Function at 0x1401cba98
Capabilities:
Get file size
Read file on windows

Disassembly:
mov r11, rsp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x160
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [r11 + 0x20], rbx
mov rax, qword [0x1403f04b0]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rbx, r8
mov r15, rdx
mov rsi, rcx
mov qword [rsp + 0x70], rcx
xor edi, edi
mov qword [rsp + 0x40], rdi
lea rdx, str.:Zone.Identifier:_DATA
lea rcx, [r11 - 0xa8]
call fcn.140048750
mov r14, rax
mov rdx, r15
lea rcx, [rsp + 0xc0]
call fcn.14005517c
nop
mov r8, r14
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.140098cf8
nop
lea rcx, [rsp + 0xc0]
call fcn.1400492c0
nop
lea rcx, [rsp + 0xe0]
call fcn.1400492c0
mov byte [rsp + 0x20], dil
lea r9, [rsp + 0x40]
lea r14d, [rdi + 7]
mov r8d, r14d
mov r15d, 0x80000000
mov edx, r15d
lea rcx, [rsp + 0xa0]
call fcn.1401cb3b8
mov dword [rsp + 0x34], eax
test eax, eax
jns 0x1401cbcc6
cmp eax, 0x80070005
je 0x1401cbb75
cmp eax, 0xd0000022
jne 0x1401cbbc5
cmp qword [rbx], rdi
je 0x1401cbbc5
call fcn.1401db2c0
mov r8, qword [rbx]
mov r8, qword [r8 + 0x58]
lea rdx, [rsp + 0x48]
mov rcx, rax
call fcn.1401db63c
mov byte [rsp + 0x20], dil
lea r9, [rsp + 0x40]
mov r8d, r14d
mov edx, r15d
lea rcx, [rsp + 0xa0]
call fcn.1401cb3b8
mov dword [rsp + 0x34], eax
cmp byte [rsp + 0x4c], dil
je 0x1401cbbc5
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_RevertToSelf]
mov eax, dword [rsp + 0x34]
test eax, eax
jns 0x1401cbcc6
call fcn.140048a14
mov r10, qword [rax + 8]
cmp dword [r10], 4
jbe 0x1401cbc94
lea rax, str.Failed_to_open_file._Cant_retrieve_the_MarkOfWebInformation
mov qword [rsp + 0x120], rax
mov qword [rsp + 0x128], 0x7a
lea rdx, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 8
cmovae rdx, qword [rsp + 0xa0]
lea rcx, [0x1402cb810]
mov rax, rdi
test rdx, rdx
je 0x1401cbc34
mov rcx, rdx
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], di
jne 0x1401cbc2b
mov qword [rsp + 0x130], rcx
lea eax, [rax*2 + 2]
mov dword [rsp + 0x138], eax
mov dword [rsp + 0x13c], edi
lea rax, [rsp + 0x34]
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x148], 4
lea rax, [rsp + 0x100]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 5
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14034e65c]
mov rcx, r10
call fcn.140001078
mov qword [rsi], rdi
mov qword [rsi + 8], rdi
lea rcx, [rsp + 0xa0]
call fcn.1400492c0
nop
mov rcx, qword [rsp + 0x40]
lea rdx, [rcx - 1]
cmp rdx, 0xfffffffffffffffd
ja 0x1401cbcbe
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rax, rsi
jmp 0x1401cc241
xor edx, edx
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileSize]
mov r13d, eax
lea ecx, [rax - 1]
cmp ecx, 0xfffffffd
ja 0x1401cc11d
mov r14d, eax
cmp dword [0x1403f07fc], eax
cmovb r14d, dword [0x1403f07fc]
mov dword [rsp + 0x38], edi
mov byte [rsp + 0x30], dil
lea edx, [r14 + 1]
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x58]
call fcn.140080ba0
nop
xor edx, edx
lea r8d, [rdx + 0x20]
lea rcx, [rsp + 0x80]
call sub.api_ms_win_crt_private_l1_1_0.dll__o_memset
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
mov r8d, r14d
mov rdx, qword [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r14d, eax
test eax, eax
je 0x1401cbeb5
cmp eax, 0x3e5
je 0x1401cbeb5
call fcn.140048a14
mov r10, qword [rax + 8]
cmp dword [r10], 4
jbe 0x1401cbe31
lea rax, str.Failed_to_read_from_MoW_stream._Cant_retrieve_the_MarkOfWebInformation
mov qword [rsp + 0x120], rax
mov qword [rsp + 0x128], 0x90
lea rdx, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 8
cmovae rdx, qword [rsp + 0xa0]
lea rcx, [0x1402cb810]
mov rax, rdi
test rdx, rdx
je 0x1401cbdcc
mov rcx, rdx
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], di
jne 0x1401cbdc3
mov qword [rsp + 0x130], rcx
lea eax, [rax*2 + 2]
mov dword [rsp + 0x138], eax
mov dword [rsp + 0x13c], edi
mov dword [rsp + 0x48], r14d
lea rax, [rsp + 0x48]
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x148], 4
lea rax, [rsp + 0x100]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 5
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14034e793]
mov rcx, r10
call fcn.140001078
mov qword [rsi], rdi
mov qword [rsi + 8], rdi
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1401cbe8c
mov rax, qword [rsp + 0x68]
sub rax, rcx
cmp rax, 0x1000
jb 0x1401cbe79
test cl, 0x1f
jne 0x1401cbe72
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x1401cbe72
sub rcx, rax
sub rcx, 8
cmp rcx, 0x1f
ja 0x1401cbe72
mov rcx, rax
jmp 0x1401cbe79
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__invalid_parameter_noinfo_noreturn]
int3
call fcn.14027abd8
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rdi
lea rcx, [rsp + 0xa0]
call fcn.1400492c0
nop
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1401cbead
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rax, rsi
jmp 0x1401cc241
mov r15d, 1
mov r9d, r15d
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x80]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_io_l1_1_0.dll_GetOverlappedResult]
test eax, eax
jne 0x1401cc031
call fcn.140048a14
mov r14, qword [rax + 8]
cmp dword [r14], 4
jbe 0x1401cbfad
lea rax, str.Failed_to_read_from_MoW_stream._Cant_retrieve_the_MarkOfWebInformation
mov qword [rsp + 0x120], rax
mov qword [rsp + 0x128], 0x90
lea rdx, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 8
cmovae rdx, qword [rsp + 0xa0]
lea rcx, [0x1402cb810]
mov rax, rdi
test rdx, rdx
je 0x1401cbf43
mov rcx, rdx
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], di
jne 0x1401cbf3a
mov qword [rsp + 0x130], rcx
lea eax, [rax*2 + 2]
mov dword [rsp + 0x138], eax
mov dword [rsp + 0x13c], edi
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rsp + 0x48], eax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x148], 4
lea rax, [rsp + 0x100]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 5
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14034e793]
mov rcx, r14
call fcn.140001078
mov qword [rsi], rdi
mov qword [rsi + 8], rdi
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1401cc008
mov rax, qword [rsp + 0x68]
sub rax, rcx
cmp rax, 0x1000
jb 0x1401cbff5
test cl, 0x1f
jne 0x1401cbfee
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x1401cbfee
sub rcx, rax
sub rcx, 8
cmp rcx, 0x1f
ja 0x1401cbfee
mov rcx, rax
jmp 0x1401cbff5
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__invalid_parameter_noinfo_noreturn]
int3
call fcn.14027abd8
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rdi
lea rcx, [rsp + 0xa0]
call fcn.1400492c0
nop
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1401cc029
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rax, rsi
jmp 0x1401cc241
mov ecx, 0x38
call fcn.14027abe8
mov r14, rax
mov dword [rax + 8], r15d
mov dword [rax + 0xc], r15d
lea rax, vtable.std::_Ref_count_obj_struct_sense::cyberData::MowInformation_.0
mov qword [r14], rax
lea r15, [r14 + 0x10]
test r15, r15
je 0x1401cc07a
xor edx, edx
lea r8d, [rdx + 0x28]
mov rcx, r15
call sub.api_ms_win_crt_private_l1_1_0.dll__o_memset
mov dword [r15], edi
mov qword [r15 + 0x18], rdi
mov qword [r15 + 0x20], SafeArrayLock
mov byte [r15 + 8], dil
mov qword [rsp + 0x50], r14
lea r15, [r14 + 0x10]
mov qword [rsp + 0x48], r15
mov dword [r15], r13d
lea rcx, [r15 + 8]
mov rdx, qword [rsp + 0x58]
call fcn.14005cce0
mov qword [rsi], r15
mov qword [rsi + 8], r14
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1401cc0f4
mov rax, qword [rsp + 0x68]
sub rax, rcx
cmp rax, 0x1000
jb 0x1401cc0e1
test cl, 0x1f
jne 0x1401cc0da
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x1401cc0da
sub rcx, rax
sub rcx, 8
cmp rcx, 0x1f
ja 0x1401cc0da
mov rcx, rax
jmp 0x1401cc0e1
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__invalid_parameter_noinfo_noreturn]
int3
call fcn.14027abd8
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rdi
lea rcx, [rsp + 0xa0]
call fcn.1400492c0
nop
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1401cc115
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rax, rsi
jmp 0x1401cc241
call fcn.140048a14
mov r14, qword [rax + 8]
cmp dword [r14], 4
jbe 0x1401cc1ee
lea rax, str.Failed_to_retrieve_the_MarOfWeb_stream_size.
mov qword [rsp + 0x120], rax
mov qword [rsp + 0x128], 0x5a
lea rdx, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 8
cmovae rdx, qword [rsp + 0xa0]
lea rcx, [0x1402cb810]
mov rax, rdi
test rdx, rdx
je 0x1401cc184
mov rcx, rdx
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], di
jne 0x1401cc17b
mov qword [rsp + 0x130], rcx
lea eax, [rax*2 + 2]
mov dword [rsp + 0x138], eax
mov dword [rsp + 0x13c], edi
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rsp + 0x48], eax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x148], 4
lea rax, [rsp + 0x100]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 5
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14034e793]
mov rcx, r14
call fcn.140001078
mov qword [rsi], rdi
mov qword [rsi + 8], rdi
lea rcx, [rsp + 0xa0]
call fcn.1400492c0
nop
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1401cc216
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rax, rsi
jmp 0x1401cc241
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14027a710
mov rbx, qword [rsp + 0x1a8]
add rsp, 0x160
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret