Function at 0x18001eb30
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x28], 0
mov rbx, rcx
je 0x18001abee
cmp dword [rcx + 0x24], 0
jne 0x18001abee
mov rax, qword [rcx + 0xc8]
sub rax, qword [rcx + 0xc0]
test rax, 0xfffffffffffffff8
jne 0x18001ab6e
mov eax, 0x80004005
add rsp, 0x20
pop rbx
ret
xor ecx, ecx
mov qword [rsp + 0x30], rdi
call fcn.1800770f4
mov rcx, rax
call fcn.180077154
call fcn.18007716c
mov edi, eax
call fcn.18007716c
add edi, eax
call fcn.18007716c
imul edi, eax
call fcn.18007716c
mov rcx, qword [rbx + 0xc8]
sub rcx, qword [rbx + 0xc0]
add edi, eax
sar rcx, 3
test rcx, rcx
jne 0x18001abbb
call fcn.180076fcc
mov rax, qword [rbx + 0xc0]
mov rcx, qword [rax]
cmp qword [rcx + 0x50], 0
jne 0x18001abdd
mov edx, edi
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
jmp 0x18001eeb0
mov edx, edi
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
jmp 0x18001eb30
xor eax, eax
add rsp, 0x20
pop rbx
ret
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0xa0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0xe0], rbx
mov rax, qword [0x18010f050]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov r13d, edx
mov r12, rcx
cmp qword [rcx + 0x58], 8
jb 0x18001eb75
mov rcx, qword [rcx + 0x40]
jmp 0x18001eb79
add rcx, 0x40
xor esi, esi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [rsi + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x60], rax
cmp rax, 0xffffffffffffffff
jne 0x18001ebb7
call fcn.180003220
nop
jmp 0x18001ee7e
mov qword [rsp + 0x48], rsi
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x18001ebe5
call fcn.180003220
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x18001ee7e
mov rax, qword [rsp + 0x48]
cmp rax, 0x100000
jle 0x18001ec05
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x80004005
jmp 0x18001ee7e
lea ecx, [rax + 0x200]
lea rdx, [0x1801171e8]
call fcn.180077024
mov rbp, rax
mov qword [rsp + 0x58], rax
test rax, rax
jne 0x18001ec37
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x8007000e
jmp 0x18001ee7e
mov r8d, dword [rsp + 0x48]
add r8d, 0x200
xor edx, edx
mov rcx, rax
call fcn.1800795c0
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x40]
mov r8d, dword [rsp + 0x48]
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x18001ec90
call fcn.180003220
mov edi, eax
mov rcx, rbp
call fcn.18007702c
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x18001ee7e
cmp dword [rsp + 0x40], 0
jne 0x18001ecb3
mov rcx, rbp
call fcn.18007702c
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x80004005
jmp 0x18001ee7e
mov qword [rsp + 0x88], socket
mov qword [rsp + 0x80], rsi
mov byte [rsp + 0x70], 0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbp
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbp
lea rcx, [rsp + 0x68]
call fcn.180002550
nop
mov r8d, r13d
lea rdx, [rsp + 0x68]
mov rcx, r12
call fcn.18001f160
mov edi, eax
test eax, eax
js 0x18001ee3c
cmp eax, 1
je 0x18001ee3c
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x18001ed73
call fcn.180003220
mov edi, eax
cmp qword [rsp + 0x88], 0x10
jb 0x18001ed41
mov rcx, qword [rsp + 0x70]
call fcn.180076a50
mov qword [rsp + 0x88], socket
mov qword [rsp + 0x80], rsi
mov byte [rsp + 0x70], 0
mov rcx, rbp
call fcn.18007702c
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x18001ee7e
mov dword [rsp + 0x40], esi
lea rdx, [rsp + 0x70]
cmp qword [rsp + 0x88], 0x10
cmovae rdx, qword [rsp + 0x70]
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x40]
mov r8d, dword [rsp + 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x18001edf8
call fcn.180003220
mov edi, eax
cmp qword [rsp + 0x88], 0x10
jb 0x18001edc6
mov rcx, qword [rsp + 0x70]
call fcn.180076a50
mov qword [rsp + 0x88], socket
mov qword [rsp + 0x80], rsi
mov byte [rsp + 0x70], 0
mov rcx, rbp
call fcn.18007702c
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x18001ee7e
cmp qword [rsp + 0x88], 0x10
jb 0x18001ee0d
mov rcx, qword [rsp + 0x70]
call fcn.180076a50
mov qword [rsp + 0x88], socket
mov qword [rsp + 0x80], rsi
mov byte [rsp + 0x70], 0
mov rcx, rbp
call fcn.18007702c
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x18001ee7e
cmp qword [rsp + 0x88], 0x10
jb 0x18001ee51
mov rcx, qword [rsp + 0x70]
call fcn.180076a50
mov qword [rsp + 0x88], socket
mov qword [rsp + 0x80], rsi
mov byte [rsp + 0x70], 0
mov rcx, rbp
call fcn.18007702c
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.180076a70
mov rbx, qword [rsp + 0xe0]
add rsp, 0xa0
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0xe0], rbx
mov rax, qword [0x18010f050]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r14d, edx
mov rbp, rcx
mov rax, qword [rcx + 0x20]
sub rax, qword [rcx + 0x18]
sar rax, 3
test rax, rax
jne 0x18001ef02
call fcn.180076fcc
mov rax, qword [rbp + 0x18]
mov rsi, qword [rax]
cmp dword [rsi + 0x5c], 0
je 0x18001f128
cmp qword [rsi + 0x10], 0xffffffffffffffff
je 0x18001f128
mov r13d, dword [rsi + 0x60]
lea rdx, [0x1801171e8]
mov rcx, r13
call fcn.180077024
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x18001ef48
mov eax, 0x8007000e
jmp 0x18001f12d
mov r8, r13
xor edx, edx
mov rcx, rax
call fcn.1800795c0
mov eax, dword [rsi + 0x5c]
test eax, eax
je 0x18001f117
mov rdx, qword [rsi + 0x10]
cmp rdx, 0xffffffffffffffff
je 0x18001f117
mov ecx, dword [rsi + 0x60]
cmp r13d, ecx
jae 0x18001ef80
mov edi, 0x80004005
jmp 0x18001f11c
mov qword [rsp + 0x40], rax
xor r15d, r15d
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ecx
lea r9, [rsp + 0x40]
lea r8d, [r15 + 1]
mov rcx, rsi
call fcn.180003b20
mov edi, eax
test eax, eax
js 0x18001f11c
cmp eax, 1
je 0x18001f11c
mov qword [rsp + 0x78], socket
mov qword [rsp + 0x70], r15
mov byte [rsp + 0x60], r15b
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.180002550
nop
mov r8d, r14d
lea rdx, [rsp + 0x58]
mov rcx, rbp
call fcn.18001f160
mov edi, eax
test eax, eax
js 0x18001f0e6
cmp eax, 1
je 0x18001f0e6
mov r8, r13
xor edx, edx
mov rcx, rbx
call fcn.1800795c0
mov r8, qword [rsp + 0x70]
cmp r8, r13
jbe 0x18001f05e
cmp qword [rsp + 0x78], 0x10
jb 0x18001f039
mov rcx, qword [rsp + 0x60]
call fcn.180076a50
mov qword [rsp + 0x78], socket
mov qword [rsp + 0x70], r15
mov byte [rsp + 0x60], 0
mov rcx, rbx
call fcn.18007702c
mov eax, 0x80004005
jmp 0x18001f12d
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rdx, qword [rsp + 0x60]
mov rcx, rbx
call fcn.1800785c0
mov edx, dword [rsi + 0x60]
cmp r13d, edx
jb 0x18001f0b0
mov eax, dword [rsi + 0x5c]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], edx
lea r9, [rsp + 0x40]
mov r8d, 1
mov rdx, qword [rsi + 0x10]
mov rcx, rsi
call fcn.180003c90
mov edi, eax
jmp 0x18001f0b5
mov edi, 0x80070057
cmp qword [rsp + 0x78], 0x10
jb 0x18001f0c7
mov rcx, qword [rsp + 0x60]
call fcn.180076a50
mov qword [rsp + 0x78], socket
mov qword [rsp + 0x70], r15
mov byte [rsp + 0x60], 0
mov rcx, rbx
call fcn.18007702c
mov eax, edi
jmp 0x18001f12d
cmp qword [rsp + 0x78], 0x10
jb 0x18001f0f8
mov rcx, qword [rsp + 0x60]
call fcn.180076a50
mov qword [rsp + 0x78], socket
mov qword [rsp + 0x70], r15
mov byte [rsp + 0x60], 0
mov rcx, rbx
call fcn.18007702c
mov eax, edi
jmp 0x18001f12d
mov edi, 0x80004005
mov rcx, rbx
call fcn.18007702c
mov eax, edi
jmp 0x18001f12d
mov eax, 0x80004005
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.180076a70
mov rbx, qword [rsp + 0xe0]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret