Function at 0x1401defa0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1a8]
sub rsp, 0x280
mov qword [rbp + 0x10], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14045cbf0]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov r12, rcx
mov qword [rbp - 0x18], rcx
xor r15d, r15d
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x80], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea r9d, [r15 + 1]
mov r8d, 0xc0000000
mov rdx, qword [rcx + 0x10]
lea rcx, [rsp + 0x78]
call fcn.14007db5c
mov edi, eax
test eax, eax
js 0x1401df8a3
mov qword [rbp], r15
xor r9d, r9d
lea r8, [rbp + 4]
xor edx, edx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
or ebx, 0xffffffff
cmp eax, ebx
jne 0x1401df04e
call fcn.14001072c
mov edi, eax
test eax, eax
js 0x1401df051
mov edi, r15d
test edi, edi
js 0x1401df8a3
lea rdx, [rbp - 0x44]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rbp - 0x48], eax
cmp eax, ebx
jne 0x1401df081
call fcn.14001072c
mov edi, eax
test eax, eax
jns 0x1401df081
mov r13, qword [rsp + 0x30]
jmp 0x1401df08d
mov r13, qword [rbp - 0x48]
mov qword [rsp + 0x30], r13
mov edi, r15d
test edi, edi
js 0x1401df8a3
mov dword [rsp + 0x64], r15d
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x64]
mov r14d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov r8d, r14d
lea rdx, [r12 + 0x18]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1401df0ca
call fcn.14001072c
mov edi, eax
jmp 0x1401df0de
cmp dword [rsp + 0x64], r14d
je 0x1401df0db
mov edi, 0x80070026
jmp 0x1401df8a3
mov edi, r15d
test edi, edi
js 0x1401df8a3
mov eax, dword [r12 + 0x1c]
mov dword [rsp + 0x4c], eax
mov eax, dword [r12 + 0x18]
mov dword [rsp + 0x48], eax
movzx eax, word [r12 + 0x20]
rol ax, 8
mov word [rsp + 0x50], ax
movzx eax, word [r12 + 0x22]
rol ax, 8
mov word [rsp + 0x52], ax
mov rax, qword [r12]
mov rcx, r12
call qword [rax + 0x10]
test al, al
je 0x1401df89e
cmp word [rsp + 0x50], r15w
je 0x1401df89e
movzx eax, word [rsp + 0x52]
test ax, ax
je 0x1401df89e
cmp ax, 8
ja 0x1401df89e
mov qword [rbp - 0x68], r15
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x28], r15
mov esi, r15d
cmp r14, r13
jae 0x1401df84f
mov r15d, 0x80070026
test edi, edi
js 0x1401df84f
mov ecx, 0x40
call fcn.1400be454
mov qword [rbp + 8], rax
test rax, rax
je 0x1401df1a6
xor r8d, r8d
lea rdx, [rsp + 0x48]
mov rcx, rax
call fcn.1401dcc80
mov rdi, rax
jmp 0x1401df1a8
xor edi, edi
mov qword [rsp + 0x38], rdi
and qword [rsp + 0x40], 0
mov rdx, rdi
lea rcx, [rbp - 0x10]
call fcn.14007d7c4
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rax]
mov qword [rsp + 0x40], rcx
mov qword [rax], rdx
mov rbx, qword [rbp - 0x10]
test rbx, rbx
je 0x1401df1f6
lock dec dword [rbx + 8]
jne 0x1401df1f6
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lock dec dword [rbx + 0xc]
jne 0x1401df1f6
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
mov r8, rdi
mov rdx, rdi
lea rcx, [rsp + 0x38]
call fcn.1400020a0
nop
mov rax, qword [rsp + 0x38]
movzx ebx, word [rsp + 0x50]
and dword [rsp + 0x58], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x58]
mov r8d, ebx
mov rdx, qword [rax + 0x30]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1401df240
call fcn.14001072c
mov edi, eax
jmp 0x1401df250
cmp dword [rsp + 0x58], ebx
je 0x1401df24e
mov edi, r15d
jmp 0x1401df81e
xor edi, edi
test edi, edi
js 0x1401df81e
mov rcx, qword [rsp + 0x38]
mov r8, qword [rcx + 0x30]
test byte [r8], 0x80
je 0x1401df26b
xor edx, edx
jmp 0x1401df26f
movzx edx, word [rcx + 0x2a]
movzx r9d, word [rcx + 0x28]
lea eax, [rdx + r9]
cdqe
add r14, rax
test byte [r8], 0x80
je 0x1401df28f
xor edx, edx
call fcn.1400a2c74
jmp 0x1401df374
lea rdx, [r8 + r9]
movzx ebx, word [rsp + 0x52]
and dword [rsp + 0x60], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x60]
mov r8d, ebx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1401df2c3
call fcn.14001072c
mov edi, eax
jmp 0x1401df2d3
cmp dword [rsp + 0x60], ebx
je 0x1401df2d1
mov edi, r15d
jmp 0x1401df374
xor edi, edi
test edi, edi
js 0x1401df374
mov rcx, qword [rsp + 0x38]
mov r9, qword [rcx + 0x30]
xor edx, edx
test byte [r9], 0x80
jne 0x1401df311
movzx r8d, word [rcx + 0x28]
movzx eax, word [rcx + 0x2a]
add eax, r8d
movsxd r10, eax
jmp 0x1401df30c
movzx eax, byte [r9 + r8]
shl rdx, 8
or rdx, rax
inc r8
cmp r8, r10
jb 0x1401df2fd
call fcn.1400a2c74
mov r11, qword [rsp + 0x38]
mov rax, qword [r11 + 8]
cmp qword [r11], rax
je 0x1401df36a
mov rbx, rax
sub rbx, qword [r11]
and dword [rsp + 0x5c], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x5c]
mov r8d, ebx
mov rdx, qword [r11]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1401df358
call fcn.14001072c
mov edi, eax
jmp 0x1401df365
mov eax, dword [rsp + 0x5c]
sub eax, ebx
neg eax
sbb edi, edi
and edi, r15d
mov r11, qword [rsp + 0x38]
mov rax, qword [r11 + 8]
sub rax, qword [r11]
add r14, rax
lea r13, [r12 + 0x28]
lea rdx, [rsp + 0x38]
mov rcx, r13
call fcn.1400356a4
test edi, edi
js 0x1401df819
mov rcx, qword [rsp + 0x38]
call fcn.14007cfcc
movzx r11d, al
dec r11d
je 0x1401df617
sub r11d, 2
je 0x1401df55f
dec r11d
jne 0x1401df819
mov rbx, qword [rbp - 0x38]
mov rsi, qword [rbp - 0x30]
cmp rbx, rsi
je 0x1401df53a
sub rsi, rbx
and rsi, 0xfffffffffffffff0
mov r12, qword [rsi + rbx - 0x10]
mov qword [rbp - 0x78], r12
mov rsi, qword [rsi + rbx - 8]
mov qword [rbp - 0x70], rsi
test rsi, rsi
je 0x1401df3f3
lock inc dword [rsi + 8]
mov rsi, qword [rbp - 0x70]
mov r12, qword [rbp - 0x78]
test r12, r12
je 0x1401df4e8
mov rax, qword [r13 + 8]
sub rax, qword [r13]
sar rax, 4
dec rax
mov qword [r12 + 0x58], rax
mov qword [rbp + 0xb0], 0xf
and qword [rbp + 0xa8], 0
mov byte [rbp + 0x98], 0
lea rdx, [r12 + 0x28]
or r13, 0xffffffffffffffff
mov r9, r13
xor r8d, r8d
lea rcx, [rbp + 0x98]
call fcn.1400030c4
mov qword [rbp + 0xc0], r12
mov qword [rbp + 0xc8], rsi
test rsi, rsi
je 0x1401df460
lock inc dword [rsi + 8]
mov rsi, qword [rbp - 0x70]
mov r12, qword [rbp - 0x18]
lea rcx, [r12 + 0x70]
lea r8, [rbp + 0x98]
lea rdx, [rbp + 0x18]
call fcn.14007d014
nop
mov rbx, qword [rbp + 0xc8]
test rbx, rbx
je 0x1401df4b6
mov eax, r13d
lock xadd dword [rbx + 8], eax
add eax, r13d
jne 0x1401df4b2
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, r13d
lock xadd dword [rbx + 0xc], eax
add eax, r13d
jne 0x1401df4b2
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
mov rsi, qword [rbp - 0x70]
cmp qword [rbp + 0xb0], 0x10
jb 0x1401df4cc
mov rcx, qword [rbp + 0x98]
call fcn.1400be0f4
mov qword [rbp + 0xb0], 0xf
and qword [rbp + 0xa8], 0
mov byte [rbp + 0x98], 0
jmp 0x1401df4f0
mov r12, qword [rbp - 0x18]
or r13, 0xffffffffffffffff
mov rbx, qword [rbp - 0x30]
add rbx, 0xfffffffffffffff0
mov rcx, rbx
call fcn.140058134
mov qword [rbp - 0x30], rbx
test rsi, rsi
je 0x1401df53a
mov eax, r13d
lock xadd dword [rsi + 8], eax
add eax, r13d
jne 0x1401df53a
mov rbx, qword [rbp - 0x70]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, r13d
lock xadd dword [rbx + 0xc], eax
add eax, r13d
jne 0x1401df53a
mov rcx, qword [rbp - 0x70]
mov rax, qword [rcx]
call qword [rax + 0x10]
xor esi, esi
mov rbx, qword [rbp - 0x60]
cmp qword [rbp - 0x68], rbx
je 0x1401df819
add rbx, 0xffffffffffffffd8
mov rcx, rbx
call fcn.14008b088
mov qword [rbp - 0x60], rbx
jmp 0x1401df819
test esi, esi
jne 0x1401df819
lea rdx, [rbp - 0x68]
lea rcx, [rbp + 0x78]
call fcn.14007c568
mov rdx, rax
lea rcx, [rbp + 0xd0]
call fcn.1401de3c0
nop
cmp qword [rax + 0x18], 0x10
jb 0x1401df58e
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.14002e7e0
nop
cmp qword [rbp + 0xe8], 0x10
jb 0x1401df5b1
mov rcx, qword [rbp + 0xd0]
call fcn.1400be0f4
mov qword [rbp + 0xe8], 0xf
and qword [rbp + 0xe0], 0
mov byte [rbp + 0xd0], 0
lea rdx, [rbp - 0x40]
lea rcx, [r12 + 0x48]
call fcn.140053360
mov r8, rax
lea rdx, [rbp + 0x28]
lea rcx, [r12 + 0x48]
call fcn.140018e00
mov esi, 1
mov rdx, qword [rbp - 0x40]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1401df819
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x1401df819
mov ecx, 0x60
call fcn.1400be454
mov rbx, rax
xor eax, eax
test rbx, rbx
je 0x1401df645
lea ecx, [rax + 0xf]
mov qword [rbx + 0x18], rcx
mov qword [rbx + 0x10], rax
mov byte [rbx], al
mov qword [rbx + 0x40], rcx
mov qword [rbx + 0x38], rax
mov byte [rbx + 0x28], al
jmp 0x1401df648
mov rbx, rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rax
mov rdx, rbx
lea rcx, [rbp - 8]
call fcn.14007d820
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rax]
mov qword [rsp + 0x70], rcx
mov qword [rax], rdx
mov rsi, qword [rbp - 8]
test rsi, rsi
je 0x1401df695
lock dec dword [rsi + 8]
jne 0x1401df695
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lock dec dword [rsi + 0xc]
jne 0x1401df695
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x10]
mov r8, rbx
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.1400020a0
nop
mov rax, qword [rbp - 0x60]
cmp qword [rbp - 0x68], rax
je 0x1401df70d
lea rdx, [rbp - 0x68]
lea rcx, [rbp + 0x38]
call fcn.14007c568
mov rdx, rax
lea rcx, [rbp + 0x148]
call fcn.1401de3c0
nop
mov rdx, rax
mov rcx, qword [rsp + 0x68]
call fcn.14000ab78
nop
cmp qword [rbp + 0x160], 0x10
jb 0x1401df6f1
mov rcx, qword [rbp + 0x148]
call fcn.1400be0f4
mov qword [rbp + 0x160], 0xf
xor ebx, ebx
mov qword [rbp + 0x158], rbx
mov byte [rbp + 0x148], bl
jmp 0x1401df70f
xor ebx, ebx
mov esi, ebx
mov r8, qword [rsp + 0x38]
mov r9, qword [r8 + 8]
sub r9, qword [r8]
mov r8, qword [r8]
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x120]
call fcn.1401ddf60
nop
mov rdx, rax
lea rcx, [rbp - 0x68]
call fcn.14007c67c
nop
cmp qword [rbp + 0x138], 0x10
jb 0x1401df755
mov rcx, qword [rbp + 0x120]
call fcn.1400be0f4
mov qword [rbp + 0x138], 0xf
mov qword [rbp + 0x130], rbx
mov byte [rbp + 0x120], bl
lea rdx, [rbp - 0x68]
lea rcx, [rbp + 0x58]
call fcn.14007c568
mov rdx, rax
lea rcx, [rbp + 0xf8]
call fcn.1401de3c0
nop
mov rcx, qword [rsp + 0x68]
add rcx, 0x28
mov rdx, rax
call fcn.14000ab78
nop
cmp qword [rbp + 0x110], 0x10
jb 0x1401df7b2
mov rcx, qword [rbp + 0xf8]
call fcn.1400be0f4
mov qword [rbp + 0x110], 0xf
mov qword [rbp + 0x108], rbx
mov byte [rbp + 0xf8], bl
mov rcx, qword [r13 + 8]
sub rcx, qword [r13]
sar rcx, 4
dec rcx
mov rax, qword [rsp + 0x68]
mov qword [rax + 0x50], rcx
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x38]
call fcn.14007c7ac
nop
mov rbx, qword [rsp + 0x70]
test rbx, rbx
je 0x1401df819
lock dec dword [rbx + 8]
jne 0x1401df819
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lock dec dword [rbx + 0xc]
jne 0x1401df819
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
mov r13, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x1401df846
lock dec dword [rbx + 8]
jne 0x1401df846
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lock dec dword [rbx + 0xc]
jne 0x1401df846
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
cmp r14, r13
jb 0x1401df176
mov rbx, qword [rbp - 0x38]
test rbx, rbx
je 0x1401df876
jmp 0x1401df866
mov rcx, rbx
call fcn.140058134
add rbx, 0x10
cmp rbx, qword [rbp - 0x30]
jne 0x1401df85a
mov rcx, qword [rbp - 0x38]
call fcn.1400be0f4
nop
mov rbx, qword [rbp - 0x68]
test rbx, rbx
je 0x1401df8a3
jmp 0x1401df88d
mov rcx, rbx
call fcn.14008b088
add rbx, 0x28
cmp rbx, qword [rbp - 0x60]
jne 0x1401df881
mov rcx, qword [rbp - 0x68]
call fcn.1400be0f4
jmp 0x1401df8a3
mov edi, 0x80004005
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1401df8b3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.1400be110
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rsi, rcx
call fcn.1401ddc60
xor ecx, ecx
test rbx, rbx
je 0x1401dfff3
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
lea rcx, [rsi + 0x10]
mov rdx, rbx
call fcn.14000c9f8
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x1401defa0