Function at 0x100004168
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
xor edi, edi
or rbp, 0xffffffffffffffff
mov rbx, rdx
and dword [rsp + 0x70], edi
mov rsi, rcx
test rcx, rcx
je 0x1000043c3
test rdx, rdx
je 0x1000043c3
xor edx, edx
mov r8d, 0xc18
call sub.msvcrt.dll_memset
and qword [rsp + 0x30], rdi
lea r13d, [rdi + 1]
mov r8d, r13d
xor r9d, r9d
mov edx, 0x80000000
mov rcx, rbx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x100004203
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rdi + 0x68]
mov edx, 2
mov r8, rbx
mov r9d, eax
mov edi, eax
call fcn.100007828
jmp 0x1000043c8
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r9d, 0x4000000
mov r12d, eax
cmp dword [rsp + 0x70], edi
ja 0x1000043ac
cmp eax, r9d
ja 0x1000043ac
lea ecx, [rax + 0x1fff]
and ecx, 0xffffe000
cmp ecx, eax
cmovb ecx, eax
mov r14d, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
mov rcx, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsi], rax
test rax, rax
jne 0x10000427b
lea edx, [rax + 2]
lea ecx, [rax + 0x66]
mov r8d, 0x18a
call fcn.100007828
mov edi, 0xe
jmp 0x1000043c8
and qword [rsp + 0x20], rdi
lea r9, [rsp + 0x70]
mov r8d, r12d
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1000042a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x6a
jmp 0x1000041ec
mov edx, dword [rsp + 0x70]
mov rcx, qword [rsi]
lea r8, [rsp + 0x80]
mov dword [rsp + 0x80], 0x1000
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
test eax, eax
jne 0x1000043a6
mov r13, qword [rsi]
lea r12, [r14 + r14]
mov rax, r12
sar rax, 0x20
test eax, eax
je 0x100004302
and qword [rsi], rdi
mov edx, 2
mov r8d, 0x1a0
lea ecx, [rdx + 0x64]
call fcn.100007828
mov edi, 0x216
jmp 0x100004390
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, r12d
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsi], rax
test rax, rax
jne 0x100004339
lea edx, [rax + 2]
lea ecx, [rax + 0x66]
mov r8d, 0x1a6
call fcn.100007828
mov edi, 0xe
jmp 0x100004390
mov r9d, dword [rsp + 0x70]
shr r12d, 1
mov r8, r13
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [rsp + 0x70], eax
cmp eax, 0x459
jne 0x10000436a
mov edi, 0xd
jmp 0x10000437a
test eax, eax
jne 0x100004390
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test eax, eax
je 0x100004390
mov edx, 2
mov r9d, edi
mov r8d, 0x1b3
lea ecx, [rdx + 0x69]
call fcn.100007828
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r13
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1000043c8
shr dword [rsp + 0x70], 1
jmp 0x1000043c8
mov r8, rbx
mov edx, r13d
mov ecx, 0x69
call fcn.100007828
mov edi, 0x216
jmp 0x1000043c8
mov edi, 0x57
test rbp, rbp
je 0x1000043dc
cmp rbp, 0xffffffffffffffff
je 0x1000043dc
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x1000043f9
mov rdx, qword [rsi]
mov eax, dword [rsp + 0x70]
lea rcx, [rdx + rax*2]
mov qword [rsi + 0x18], rdx
mov qword [rsi + 0x28], rdx
mov qword [rsi + 8], rcx
jmp 0x100004401
mov rcx, rsi
call fcn.100004118
lea r11, [rsp + 0x40]
mov eax, edi
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret