Function at 0x140006604
Capabilities:
Check if file exists
Get file attributes
Read file on windows

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0xa0
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x90], rbx
mov qword [rbp + 0x98], rsi
mov qword [rbp + 0xa0], rdi
mov rax, qword [0x1402c0930]
xor rax, rbp
mov qword [rbp + 0x50], rax
mov rbx, rdx
mov r14, rcx
xor r12d, r12d
mov r13d, r12d
mov qword [rbp + 0x30], r12
mov eax, 0x100
mov dword [rbp + 0xc], eax
mov ecx, eax
call fcn.14000603c
mov rsi, rax
mov qword [rbp + 0x28], rax
mov r15d, r12d
mov dword [rbp + 0x1c], r12d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [rbp + 0x24], eax
lea edi, [r12 + 1]
cmp eax, 0xffffffff
je 0x140006986
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x8000080
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, edi
mov edx, 0x80000000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r13, rax
mov qword [rbp + 0x30], rax
cmp rax, 0xffffffffffffffff
je 0x140006986
mov dword [rbp + 0x14], r12d
mov eax, 0x8000
call fcn.1401d75c0
sub rsp, rax
lea rbx, [rsp + 0x40]
mov qword [rbp + 0x40], rbx
mov qword [rsp + 0x20], r12
lea r9, [rbp]
mov r8d, eax
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140006982
mov ecx, r12d
mov r8b, 0xa
mov edx, dword [rbp]
mov dword [rbp + 0x20], ecx
cmp ecx, edx
jae 0x14000671a
mov eax, ecx
cmp byte [rax + rbx], 0xd
je 0x14000671a
cmp byte [rax + rbx], r8b
je 0x14000671a
add ecx, edi
jmp 0x140006701
cmp r12d, edx
jne 0x140006724
mov eax, r12d
jmp 0x140006743
cmp byte [rbx], r8b
jne 0x14000672d
mov eax, edi
jmp 0x140006743
lea eax, [rdx - 1]
cmp r12d, eax
jae 0x14000673e
cmp byte [rbx + 1], r8b
mov eax, r12d
je 0x140006743
mov eax, 2
mov dword [r14 + 0x4c], eax
cdqe
lea rcx, [0x140274340]
mov rax, qword [rcx + rax*8]
mov qword [rbp + 0x48], rax
lea rcx, [r14 + 0x58]
xor edx, edx
mov r8d, 0x1000
call fcn.140008138
mov ebx, r12d
mov dword [rbp + 8], ebx
mov dword [rbp + 4], r12d
call fcn.14000289c
mov dword [rbp + 0x18], eax
mov edx, dword [rbp]
cmp ebx, edx
jae 0x1400068c9
mov ecx, ebx
mov r10, qword [rbp + 0x40]
movsx eax, byte [rcx + r10]
mov dword [rbp + 0x10], eax
add ebx, edi
mov dword [rbp + 8], ebx
cmp ebx, edx
jne 0x1400067ca
cmp edx, 0x8000
jne 0x1400067ca
and qword [rsp + 0x20], 0
lea r9, [rbp]
mov r8d, edx
mov rdx, r10
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140006982
and dword [rbp + 8], 0
movsxd rax, r15d
mov ecx, dword [rbp + 0x10]
mov byte [rax + rsi], cl
add r15d, edi
mov dword [rbp + 0x14], r15d
mov eax, dword [rbp + 0xc]
cmp r15d, eax
jne 0x14000681b
add eax, 0x100
mov dword [rbp + 0xc], eax
mov dword [rbp + 0x38], eax
movsxd rcx, eax
call fcn.14000603c
mov rbx, rax
movsxd r8, r15d
mov rdx, rsi
mov rcx, rax
call fcn.1401d7ec0
mov rdx, rdi
mov rcx, rsi
call fcn.1400025c8
mov rsi, rbx
mov qword [rbp + 0x28], rbx
mov ecx, dword [rbp + 0x10]
movsxd rax, r12d
mov rdx, qword [rbp + 0x48]
cmp cl, byte [rax + rdx]
jne 0x1400068ba
add r12d, edi
mov dword [rbp + 4], r12d
movsxd rax, r12d
cmp byte [rax + rdx], 0
jne 0x1400068c1
sub r15d, r12d
movsxd rax, r15d
mov byte [rax + rsi], 0
test rsi, rsi
je 0x140006861
mov rcx, rsi
call fcn.1401db780
lea edx, [rdi + rax]
cmp edx, 0x3fffffff
jle 0x140006865
xor eax, eax
jmp 0x1400068a1
movsxd rax, edx
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14000687e
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1401d75c0
sub rsp, rcx
lea rcx, [rsp + 0x40]
mov r9d, dword [rbp + 0x18]
mov r8d, edx
mov rdx, rsi
call fcn.140005fc4
or r9d, 0xffffffff
or r8d, r9d
mov rdx, rax
mov rcx, r14
call fcn.140006300
xor r15d, r15d
mov dword [rbp + 0x14], r15d
xor r12d, r12d
mov dword [rbp + 4], r12d
mov ebx, dword [rbp + 8]
jmp 0x14000677b
movsxd rax, r15d
xor r12d, r12d
mov byte [rax + rsi], r12b
test rsi, rsi
je 0x1400068eb
mov rcx, rsi
call fcn.1401db780
lea edx, [rdi + rax]
cmp edx, 0x3fffffff
jle 0x1400068f0
mov rax, r12
jmp 0x14000692c
movsxd rax, edx
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x140006909
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1401d75c0
sub rsp, rcx
lea rcx, [rsp + 0x40]
mov r9d, dword [rbp + 0x18]
mov r8d, edx
mov rdx, rsi
call fcn.140005fc4
or r9d, 0xffffffff
or r8d, r9d
mov rdx, rax
mov rcx, r14
call fcn.140006300
mov dword [r14 + 0x40], edi
mov eax, dword [rbp + 0x24]
and eax, edi
mov dword [r14 + 0x44], eax
mov dword [r14 + 0x48], r12d
mov qword [r14 + 0xb0], r12
mov dword [r14 + 0x54], 0x80000
mov qword [r14 + 0xa8], r12
mov r15d, edi
or dword [rsp + 0x20], 0xffffffff
mov r9d, 0x1000
xor r8d, r8d
xor edx, edx
mov rcx, r14
call fcn.140007188
jmp 0x140006986
mov r15d, dword [rbp + 0x1c]
test rsi, rsi
je 0x140006996
mov rdx, rdi
mov rcx, rsi
call fcn.1400025c8
test r13, r13
je 0x1400069a4
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r15d
mov rcx, qword [rbp + 0x50]
xor rcx, rbp
call fcn.1401d6b50
mov rbx, qword [rbp + 0x90]
mov rsi, qword [rbp + 0x98]
mov rdi, qword [rbp + 0xa0]
lea rsp, [rbp + 0x60]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret