Function at 0x180011374
Capabilities:
Get file size
Read file on windows

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov r14b, r8b
mov r12, rdx
mov rdi, rcx
add rcx, 0x18
call fcn.180010984
mov rbx, qword [rdi]
test rbx, rbx
je 0x1800113c6
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
and qword [rdi], 0
and dword [rdi + 8], 0
and dword [rdi + 0xc], 0
mov rdx, r12
mov rcx, rdi
call fcn.180010180
mov esi, eax
test eax, eax
js 0x18001157b
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.180026510
mov qword [rsp + 0x80], rax
test rax, rax
je 0x18001140a
mov rdx, r12
mov rcx, rax
call fcn.18001e590
mov rbp, rax
jmp 0x18001140c
xor ebp, ebp
mov eax, 0x8007000e
test rbp, rbp
je 0x18001143b
mov rcx, rbp
call fcn.18001ce60
test al, al
jne 0x18001143d
mov esi, 0x800700a7
mov rcx, rbp
call fcn.18001e8a0
mov rcx, rbp
call fcn.1800251c0
xor ebp, ebp
jmp 0x18001143d
mov esi, eax
test esi, esi
js 0x18001152e
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
jne 0x18001148d
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x18001151f
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
mov dword [rdi + 8], ebx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rdi], rax
test rax, rax
mov ecx, 0x8007000e
cmove esi, ecx
test esi, esi
js 0x18001151f
mov ebx, dword [rdi + 0x14]
add ebx, dword [rdi + 0x10]
and dword [rsp + 0x80], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x80]
mov r8d, dword [rdi + 8]
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18001150b
xor edx, edx
mov eax, dword [rsp + 0x80]
div ebx
mov dword [rdi + 0xc], eax
jmp 0x18001151f
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
cmp r12, 0xffffffffffffffff
je 0x18001152e
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbp, rbp
je 0x18001154b
mov rcx, rbp
call fcn.18001cec0
mov rcx, rbp
call fcn.18001e8a0
mov rcx, rbp
call fcn.1800251c0
test esi, esi
js 0x18001157b
test r14b, r14b
je 0x1800115ac
mov rcx, qword [rdi]
test rcx, rcx
je 0x1800115ac
cmp dword [rdi + 0xc], 0
je 0x1800115ac
mov r8d, dword [rdi + 0x14]
add r8d, dword [rdi + 0x10]
mov edx, dword [rdi + 0xc]
lea r9, [0x180010280]
call fcn.180028900
jmp 0x1800115ac
lea rcx, [rdi + 0x18]
call fcn.180010984
mov rbx, qword [rdi]
test rbx, rbx
je 0x1800115a4
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
and qword [rdi], 0
and dword [rdi + 8], 0
and dword [rdi + 0xc], 0
mov eax, esi
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret