Function at 0x140044010
Capabilities:
Get file size
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x428]
sub rsp, 0x500
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x1401c1050]
xor rax, rsp
mov qword [rbp + 0x3d0], rax
mov r15, rcx
xor r12d, r12d
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], r12w
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x80], r12
lea r8d, [r12 + 1]
lea rdx, [0x140191dc0]
lea rcx, [rsp + 0x68]
call fcn.140006890
nop
lea rdx, [rsp + 0x68]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rbp - 0x80]
cmp rsi, 8
cmovae rdx, rbx
lea rdi, [r15 + 0x68]
mov rcx, rdi
call fcn.14003bc90
mov qword [rbp - 0x78], r12
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
mov r8d, eax
cmp qword [rdi + 0x10], r8
cmovb r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x1400440d5
mov rdx, qword [rdi]
lea rcx, [rbp - 0x78]
call fcn.140006890
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x140044120
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004411b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400445a5
call fcn.14007c190
movups xmm0, xmmword [rbp - 0x78]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rbp - 0x68]
movups xmmword [rsp + 0x58], xmm1
movabs rax, 0x7ffffffffffffffe
movq rcx, xmm1
sub rax, rcx
mov rdx, qword [rsp + 0x78]
cmp rax, rdx
jb 0x1400445ab
lea r9, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae r9, qword [rsp + 0x48]
lea rax, [rsp + 0x68]
cmp rsi, 8
cmovae rax, rbx
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x58]
call fcn.1400072d0
nop
lea rdx, str.asu.trace
lea rcx, [rbp - 0x58]
call fcn.140006480
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x1400441f2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400441ed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400445b1
call fcn.14007c190
movups xmmword [rsp + 0x48], xmm6
movups xmmword [rsp + 0x58], xmm7
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb 0x14004423c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140044237
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400445b7
call fcn.14007c190
mov eax, dword [r15 + 0x88]
cmp eax, 0xa
je 0x14004425c
mov ecx, 0xa00000
mov r14d, 0x1400000
cmp eax, 0x14
cmovne r14d, ecx
jmp 0x140044262
mov r14d, 0x3200000
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp - 0x30]
call fcn.14007e870
mov qword [rsp + 0x40], r12
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rdx, qword [rsp + 0x48]
lea r8, str.rb__ccsUTF_8
lea rcx, [rsp + 0x40]
call fcn.14008ffc8
mov r9, qword [rsp + 0x40]
test r9, r9
je 0x1400442c0
mov edx, 1
lea r8d, [rdx + 8]
lea rcx, [rbp - 0x30]
call fcn.140091ef0
mov rcx, qword [rsp + 0x40]
call fcn.140090150
mov rcx, rdi
cmp qword [rdi + 0x18], 8
jb 0x1400442cd
mov rcx, qword [rdi]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400444e3
lea rdx, [rbp - 0x38]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov rcx, rsi
test eax, eax
je 0x1400444dd
mov rbx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov sil, 1
cmp rbx, r14
jl 0x1400444e6
mov byte [r15 + 0x130], sil
mov rcx, qword [r15 + 0x90]
test rcx, rcx
je 0x140044348
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, rdi
lea rcx, [rbp - 0x58]
call fcn.140006070
nop
lea rcx, [rbp - 0x58]
call fcn.14005ebc0
lea rdx, [rbp - 0x58]
mov rcx, rdi
call fcn.14003f590
test al, al
je 0x1400443de
mov r8b, 1
mov rcx, rdi
call fcn.1400421a0
test eax, eax
je 0x14004438e
cmp eax, 1
jne 0x1400443de
mov rcx, rdi
call fcn.14002d370
test al, al
je 0x1400443de
cmp qword [rdi + 0x18], 8
jb 0x140044398
mov rdi, qword [rdi]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x200080
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 3]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [r15 + 0x90], rax
test rax, rax
je 0x1400443de
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r15 + 0x90], r12
mov rax, qword [r15]
lea rdx, [r15 + 0x90]
mov rcx, r15
mov rax, qword [rax]
call qword [case.0x14004792d.0]
movzx esi, al
mov qword [rbp - 0x78], r12
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
mov r8d, 8
lea rdx, str.keeplogs
lea rcx, [rbp - 0x78]
call fcn.140006ad0
nop
lea r9, [rbp - 0x78]
mov rbx, qword [rbp - 0x78]
mov rdi, qword [rbp - 0x60]
cmp rdi, 0x10
cmovae r9, rbx
lea rax, [rbp - 0x30]
sub r9, rax
nop word [rax + rax]
movzx r8d, byte [rax]
movzx edx, byte [rax + r9]
sub r8d, edx
jne 0x140044455
inc rax
test edx, edx
jne 0x140044440
test r8d, r8d
je 0x140044463
mov rcx, r15
call fcn.140039760
nop
cmp rdi, 0x10
jb 0x14004449b
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140044492
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400445bd
mov rcx, rbx
call fcn.14007c190
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb 0x1400444e6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400444d6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400445c3
call fcn.14007c190
jmp 0x1400444e6
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor sil, sil
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x140044528
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140044522
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400445c9
call fcn.14007c190
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x140044566
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140044561
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004459f
call fcn.14007c190
movzx eax, sil
mov rcx, qword [rbp + 0x3d0]
xor rcx, rsp
call fcn.14007bb60
lea r11, [rsp + 0x500]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.140082b90
nop
call fcn.140082b90
nop
call fcn.140002490
nop
call fcn.140082b90
nop
call fcn.140082b90
nop
call fcn.140082b90
nop
call fcn.140082b90
nop
call fcn.140082b90
int3