Function at 0x140022894
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
and qword [rbp - 0x18], 0
xor r15b, r15b
and qword [r9], 0
mov r13, r9
mov r14d, r8d
mov r12, rdx
mov rsi, rcx
test rcx, rcx
jne 0x1400228dc
test rdx, rdx
jne 0x1400228dc
mov edi, 0x57
jmp 0x140022b83
test r14d, 0xfffffffe
jne 0x1400228d2
xor r8d, r8d
lea rcx, [0x14004f6a8]
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlRunOnceBeginInitialize]
nop dword [rax + rax]
cmp eax, 0x103
jne 0x14002297a
test byte [0x14004f6d0], 1
jne 0x14002294e
call fcn.14002e5a0
lock or dword [0x14004f6d0], 1
mov al, byte [str.v100.5_vb_release_svc_2021_10_19T12:58:38_2021_10_19T12:58:38]
lea rcx, str.v100.5_vb_release_svc_2021_10_19T12:58:38_2021_10_19T12:58:38
mov dword [rbp + 0x58], 0x640005
jmp 0x140022938
inc rcx
mov byte [rbp + 0x58], al
mov al, byte [rcx]
test al, al
jne 0x140022930
mov eax, dword [0x14004f098]
mov rsi, qword [rbp + 0x40]
not eax
mov dword [0x14004f6d4], eax
mov dword [0x14004f6c0], 0x7a4e55c5
mov dword [0x14004f6c4], 0x82ef4d88
xor r8d, r8d
lea rcx, [0x14004f6a8]
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlRunOnceComplete]
nop dword [rax + rax]
test rsi, rsi
jne 0x1400229af
mov edx, r14d
lea r9, [rbp + 0x40]
not edx
lea r8d, [rsi + 3]
and edx, 1
mov rcx, r12
lea edx, [rdx*2 + 1]
call fcn.14002872c
mov edi, eax
test eax, eax
jne 0x140022b83
mov rsi, qword [rbp + 0x40]
mov r15b, 1
lea rdx, [rbp - 0x10]
mov rcx, rsi
xor edi, edi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileSizeEx]
nop dword [rax + rax]
test eax, eax
jne 0x1400229d6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
test edi, edi
jne 0x140022b76
mov rbx, qword [rbp - 0x10]
cmp ebx, 0x1000
jbe 0x140022b5c
cmp dword [rbp - 0xc], edi
jne 0x140022b5c
lea edx, [rdi + 0x10]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__aligned_malloc]
nop dword [rax + rax]
mov qword [rbp - 0x18], rax
test rax, rax
jne 0x140022a1a
lea edi, [rax + 8]
jmp 0x140022b61
mov rdx, qword [rbp - 0x18]
lea r9, [rbp - 0x20]
xor edi, edi
mov r8d, ebx
and qword [rsp + 0x20], rdi
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
nop dword [rax + rax]
test eax, eax
jne 0x140022a4d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
test edi, edi
jne 0x140022b61
mov r9, rsi
lea rdx, [rbp - 0x10]
mov r8, r12
lea rcx, [rbp - 0x18]
call fcn.140027070
mov edi, eax
test eax, eax
jne 0x140022b61
test r14b, 1
je 0x140022a8a
test r15b, r15b
je 0x140022a85
mov rcx, rsi
call fcn.140028788
xor esi, esi
xor r15b, r15b
lea rcx, [0x14003f658]
call qword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_GetModuleHandleW]
nop dword [rax + rax]
test rax, rax
jne 0x140022ab5
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
jmp 0x140022b61
lea rdx, str.RtlValidRelativeSecurityDescriptor
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_GetProcAddress]
nop dword [rax + rax]
mov qword [0x14004f728], rax
test rax, rax
je 0x140022aa2
mov r14, qword [rbp - 0x18]
lea r9, [rbp - 8]
mov rdx, qword [rbp - 0x10]
mov rcx, r14
and qword [rbp - 8], 0
mov r8, r12
and qword [r13], 0
call fcn.1400254bc
mov rbx, qword [rbp - 8]
mov edi, eax
test eax, eax
jne 0x140022b2b
mov rcx, rbx
xor r14d, r14d
call fcn.140026e18
mov edi, eax
test eax, eax
jne 0x140022b3f
mov rcx, rbx
call fcn.140024aa0
mov edi, eax
test eax, eax
jne 0x140022b3f
mov rax, qword [rbx + 0x38]
xor ebx, ebx
mov qword [r13], rax
test r14, r14
je 0x140022b3f
mov rcx, r14
call qword [sym.imp.msvcrt.dll__aligned_free]
nop dword [rax + rax]
mov rcx, rbx
call fcn.140022bec
test edi, edi
jne 0x140022b76
mov rax, qword [r13]
mov rcx, qword [rax + 0x10]
mov qword [rcx + 0x80], rsi
jmp 0x140022b83
mov edi, 0x3f1
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x140022b76
call qword [sym.imp.msvcrt.dll__aligned_free]
nop dword [rax + rax]
test r15b, r15b
je 0x140022b83
mov rcx, rsi
call fcn.140028788
mov rbx, qword [rsp + 0x98]
mov eax, edi
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret