Function at 0x1401e23e4
Capabilities:
Get file size
Read file on windows

Disassembly:
mov r11, rsp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x160
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [r11 + 0x20], rbx
mov rax, qword [0x14044e770]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rbx, r8
mov r15, rdx
mov r14, rcx
mov qword [rsp + 0x70], rcx
xor esi, esi
mov qword [rsp + 0x40], rsi
lea rdx, str.:Zone.Identifier:_DATA
lea rcx, [r11 - 0xa8]
call fcn.14004a9e4
mov rdi, rax
mov rdx, r15
lea rcx, [rsp + 0xc0]
call fcn.14004a36c
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.140099824
nop
lea rcx, [rsp + 0xc0]
call fcn.14004b500
nop
lea rcx, [rsp + 0xe0]
call fcn.14004b500
mov byte [rsp + 0x20], sil
lea r9, [rsp + 0x40]
lea edi, [rsi + 7]
mov r8d, edi
mov r15d, 0x80000000
mov edx, r15d
lea rcx, [rsp + 0xa0]
call fcn.1401e1fb8
mov dword [rsp + 0x34], eax
test eax, eax
jns 0x1401e2613
cmp eax, 0x80070005
je 0x1401e24c0
cmp eax, 0xd0000022
jne 0x1401e250d
cmp qword [rbx], rsi
je 0x1401e250d
call fcn.1401f2ab4
mov r8, qword [rbx]
mov r8, qword [r8 + 0x58]
lea rdx, [rsp + 0x48]
mov rcx, rax
call fcn.1401f2dfc
mov byte [rsp + 0x20], sil
lea r9, [rsp + 0x40]
mov r8d, edi
mov edx, r15d
lea rcx, [rsp + 0xa0]
call fcn.1401e1fb8
mov dword [rsp + 0x34], eax
lea rcx, [rsp + 0x48]
call fcn.1401f2a80
mov eax, dword [rsp + 0x34]
test eax, eax
jns 0x1401e2613
call fcn.14004acb4
mov r10, qword [rax + 8]
cmp dword [r10], 4
jbe 0x1401e25dc
lea rax, str.Failed_to_open_file._Cant_retrieve_the_MarkOfWebInformation
mov qword [rsp + 0x120], rax
mov qword [rsp + 0x128], 0x7a
lea rdx, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 8
cmovae rdx, qword [rsp + 0xa0]
lea rcx, [0x14030cae0]
mov rax, rsi
test rdx, rdx
je 0x1401e257c
mov rcx, rdx
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], si
jne 0x1401e2573
mov qword [rsp + 0x130], rcx
lea eax, [rax*2 + 2]
mov dword [rsp + 0x138], eax
mov dword [rsp + 0x13c], esi
lea rax, [rsp + 0x34]
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x148], 4
lea rax, [rsp + 0x100]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 5
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14039d854]
mov rcx, r10
call fcn.140001158
mov qword [r14], rsi
mov qword [r14 + 8], rsi
lea rcx, [rsp + 0xa0]
call fcn.14004b500
nop
mov rcx, qword [rsp + 0x40]
lea rdx, [rcx - 1]
cmp rdx, 0xfffffffffffffffd
setbe dl
test dl, dl
je 0x1401e260b
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rax, r14
jmp 0x1401e2ba3
xor edx, edx
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r13d, eax
lea ecx, [rax - 1]
cmp ecx, 0xfffffffd
ja 0x1401e2a76
mov edi, eax
cmp dword [0x14044eae4], eax
cmovb edi, dword [0x14044eae4]
mov dword [rsp + 0x38], esi
mov byte [rsp + 0x30], sil
lea edx, [rdi + 1]
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x58]
call fcn.14007dfa0
nop
xor edx, edx
lea r8d, [rdx + 0x20]
lea rcx, [rsp + 0x80]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
mov r8d, edi
mov rdx, qword [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r15d, eax
test eax, eax
je 0x1401e2802
cmp eax, 0x3e5
je 0x1401e2802
call fcn.14004acb4
mov r10, qword [rax + 8]
cmp dword [r10], 4
jbe 0x1401e277b
lea rcx, str.Failed_to_read_from_MoW_stream._Cant_retrieve_the_MarkOfWebInformation
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x128], 0x90
lea rdx, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 8
cmovae rdx, qword [rsp + 0xa0]
lea rcx, [0x14030cae0]
mov rax, rsi
test rdx, rdx
je 0x1401e2716
mov rcx, rdx
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], si
jne 0x1401e270d
mov qword [rsp + 0x130], rcx
lea eax, [rax*2 + 2]
mov dword [rsp + 0x138], eax
mov dword [rsp + 0x13c], esi
mov dword [rsp + 0x48], r15d
lea rax, [rsp + 0x48]
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x148], 4
lea rax, [rsp + 0x100]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 5
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14039d7d9]
mov rcx, r10
call fcn.140001158
mov qword [r14], rsi
mov qword [r14 + 8], rsi
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1401e27d4
mov rax, qword [rsp + 0x68]
sub rax, rcx
mov rdx, rcx
cmp rax, 0x1000
jb 0x1401e27c1
test dl, 0x1f
jne 0x1401e27ba
mov rcx, qword [rcx - 8]
cmp rcx, rdx
jae 0x1401e27ba
sub rdx, rcx
sub rdx, 8
cmp rdx, 0x1f
jbe 0x1401e27c1
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__invalid_parameter_noinfo_noreturn]
int3
call fcn.1402aed28
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rsi
lea rcx, [rsp + 0xa0]
call fcn.14004b500
nop
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
setbe al
test al, al
je 0x1401e27fa
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rax, r14
jmp 0x1401e2ba3
mov r9d, 1
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x1401e297d
call fcn.14004acb4
mov rdi, qword [rax + 8]
cmp dword [rdi], 4
jbe 0x1401e28f6
lea rcx, str.Failed_to_read_from_MoW_stream._Cant_retrieve_the_MarkOfWebInformation
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x128], 0x90
lea rdx, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 8
cmovae rdx, qword [rsp + 0xa0]
lea rcx, [0x14030cae0]
mov rax, rsi
test rdx, rdx
je 0x1401e288c
mov rcx, rdx
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], si
jne 0x1401e2883
mov qword [rsp + 0x130], rcx
lea eax, [rax*2 + 2]
mov dword [rsp + 0x138], eax
mov dword [rsp + 0x13c], esi
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rsp + 0x48], eax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x148], 4
lea rax, [rsp + 0x100]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 5
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14039d7d9]
mov rcx, rdi
call fcn.140001158
mov qword [r14], rsi
mov qword [r14 + 8], rsi
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1401e294f
mov rax, qword [rsp + 0x68]
sub rax, rcx
mov rdx, rcx
cmp rax, 0x1000
jb 0x1401e293c
test dl, 0x1f
jne 0x1401e2935
mov rcx, qword [rcx - 8]
cmp rcx, rdx
jae 0x1401e2935
sub rdx, rcx
sub rdx, 8
cmp rdx, 0x1f
jbe 0x1401e293c
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__invalid_parameter_noinfo_noreturn]
int3
call fcn.1402aed28
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rsi
lea rcx, [rsp + 0xa0]
call fcn.14004b500
nop
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
setbe al
test al, al
je 0x1401e2975
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rax, r14
jmp 0x1401e2ba3
cmp dword [rsp + 0x38], edi
je 0x1401e2988
call fcn.140298678
mov ecx, 0x38
call fcn.1402aee08
mov r15, rax
mov dword [rax + 8], 1
mov dword [rax + 0xc], 1
lea rax, vtable.std::_Ref_count_obj_struct_sense::cyberData::MowInformation_.0
mov qword [r15], rax
xor edx, edx
lea r8d, [rdx + 0x28]
lea rcx, [r15 + 0x10]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov dword [r15 + 0x10], esi
mov qword [r15 + 0x28], rsi
mov qword [r15 + 0x30], SafeArrayAccessData
mov byte [r15 + 0x18], sil
lea rdi, [r15 + 0x10]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r15
mov dword [rdi], r13d
lea rcx, [rdi + 8]
mov rdx, qword [rsp + 0x58]
call fcn.1400639c4
mov qword [r14], rdi
mov qword [r14 + 8], r15
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1401e2a48
mov rax, qword [rsp + 0x68]
sub rax, rcx
mov rdx, rcx
cmp rax, 0x1000
jb 0x1401e2a35
test dl, 0x1f
jne 0x1401e2a2e
mov rcx, qword [rcx - 8]
cmp rcx, rdx
jae 0x1401e2a2e
sub rdx, rcx
sub rdx, 8
cmp rdx, 0x1f
jbe 0x1401e2a35
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__invalid_parameter_noinfo_noreturn]
int3
call fcn.1402aed28
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rsi
lea rcx, [rsp + 0xa0]
call fcn.14004b500
nop
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
setbe al
test al, al
je 0x1401e2a6e
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rax, r14
jmp 0x1401e2ba3
call fcn.14004acb4
mov rdi, qword [rax + 8]
cmp dword [rdi], 4
jbe 0x1401e2b46
lea rax, str.Failed_to_retrieve_the_MarOfWeb_stream_size.
mov qword [rsp + 0x120], rax
mov qword [rsp + 0x128], 0x5a
lea rdx, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 8
cmovae rdx, qword [rsp + 0xa0]
lea rcx, [0x14030cae0]
mov rax, rsi
test rdx, rdx
je 0x1401e2adc
mov rcx, rdx
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], si
jne 0x1401e2ad3
mov qword [rsp + 0x130], rcx
lea eax, [rax*2 + 2]
mov dword [rsp + 0x138], eax
mov dword [rsp + 0x13c], esi
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rsp + 0x48], eax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x148], 4
lea rax, [rsp + 0x100]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 5
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14039d7d9]
mov rcx, rdi
call fcn.140001158
mov qword [r14], rsi
mov qword [r14 + 8], rsi
lea rcx, [rsp + 0xa0]
call fcn.14004b500
nop
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
setbe al
test al, al
je 0x1401e2b73
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rax, r14
jmp 0x1401e2ba3
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1402ae860
mov rbx, qword [rsp + 0x1a8]
add rsp, 0x160
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret