Function at 0x14001b8a0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
xor ebp, ebp
xor r15b, r15b
and qword [r9], rbp
mov r12, r9
mov r14d, r8d
mov r13, rdx
mov rsi, rcx
test rcx, rcx
jne 0x14001b8dc
test rdx, rdx
jne 0x14001b8dc
mov edi, 0x57
jmp 0x14001bb0a
test r8d, 0xfffffffe
jne 0x14001b8d2
test rcx, rcx
jne 0x14001b938
mov al, r14b
xor edi, edi
and qword [rsp + 0x30], rdi
not al
and dword [rsp + 0x28], edi
xor r9d, r9d
movzx edx, al
xor r8d, r8d
and edx, 1
mov dword [rsp + 0x20], 3
add edx, edx
mov rcx, r13
or edx, 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14001b92d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jne 0x14001bb0a
mov r15b, 1
lea rdx, [rsp + 0xa8]
mov rcx, rsi
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x14001b957
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jne 0x14001bae8
mov rbx, qword [rsp + 0xa8]
test ebx, ebx
je 0x14001bad5
cmp dword [rsp + 0xac], ebp
jne 0x14001bad5
lea edx, [rdi + 0x10]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__aligned_malloc]
mov rbp, rax
test rax, rax
jne 0x14001b998
lea edi, [rax + 8]
jmp 0x14001bae8
xor edi, edi
lea r9, [rsp + 0x90]
and qword [rsp + 0x20], rdi
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14001b9c2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jne 0x14001bada
test r14b, 1
je 0x14001b9f2
lea rax, [rsi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14001b9ed
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x14001b9ed
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
xor r15b, r15b
xor r8d, r8d
lea rcx, [0x14002bf08]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov r14, rax
test rax, rax
jne 0x14001ba19
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x14001bada
lea rdx, str.RtlValidRelativeSecurityDescriptor
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14003f6d8], rax
test rax, rax
jne 0x14001ba4b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, r14
mov edi, eax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x14001bada
mov rdx, qword [rsp + 0xa8]
lea r9, [rsp + 0x40]
and qword [rsp + 0x40], 0
mov r8, r13
and qword [r12], 0
mov rcx, rbp
call fcn.14001f758
mov rbx, qword [rsp + 0x40]
mov edi, eax
test eax, eax
jne 0x14001baa1
mov rcx, rbx
xor ebp, ebp
call fcn.1400216fc
mov edi, eax
test eax, eax
jne 0x14001baaf
mov rcx, rbx
call fcn.140020260
mov edi, eax
test eax, eax
jne 0x14001baaf
mov rax, qword [rbx + 0x38]
xor ebx, ebx
mov qword [r12], rax
test rbp, rbp
je 0x14001baaf
mov rcx, rbp
call qword [sym.imp.msvcrt.dll__aligned_free]
mov rcx, rbx
call fcn.14001bb6c
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test edi, edi
jne 0x14001bae8
mov rax, qword [r12]
mov rcx, qword [rax + 0x10]
mov qword [rcx + 0x80], rsi
jmp 0x14001bb0a
mov edi, 0x3f1
test rbp, rbp
je 0x14001bae8
mov rcx, rbp
call qword [sym.imp.msvcrt.dll__aligned_free]
test r15b, r15b
je 0x14001bb0a
lea rax, [rsi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14001bb0a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x14001bb0a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret