Function at 0x1400022f0
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov rax, qword [0x140021020]
xor rax, rsp
mov qword [rbp + 0x150], rax
xor r15d, r15d
movzx r14d, dl
xor r9d, r9d
mov qword [rsp + 0x30], r15
lea r8d, [r15 + 1]
mov edx, 0x80000000
mov dword [rsp + 0x28], r15d
mov rsi, rcx
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140002356
xor al, al
jmp 0x140002647
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x2a0], rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
xor r9d, r9d
xor r8d, r8d
lea edx, [rax - 0x88]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
xor eax, eax
lea r9, [rsp + 0x40]
lea rdx, [rbp - 0x30]
mov r8d, 0x88
mov rcx, rdi
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
mov qword [rbp], rax
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], rax
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], rax
mov qword [rbp + 0x50], rax
mov dword [rsp + 0x40], r15d
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
movabs rax, 0xdead13371337beef
cmp qword [rbp + 0x50], rax
jne 0x14000254b
add ebx, 0xffffff78
lea rcx, [rbp + 0x60]
mov edx, ebx
mov r14d, ebx
call fcn.1400014f0
mov rsi, qword [rbp + 0x60]
lea r9, [rsp + 0x40]
mov rdx, rsi
mov r8d, ebx
mov rcx, rdi
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x140002534
xor eax, eax
lea rcx, [rbp + 0x80]
mov r8d, r14d
mov rdx, rsi
mov qword [rbp + 0x80], rax
mov qword [rbp + 0x88], rax
mov qword [rbp + 0x90], rax
mov qword [rbp + 0x98], rax
mov qword [rbp + 0xa0], rax
mov qword [rbp + 0xa8], rax
mov qword [rbp + 0xb0], rax
mov qword [rbp + 0xb8], rax
call fcn.140003550
lea rcx, [rbp + 0xc0]
xor edx, edx
mov r8d, 0x88
mov dword [rbp + 0x60], 0x725e8104
mov dword [rbp + 0x64], 0xa09f6cbc
mov dword [rbp + 0x68], 0x7179e921
mov dword [rbp + 0x6c], 0xc41291ea
mov dword [rbp + 0x70], 0xdf25b8fa
mov dword [rbp + 0x74], 0xf1cd8357
mov dword [rbp + 0x78], 0x1fdabd90
mov dword [rbp + 0x7c], 0x86063b19
mov qword [rsp + 0x68], r15
call fcn.140008110
lea rax, [rbp + 0x60]
lea r8, [rbp - 0x30]
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0xc0]
mov r9d, 0x88
mov qword [rsp + 0x20], rax
call fcn.140003b50
test eax, eax
jne 0x140002534
lea r8d, [rax + 0x40]
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0xc0]
call fcn.140008030
test eax, eax
sete bl
jmp 0x140002536
xor bl, bl
test rsi, rsi
je 0x140002543
mov rcx, rsi
call fcn.140006d0c
movzx eax, bl
jmp 0x14000263f
xor eax, eax
lea rcx, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
lea r8d, [rax + 0x50]
mov dword [rsp + 0x48], 0x20
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], r15
mov dword [rbp - 0x40], 0xaac56b
mov dword [rbp - 0x3c], 0x11d0cd44
mov dword [rbp - 0x38], 0xc000c28c
mov dword [rbp - 0x34], 0xee95c24f
call fcn.140008110
mov eax, r15d
test r14b, r14b
mov ecx, 0x1000
lea r8, [rsp + 0x70]
setne al
cmp byte [0x140022a41], r15b
lea rdx, [rbp - 0x40]
mov dword [rbp - 0x74], eax
mov eax, dword [rbp - 0x48]
mov dword [rsp + 0x70], 0x50
cmovne eax, ecx
xor ecx, ecx
mov qword [rsp + 0x78], r15
mov dword [rbp - 0x48], eax
lea rax, [rsp + 0x48]
mov qword [rbp - 0x80], r15
mov dword [rbp - 0x78], 2
mov dword [rbp - 0x70], 1
mov dword [rbp - 0x60], 1
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x50], r15
mov dword [rbp - 0x44], r15d
call sub.WINTRUST.dll_WinVerifyTrust
lea r8, [rsp + 0x70]
lea rdx, [rbp - 0x40]
xor ecx, ecx
mov dword [rbp - 0x60], 2
mov ebx, eax
call sub.WINTRUST.dll_WinVerifyTrust
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
sete al
mov rbx, qword [rsp + 0x2a0]
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.140006c80
add rsp, 0x260
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret