Function at 0x140079680
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x330
mov rax, qword [0x140317e98]
xor rax, rsp
mov qword [rsp + 0x320], rax
mov r15, rdx
call fcn.140032750
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.14002d380
nop
call fcn.140032760
mov rcx, rax
call fcn.14002e380
xor ebx, ebx
test al, al
je 0x140079857
mov rdx, r15
lea rcx, [rsp + 0x60]
call fcn.14002d920
lea rcx, [rsp + 0x60]
call fcn.14002d690
mov rcx, rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rbx + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x14007978a
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test eax, eax
je 0x14007978a
mov dword [rsp + 0x40], ebx
mov ebp, esi
lea rdx, [0x140267438]
mov ecx, esi
call fcn.1400d7d70
mov rdi, rax
test rax, rax
je 0x140079938
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x40]
mov r8d, esi
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x40], esi
je 0x140079938
mov rcx, rdi
call fcn.1400d7558
nop
lea rcx, [rsp + 0x60]
call fcn.140003d20
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x140079828
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test eax, eax
je 0x140079828
mov dword [rsp + 0x44], ebx
mov ebp, esi
lea rdx, [0x140267438]
mov ecx, esi
call fcn.1400d7d70
mov rdi, rax
test rax, rax
je 0x140079828
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x44]
mov r8d, esi
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x44], esi
je 0x14007994b
mov rcx, rdi
call fcn.1400d7558
xor eax, eax
mov rcx, qword [rsp + 0x320]
xor rcx, rsp
call fcn.1400d7670
lea r11, [rsp + 0x330]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
call fcn.140032760
nop
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.14002d900
call fcn.140032bd0
test al, al
je 0x14007987a
call fcn.140032770
jmp 0x140079892
lea rcx, [rsp + 0x60]
call fcn.14002d690
mov rcx, rax
xor edx, edx
lea r8d, [rdx + 2]
call fcn.140055440
mov rsi, rax
test rax, rax
je 0x14007978a
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
mov r8b, 1
mov rdx, r15
mov rcx, rsi
call fcn.140054d90
test eax, eax
jne 0x1400798cf
mov r14d, dword [rsp + 0x31c]
test r14d, r14d
jne 0x1400798e9
call fcn.140032bd0
test al, al
jne 0x14007978a
mov rcx, rsi
call fcn.140054b80
jmp 0x14007978a
mov rbp, r14
mov rcx, r14
call fcn.1400d7860
mov rdi, rax
mov dword [rsp + 0x20], 3
mov r9d, r14d
mov r8, rax
mov edx, dword [rsp + 0x48]
mov rcx, rsi
call fcn.140055b70
test eax, eax
je 0x140079926
cmp eax, 0x600
je 0x140079926
mov rcx, rdi
call fcn.1400d7558
jmp 0x1400798cf
call fcn.140032bd0
test al, al
jne 0x140079938
mov rcx, rsi
call fcn.140054b80
nop
lea rcx, [rsp + 0x60]
call fcn.140003d20
test rdi, rdi
je 0x140079794
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r14, rax
test rax, rax
je 0x140079a03
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x140079a03
mov r8, rbp
mov rdx, rdi
mov rcx, rax
call fcn.1400d9910
mov qword [rsp + 0x50], rbx
lea r8, [rsp + 0x50]
mov edx, 1
mov rcx, r14
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov rsi, rbx
mov rbp, qword [rsp + 0x50]
test rbp, rbp
je 0x140079a00
mov ecx, 0x18
call fcn.1400d8310
mov rsi, rax
test rax, rax
je 0x1400799dc
lea rax, vtable.Gdiplus::Image.0
mov qword [rsi], rax
lea rdx, [rsi + 8]
mov qword [rdx], rbx
mov rcx, rbp
call fcn.1400d847e
mov dword [rsi + 0x10], eax
mov dword [rsi + 0x10], ebx
test eax, eax
je 0x140079a00
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rdi
call fcn.1400d7558
mov rax, rbx
jmp 0x14007982a
mov rbx, rsi
mov rcx, rdi
call fcn.1400d7558
mov rax, rbx
jmp 0x14007982a