Function at 0x1401009a0
Capabilities:
Get file size
Get system information on windows
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], r8
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
or qword [rbp - 1], 0xffffffffffffffff
mov r12, rdx
xor r15d, r15d
lea rdx, [rbp - 9]
mov rcx, r12
mov qword [rbp - 0x11], r15
mov r13, r9
mov qword [rbp - 0x19], r15
mov qword [rbp - 9], r15
call fcn.140081300
mov rbx, qword [rbp - 9]
mov edi, eax
test eax, eax
jns 0x1401009fc
mov ecx, eax
jmp 0x140100b7b
xor r9d, r9d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov edx, 0x80000000
mov rcx, rbx
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 5]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140100b5a
mov rcx, rax
mov qword [rbp - 1], rax
lea rdx, [rbp - 0x29]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r14d, eax
cmp eax, 0xffffffff
je 0x140100b5a
cmp dword [rbp - 0x29], r15d
je 0x140100a63
mov ecx, 0x80070057
mov edi, ecx
jmp 0x140100b7b
cmp r14d, 0x100000
ja 0x140100a57
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor edi, edi
mov r15, rax
test rax, rax
jne 0x140100a98
mov qword [rbp - 0x11], rax
mov edi, 0x8007000e
jmp 0x140100b79
mov rcx, rsi
mov qword [rbp - 0x11], r15
lea r9, [rbp - 0x25]
mov qword [rsp + 0x20], rdi
mov r8d, r14d
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140100ac6
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor r15d, r15d
jmp 0x140100b60
cmp dword [rbp - 0x25], r14d
je 0x140100ae0
mov edi, 0x8000ffff
mov ecx, edi
call fcn.140082a8c
xor r15d, r15d
jmp 0x140100b80
mov rsi, qword [rbp + 0x67]
mov rsi, qword [rsi + 0xb8]
mov rax, qword [rsi]
mov rdi, qword [rax + 0x18]
mov rax, qword [0x1403cf6d0]
mov rcx, rdi
call rax
lea rcx, [rbp - 0x21]
mov rax, rdi
mov qword [rsp + 0x20], rcx
lea r9, [rbp - 0x19]
mov rcx, rsi
mov r8d, r14d
mov rdx, r15
call rax
xor r15d, r15d
mov edi, eax
test eax, eax
js 0x1401009f5
mov r8, qword [rbp + 0x77]
mov r9, r13
mov edx, dword [rbp - 0x21]
mov rcx, qword [rbp - 0x19]
call fcn.140102a84
mov edi, eax
test eax, eax
js 0x1401009f5
lea rdx, [r13 + 0x20]
mov rcx, r12
call fcn.140082960
mov edi, eax
test eax, eax
jns 0x140100b80
jmp 0x1401009f5
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140100b6b
mov edi, 0x80004005
jmp 0x140100b79
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, edi
call fcn.140082a8c
mov ecx, edi
call fcn.140082b34
test rbx, rbx
je 0x140100ba8
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rbx - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.140082b34
xor r9d, r9d
mov qword [rbp + 7], 3
lea rax, [0x14000f69c]
mov qword [rbp + 0x17], r15
mov qword [rbp + 0xf], rax
lea rdx, [rbp + 7]
lea rax, [rbp - 0x19]
mov ecx, 0xb9
lea r8d, [r9 + 0x20]
mov qword [rbp + 0x1f], rax
call sub.ntdll.dll_NtQuerySystemInformation
lea rcx, [rbp - 0x11]
call fcn.140078854
lea rcx, [rbp - 1]
call fcn.14007f49c
mov rbx, qword [rsp + 0xd8]
mov eax, edi
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret