Function at 0x18001ecf4
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x58
mov qword [rbp - 0x10], 0xfffffffffffffffe
mov rbx, rdx
mov rsi, rcx
add rcx, 8
or r13, 0xffffffffffffffff
xor r15d, r15d
test rdx, rdx
jne 0x18001ed2b
mov eax, r15d
jmp 0x18001ed38
mov rax, r13
inc rax
cmp word [rdx + rax*2], r15w
jne 0x18001ed2e
mov r8d, eax
call fcn.180005498
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
lea r12d, [r9 + 1]
mov r8d, r12d
mov edx, 0x80000000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, r13
je 0x18001f1ab
lea rdx, [rbp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x18001f1a2
cmp qword [rbp + 0x50], 0x100000
jg 0x18001f1a2
mov qword [rbp + 0x60], r15
mov ecx, dword [rbp + 0x50]
add ecx, 8
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov rbx, rax
mov qword [rbp + 0x60], rax
mov dword [rbp + 0x48], r15d
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x48]
lea r14d, [r12 + 3]
mov r8d, r14d
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [rbp + 0x48], r14d
je 0x18001edeb
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, r15d
jmp 0x18001f18f
cmp byte [rbx], 0xff
jne 0x18001ee46
cmp byte [rbx + 1], 0xfe
jne 0x18001ee46
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 2]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov r8d, dword [rbp + 0x50]
add r8d, 0xfffffffe
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x48]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18001f17b
mov eax, dword [rbp + 0x48]
test eax, eax
je 0x18001f17b
shr rax, 1
mov word [rbx + rax*2], r15w
jmp 0x18001eede
movzx eax, word [rbx]
cmp ax, word [0x18008d34c]
jne 0x18001eef3
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 2]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov r8d, dword [rbp + 0x50]
add r8d, 0xfffffffe
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x48]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18001f17b
mov eax, dword [rbp + 0x48]
test eax, eax
je 0x18001f17b
shr rax, 1
mov word [rbx + rax*2], r15w
mov ecx, dword [rbp + 0x48]
shr rcx, 1
mov rdx, rbx
lea rax, [rbx + rcx*2]
mov r8, r15
lea rcx, [rcx*2 + 1]
shr rcx, 1
cmp rbx, rax
cmova rcx, r15
test rcx, rcx
je 0x18001eede
movzx eax, word [rdx]
rol ax, 8
mov word [rdx], ax
lea rdx, [rdx + 2]
add r8, r12
cmp r8, rcx
jne 0x18001eec8
mov qword [rbp + 0x58], rbx
lea rdx, [rbp + 0x58]
mov rcx, rsi
call fcn.180036ec8
jmp 0x18001f17b
cmp ax, word [0x18008d350]
jne 0x18001ef63
mov al, byte [rbx + 2]
cmp al, byte [0x18008d352]
jne 0x18001ef63
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 3]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov r8d, dword [rbp + 0x50]
add r8d, 0xfffffffd
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x48]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18001f17b
mov eax, dword [rbp + 0x48]
test eax, eax
je 0x18001f17b
mov byte [rax + rbx], r15b
mov qword [rbp + 0x58], rbx
lea rdx, [rbp + 0x58]
mov rcx, rsi
call fcn.18003721c
jmp 0x18001f17b
movzx eax, word [rbx]
cmp ax, word [0x18008d354]
jne 0x18001f059
mov al, byte [rbx + 2]
cmp al, byte [str.v.ShellClassInfo]
jne 0x18001f059
cmp byte [rbx + 3], 0x39
ja 0x18001f17b
movzx eax, byte [rbx + 3]
movabs rcx, 0x300880000000000
bt rcx, rax
jae 0x18001f17b
xor r9d, r9d
xor r8d, r8d
mov edx, r14d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov r8d, dword [rbp + 0x50]
add r8d, 0xfffffffc
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x48]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18001f17b
mov eax, dword [rbp + 0x48]
test eax, eax
je 0x18001f17b
mov byte [rax + rbx], r15b
mov qword [rbp + 0x58], r15
mov eax, dword [rbp + 0x50]
lea ecx, [rax*2 + 4]
mov eax, 2
mul rcx
cmovo rax, r13
mov rcx, rax
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov r14, rax
mov qword [rbp + 0x58], rax
mov ecx, dword [rbp + 0x50]
lea ecx, [rcx*2 + 4]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, r13d
mov r8, rbx
xor edx, edx
mov ecx, 0xfde8
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x18001f04f
mov qword [rbp - 0x18], r14
lea rdx, [rbp - 0x18]
mov rcx, rsi
call fcn.180036ec8
nop
mov edx, 2
jmp 0x18001f16f
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x48]
mov r8d, dword [rbp + 0x50]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18001f17b
mov eax, dword [rbp + 0x48]
test eax, eax
je 0x18001f17b
xor ecx, ecx
mov qword [rax + rbx], rcx
mov qword [rbp + 0x58], r15
mov ecx, dword [rbp + 0x50]
add ecx, 8
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov r14, rax
mov qword [rbp + 0x58], rax
mov r8d, dword [rbp + 0x50]
add r8d, 8
mov rdx, rbx
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov qword [rbp - 0x18], r14
lea rdx, [rbp - 0x18]
mov rcx, rsi
call fcn.18003721c
cmp qword [rsi + 0x28], r15
ja 0x18001f16c
mov r8d, dword [rbp + 0x50]
add r8d, 8
mov rdx, rbx
mov rcx, r14
call sub.msvcrt.dll_memcpy
mov qword [rbp - 0x18], r14
lea rdx, [rbp - 0x18]
mov rcx, rsi
call fcn.180036ec8
cmp qword [rsi + 0x28], r15
ja 0x18001f16c
mov r8d, dword [rbp + 0x50]
add r8d, 8
mov rdx, rbx
mov rcx, r14
call sub.msvcrt.dll_memcpy
mov ecx, dword [rbp + 0x48]
inc ecx
shr rcx, 1
mov rdx, rbx
lea rax, [rbx + rcx*2]
mov r8, r15
lea rcx, [rcx*2 + 1]
shr rcx, 1
cmp rbx, rax
cmova rcx, r15
test rcx, rcx
je 0x18001f15b
movzx eax, word [rdx]
rol ax, 8
mov word [rdx], ax
lea rdx, [rdx + 2]
add r8, r12
cmp r8, rcx
jne 0x18001f145
mov qword [rbp - 0x18], r14
lea rdx, [rbp - 0x18]
mov rcx, rsi
call fcn.180036ec8
nop
mov rdx, r12
mov rcx, r14
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rbp + 0x58], r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, r15d
cmp qword [rsi + 0x28], r15
seta dil
mov rdx, r12
mov rcx, rbx
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rbp + 0x60], r15
mov eax, edi
jmp 0x18001f1ad
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret