Function at 0x1400f72f8
Capabilities:
Get file size
Get system information on windows
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], r8
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
and qword [rbp - 9], 0
mov r12, rdx
and qword [rbp - 0x19], 0
lea rdx, [rbp - 0x11]
and qword [rbp - 0x11], 0
or rsi, 0xffffffffffffffff
mov rcx, r12
mov qword [rbp - 1], rsi
mov r13, r9
call fcn.1400783a0
mov rbx, qword [rbp - 0x11]
mov edi, eax
test eax, eax
jns 0x1400f7357
mov ecx, eax
jmp 0x1400f74ed
and qword [rsp + 0x30], 0
xor r9d, r9d
and dword [rsp + 0x28], 0
mov edx, 0x80000000
mov rcx, rbx
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 5]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea rcx, [rax + 1]
test rcx, 0xfffffffffffffffe
jne 0x1400f7390
mov cl, 1
jmp 0x1400f7399
mov rsi, rax
mov qword [rbp - 1], rax
xor cl, cl
xor eax, eax
test cl, cl
cmove rax, rsi
test rax, rax
jne 0x1400f73cd
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400f73ba
mov edi, 0x80004005
jmp 0x1400f74eb
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x1400f74eb
lea rax, [rsi - 1]
cmp rax, 0xfffffffffffffffd
lea rdx, [rbp - 0x29]
seta al
xor ecx, ecx
test al, al
cmove rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r14d, eax
cmp eax, 0xffffffff
je 0x1400f73a6
cmp dword [rbp - 0x29], 0
je 0x1400f7404
mov ecx, 0x80070057
mov edi, ecx
jmp 0x1400f74ed
cmp r14d, 0x100000
ja 0x1400f73f8
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r15, rax
test rax, rax
je 0x1400f74e6
lea rcx, [rsi - 1]
mov qword [rbp - 9], rax
cmp rcx, 0xfffffffffffffffd
lea r9, [rbp - 0x25]
mov r8d, r14d
seta dl
xor ecx, ecx
test dl, dl
mov rdx, rax
cmove rcx, rsi
and qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400f73a6
cmp dword [rbp - 0x25], r14d
je 0x1400f746f
mov edi, 0x8000ffff
jmp 0x1400f74eb
mov rsi, qword [rbp + 0x67]
mov rsi, qword [rsi + 0xb8]
mov rax, qword [rsi]
mov rdi, qword [rax + 0x18]
mov rax, qword [0x1403c1610]
mov rcx, rdi
call rax
lea rcx, [rbp - 0x21]
mov rax, rdi
mov qword [rsp + 0x20], rcx
lea r9, [rbp - 0x19]
mov rcx, rsi
mov r8d, r14d
mov rdx, r15
call rax
mov edi, eax
test eax, eax
js 0x1400f7350
mov r8, qword [rbp + 0x77]
mov r9, r13
mov edx, dword [rbp - 0x21]
mov rcx, qword [rbp - 0x19]
call fcn.1400f926c
mov edi, eax
test eax, eax
js 0x1400f7350
lea rdx, [r13 + 0x20]
mov rcx, r12
call fcn.140079b08
mov edi, eax
test eax, eax
jns 0x1400f74f2
jmp 0x1400f7350
mov edi, 0x8007000e
mov ecx, edi
call fcn.140079c40
mov ecx, edi
call fcn.140079c60
test rbx, rbx
je 0x1400f751a
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rbx - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.140079c60
and qword [rbp + 0x17], 0
lea rax, [0x140048d58]
xor r9d, r9d
mov qword [rbp + 0xf], rax
lea rax, [rbp - 0x19]
mov qword [rbp + 7], 3
lea rdx, [rbp + 7]
mov qword [rbp + 0x1f], rax
mov ecx, 0xb9
lea r8d, [r9 + 0x20]
call sub.ntdll.dll_NtQuerySystemInformation
lea rcx, [rbp - 9]
call fcn.14006fca4
lea rcx, [rbp - 1]
call fcn.140076840
mov rbx, qword [rsp + 0xd8]
mov eax, edi
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret