Function at 0x14004469c
Capabilities:
Get file size
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov dword [rax + 0x20], r9d
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
xor edi, edi
mov r13, r8
mov qword [rax - 0x58], rdi
mov r15, rdx
mov qword [rdx], rdi
xor r9d, r9d
mov dword [rax - 0x60], 0x80
mov edx, 0x80000000
lea r8d, [rdi + 1]
mov dword [rbp + 0x58], edi
mov r14d, edi
mov dword [rbp - 0x10], edi
mov ebx, edi
mov dword [rax - 0x68], 3
mov esi, edi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
nop dword [rax + rax]
mov r12, rax
cmp rax, 0xffffffffffffffff
jne 0x140044731
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x14004471f
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x140044ac0
mov ebx, 0x80004005
jmp 0x140044ad5
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileSize]
nop dword [rax + rax]
mov esi, eax
cmp eax, 0xffffffff
jne 0x140044776
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x140044764
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x140044ac0
mov ebx, 0x80004005
jmp 0x140044ac6
mov edi, 0x80004005
cmp esi, 2
jbe 0x140044953
xor ecx, ecx
lea r9, [rbp - 0x10]
mov qword [rsp + 0x20], rcx
lea rdx, [rbp + 0x48]
lea r8d, [rcx + 2]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
nop dword [rax + rax]
xor edx, edx
test eax, eax
jne 0x1400447ce
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
xor edx, edx
mov ebx, eax
test eax, eax
jle 0x1400447c9
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
cmovns ebx, edi
cmp dword [rbp - 0x10], 2
jne 0x1400449f6
test ebx, ebx
js 0x140044ac0
movzx eax, word [rbp + 0x48]
mov ecx, 0xfeff
cmp ax, cx
jne 0x140044887
add esi, 0xfffffffe
mov ecx, esi
shr ecx, 1
inc ecx
call fcn.1400435fc
mov qword [r15], rax
test rax, rax
jne 0x140044812
mov ebx, 0x8007000e
jmp 0x140044ac0
lea r9, [rbp + 0x58]
mov qword [rsp + 0x20], r14
mov r8d, esi
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
nop dword [rax + rax]
test eax, eax
jne 0x140044862
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x14004484f
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x140044855
mov ebx, edi
mov rcx, r15
call fcn.140043c18
jmp 0x140044ac0
mov ecx, dword [rbp + 0x58]
mov rax, qword [r15]
shr rcx, 1
mov word [rax + rcx*2], r14w
test r13, r13
je 0x140044ac0
mov eax, dword [rbp + 0x58]
shr eax, 1
mov dword [r13], eax
jmp 0x140044ac0
cmp esi, 3
jbe 0x1400449b7
cmp ax, word [0x140052f04]
jne 0x1400449b7
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x10]
lea rdx, [rbp + 0x58]
mov r8d, 1
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
nop dword [rax + rax]
test eax, eax
jne 0x1400448e3
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x1400448e0
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
cmovns ebx, edi
cmp dword [rbp - 0x10], 1
jne 0x1400449f6
test ebx, ebx
js 0x140044ac0
cmp byte [rbp + 0x58], 0xbf
jne 0x140044906
mov r14d, 0xfde9
add esi, 0xfffffffd
jmp 0x140044947
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
nop dword [rax + rax]
cmp eax, 0xffffffff
jne 0x140044947
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x14004493f
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0x140044ac0
mov ebx, edi
mov dword [rbp + 0x58], r14d
test ebx, ebx
js 0x140044ac0
lea ecx, [rsi + 1]
call fcn.1400014a0
xor ecx, ecx
mov r14, rax
test rax, rax
je 0x140044808
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x48]
mov rcx, r12
mov r8d, esi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
nop dword [rax + rax]
xor esi, esi
test eax, eax
jne 0x1400449fd
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x1400449a8
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x140044ab8
mov ebx, edi
jmp 0x140044ab8
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
nop dword [rax + rax]
cmp eax, 0xffffffff
jne 0x140044953
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x1400449ee
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x140044ac0
mov ebx, edi
jmp 0x140044ac0
mov r9d, dword [rbp + 0x48]
mov r8, r14
mov ecx, dword [rbp + 0x58]
xor edx, edx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
nop dword [rax + rax]
movsxd rsi, eax
cmp esi, 0x7ffffffe
ja 0x140044aae
lea ecx, [rsi + 1]
call fcn.1400435fc
xor r8d, r8d
mov qword [r15], rax
test rax, rax
je 0x140044ab3
mov r9d, dword [rbp + 0x48]
mov edx, r8d
test r9d, r9d
je 0x140044a9b
mov ecx, dword [rbp + 0x58]
mov r8, r14
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
nop dword [rax + rax]
xor r8d, r8d
mov edx, eax
test eax, eax
jne 0x140044a9b
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x140044a8b
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x140044a91
mov ebx, edi
mov rcx, r15
call fcn.140043c18
jmp 0x140044ab8
mov rax, qword [r15]
mov word [rax + rsi*2], r8w
test r13, r13
je 0x140044ab8
mov dword [r13], edx
jmp 0x140044ab8
xor ecx, ecx
mov qword [r15], rcx
mov ebx, 0x8007000e
mov rcx, r14
call fcn.140001454
cmp r12, 0xffffffffffffffff
je 0x140044ad5
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov eax, ebx
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret