Function at 0x1400178b0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov dword [rsp + 0x18], r8d
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
xor esi, esi
mov dword [rsp + 0x48], 0x18
mov r14d, 3
mov qword [rsp + 0x50], rsi
mov r8d, edx
mov r12d, 1
and r8d, r14d
mov dword [rsp + 0x58], r12d
mov edi, edx
mov r15, rcx
cmp r8d, 2
ja 0x1400178fd
mov eax, edx
and eax, 9
cmp al, 9
jne 0x140017912
mov eax, 0xffffffff
add rsp, 0x60
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
test r8d, r8d
jne 0x140017aa0
mov ebx, 0x80000000
mov eax, r14d
mov qword [rsp + 0x30], rsi
mov edx, ebx
mov dword [rsp + 0x28], 0x80
lea r9, [rsp + 0x48]
mov r8d, r14d
mov rcx, r15
cmp edi, 0x10a
je 0x1400179b7
mov dword [rsp + 0x20], eax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
nop dword [rax + rax]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x14002740c
mov edx, 8
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__open_osfhandle]
nop dword [rax + rax]
mov ebx, eax
test dil, 8
jne 0x1400179f2
lea eax, [rbx - 3]
mov edx, ebx
cmp eax, 0x5b
ja 0x1400179a5
cmp ebx, 0x1f
jg 0x1400274dc
mov eax, esi
lea rcx, [0x14004cc58]
lea rcx, [rcx + rax*4]
mov eax, dword [rcx]
bts eax, edx
mov dword [rcx], eax
mov eax, ebx
add rsp, 0x60
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
bts edx, 0x1f
mov dword [rsp + 0x20], 3
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
nop dword [rax + rax]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x140017ac8
mov edx, 8
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__open_osfhandle]
nop dword [rax + rax]
mov ebx, eax
mov ecx, ebx
call fcn.14001447c
test eax, eax
jne 0x14001797e
lea rdx, [rsp + 0x44]
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileSize]
nop dword [rax + rax]
mov dword [rsp + 0x40], eax
cmp qword [rsp + 0x40], rsi
je 0x14001797e
mov r9d, 2
mov word [rsp + 0xb0], si
lea r8, [rsp + 0xa8]
mov dword [rsp + 0xa8], 0xffffffff
mov rcx, rbp
lea edx, [r9 - 3]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFilePointer]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x140027436
lea r9, [rsp + 0xb8]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0xb0]
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
nop dword [rax + rax]
test eax, eax
je 0x14002747e
cmp word [rsp + 0xb0], 0x1a
jne 0x14001797e
jmp 0x1400274aa
lea rdx, [0x140037bc8]
mov ebx, 0x40000000
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsicmp]
nop dword [rax + rax]
test eax, eax
mov eax, 2
cmovne r14d, r12d
jmp 0x140017923
mov qword [rsp + 0x30], rsi
lea r9, [rsp + 0x48]
mov dword [rsp + 0x28], 0x80
mov r8d, r14d
mov edx, ebx
mov dword [rsp + 0x20], 4
mov rcx, r15
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
nop dword [rax + rax]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x1400179dc
jmp 0x14002740c
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov dword [0x14004cc50], eax
cmp eax, 0x6e
jne 0x1400178fd
mov dword [0x14004cc50], 2
jmp 0x1400178fd
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov dword [0x14004cc50], eax
test eax, eax
je 0x140017a5d
cmp ebx, 0xffffffff
je 0x140027469
mov ecx, ebx
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__close]
nop dword [rax + rax]
nop
jmp 0x1400178fd
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
nop
jmp 0x1400178fd
mov r9d, 2
mov dword [rsp + 0xa8], esi
lea r8, [rsp + 0xa8]
xor edx, edx
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFilePointer]
nop dword [rax + rax]
nop
jmp 0x140017a8c
mov r9d, 2
mov dword [rsp + 0xa8], 0xffffffff
lea r8, [rsp + 0xa8]
mov rcx, rbp
lea edx, [r9 - 3]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFilePointer]
nop dword [rax + rax]
nop
jmp 0x14001797e
lea ecx, [rbx - 0x20]
shr ecx, 5
lea eax, [rcx + 1]
shl eax, 5
lea esi, [rcx + 1]
sub edx, eax
jmp 0x140017991