Function at 0x18005e990
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x28], 0
mov rbx, rcx
je 0x18005b5de
cmp dword [rcx + 0x24], 0
jne 0x18005b5de
mov rax, qword [rcx + 0xc8]
sub rax, qword [rcx + 0xc0]
test rax, 0xfffffffffffffff8
jne 0x18005b55e
mov eax, 0x80004005
add rsp, 0x20
pop rbx
ret
xor ecx, ecx
mov qword [rsp + 0x30], rdi
call fcn.18006ab74
mov rcx, rax
call fcn.18006abd4
call fcn.18006abec
mov edi, eax
call fcn.18006abec
add edi, eax
call fcn.18006abec
imul edi, eax
call fcn.18006abec
mov rcx, qword [rbx + 0xc8]
sub rcx, qword [rbx + 0xc0]
add edi, eax
sar rcx, 3
test rcx, rcx
jne 0x18005b5ab
call fcn.18006aa4c
mov rax, qword [rbx + 0xc0]
mov rcx, qword [rax]
cmp qword [rcx + 0x50], 0
jne 0x18005b5cd
mov edx, edi
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
jmp 0x18005ed10
mov edx, edi
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
jmp 0x18005e990
xor eax, eax
add rsp, 0x20
pop rbx
ret
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0xa0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0xe0], rbx
mov rax, qword [0x1800ff050]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov r13d, edx
mov r12, rcx
cmp qword [rcx + 0x58], 8
jb 0x18005e9d5
mov rcx, qword [rcx + 0x40]
jmp 0x18005e9d9
add rcx, 0x40
xor esi, esi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [rsi + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x60], rax
cmp rax, 0xffffffffffffffff
jne 0x18005ea17
call fcn.180003180
nop
jmp 0x18005ecde
mov qword [rsp + 0x48], rsi
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x18005ea45
call fcn.180003180
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x18005ecde
mov rax, qword [rsp + 0x48]
cmp rax, 0x100000
jle 0x18005ea65
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x80004005
jmp 0x18005ecde
lea ecx, [rax + 0x200]
lea rdx, [0x180106f48]
call fcn.18006aaa4
mov rbp, rax
mov qword [rsp + 0x58], rax
test rax, rax
jne 0x18005ea97
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x8007000e
jmp 0x18005ecde
mov r8d, dword [rsp + 0x48]
add r8d, 0x200
xor edx, edx
mov rcx, rax
call fcn.18006cf60
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x40]
mov r8d, dword [rsp + 0x48]
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x18005eaf0
call fcn.180003180
mov edi, eax
mov rcx, rbp
call fcn.18006aaac
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x18005ecde
cmp dword [rsp + 0x40], 0
jne 0x18005eb13
mov rcx, rbp
call fcn.18006aaac
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x80004005
jmp 0x18005ecde
mov qword [rsp + 0x88], send
mov qword [rsp + 0x80], rsi
mov byte [rsp + 0x70], 0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbp
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbp
lea rcx, [rsp + 0x68]
call fcn.1800024b0
nop
mov r8d, r13d
lea rdx, [rsp + 0x68]
mov rcx, r12
call fcn.18005ef90
mov edi, eax
test eax, eax
js 0x18005ec9c
cmp eax, 1
je 0x18005ec9c
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x18005ebd3
call fcn.180003180
mov edi, eax
cmp qword [rsp + 0x88], 0x10
jb 0x18005eba1
mov rcx, qword [rsp + 0x70]
call fcn.18006a4d4
mov qword [rsp + 0x88], send
mov qword [rsp + 0x80], rsi
mov byte [rsp + 0x70], 0
mov rcx, rbp
call fcn.18006aaac
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x18005ecde
mov dword [rsp + 0x40], esi
lea rdx, [rsp + 0x70]
cmp qword [rsp + 0x88], 0x10
cmovae rdx, qword [rsp + 0x70]
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x40]
mov r8d, dword [rsp + 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x18005ec58
call fcn.180003180
mov edi, eax
cmp qword [rsp + 0x88], 0x10
jb 0x18005ec26
mov rcx, qword [rsp + 0x70]
call fcn.18006a4d4
mov qword [rsp + 0x88], send
mov qword [rsp + 0x80], rsi
mov byte [rsp + 0x70], 0
mov rcx, rbp
call fcn.18006aaac
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x18005ecde
cmp qword [rsp + 0x88], 0x10
jb 0x18005ec6d
mov rcx, qword [rsp + 0x70]
call fcn.18006a4d4
mov qword [rsp + 0x88], send
mov qword [rsp + 0x80], rsi
mov byte [rsp + 0x70], 0
mov rcx, rbp
call fcn.18006aaac
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x18005ecde
cmp qword [rsp + 0x88], 0x10
jb 0x18005ecb1
mov rcx, qword [rsp + 0x70]
call fcn.18006a4d4
mov qword [rsp + 0x88], send
mov qword [rsp + 0x80], rsi
mov byte [rsp + 0x70], 0
mov rcx, rbp
call fcn.18006aaac
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.18006a4f0
mov rbx, qword [rsp + 0xe0]
add rsp, 0xa0
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x90
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0xd0], rbx
mov rax, qword [0x1800ff050]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r12d, edx
mov rbp, rcx
mov rax, qword [rcx + 0x20]
sub rax, qword [rcx + 0x18]
sar rax, 3
test rax, rax
jne 0x18005ed5e
call fcn.18006aa4c
mov rax, qword [rbp + 0x18]
mov rsi, qword [rax]
cmp dword [rsi + 0x5c], 0
je 0x18005ef58
cmp qword [rsi + 0x10], 0xffffffffffffffff
je 0x18005ef58
mov eax, dword [rsi + 0x60]
mov dword [rsp + 0x40], eax
mov rdi, rax
lea rdx, [0x180106f48]
mov rcx, rax
call fcn.18006aaa4
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x18005edaa
mov eax, 0x8007000e
jmp 0x18005ef5d
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.18006cf60
cmp dword [rsi + 0x5c], 0
je 0x18005ef47
lea r8, [rsp + 0x40]
mov rdx, rbx
mov rcx, rsi
call fcn.180060850
mov edi, eax
test eax, eax
js 0x18005ef4c
cmp eax, 1
je 0x18005ef4c
mov qword [rsp + 0x78], send
xor r13d, r13d
mov qword [rsp + 0x70], r13
mov byte [rsp + 0x60], r13b
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.1800024b0
nop
mov r8d, r12d
lea rdx, [rsp + 0x58]
mov rcx, rbp
call fcn.18005ef90
mov edi, eax
test eax, eax
js 0x18005ef16
cmp eax, 1
je 0x18005ef16
mov ebp, dword [rsp + 0x40]
mov r8, rbp
xor edx, edx
mov rcx, rbx
call fcn.18006cf60
mov r8, qword [rsp + 0x70]
cmp r8, rbp
jbe 0x18005ee8f
cmp qword [rsp + 0x78], 0x10
jb 0x18005ee6a
mov rcx, qword [rsp + 0x60]
call fcn.18006a4d4
mov qword [rsp + 0x78], send
mov qword [rsp + 0x70], r13
mov byte [rsp + 0x60], 0
mov rcx, rbx
call fcn.18006aaac
mov eax, 0x80004005
jmp 0x18005ef5d
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rdx, qword [rsp + 0x60]
mov rcx, rbx
call fcn.18006c2d0
mov edx, dword [rsi + 0x60]
cmp ebp, edx
jb 0x18005eee0
mov eax, dword [rsi + 0x5c]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], edx
lea r9, [rsp + 0x40]
mov r8d, 1
mov rdx, qword [rsi + 0x10]
mov rcx, rsi
call fcn.180003c30
mov edi, eax
jmp 0x18005eee5
mov edi, 0x80070057
cmp qword [rsp + 0x78], 0x10
jb 0x18005eef7
mov rcx, qword [rsp + 0x60]
call fcn.18006a4d4
mov qword [rsp + 0x78], send
mov qword [rsp + 0x70], r13
mov byte [rsp + 0x60], 0
mov rcx, rbx
call fcn.18006aaac
mov eax, edi
jmp 0x18005ef5d
cmp qword [rsp + 0x78], 0x10
jb 0x18005ef28
mov rcx, qword [rsp + 0x60]
call fcn.18006a4d4
mov qword [rsp + 0x78], send
mov qword [rsp + 0x70], r13
mov byte [rsp + 0x60], 0
mov rcx, rbx
call fcn.18006aaac
mov eax, edi
jmp 0x18005ef5d
mov edi, 0x80004005
mov rcx, rbx
call fcn.18006aaac
mov eax, edi
jmp 0x18005ef5d
mov eax, 0x80004005
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.18006a4f0
mov rbx, qword [rsp + 0xd0]
add rsp, 0x90
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret