Function at 0x140012430
Capabilities:
Get file size
Read file on windows

Disassembly:
push rsi
push rdi
push r14
push r15
sub rsp, 0xe18
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0xdf0], rax
mov rdi, rcx
mov qword [rsp + 0x48], rdx
add rcx, 0x30
mov r14, rdx
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx + 0x10]
je 0x140012473
mov qword [rdx], r14
add qword [rcx + 8], 8
jmp 0x14001247d
lea r8, [rsp + 0x48]
call fcn.140003260
xor esi, esi
mov r15d, esi
cmp qword [rdi + 0x60], rsi
jbe 0x1400124ea
cmp qword [rdi + 0x68], 0xf
lea r8, [rdi + 0x50]
jbe 0x140012496
mov r8, qword [r8]
lea r9, [r14 + 0x20]
lea rdx, str._s_s
lea rcx, [rsp + 0xce0]
call qword [sym.imp.USER32.dll_wsprintfA]
xor r9d, r9d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
lea rcx, [rsp + 0xce0]
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r15, rax
test rax, rax
jne 0x140012540
cmp qword [rdi + 0x60], rsi
jne 0x140012540
lea r8, [r14 + 0x20]
lea rdx, [0x1400316d4]
lea rcx, [rsp + 0xce0]
call qword [sym.imp.USER32.dll_wsprintfA]
xor r9d, r9d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
lea rcx, [rsp + 0xce0]
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r15, rax
test rax, rax
je 0x1400128f9
xor edx, edx
mov qword [rsp + 0xe08], r12
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r12d, eax
cmp eax, 0xffffffff
jne 0x14001256b
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400128f1
mov eax, r12d
mov qword [rsp + 0xe50], rbx
and eax, 0x1f
mov qword [rsp + 0xe10], rbp
mov ecx, 0x20
sub ecx, eax
test eax, eax
cmove ecx, esi
add ecx, r12d
mov dword [rsp + 0x48], ecx
mov ebx, ecx
call fcn.14002ea50
mov r8d, ebx
xor edx, edx
mov rcx, rax
mov rbp, rax
call sub.VCRUNTIME140.dll_memset
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
mov rdx, rbp
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400125e0
mov rcx, rbp
call fcn.14002ea1c
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400128e1
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0xc78
call sub.VCRUNTIME140.dll_memset
mov r8d, dword [rsp + 0x50]
lea rcx, [rsp + 0x60]
mov rdx, rbp
call fcn.140027c80
test eax, eax
jne 0x14001261e
mov rcx, rbp
call fcn.14002ea1c
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400128df
mov qword [rsp + 0xe00], r13
cmp dword [r14 + 0x10], esi
jne 0x140012669
cmp dword [r14 + 0xc], esi
lea r9, [rsp + 0x40]
mov eax, 0x7d00
mov qword [rsp + 0x28], pe_nt_image_headers64
mov ecx, 0x3e80
mov r8, r12
cmove eax, ecx
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x20], eax
call fcn.140027470
mov rsi, qword [rsp + 0x40]
mov r12, rax
jmp 0x14001277d
cmp byte [rbp], 0x52
mov qword [rsp + 0x60], rbp
je 0x14001268a
cmp byte [rbp + 1], 0x49
je 0x14001268a
cmp byte [rbp + 2], 0x46
je 0x14001268a
cmp byte [rbp + 3], 0x46
jne 0x14001278f
cmp byte [rbp + 8], 0x57
lea rax, [rbp + 8]
je 0x1400126aa
cmp byte [rax + 1], 0x41
je 0x1400126aa
cmp byte [rax + 2], 0x56
je 0x1400126aa
cmp byte [rax + 3], 0x45
jne 0x14001278f
add rax, 4
mov qword [rsp + 0x68], rsi
lea r8, [r12 + rbp]
mov rdx, rsi
mov qword [rsp + 0x70], rdx
cmp rax, r8
jae 0x14001278f
movzx ecx, byte [rax]
cmp cl, 0x66
jne 0x1400126ec
cmp byte [rax + 1], 0x6d
jne 0x14001270a
cmp byte [rax + 2], 0x74
jne 0x14001270a
cmp byte [rax + 3], 0x20
jne 0x14001270a
mov rsi, rax
mov qword [rsp + 0x68], rax
jmp 0x14001270a
cmp cl, 0x64
jne 0x14001270a
cmp byte [rax + 1], 0x61
jne 0x14001270a
cmp byte [rax + 2], 0x74
jne 0x14001270a
cmp byte [rax + 3], 0x61
cmove rdx, rax
mov qword [rsp + 0x70], rdx
mov ecx, dword [rax + 4]
add rax, 8
add rax, rcx
cmp rax, r8
jb 0x1400126c8
test rsi, rsi
je 0x14001278f
test rdx, rdx
je 0x14001278f
cmp word [rsi + 8], 1
jne 0x14001278f
mov r9d, pe_nt_image_headers64
lea rdx, [rsp + 0x40]
mov r8d, 0x4844
lea rcx, [rsp + 0x60]
call fcn.1400276f0
mov r13, rax
test rax, rax
je 0x14001278f
mov rsi, qword [rsp + 0x40]
shr rsi, 1
mov rcx, rsi
call fcn.14002ea50
mov r9, qword [rsp + 0x40]
lea rcx, [rsp + 0x60]
mov r8, rax
mov rdx, r13
mov r12, rax
call fcn.140027950
mov rcx, r13
call fcn.14002ea1c
test r12, r12
je 0x14001278f
mov rcx, rbp
call fcn.14002ea1c
mov rbp, r12
jmp 0x140012793
mov esi, dword [rsp + 0x48]
mov r13, qword [rsp + 0xe00]
mov edx, esi
shr edx, 8
cmp dword [r14 + 0x10], 0
jne 0x1400127c7
mov eax, dword [rdi + 0xf7c]
mov dword [r14 + 0x14], eax
mov ecx, dword [rdi + 0xf7c]
dec ecx
add ecx, edx
mov dword [r14 + 0x18], ecx
add dword [rdi + 0xf7c], edx
jmp 0x14001280b
mov ecx, dword [rdi + 0xf78]
mov r8d, ecx
and r8d, 0xf000
lea eax, [rcx - 1]
add eax, edx
and eax, 0xf000
cmp r8d, eax
je 0x1400127f3
lea ecx, [r8 + 0x1000]
mov dword [rdi + 0xf78], ecx
mov dword [r14 + 0x14], ecx
mov ecx, dword [rdi + 0xf78]
dec ecx
add ecx, edx
mov dword [r14 + 0x18], ecx
add dword [rdi + 0xf78], edx
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x1400128a0
cmp dword [rdi + 0x70], 0
jne 0x1400128a0
mov rax, qword [rcx]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x200
call qword [rax + InitCommonControls]
mov rcx, qword [rdi + 0x10]
xor r9d, r9d
movzx r8d, byte [r14 + 0x14]
mov edx, 0x201
mov rax, qword [rcx]
call qword [rax + InitCommonControls]
mov rcx, qword [rdi + 0x10]
xor r9d, r9d
movzx r8d, byte [r14 + 0x15]
mov edx, 0x202
mov rax, qword [rcx]
call qword [rax + InitCommonControls]
mov rcx, qword [rdi + 0x10]
xor r9d, r9d
mov r8d, dword [r14 + 0x10]
mov edx, 0x203
mov rax, qword [rcx]
call qword [rax + InitCommonControls]
test esi, esi
je 0x1400128a0
mov rbx, rbp
mov esi, esi
mov rcx, qword [rdi + 0x10]
xor r9d, r9d
movzx r8d, byte [rbx]
mov edx, 0x204
mov rax, qword [rcx]
call qword [rax + InitCommonControls]
lea rbx, [rbx + 1]
sub rsi, 1
jne 0x140012880
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x1400128c9
mov rax, qword [rcx]
call qword [rax + 0x38]
test eax, eax
jne 0x1400128c9
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rdi + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x38]
test eax, eax
je 0x1400128b3
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbp
call fcn.14002ea1c
mov esi, 1
mov eax, esi
mov rbp, qword [rsp + 0xe10]
mov rbx, qword [rsp + 0xe50]
mov r12, qword [rsp + 0xe08]
mov rcx, qword [rsp + 0xdf0]
xor rcx, rsp
call fcn.14002e9c0
add rsp, 0xe18
pop r15
pop r14
pop rdi
pop rsi
ret