Function at 0x1400226f8
Capabilities:
Get disk size
Get file size
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1850]
mov eax, 0x1950
call fcn.1400be0c0
sub rsp, rax
mov qword [rbp - 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x19a0], rbx
mov rax, qword [0x140197e90]
xor rax, rsp
mov qword [rbp + 0x1840], rax
mov r15, rdx
mov rsi, rcx
mov qword [rbp - 0x50], rcx
xor r13d, r13d
mov dword [rsp + 0x40], r13d
lea rcx, [0x1401979a8]
mov rax, qword [0x1401979a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsi], rax
lea r14d, [r13 + 1]
mov edi, r14d
mov dword [rsp + 0x40], r14d
mov ecx, dword [0x14019fd80]
lea r8d, [rcx + 2]
lea eax, [rcx + 1]
imul r8d, eax
imul r8d, ecx
mov eax, 0x38e38e39
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub r8d, eax
cmp r8d, 0x10
jne 0x1400227ba
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov rax, qword [r15]
mov ebx, 2
lea r12d, [rbx + 1]
cmp dword [rax - 0x10], r13d
je 0x14002283b
movzx eax, word [rax]
cmp ax, word [0x14012e2f8]
jne 0x1400227dd
mov eax, r13d
jmp 0x1400227e2
sbb eax, eax
or eax, r14d
test eax, eax
je 0x14002283b
lea rcx, [rbp - 0x70]
call fcn.1400215d0
nop
mov edi, r12d
mov dword [rsp + 0x40], r12d
mov rcx, qword [rax]
mov eax, r13d
test rcx, rcx
setne al
test eax, eax
jne 0x140022813
mov ecx, 0x80004005
call fcn.140001874
int3
mov rax, qword [r15]
sub rcx, rax
movzx edx, word [rax]
cmp dx, word [rax + rcx]
jne 0x14002282f
add rax, rbx
test dx, dx
jne 0x140022819
mov eax, r13d
jmp 0x140022834
sbb eax, eax
or eax, r14d
test eax, eax
je 0x14002283b
mov r14b, r13b
test bl, dil
je 0x14002286b
and edi, 0xfffffffd
mov dword [rsp + 0x40], edi
mov rdx, qword [rbp - 0x70]
add rdx, 0xffffffffffffffe8
or rdi, 0xffffffffffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x14002286f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14002286f
or rdi, 0xffffffffffffffff
test r14b, r14b
je 0x1400228b1
lea rcx, [rbp - 0x68]
call fcn.1400215d0
nop
mov rdx, rax
mov rcx, rsi
call fcn.140001d7c
nop
mov rdx, qword [rbp - 0x68]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x140022c6a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140022c6a
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov rcx, qword [r15]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, rdi
jne 0x1400228fa
lea rcx, [rsp + 0x78]
call fcn.1400215d0
nop
mov rdx, rax
mov rcx, rsi
call fcn.140001d7c
nop
mov rdx, qword [rsp + 0x78]
jmp 0x14002288e
xor eax, eax
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x60]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x140022950
lea rcx, [rbp - 0x60]
call fcn.1400215d0
nop
mov rdx, rax
mov rcx, rsi
call fcn.140001d7c
nop
mov rdx, qword [rbp - 0x60]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x140022c61
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140022c61
cmp dword [rsp + 0x64], r13d
je 0x140022973
lea rcx, [rbp - 0x78]
call fcn.1400215d0
nop
mov rdx, rax
mov rcx, rsi
call fcn.140001d7c
nop
mov rdx, qword [rbp - 0x78]
jmp 0x14002292d
cmp dword [rsp + 0x60], r13d
je 0x140022c61
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r13
mov edx, dword [rsp + 0x60]
lea rcx, [rsp + 0x48]
call fcn.140022ef4
mov dword [rsp + 0x70], r13d
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x70]
mov r8d, dword [rsp + 0x60]
mov rdi, qword [rsp + 0x48]
mov rdx, rdi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400229d5
test rdi, rdi
je 0x140022c61
mov rcx, rdi
jmp 0x140022c4d
mov r14b, r13b
mov r15b, r13b
mov al, byte [rdi]
cmp al, 0xff
jne 0x1400229ec
cmp byte [rdi + 1], 0xfe
jne 0x1400229ec
mov r14b, 1
jmp 0x140022a24
cmp al, 0xfe
jne 0x140022a03
cmp byte [rdi + 1], 0xff
jne 0x140022a03
mov eax, 1
mov r14b, al
mov r15b, al
jmp 0x140022a24
cmp al, 0xef
jne 0x140022b4b
cmp byte [rdi + 1], 0xbb
jne 0x140022b4b
cmp byte [rdi + 2], 0xbf
jne 0x140022b4b
mov ebx, 3
movsxd rdx, ebx
add rdx, rdi
mov rbx, qword [rsp + 0x50]
cmp rdx, rbx
jne 0x140022a39
mov rbx, rdi
jmp 0x140022a4f
cmp rdi, rdx
je 0x140022a54
sub rbx, rdx
mov r8, rbx
mov rcx, rdi
call fcn.1400b9040
add rbx, rdi
mov qword [rsp + 0x50], rbx
test r15b, r15b
je 0x140022b50
mov rcx, rdi
mov r9d, dword [0x14019fd80]
mov r8d, r9d
imul r8d, r9d
mov eax, 0x2aaaaaab
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub r8d, eax
mov r15d, 1
cmp r8d, 3
jne 0x140022a9f
add r9d, r15d
mov dword [0x14019fd80], r9d
cmp rdi, rbx
je 0x140022ab9
mov r8b, byte [rcx + 1]
mov dl, byte [rcx]
mov byte [rcx + 1], dl
mov byte [rcx], r8b
add rcx, 2
cmp rcx, rbx
jne 0x140022aa4
imul r9d, r9d
mov eax, 0x2e8ba2e9
imul r9d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xb
sub r9d, edx
cmp r9d, 6
jne 0x140022b50
mov word [rbp - 0x40], r13w
xor edx, edx
mov r8d, 0x187e
lea rcx, [rbp - 0x3e]
call fcn.1400be450
mov r10, r13
or r9, 0xffffffffffffffff
mov r8, r13
test r10, r10
je 0x140022b23
test r8, r8
je 0x140022b23
lea rcx, [r9 + r8]
lea rax, [r9 + r8]
movzx edx, word [rsp + rcx*2 + 0x52]
add dx, word [rbp + rax*2 - 0x40]
add dx, r15w
lea rax, [r9 + r8]
mov word [rbp + rax*2 - 0x3e], dx
add r8, r15
cmp r8, 0x38
jl 0x140022afa
add r10, r15
add r9, 0x38
cmp r9, 0xc3f
jl 0x140022af7
movsx eax, word [rbp + 0x183e]
mov dword [0x14019fd80], eax
jmp 0x140022b50
mov rbx, qword [rsp + 0x50]
sub rbx, rdi
cmp byte [rdi + rbx - 1], r13b
je 0x140022b9b
mov r15d, 1
add rbx, r15
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.140022ef4
mov rdi, qword [rsp + 0x48]
mov byte [rdi + rbx - 1], r13b
test r14b, r14b
je 0x140022be8
add rbx, r15
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.140022ef4
mov rdx, qword [rsp + 0x48]
mov byte [rdx + rbx - 1], r13b
jmp 0x140022bb8
test r14b, r14b
je 0x140022be8
lea rdx, [rbx + 2]
lea rcx, [rsp + 0x48]
call fcn.140022ef4
mov rdx, qword [rsp + 0x48]
mov word [rdx + rbx], r13w
lea rcx, [rbp - 0x80]
call fcn.140001cb0
nop
mov rdx, rax
mov rcx, rsi
call fcn.140001d7c
nop
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140022c43
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140022c43
lea rcx, [0x1401979a8]
mov rax, qword [0x1401979a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
mov rdx, rdi
lea rcx, [rsp + 0x68]
call fcn.140002b78
nop
lea rdx, [rsp + 0x68]
mov rcx, rsi
call fcn.140001d7c
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140022c37
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, rsi
mov rcx, rsi
call fcn.140020b2c
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140022c61
call fcn.1400b8ff4
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rsi
mov rcx, qword [rbp + 0x1840]
xor rcx, rsp
call fcn.1400b9010
mov rbx, qword [rsp + 0x19a0]
add rsp, 0x1950
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret