Function at 0x1400eef70
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
xor ebx, ebx
mov r14, r9
mov rsi, r8
mov rdi, rdx
mov r13, rcx
mov dword [rbp - 0x20], ebx
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
mov r15b, 4
cmp rcx, rax
je 0x1400eefd9
test byte [rcx + 0x1c], r15b
je 0x1400eefd9
cmp byte [rcx + 0x19], r15b
jb 0x1400eefd9
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000d538]
mov edx, 0xca
call fcn.14001dd24
mov byte [r14], bl
mov r14d, 3
mov qword [rsp + 0x30], rbx
lea r8d, [r14 - 2]
xor r9d, r9d
mov edx, 0x80000000
mov rcx, rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x1400ef4ec
lea rdx, [rbp - 0x18]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x1400ef080
mov rax, qword [0x14017d3a8]
lea r13, [0x14017d3a8]
cmp rax, r13
je 0x1400ef484
test byte [rax + 0x1c], r15b
je 0x1400ef484
cmp byte [rax + 0x19], r14b
jb 0x1400ef484
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x14017d3a8]
lea r8, [0x14000d538]
mov rcx, qword [rcx + 0x10]
mov edx, 0xcb
mov r9, rdi
mov dword [rsp + 0x20], eax
call fcn.14001ecbc
jmp 0x1400ef484
mov rcx, qword [rbp + 0x68]
mov rax, qword [rbp - 0x18]
mov edx, 0x200
mov qword [rcx], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
jne 0x1400ef0b8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r11d, eax
mov rax, qword [rbp + 0x70]
mov dword [rax], r11d
mov ebx, r14d
jmp 0x1400ef484
lea r9, [rbp - 0x20]
mov r8d, 0x200
mov rdx, rax
mov rcx, r12
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400ef491
cmp dword [rbp - 0x20], reloc.ADVAPI32.dll_TraceEvent
jne 0x1400ef491
lea rdx, [rbp - 0x10]
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
call fcn.1400f33b4
test al, al
jne 0x1400ef143
mov rcx, qword [0x14017d3a8]
lea r13, [0x14017d3a8]
cmp rcx, r13
je 0x1400ef47b
test byte [rcx + 0x1c], r15b
je 0x1400ef47b
cmp byte [rcx + 0x19], r14b
jb 0x1400ef47b
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000d538]
mov edx, 0xcd
call fcn.14001dd24
jmp 0x1400ef47b
mov r9, qword [rbp - 0x10]
cmp r9, rsi
jge 0x1400ef1af
mov rcx, qword [0x14017d3a8]
lea r13, [0x14017d3a8]
cmp rcx, r13
je 0x1400ef47b
test byte [rcx + 0x1c], r15b
je 0x1400ef47b
cmp byte [rcx + 0x19], r14b
jb 0x1400ef47b
mov rcx, qword [rcx + 0x10]
mov r8, r9
mov dword [rsp + 0x30], esi
sar r8, 0x20
mov rax, rsi
mov edx, 0xce
sar rax, 0x20
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r9d
mov r9d, r8d
lea r8, [0x14000d538]
call fcn.1400296b0
jmp 0x1400ef47b
mov edx, 0x400
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
jne 0x1400ef1e2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov r11d, eax
mov rax, qword [rbp + 0x70]
mov dword [rax], r11d
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1400ef0b0
lea r9, [rbp - 0x20]
mov r8d, 0x400
mov rdx, rax
mov rcx, r12
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400ef429
cmp dword [rbp - 0x20], reloc.ADVAPI32.dll_TraceEvent
jne 0x1400ef429
mov rdx, rsi
mov rcx, r13
call fcn.1400f3c78
test al, al
jne 0x1400ef266
mov rcx, qword [0x14017d3a8]
lea r13, [0x14017d3a8]
cmp rcx, r13
je 0x1400ef472
test byte [rcx + 0x1c], r15b
je 0x1400ef472
cmp byte [rcx + 0x19], r14b
jb 0x1400ef472
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000d538]
mov edx, 0xd0
call fcn.14001dd24
jmp 0x1400ef472
mov r15d, dword [r13 + 0xbc]
xor ecx, ecx
shl r15d, 2
mov edx, r15d
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r14, rax
test rax, rax
jne 0x1400ef2af
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
mov r11d, eax
mov rax, qword [rbp + 0x70]
mov dword [rax], r11d
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea ebx, [r14 + 3]
jmp 0x1400ef484
lea r9, [rbp - 0x20]
mov r8d, r15d
mov rdx, rax
mov rcx, r12
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400ef3c9
cmp dword [rbp - 0x20], r15d
jne 0x1400ef3c9
mov rdx, r14
mov rcx, r13
call fcn.1400f4258
test al, al
jne 0x1400ef32a
mov rcx, qword [0x14017d3a8]
lea r13, [0x14017d3a8]
cmp rcx, r13
je 0x1400ef31c
test byte [rcx + 0x1c], 4
je 0x1400ef31c
cmp byte [rcx + 0x19], 3
jb 0x1400ef31c
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000d538]
mov edx, 0xd2
call fcn.14001dd24
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1400ef472
mov rcx, qword [0x14017d3a8]
lea r13, [0x14017d3a8]
cmp rcx, r13
je 0x1400ef362
test byte [rcx + 0x1c], 4
je 0x1400ef362
cmp byte [rcx + 0x19], 4
jb 0x1400ef362
mov r9, qword [rbp + 0x48]
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000d538]
mov edx, 0xd3
call fcn.14001ec40
mov rax, qword [rbp + 0x58]
mov rcx, rsi
mov byte [rax], 1
mov rax, qword [rbp + 0x60]
mov qword [rax], r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14017d3a8]
cmp rcx, r13
je 0x1400ef4ec
test byte [rcx + 0x1c], 4
je 0x1400ef4ec
cmp byte [rcx + 0x19], 4
jb 0x1400ef4ec
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000d538]
mov edx, 0xd4
call fcn.14001dd24
jmp 0x1400ef4ec
mov rax, qword [0x14017d3a8]
lea r13, [0x14017d3a8]
cmp rax, r13
je 0x1400ef31c
test byte [rax + 0x1c], 4
je 0x1400ef31c
cmp byte [rax + 0x19], 3
jb 0x1400ef31c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x14017d3a8]
lea r8, [0x14000d538]
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x28], eax
mov eax, dword [rbp - 0x20]
mov edx, 0xd1
mov r9d, r15d
mov dword [rsp + 0x20], eax
call fcn.1400d3284
jmp 0x1400ef31c
mov rax, qword [0x14017d3a8]
lea r13, [0x14017d3a8]
cmp rax, r13
je 0x1400ef472
test byte [rax + 0x1c], r15b
je 0x1400ef472
cmp byte [rax + 0x19], r14b
jb 0x1400ef472
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x14017d3a8]
mov r9d, dword [rbp - 0x20]
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000d538]
mov edx, 0xcf
mov dword [rsp + 0x20], eax
call fcn.1400285b4
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x1400ef4ee
mov rax, qword [0x14017d3a8]
lea r13, [0x14017d3a8]
cmp rax, r13
je 0x1400ef4da
test byte [rax + 0x1c], r15b
je 0x1400ef4da
cmp byte [rax + 0x19], r14b
jb 0x1400ef4da
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x14017d3a8]
mov r9d, dword [rbp - 0x20]
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000d538]
mov edx, 0xcc
mov dword [rsp + 0x20], eax
call fcn.1400285b4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret