Function at 0x1401105d0
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0xf0]
sub rsp, 0x1f0
mov rax, qword [0x1403f80a0]
xor rax, rsp
mov qword [rbp + 0xe0], rax
mov r14, rcx
cmp qword [rcx + 0x18], 8
jb 0x14011060b
mov rcx, qword [rcx]
xor esi, esi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov edi, 3
mov dword [rsp + 0x20], edi
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rsi + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x78], rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x140110882
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140110882
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x40]
lea r8d, [rsi + 0x40]
lea rdx, [rbp - 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140110887
cmp dword [rsp + 0x40], 0x40
jne 0x140110887
mov eax, 0x5a4d
cmp word [rbp - 0x70], ax
jne 0x140110887
cmp dword [rbp - 0x62], 0x544f4952
je 0x1401106ad
lea edi, [rsi + 6]
jmp 0x140110887
cmp qword [r14 + 0x18], 8
jb 0x1401106b7
mov r14, qword [r14]
mov rcx, r14
call fcn.140105c50
test eax, eax
jns 0x1401106cd
mov edi, 4
jmp 0x140110887
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rbp - 0x34]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x140110887
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x40]
mov r8d, 0x108
lea rdx, [rbp - 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140110887
cmp dword [rsp + 0x40], 0x108
jne 0x140110887
cmp dword [rbp - 0x30], 0x4550
jne 0x140110887
mov eax, 0x8664
cmp word [rbp - 0x2c], ax
jne 0x140110887
mov r14, rsi
cmp si, word [rbp - 0x2a]
jae 0x14011088d
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x40]
mov r8d, Ordinal_41
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140110887
cmp dword [rsp + 0x40], 0x28
jne 0x140110887
mov edx, dword [rsp + 0x50]
mov eax, dword [rsp + 0x58]
movzx ecx, word [rsp + 0x54]
cmp edx, 0x696f742e
jne 0x140110795
cmp cx, 0x72
jne 0x140110795
cmp eax, 8
jae 0x1401107b4
cmp edx, 0x7574732e
jne 0x1401107a8
cmp cx, 0x62
jne 0x1401107a8
cmp eax, 0x34
jae 0x140110821
inc r14
movzx eax, word [rbp - 0x2a]
cmp r14, rax
jmp 0x14011073e
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rsp + 0x64]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x140110887
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x40]
mov r8d, 8
lea rdx, [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140110887
cmp dword [rsp + 0x40], 8
jne 0x140110887
cmp word [rsp + 0x48], 1
je 0x140110810
mov edi, 5
jmp 0x140110887
test dword [rsp + 0x4c], 0x200
jne 0x140110889
mov esi, 7
jmp 0x140110889
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rsp + 0x64]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x14011088b
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x40]
mov r8d, 8
lea rdx, [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14011088b
cmp dword [rsp + 0x40], 8
jne 0x14011088b
cmp word [rsp + 0x48], 1
je 0x140110871
mov edi, 5
jmp 0x14011088b
test dword [rsp + 0x4c], 0x200
jne 0x14011088d
mov esi, 7
jmp 0x14011088d
mov edi, 2
mov esi, edi
mov edi, esi
mov esi, edi
lea rcx, [rbx - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x1401108a0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rcx, qword [rbp + 0xe0]
xor rcx, rsp
call fcn.1401304f0
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret