Function at 0x140029d00
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xe0]
sub rsp, 0x1e0
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x230], rbx
mov rax, qword [0x140131088]
xor rax, rsp
mov qword [rbp + 0xd0], rax
mov r13, rdx
mov qword [rbp - 0x70], rdx
mov rsi, rcx
xor edi, edi
mov dword [rbp - 0x68], edi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x68], rdi
mov r12d, edi
mov r14d, edi
mov dword [rsp + 0x60], edi
mov r15d, edi
mov dword [rbp - 0x80], edi
mov qword [rbp + 0xa8], 7
mov qword [rbp + 0xa0], rdi
mov word [rbp + 0x90], di
xor edx, edx
mov r8d, 0xd0
lea rcx, [rbp - 0x40]
call fcn.1400a1560
lea edx, [rdi + 4]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x140029deb
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], rdi
cmp qword [rsi + 0x18], 8
jb 0x140029db7
mov rax, qword [rsi]
jmp 0x140029dba
mov rax, rsi
mov word [rax], di
cmp word [0], 0
je 0x140029dd9
mov rax, rdi
or rdi, 0xffffffffffffffff
nop
inc rdi
cmp word [rax + rdi*2], ax
jne 0x140029dd0
mov r8, rdi
xor edx, edx
mov rcx, rsi
call fcn.140008a20
jmp 0x14002a206
call fcn.140029c70
mov ebx, eax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r13, rax
mov eax, edi
cmp r13, 0xffffffffffffffff
mov ecx, 1
cmovne eax, ecx
mov dword [rsp + 0x70], eax
test ebx, ebx
je 0x140029e3e
call fcn.140029be0
mov eax, dword [rsp + 0x70]
test eax, eax
je 0x14002a1a9
lea rdx, [rbp - 0x48]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov ecx, 9
call fcn.14009e2ac
mov qword [rsp + 0x70], rax
xor ecx, ecx
mov byte [rax], cl
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 0x80]
xor r8d, r8d
mov rdx, rax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, r13
test eax, eax
jne 0x140029e95
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r13, qword [rsp + 0x70]
jmp 0x14002a181
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp - 0x60], edi
mov r13, qword [rsp + 0x70]
mov qword [rbp - 0x58], r13
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x7c]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x74]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
mov r9d, 2
mov r8d, 0x400
lea rdx, [rbp - 0x60]
mov ecx, r9d
call qword [sym.imp.CRYPT32.dll_CryptQueryObject]
test eax, eax
jne 0x140029fa1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0xb0]
call fcn.140029980
nop
call fcn.140029c70
test eax, eax
je 0x140029f23
call fcn.140029be0
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x7c]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x74]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
mov r9d, 2
mov r8d, 0x400
mov rdx, qword [rbp - 0x70]
lea ecx, [r9 - 1]
call qword [sym.imp.CRYPT32.dll_CryptQueryObject]
nop
mov r8, qword [rbp + 0xc8]
test eax, eax
je 0x14002a165
cmp r8, 8
jb 0x140029fa1
inc r8
mov rdx, qword [rbp + 0xb0]
lea rcx, [rbp + 0xb0]
call fcn.140008b70
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 6]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.CRYPT32.dll_CryptMsgGetParam]
test eax, eax
je 0x14002a181
mov ecx, dword [rsp + 0x60]
call fcn.14009e2ac
mov r14, rax
test rax, rax
je 0x14002a181
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov rcx, rax
call fcn.1400a1560
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9, r14
xor r8d, r8d
lea edx, [r8 + 6]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.CRYPT32.dll_CryptMsgGetParam]
test eax, eax
je 0x14002a181
movups xmm0, xmmword [r14 + 8]
movaps xmmword [rbp - 0x10], xmm0
movups xmm0, xmmword [r14 + 0x18]
movups xmmword [rbp - 0x38], xmm0
mov qword [rsp + 0x28], rdi
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0xb0000
xor r8d, r8d
mov edx, 0x10001
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.CRYPT32.dll_CertFindCertificateInStore]
mov r12, rax
test rax, rax
je 0x14002a181
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, rax
call qword [sym.imp.CRYPT32.dll_CertGetNameStringW]
mov ebx, eax
cmp eax, 1
jbe 0x14002a181
lea ecx, [rbx + 1]
mov qword [rbp - 0x70], rcx
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.14009e2ac
mov r15, rax
test rax, rax
je 0x14002a181
mov r8, qword [rbp - 0x70]
add r8, r8
xor edx, edx
mov rcx, rax
call fcn.1400a1560
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, r12
call qword [sym.imp.CRYPT32.dll_CertGetNameStringW]
test eax, eax
je 0x14002a181
mov qword [rbp + 0xc8], 7
mov qword [rbp + 0xc0], rdi
mov word [rbp + 0xb0], di
mov r8d, ebx
mov rdx, r15
lea rcx, [rbp + 0xb0]
call fcn.140008a20
nop
mov r8, qword [rbp + 0xa8]
cmp r8, 8
jb 0x14002a131
inc r8
mov rdx, qword [rbp + 0x90]
lea rcx, [rbp + 0x90]
call fcn.140008b70
mov qword [rbp + 0xa8], 7
mov qword [rbp + 0xa0], rdi
mov word [rbp + 0x90], di
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x90]
call fcn.140009120
nop
mov r8, qword [rbp + 0xc8]
cmp r8, 8
jb 0x14002a181
inc r8
mov rdx, qword [rbp + 0xb0]
lea rcx, [rbp + 0xb0]
call fcn.140008b70
test r13, r13
je 0x14002a18e
mov rcx, r13
call fcn.14009de9c
test r14, r14
je 0x14002a19b
mov rcx, r14
call fcn.14009de9c
test r12, r12
je 0x14002a1a9
mov rcx, r12
call qword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14002a1bb
xor edx, edx
call qword [sym.imp.CRYPT32.dll_CertCloseStore]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14002a1cb
call qword [sym.imp.CRYPT32.dll_CryptMsgClose]
test r15, r15
je 0x14002a1d8
mov rcx, r15
call fcn.14009de9c
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], rdi
cmp qword [rsi + 0x18], 8
jb 0x14002a1f0
mov rax, qword [rsi]
jmp 0x14002a1f3
mov rax, rsi
mov word [rax], di
lea rdx, [rbp + 0x90]
mov rcx, rsi
call fcn.140009120
nop
mov r8, qword [rbp + 0xa8]
cmp r8, 8
jb 0x14002a229
inc r8
mov rdx, qword [rbp + 0x90]
lea rcx, [rbp + 0x90]
call fcn.140008b70
mov rax, rsi
mov rcx, qword [rbp + 0xd0]
xor rcx, rsp
call fcn.14009d860
mov rbx, qword [rsp + 0x230]
add rsp, 0x1e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret