Function at 0x14000f0f0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x590]
sub rsp, 0x690
mov rax, qword [0x1400400b0]
xor rax, rsp
mov qword [rbp + 0x580], rax
mov r15, qword [0x14004cbb0]
xor r13d, r13d
mov qword [rsp + 0x58], rcx
mov r14d, 1
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x48], r14d
mov qword [rsp + 0x60], r15
test r15, r15
je 0x14000f17c
mov rcx, qword [rcx + 0x78]
test rcx, rcx
jne 0x14000f1b0
mov rcx, r15
call fcn.140018ea4
mov rax, qword [r15 + 0x1d0]
xor edx, edx
mov ecx, 0x2330
mov qword [0x14004cbb0], rax
call fcn.140002bfc
mov eax, r14d
mov rcx, qword [rbp + 0x580]
xor rcx, rsp
call fcn.14001f920
lea r11, [rsp + 0x690]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14000fbec
mov rbx, rax
movzx eax, word [rax]
cmp ax, 0x3a
je 0x14000f1c7
cmp ax, 0x2b
jne 0x14000f1cb
add rbx, 2
mov esi, r13d
nop
movzx edi, word [rbx]
lea rcx, [0x140037ab0]
movzx edx, di
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcschr]
nop dword [rax + rax]
test rax, rax
jne 0x14000f21e
movzx edx, di
lea rcx, str.:_n_r_t
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcschr]
nop dword [rax + rax]
test rax, rax
jne 0x14000f21e
mov eax, esi
lea ecx, [rsi + 1]
add rbx, 2
mov esi, ecx
mov word [rsp + rax*2 + 0x70], di
cmp ecx, 0x7f
jb 0x14000f1d0
mov eax, esi
mov rcx, r15
mov esi, dword [r15 + 0xc]
mov dword [rsp + 0x4c], esi
mov word [rsp + rax*2 + 0x70], r13w
call fcn.14001464c
mov dword [rsp + 0x50], eax
mov r12d, eax
cmp eax, 0xffffffff
je 0x14000f17c
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__get_osfhandle]
nop dword [rax + rax]
mov rcx, rax
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileSize]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x58]
mov edi, eax
mov dword [rsp + 0x54], eax
mov rcx, qword [rcx + 0x78]
call fcn.14000fbec
cmp byte [0x14004cbc5], r13b
mov rbx, rax
je 0x14000f2e5
mov r8d, 4
lea rdx, str.:EOF
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsnicmp]
nop dword [rax + rax]
test eax, eax
jne 0x14000f2e5
movzx ecx, word [rbx + 8]
test cx, cx
je 0x14000f2be
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_iswspace]
nop dword [rax + rax]
test eax, eax
je 0x14000f2e5
mov ecx, r12d
mov dword [r15 + 0xc], edi
mov byte [0x14004cba8], r14b
call fcn.140014604
mov eax, r13d
jmp 0x14000f17f
mov r14d, dword [rsp + 0x48]
cmp dword [0x1400449b4], r13d
je 0x14000f2f3
call fcn.140032318
mov ecx, r12d
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__get_osfhandle]
nop dword [rax + rax]
mov r9d, 1
xor r8d, r8d
mov rcx, rax
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFilePointer]
nop dword [rax + rax]
mov dword [r15 + 0xc], eax
cmp eax, esi
jl 0x14000f377
test r14d, r14d
jne 0x14000f377
mov esi, dword [rsp + 0x40]
test esi, esi
jne 0x14000fa9b
cmp dword [rsp + 0x48], r13d
je 0x14000fa9b
mov ecx, r12d
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__get_osfhandle]
nop dword [rax + rax]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFilePointer]
nop dword [rax + rax]
mov esi, dword [rsp + 0x4c]
mov r14d, r13d
mov dword [rsp + 0x48], r13d
jmp 0x14000f2e5
mov ecx, r12d
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__get_osfhandle]
nop dword [rax + rax]
mov rcx, rax
mov r14, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileType]
nop dword [rax + rax]
btr eax, 0xf
mov rcx, r14
cmp eax, 2
jne 0x14000f3c4
lea r9, [rsp + 0x40]
mov r8d, 0x200
lea rdx, [rbp + 0x170]
call fcn.14002bf68
mov esi, dword [rsp + 0x40]
jmp 0x14000f682
mov r9d, 1
lea rdi, [0x140050dd0]
xor r8d, r8d
lea r12, [0x140050dd0]
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFilePointer]
nop dword [rax + rax]
lea rcx, [0x14005b420]
mov r15d, eax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_AcquireSRWLockShared]
nop dword [rax + rax]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], r13
mov r8d, 0x200
lea rdx, [0x140050dd0]
mov rcx, r14
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
nop dword [rax + rax]
lea rcx, [0x14005b420]
mov ebx, eax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseSRWLockShared]
nop dword [rax + rax]
mov esi, dword [rsp + 0x40]
test ebx, ebx
jne 0x14000f44a
mov eax, r13d
jmp 0x14000f678
test esi, esi
jne 0x14000f456
mov eax, r13d
jmp 0x14000f678
mov r10d, dword [0x1400449b8]
mov ecx, esi
mov dword [rsp + 0x44], ecx
mov edx, esi
cmp r10d, 0xfde9
jne 0x14000f4b4
test r15d, r15d
jne 0x14000f4b4
movzx eax, word [0x140050dd0]
cmp ax, word [0x1400385a0]
jne 0x14000f4b4
movzx eax, byte [0x140050dd2]
cmp al, byte [0x1400385a2]
jne 0x14000f4b4
add esi, 0xfffffffd
lea rax, [0x140050dd3]
mov ecx, esi
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x44], ecx
mov r15d, 3
mov r12, rax
mov rdi, rax
mov edx, esi
lea r8, [0x140000000]
test esi, esi
jle 0x14000f542
cmp edx, 3
jl 0x14000f4df
movzx eax, byte [rdi]
cmp al, 0xa
jne 0x14000f4d5
cmp byte [rdi + 1], 0xd
jmp 0x14000f4dd
cmp al, 0xd
jne 0x14000f4df
cmp byte [rdi + 1], 0xa
je 0x14000f50f
movzx eax, byte [rdi]
cmp byte [rax + r8 + 0x5b320], r13b
je 0x14000f4fe
cmp ecx, 1
je 0x14000f57c
add rdi, 2
add ecx, 0xfffffffe
jmp 0x14000f503
inc rdi
dec ecx
mov dword [rsp + 0x44], ecx
mov edx, ecx
test ecx, ecx
jg 0x14000f4c3
jmp 0x14000f542
mov esi, edi
mov byte [rdi + 2], r13b
sub esi, r12d
xor r9d, r9d
add esi, 2
xor r8d, r8d
mov rcx, r14
lea edx, [rsi + r15]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFilePointer]
nop dword [rax + rax]
mov r10d, dword [0x1400449b8]
lea r8, [0x140000000]
mov edx, 1
mov eax, r10d
cmp r10d, 0xdeaa
ja 0x14000f61b
je case.0x14000f639.57003
cmp eax, 0xc42c
ja 0x14000f5e9
je case.0x14000f639.57003
cmp eax, 0x2a
je case.0x14000f639.57003
jmp case.default.0x14000f639
lea rcx, [0x14005b420]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_AcquireSRWLockShared]
nop dword [rax + rax]
lea rdx, [rdi + 1]
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x44]
mov r8d, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
nop dword [rax + rax]
lea rcx, [0x14005b420]
mov ebx, eax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseSRWLockShared]
nop dword [rax + rax]
test ebx, ebx
je 0x14000f5d9
cmp dword [rsp + 0x44], r13d
je 0x14000f5d9
inc esi
jmp 0x14000f534
mov esi, r13d
mov dword [rsp + 0x40], r13d
mov eax, r13d
jmp 0x14000f678
cmp eax, 0xc433
ja 0x14000f604
je case.0x14000f639.57003
sub eax, 0xc42d
je case.0x14000f639.57003
sub eax, edx
je case.0x14000f639.57003
cmp eax, 3
je case.0x14000f639.57003
jmp case.default.0x14000f639
cmp eax, 0xc435
je case.0x14000f639.57003
cmp eax, 0xcec8
je case.0x14000f639.57003
cmp eax, 0xd698
je case.0x14000f639.57003
jmp case.default.0x14000f639
cmp eax, 0xfde8
ja 0x14000f63f
je case.0x14000f639.57003
add eax, 0xffff2155
cmp eax, 8
ja case.default.0x14000f639
mov ecx, dword [r8 + rax*4 + 0xfae4]
add rcx, r8
jmp rcx
cmp eax, 0xfde9
jne case.default.0x14000f639
mov edx, r13d
lea rax, [rbp + 0x170]
mov dword [rsp + 0x28], 0x200
mov r9d, esi
mov qword [rsp + 0x20], rax
mov r8, r12
mov ecx, r10d
call qword [sym.imp.api_ms_win_core_string_l1_1_0.dll_MultiByteToWideChar]
nop dword [rax + rax]
mov esi, eax
mov dword [rsp + 0x40], eax
mov r15, qword [rsp + 0x60]
mov r12d, dword [rsp + 0x50]
test eax, eax
je 0x14000f32d
test esi, esi
je 0x14000f335
cmp esi, 0xffffffff
je 0x14000f32d
cmp word [rbp + 0x170], r13w
je 0x14000f32d
cmp word [rsp + 0x70], r13w
je 0x14000f32d
mov eax, esi
add rax, rax
cmp rax, 0x402
jae 0x14000fadb
mov edx, 0x3a
mov word [rbp + rax + 0x170], r13w
lea rcx, [rbp + 0x170]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcschr]
nop dword [rax + rax]
mov esi, dword [rsp + 0x4c]
mov r14, rax
test rax, rax
je 0x14000f2e0
nop word [rax + rax]
mov rdi, r14
add r14, 2
cmp word [rdi], 0xa
je 0x14000f726
nop dword [rax]
lea rax, [rbp + 0x170]
cmp rdi, rax
je 0x14000f726
sub rdi, 2
cmp word [rdi], 0xa
jne 0x14000f710
cmp word [rdi], 0x3a
je 0x14000f730
add rdi, 2
mov rbx, rdi
test rdi, rdi
je 0x14000f77a
movzx esi, word [rbx]
movzx ecx, si
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_iswspace]
nop dword [rax + rax]
test eax, eax
je 0x14000f754
cmp si, 0xa
jne 0x14000f774
movzx edx, si
lea rcx, [0x140037ab0]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcschr]
nop dword [rax + rax]
test rax, rax
je 0x14000f77a
test si, si
je 0x14000f77a
add rbx, 2
jmp 0x14000f738
cmp word [rbx], 0x3a
jne 0x14000f921
test rdi, rdi
jne 0x14000f78e
mov r14, r13
jmp 0x14000f7aa
mov edx, 0xa
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcschr]
nop dword [rax + rax]
mov r14, rax
test rax, rax
jne 0x14000f7f0
mov ecx, r12d
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__get_osfhandle]
nop dword [rax + rax]
mov r9d, 1
xor r8d, r8d
mov rcx, rax
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFilePointer]
nop dword [rax + rax]
cmp eax, dword [rsp + 0x54]
je 0x14000f7f0
mov esi, dword [rsp + 0x40]
cmp esi, 0x200
jne 0x14000f94f
nop dword [rax]
movzx edi, word [rbx]
movzx ecx, di
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_iswspace]
nop dword [rax + rax]
test eax, eax
je 0x14000f80c
cmp di, 0xa
jne 0x14000f82c
movzx edx, di
lea rcx, [0x140037ab0]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcschr]
nop dword [rax + rax]
test rax, rax
je 0x14000f832
test di, di
je 0x14000f832
add rbx, 2
jmp 0x14000f7f0
movzx eax, word [rbx]
cmp ax, 0x3a
je 0x14000f841
cmp ax, 0x2b
jne 0x14000f845
add rbx, 2
test rbx, rbx
je 0x14000f892
nop word [rax + rax]
movzx edi, word [rbx]
movzx ecx, di
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_iswspace]
nop dword [rax + rax]
test eax, eax
je 0x14000f86c
cmp di, 0xa
jne 0x14000f88c
movzx edx, di
lea rcx, [0x140037ab0]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcschr]
nop dword [rax + rax]
test rax, rax
je 0x14000f892
test di, di
je 0x14000f892
add rbx, 2
jmp 0x14000f850
mov esi, r13d
nop word [rax + rax]
movzx edi, word [rbx]
lea rcx, str.:_n_r_t
movzx edx, di
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcschr]
nop dword [rax + rax]
test rax, rax
jne 0x14000f8fc
movzx edx, di
lea rcx, [0x140038ad0]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcschr]
nop dword [rax + rax]
test rax, rax
jne 0x14000f8fc
cmp di, 0x5e
jne 0x14000f8e7
movzx edi, word [rbx + 2]
add rbx, 2
mov eax, esi
lea ecx, [rsi + 1]
add rbx, 2
mov esi, ecx
mov word [rbp + rax*2 + 0x70], di
cmp ecx, 0x7f
jb 0x14000f8a0
mov eax, esi
lea rdx, [rbp + 0x70]
lea rcx, [rsp + 0x70]
mov word [rbp + rax*2 + 0x70], r13w
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x14000f9da
test r14, r14
je 0x14000fa89
mov edx, 0x3a
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcschr]
nop dword [rax + rax]
mov r14, rax
test rax, rax
jne 0x14000f700
jmp 0x14000fa89
mov ecx, dword [0x1400449b8]
lea rax, [rbp + 0x170]
sub rdi, rax
mov eax, ecx
sar rdi, 1
sub esi, edi
sub eax, 0x3a4
je 0x14000f97c
sub eax, 4
je 0x14000f97c
sub eax, 0xd
je 0x14000f97c
cmp eax, 1
jne 0x14000f9aa
mov qword [rsp + 0x38], r13
lea r8, [rbp + 0x170]
mov qword [rsp + 0x30], r13
mov r9d, esi
mov dword [rsp + 0x28], r13d
xor edx, edx
mov qword [rsp + 0x20], r13
call qword [sym.imp.api_ms_win_core_string_l1_1_0.dll_WideCharToMultiByte]
nop dword [rax + rax]
mov esi, eax
mov ecx, r12d
neg esi
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__get_osfhandle]
nop dword [rax + rax]
mov r9d, 1
xor r8d, r8d
mov rcx, rax
mov edx, esi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFilePointer]
nop dword [rax + rax]
jmp 0x14000fa89
mov rax, qword [rsp + 0x58]
mov ecx, dword [0x1400449b8]
movzx eax, byte [rax + 0x80]
and al, 1
mov byte [0x14004cba8], al
mov eax, ecx
test r14, r14
jne 0x14000fa1e
sub eax, 0x3a4
je 0x14000fa17
sub eax, 4
je 0x14000fa17
sub eax, 0xd
je 0x14000fa17
cmp eax, 1
je 0x14000fa17
mov eax, dword [rsp + 0x40]
jmp 0x14000fa85
mov r9d, dword [rsp + 0x40]
jmp 0x14000fa5c
sub eax, 0x3a4
je 0x14000fa4b
sub eax, 4
je 0x14000fa4b
sub eax, 0xd
je 0x14000fa4b
cmp eax, 1
je 0x14000fa4b
lea rax, [rbp + 0x170]
sub r14, rax
add r14, 2
sar r14, 1
add dword [r15 + 0xc], r14d
jmp 0x14000fa89
lea rax, [rbp + 0x170]
sub r14, rax
lea r9, [r14 + 2]
sar r9, 1
mov qword [rsp + 0x38], r13
lea r8, [rbp + 0x170]
mov qword [rsp + 0x30], r13
xor edx, edx
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
call qword [sym.imp.api_ms_win_core_string_l1_1_0.dll_WideCharToMultiByte]
nop dword [rax + rax]
add dword [r15 + 0xc], eax
cmp byte [0x14004cba8], 1
je 0x14000facb
mov esi, dword [rsp + 0x4c]
jmp 0x14000f2e0
mov rcx, r15
call fcn.140018ea4
mov rax, qword [r15 + 0x1d0]
lea r8, [rsp + 0x70]
mov edx, 1
mov qword [0x14004cbb0], rax
mov ecx, 0x400023ab
call fcn.140002bfc
mov r13d, 1
mov ecx, r12d
call fcn.140014604
mov eax, r13d
jmp 0x14000f17f
call fcn.14001fa58
int3