Function at 0x1400fea40
Capabilities:
Get file size
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbx
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
xor r12d, r12d
mov rcx, rdx
lea rdx, [rbp - 8]
mov qword [rbp - 0x10], r12
mov edi, r12d
mov qword [rbp - 8], r12
mov r13, r9
or rbx, 0xffffffffffffffff
call fcn.140079440
mov r14, qword [rbp - 8]
mov r15d, eax
test eax, eax
js 0x1400fec17
xor r15d, r15d
lea r8d, [rbx + 6]
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov dword [rsp + 0x28], r15d
mov edx, 0x80000000
mov rcx, r14
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea rcx, [rax + 1]
test rcx, 0xfffffffffffffffe
jne 0x1400feaf7
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400feade
mov r15d, 0x80004005
jmp 0x1400feaef
movzx r15d, ax
or r15d, 0x80070000
test eax, eax
cmovle r15d, eax
mov ecx, r15d
jmp 0x1400fec19
mov rcx, rax
lea rdx, [rbp - 0x20]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r12d, eax
cmp eax, 0xffffffff
jne 0x1400feb1a
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor r12d, r12d
jmp 0x1400fead2
cmp dword [rbp - 0x20], r15d
je 0x1400feb35
mov ecx, 0x80070057
mov r15d, ecx
call fcn.14007ac40
xor r12d, r12d
jmp 0x1400fec1e
cmp r12d, 0x100000
ja 0x1400feb20
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r12
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x1400feb65
mov rdx, rax
mov rdi, rax
test rax, rax
jne 0x1400feb70
mov r15d, 0x8007000e
mov ecx, r15d
jmp 0x1400feb28
mov rcx, rbx
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x1c]
mov r8d, r12d
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400feb0f
cmp dword [rbp - 0x1c], r12d
je 0x1400feb97
mov r15d, 0x8000ffff
jmp 0x1400feb6b
mov r15, qword [rbp + 0x40]
mov r15, qword [r15 + 0xb8]
mov rax, qword [r15]
mov rdi, qword [rax + 0x18]
mov rax, qword [0x1403d25b8]
mov rcx, rdi
call rax
lea rcx, [rbp - 0x18]
mov rax, rdi
mov qword [rsp + 0x20], rcx
lea r9, [rbp - 0x10]
mov rcx, r15
mov r8d, r12d
mov rdx, rsi
call rax
xor r12d, r12d
mov r15d, eax
test eax, eax
jns 0x1400febe6
mov ecx, eax
call fcn.14007ac40
mov rdi, rsi
jmp 0x1400fec1e
mov r8, qword [rbp + 0x50]
mov r9, r13
mov edx, dword [rbp - 0x18]
mov rcx, qword [rbp - 0x10]
call fcn.140100aec
mov r15d, eax
test eax, eax
js 0x1400febda
mov rcx, qword [rbp + 0x48]
lea rdx, [r13 + 0x20]
call fcn.14007ab14
mov r15d, eax
mov rdi, rsi
test eax, eax
jns 0x1400fec1e
mov ecx, eax
call fcn.14007ac40
mov ecx, r15d
call fcn.14007ace8
test r14, r14
je 0x1400fec47
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [r14 - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.14007ace8
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x1400fec5a
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbp - 0x10], r12
test rdi, rdi
je 0x1400fec73
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400fec86
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0xb8]
mov eax, r15d
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret