx, rcx
je 0x417cb9
call fcn.00425490
jmp 0x417cb9
lea rbp, [0x0043d698]
lea r13, [0x0043d608]
movsxd rdi, dword [r15 + 0x10]
test edi, edi
jle 0x417cf9
lea edx, [rdi + 2]
mov rax, qword [r15]
mov rcx, r15
call qword [rax + 8]
cmp edi, edi
jge 0x417ce8
mov rdx, qword [r15 + 8]
add rdx, rdi
lea rcx, [rdx + 2]
mov eax, edi
sub eax, edi
movsxd r8, eax
call fcn.004254c0
mov rcx, rdi
add rcx, qword [r15 + 8]
movzx eax, word [0x0043e890]
mov word [rcx], ax
mov eax, dword [r15 + 0x10]
mov dword [r15 + 0x20], eax
mov rcx, r15
call fcn.00416390
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x50], esi
mov qword [rsp + 0x40], r13
mov dword [rsp + 0x58], esi
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [0x0043d610]
nop
mov qword [rsp + 0x40], r14
mov ebx, esi
lea rax, str.disableexternal
nop
nop
nop
inc ebx
inc rax
cmp byte [rax], 0
jne 0x417d40
movsxd rsi, dword [rsp + 0x50]
lea edx, [rsi + rbx]
lea rcx, [rsp + 0x40]
call qword [0x0043d650]
cmp esi, esi
jge 0x417d82
mov rax, qword [rsp + 0x48]
lea rdx, [rax + rsi]
movsxd rdi, ebx
add rdi, rax
add rdi, rsi
mov eax, esi
sub eax, esi
movsxd r8, eax
mov rcx, rdi
call fcn.004254c0
movsxd r8, ebx
mov rcx, rsi
add rcx, qword [rsp + 0x48]
lea rdx, str.disableexternal
call fcn.004254c0
nop
mov qword [rsp + 0x40], rbp
mov dword [rsp + 0x20], 1
mov r9d, 1
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x68]
mov rcx, r15
call fcn.00403520
mov r14, rax
xor r12d, r12d
mov esi, r12d
lea rdx, str.true
nop
inc esi
movsxd rcx, esi
cmp byte [rcx + rdx], r12b
jne 0x417dd0
mov ecx, dword [rax + 0x10]
mov eax, esi
cmp ecx, esi
cmovl eax, ecx
mov ebp, r12d
mov rbx, r12
movsxd r13, eax
test eax, eax
jle 0x417e3e
nop
nop
nop
nop
movzx ecx, byte [rbx + rdx]
mov rax, qword [r14 + 8]
movzx r12d, byte [rbx + rax]
cmp r12b, cl
je 0x417e30
movsx ecx, cl
call fcn.00426440
mov edi, eax
movsx ecx, r12b
call fcn.00426440
cmp eax, edi
jne 0x417e3a
lea rdx, str.true
inc ebp
inc rbx
cmp rbx, r13
jl 0x417e00
test ebp, ebp
js 0x417e51
cmp ebp, dword [r14 + 0x10]
jge 0x417e51
movsxd rcx, ebp
mov rax, qword [r14 + 8]
movzx ecx, byte [rcx + rax]
jmp 0x417e53
xor cl, cl
test ebp, ebp
js 0x417e6b
cmp ebp, esi
jge 0x417e6b
movsxd rax, ebp
lea rdx, str.true
movzx edx, byte [rax + rdx]
jmp 0x417e6d
xor dl, dl
movsx ecx, cl
movsx eax, dl
sub ecx, eax
sete dil
lea rsi, [0x0043d608]
mov qword [rsp + 0x68], rsi
mov rcx, qword [rsp + 0x70]
xor ebx, ebx
mov qword [rsp + 0x70], rbx
mov dword [rsp + 0x78], ebx
mov dword [rsp + 0x80], ebx
test rcx, rcx
je 0x417ea6
call fcn.00425490
lea rax, [0x0043d5e0]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x40], rsi
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x50], ebx
mov dword [rsp + 0x58], ebx
test rcx, rcx
je 0x417ed3
call fcn.00425490
test dil, dil
je 0x417f1a
movsxd rdi, dword [r15 + 0x20]
mov eax, dword [r15 + 0x10]
test eax, eax
jle 0x417f16
cmp edi, eax
jl 0x417ef5
mov rax, qword [r15]
xor edx, edx
mov rcx, r15
call qword [rax + 8]
jmp 0x417f16
mov rcx, qword [r15 + 8]
sub eax, edi
movsxd r8, eax
lea rdx, [rcx + rdi]
call fcn.004254c0
mov rax, qword [r15]
mov edx, dword [r15 + 0x10]
sub edx, edi
mov rcx, r15
call qword [rax + 8]
mov dword [r15 + 0x20], ebx
mov rcx, qword [rsp + 0x1b0]
call fcn.0043c500
mov rbx, qword [rsp + 0x1f8]
mov rbp, qword [rsp + 0x200]
mov rsi, qword [rsp + 0x208]
mov rdi, qword [rsp + 0x1e0]
mov r12, qword [rsp + 0x1d8]
mov r13, qword [rsp + 0x1d0]
mov r14, qword [rsp + 0x1c8]
mov r15, qword [rsp + 0x1c0]
add rsp, 0x1e8
ret