Function at 0x180026510
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
lea r13d, [rdx + 0x2d]
mov r15d, edx
mov rsi, rcx
cmp edx, r13d
jae case.0x180026572.8
mov r14d, dword [rsp + 0x98]
lea r12d, [rdx - 0x60]
mov rbp, qword [rsp + 0xa0]
lea rdx, [0x180000000]
cmp r12d, 0x9c
ja case.0x180026572.9
movzx eax, byte [rdx + r12 + 0x26960]
mov ecx, dword [rdx + rax*4 + 0x26938]
add rcx, rdx
jmp rcx
cmp qword [rsi + 0x20], 0
setne byte [rsp + 0xa0]
jmp case.0x180026572.9
xor r14d, r14d
jmp case.0x180026572.9
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov rcx, rsi
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
lea rdx, [0x180000000]
jmp case.0x180026572.9
cmp rbp, 0xffffffffffffffff
je 0x180026721
mov edi, 0x54
nop word [rax + rax]
cmp edi, 0x54
je 0x1800266f2
cmp edi, 0x1ed8
jne 0x180026703
mov eax, dword [0x18007de20]
test eax, eax
je 0x1800266db
xor r8d, r8d
mov qword [rsp + 0x40], rax
lea r9, [rsp + 0x40]
xor ecx, ecx
lea edx, [r8 + 0x1a]
call fcn.18003ea40
mov qword [0x18007de18], rax
test rax, rax
je 0x1800266db
mov ebx, 0x128
cmp ebx, 0x128
je 0x180026696
cmp ebx, 0x92d8
je 0x18002667f
cmp ebx, 0x12488
jne 0x1800266be
mov r8d, dword [0x18007de20]
lea rax, [0x18007de08]
mov rdx, qword [0x18007de18]
xor r9d, r9d
mov rcx, qword [0x18007de00]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
mov r14d, eax
jmp 0x1800266be
mov edx, dword [0x18007de20]
lea rcx, str.GVmomiFaultInvalidResponse
mov r8, rsi
call fcn.18003efe0
jmp 0x1800266be
mov r8d, dword [0x18007de20]
lea r9, [rsp + 0xa8]
mov rdx, qword [0x18007de18]
mov rcx, rbp
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
add ebx, 0x91b0
cmp ebx, 0x1b510
jbe 0x180026630
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180026703
lea rcx, str.IP_address.
call fcn.18003edc0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180026703
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [0x18007de20], eax
add edi, 0x1e84
cmp edi, 0x3d08
jbe 0x1800265e0
lea rdx, [0x180000000]
jmp case.0x180026572.9
mov rdx, rsi
lea rcx, str.v_cmpx_ngt_f16
call fcn.18003edc0
lea rdx, [0x180000000]
jmp case.0x180026572.9
cmp qword [rsi + 0x28], 0
je 0x180026910
cmp qword [rsi + 0x30], 0
jne case.0x180026572.9
mov eax, 0x1d
cmp eax, 0x1d
je 0x18002677e
cmp eax, 0xe4
jne 0x180026786
mov eax, dword [rsp + 0xa0]
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov byte [rsp + 0xa0], 0
add eax, 0xc7
cmp eax, 0x1ab
jb 0x180026753
jmp case.0x180026572.9
cmp qword [rsi + 0x38], 0
jne case.0x180026572.9
mov eax, 0x104
cmp eax, 0x104
je 0x1800267b0
cmp eax, 0x1c3
je case.0x180026572.8
jmp 0x1800267b8
mov byte [rsp + 0xa0], 0
add eax, 0xbf
cmp eax, 0x282
jb 0x1800267a0
add r15d, 5
add r12d, 5
cmp r15d, r13d
jb 0x180026552
jmp case.0x180026572.8
mov edi, 0xeb
cmp edi, 0xeb
je 0x18002686c
cmp edi, 0x18d
je 0x180026829
cmp edi, 0x22f
je 0x180026819
cmp edi, 0x2d1
jne 0x1800268f7
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1800268f7
mov rcx, qword [rsi + 0x38]
lea rdx, [rsi + 0x58]
call qword [rsi + 0x30]
jmp 0x1800268f7
mov r8, qword [0x18007d6b8]
mov r9d, 0x57
xor edx, edx
xor ecx, ecx
call fcn.180024e10
test al, al
jne 0x1800268f7
mov eax, 0x98
nop dword [rax]
cmp eax, 0x98
je 0x180026910
add eax, 0x2d20
cmp eax, 0x2d20
jbe 0x180026850
jmp 0x1800268f7
mov rcx, qword [rsi + 0x18]
lea rbx, [rsi + 0x58]
mov rdx, rbx
call qword [rsi + 0x10]
test al, al
jne 0x1800268ab
mov eax, 0x92
cmp eax, 0x92
je 0x180026897
cmp eax, 0x4228
je case.0x180026572.8
jmp 0x18002689f
mov byte [rsp + 0xa0], 0
add eax, 0x4196
cmp eax, 0x832c
jbe 0x180026883
cmp qword [rbx + 0x18], 0x10
jb 0x1800268b5
mov rbx, qword [rbx]
movzx eax, word [rsi + 0x78]
lea rdx, [rsp + 0x98]
mov r8, qword [0x18007d6b8]
mov r9, rbx
mov ecx, 0x16
mov word [rsp + 0x98], ax
call fcn.18003bcb0
test al, al
je 0x1800268f7
mov eax, 0x124
cmp eax, 0x124
je 0x18002691d
add eax, 0x3a
cmp eax, 0x15e
jb 0x1800268e6
add edi, 0xa2
cmp edi, 0x373
jb 0x1800267e5
jmp case.0x180026572.4
mov byte [rsp + 0xa0], 0
jmp case.0x180026572.8
mov byte [rsp + 0xa0], 1
jmp case.0x180026572.8
mov eax, r14d
jmp 0x180026766