Function at 0x14007ac50
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov r13, qword [0x140162ac0]
xor r9d, r9d
mov rbx, rdx
mov qword [rsp + 0x48], r13
mov r14, rcx
mov byte [rsp + 0x20], 1
xor edx, edx
mov rcx, r13
lea r8, [r9 - 1]
call fcn.1400d5e90
mov rax, qword [0x14015bc10]
xor r12b, r12b
mov byte [rsp + 0xc8], r12b
mov rbp, 0xffffffffffffffff
mov qword [rsp + 0x78], rsi
mov r15d, dword [rax + 0x13c]
btr r15d, 0x1f
nop dword [rax]
mov rdi, rbx
movzx eax, word [rdi]
cmp ax, 0x20
je 0x14007acd2
cmp ax, 9
jne 0x14007acd8
add rdi, 2
jmp 0x14007acc3
cmp ax, 0x2a
jne 0x14007ae03
movzx esi, word [rdi + 2]
lea rbx, [rdi + 2]
test esi, 0xffffff80
jne 0x14007ad05
mov edx, 2
mov ecx, esi
call fcn.1400fc354
test eax, eax
je 0x14007ad05
and esi, 0xffffffdf
cmp esi, 0x43
je 0x14007adda
cmp esi, 0x4d
je 0x14007ad87
cmp esi, 0x50
je 0x14007ad29
cmp esi, 0x54
jne 0x14007ade2
mov r12b, 1
jmp 0x14007ade2
lea rcx, [rdi + 4]
call fcn.1400f73ac
movzx edx, word [rbx]
mov r15d, eax
test dx, dx
je 0x14007ad6f
nop dword [rax]
lea rcx, [0x1401373a0]
mov eax, SafeArrayAllocDescriptor
nop dword [rax]
cmp dx, ax
je 0x14007add4
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x14007ad50
movzx edx, word [rbx + 2]
add rbx, 2
test dx, dx
jne 0x14007ad40
mov rax, qword [0x14015bc10]
mov dl, 1
mov rcx, r14
mov dword [rax + 0x40], 0x57
jmp 0x14007b4af
lea rcx, [rdi + 4]
call fcn.1400652b0
movzx r8d, word [rbx]
mov rbp, rax
test r8w, r8w
je 0x14007ad6f
nop dword [rax]
lea rdx, [0x1401373a0]
mov ecx, SafeArrayAllocDescriptor
nop dword [rax]
cmp r8w, cx
je 0x14007add4
movzx ecx, word [rdx + 2]
add rdx, 2
test cx, cx
jne 0x14007adb0
movzx r8d, word [rbx + 2]
add rbx, 2
test r8w, r8w
jne 0x14007ada0
jmp 0x14007ad6f
add rbx, 0xfffffffffffffffe
jmp 0x14007ade2
mov byte [rsp + 0xc8], 1
cmp word [rbx], 0
je 0x14007acc0
add rbx, 2
cmp word [rbx], 0
je 0x14007acc0
add rbx, 2
jmp 0x14007acc0
xor edi, edi
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x8000000
mov rcx, rbx
mov dword [rsp + 0x20], 3
lea r8d, [rdi + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14007ae52
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x14015bc10]
mov dl, 1
mov dword [rcx + 0x40], eax
mov rcx, r14
jmp 0x14007b4af
xor eax, eax
lea rdx, [rsp + 0xd4]
mov rcx, rsi
mov qword [rsp + 0xd0], rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, 0xffffffff
mov dword [rsp + 0xd0], eax
cmp eax, ecx
jne 0x14007ae8c
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14007ae9a
mov ecx, 0xffffffff
mov rbx, qword [rsp + 0xd0]
cmp rbx, 0xffffffffffffffff
jne 0x14007aebd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x14015bc10]
mov dword [rcx + 0x40], eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dl, 1
mov rcx, r14
jmp 0x14007b4af
cmp rbx, rbp
cmova rbx, rbp
cmp rbx, rcx
jbe 0x14007aee7
lea r9, [0x14012046c]
xor r8d, r8d
lea rdx, str.Out_of_memory.
mov rcx, r14
call fcn.140062de0
jmp 0x14007b4b4
test rbx, rbx
jne 0x14007af09
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x14015bc10]
xor edx, edx
mov rcx, r14
mov dword [rax + 0x40], edi
jmp 0x14007b4af
cmp byte [rsp + 0xc8], dil
je 0x14007b022
movzx eax, byte [r13 + 0x23]
test al, al
jne 0x14007af28
mov rax, qword [r13 + 0x10]
movzx eax, byte [rax + 0x23]
cmp al, 2
je 0x14007b022
mov rax, rbx
mov byte [rsp + 0x20], dil
and eax, 1
mov r8, rbx
shr r8, 1
mov bpl, 1
add r8, rax
movzx r9d, bpl
xor edx, edx
mov rcx, r13
call fcn.1400d5e90
cmp eax, 1
jne 0x14007b053
xor r8d, r8d
mov edx, eax
mov rcx, r13
call fcn.140001770
mov rdi, rax
test rax, rax
je 0x14007b053
lea r9, [rsp + 0xd8]
mov qword [rsp + 0x20], 0
mov r8d, ebx
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r14d, eax
mov dword [rsp + 0xd0], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x14015bc10]
mov dword [rcx + 0x40], eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14d, r14d
je 0x14007b413
movzx ebx, byte [rsp + 0xc8]
test bl, bl
jne 0x14007b365
mov ecx, dword [rsp + 0xd8]
cmp ecx, 3
jb 0x14007b063
cmp byte [rdi], 0xef
jne 0x14007b063
cmp byte [rdi + 1], 0xbb
jne 0x14007b063
cmp byte [rdi + 2], 0xbf
jne 0x14007b063
lea r8d, [rcx - 3]
mov r9d, 0xfde9
mov rcx, r13
lea rdx, [rdi + 3]
call fcn.1400d6c60
test eax, eax
jne 0x14007b0a8
xor r14d, r14d
mov dword [rsp + 0xd0], r14d
jmp 0x14007b0a8
lea rcx, [rbx + 2]
xor bpl, bpl
call fcn.1400f75c0
mov rdi, rax
test rax, rax
jne 0x14007af77
lea r9, [0x14012046c]
xor r8d, r8d
lea rdx, str.Out_of_memory.
mov rcx, r14
call fcn.140062de0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x14007b4b4
cmp ecx, 2
jb 0x14007b0dd
cmp byte [rdi], 0xff
jne 0x14007b0dd
cmp byte [rdi + 1], 0xfe
jne 0x14007b0dd
lea rdx, [rdi + 2]
add ecx, 0xfffffffe
mov r8d, ecx
mov r9b, 1
shr r8, 1
mov rcx, r13
mov byte [rsp + 0x20], 0
call fcn.1400d5e90
test eax, eax
mov eax, 0
cmove r14d, eax
mov dword [rsp + 0xd0], r14d
test rdi, rdi
je 0x14007b0b0
mov rcx, rdi
call fcn.1400f75c8
xor r8d, r8d
mov rcx, r13
lea edx, [r8 + 1]
call fcn.140001770
mov qword [rsp + 0x58], rax
mov r15, rax
test r12b, r12b
je 0x14007b463
cmp byte [r13 + 0x23], 0
jne 0x14007b100
mov rbx, qword [r13 + 0x10]
jmp 0x14007b103
mov rdx, rdi
cmp r15d, 0x4b0
je 0x14007b07a
mov r8d, ecx
mov r9d, r15d
mov rcx, r13
call fcn.1400d6c60
test eax, eax
jne 0x14007b0a3
xor r14d, r14d
jmp 0x14007b09b
mov rbx, r13
cmp byte [rbx + 0x23], 1
lea r12, [0x1401662d0]
jne 0x14007b124
test byte [rbx + 0x21], 8
je 0x14007b11e
mov rcx, rbx
call fcn.140001610
lea rsi, [rbx + 0x10]
jmp 0x14007b127
mov rsi, r12
mov rsi, qword [rsi]
xor eax, eax
shr rsi, 1
mov ebp, 0xffffffff
mov r14d, eax
mov ebx, eax
mov qword [rsp + 0x50], rax
cmp word [r15], ax
je 0x14007b325
cmp rsi, 0x1388
jb 0x14007b2bc
mov edi, eax
nop word [rax + rax]
lea rdx, [0x140141798]
mov rcx, r15
call fcn.1400f0d44
mov r13, rax
test rax, rax
je 0x14007b227
inc edi
mov eax, 0xffffffff
mov dword [rsp + 0x40], edi
add ebp, eax
mov rdi, r13
sub rdi, r15
sar rdi, 1
lea rax, [rdi + rbx]
lea rcx, [rax + 1]
mov qword [rsp + 0x60], rax
cmp rcx, qword [rsp + 0x50]
jb 0x14007b1ee
mov edx, dword [rsp + 0x40]
mov rax, r13
sub rax, qword [rsp + 0x58]
mov r8d, ebp
movsxd rcx, ecx
sar rax, 1
cdqe
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov rcx, 0xffffffffffffffff
movsxd r9, esi
call fcn.1400d15f0
mov rcx, r14
mov qword [rsp + 0x50], rax
lea rdx, [rax + rax]
call fcn.1400f75dc
test rax, rax
je 0x14007b262
mov r14, rax
test rdi, rdi
je 0x14007b208
lea r8, [rdi + rdi]
mov rdx, r15
lea rcx, [r14 + rbx*2]
call fcn.1400f1320
mov rbx, qword [rsp + 0x60]
movzx eax, word [reloc.WSOCK32.dll_inet_addr]
lea r15, [r13 + 4]
mov edi, dword [rsp + 0x40]
mov word [r14 + rbx*2], ax
inc rbx
test ebp, ebp
jne 0x14007b160
test edi, edi
je 0x14007b320
mov rdi, qword [rsp + 0x58]
mov rax, r15
sub rax, rdi
sar rax, 1
sub rsi, rax
je 0x14007b293
lea rbp, [rsi + rbx]
cmp rbp, qword [rsp + 0x50]
jb 0x14007b280
lea rdx, [rbp*2 + 2]
mov rcx, r14
call fcn.1400f75dc
test rax, rax
jne 0x14007b27d
test r14, r14
je 0x14007b26f
mov rcx, r14
call fcn.1400f75c8
mov r13, qword [rsp + 0x48]
xor eax, eax
mov ebx, eax
jmp 0x14007b328
mov r14, rax
lea r8, [rsi + rsi]
mov rdx, r15
lea rcx, [r14 + rbx*2]
call fcn.1400f1320
mov rbx, rbp
xor eax, eax
lea r8, [rbx*2 + 2]
mov rdx, r14
mov word [r14 + rbx*2], ax
mov rcx, rdi
call fcn.1400f1320
mov rcx, r14
call fcn.1400f75c8
mov r13, qword [rsp + 0x48]
jmp 0x14007b328
mov rdi, r15
mov r13, rbp
nop dword [rax]
nop word [rax + rax]
lea rdx, [0x140141798]
mov rcx, rdi
call fcn.1400f0d44
mov rbx, rax
test rax, rax
je 0x14007b320
mov rcx, rax
lea rdi, [rax + 2]
sub rcx, r15
lea rdx, [rax + 4]
sar rcx, 1
mov r8, rsi
sub r8, rcx
mov rcx, rdi
lea r8, [r8*2 - 2]
call fcn.1400f1320
movzx eax, word [reloc.WSOCK32.dll_inet_addr]
dec rsi
mov word [rbx], ax
add ebp, r13d
jne 0x14007b2d0
mov r13, qword [rsp + 0x48]
mov rbx, rsi
cmp byte [r13 + 0x23], 0
jne 0x14007b335
mov rdi, qword [r13 + 0x10]
jmp 0x14007b338
mov rdi, r13
cmp byte [rdi + 0x23], 1
jne 0x14007b350
test byte [rdi + 0x21], 8
je 0x14007b34c
mov rcx, rdi
call fcn.140001610
lea r12, [rdi + 0x10]
mov r14d, dword [rsp + 0xd0]
lea rax, [rbx + rbx]
mov qword [r12], rax
jmp 0x14007b45b
movzx eax, byte [r13 + 0x23]
test al, al
jne 0x14007b376
mov rax, qword [r13 + 0x10]
movzx eax, byte [rax + 0x23]
cmp al, 2
jne 0x14007b3bf
mov edx, dword [rsp + 0xd8]
mov rcx, rdi
call fcn.1400d5c70
mov rcx, rdi
mov ebx, eax
call fcn.1400f75c8
cmp ebx, 1
jne 0x14007b48f
mov rcx, qword [0x140160738]
lea rdx, [0x14012054c]
xor r9d, r9d
mov byte [rsp + 0x20], bl
lea r8, [r9 - 1]
call fcn.1400d5e90
jmp 0x14007b4b4
mov ecx, dword [rsp + 0xd8]
test cl, 1
je 0x14007b3d1
mov byte [rcx + rdi], 0
inc ecx
xor eax, eax
mov esi, ecx
mov word [rcx + rdi], ax
cmp byte [r13 + 0x23], al
jne 0x14007b3e5
mov rbx, qword [r13 + 0x10]
jmp 0x14007b3e8
mov rbx, r13
cmp byte [rbx + 0x23], 1
jne 0x14007b406
test byte [rbx + 0x21], 8
je 0x14007b3fc
mov rcx, rbx
call fcn.140001610
lea r12, [rbx + 0x10]
mov qword [r12], rsi
jmp 0x14007b45b
lea r12, [0x1401662d0]
mov qword [r12], rsi
jmp 0x14007b45b
xor eax, eax
mov word [rdi], ax
cmp byte [r13 + 0x23], al
jne 0x14007b424
mov rbx, qword [r13 + 0x10]
jmp 0x14007b427
mov rbx, r13
cmp byte [rbx + 0x23], 1
jne 0x14007b443
test byte [rbx + 0x21], 8
je 0x14007b43d
mov rcx, rbx
call fcn.140001610
xor eax, eax
lea r12, [rbx + 0x10]
jmp 0x14007b44a
lea r12, [0x1401662d0]
mov qword [r12], rax
test bpl, bpl
jne 0x14007b45b
mov rcx, rdi
call fcn.1400f75c8
movzx ebx, byte [rsp + 0xc8]
cmp byte [r13 + 0x23], 0
jne 0x14007b46e
mov r13, qword [r13 + 0x10]
cmp byte [r13 + 0x23], 2
jne 0x14007b493
cmp qword [0x140164960], 0
je 0x14007b493
lea rcx, [0x140164948]
call fcn.140007590
test eax, eax
jne 0x14007b4a1
xor eax, eax
jmp 0x14007b4b4
and byte [r13 + 0x21], 0x86
test bl, bl
je 0x14007b4a1
or byte [r13 + 0x21], 1
mov rcx, qword [rsp + 0xc0]
test r14d, r14d
sete dl
call fcn.1400629e0
mov rsi, qword [rsp + 0x78]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbp
pop rbx
ret