Function at 0x14000dda0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x590]
sub rsp, 0x690
mov rax, qword [0x14003b0f8]
xor rax, rsp
mov qword [rbp + 0x580], rax
mov r14, qword [0x140043a90]
xor r15d, r15d
mov qword [rsp + 0x60], rcx
mov r12d, 1
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x58], r12d
mov qword [rsp + 0x48], r14
test r14, r14
je 0x14001c544
mov rcx, qword [rcx + 0x78]
test rcx, rcx
je 0x14001c522
call fcn.14000fd60
mov rbx, rax
movzx eax, word [rax]
cmp ax, 0x3a
jne 0x14000e389
add rbx, 2
mov esi, r15d
nop
movzx edi, word [rbx]
lea rcx, [0x140032340]
movzx edx, di
call qword [sym.imp.msvcrt.dll_wcschr]
test rax, rax
jne 0x14000de72
movzx edx, di
lea rcx, [0x140032330]
call qword [sym.imp.msvcrt.dll_wcschr]
test rax, rax
jne 0x14000de72
mov eax, esi
lea ecx, [rsi + 1]
add rbx, 2
mov esi, ecx
mov word [rsp + rax*2 + 0x70], di
cmp ecx, 0x7f
jb 0x14000de30
mov edi, dword [r14 + 0xc]
mov rcx, r14
mov eax, esi
mov dword [rsp + 0x54], edi
mov word [rsp + rax*2 + 0x70], r15w
call fcn.14000f8b4
mov r13d, eax
cmp eax, 0xffffffff
je 0x14001c544
mov ecx, eax
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov rcx, rax
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileSize]
mov rcx, qword [rsp + 0x60]
mov esi, eax
mov dword [rsp + 0x5c], eax
mov rcx, qword [rcx + 0x78]
call fcn.14000fd60
cmp byte [0x140043aa5], r15b
mov rbx, rax
je 0x14000df96
mov r8d, 4
lea rdx, str.:EOF
mov rcx, rax
call qword [sym.imp.msvcrt.dll__wcsnicmp]
test eax, eax
jne 0x14000df96
movzx ecx, word [rbx + 8]
test cx, cx
jne 0x14000e398
mov dword [r14 + 0xc], esi
mov byte [0x140043a88], r12b
mov ecx, r13d
call fcn.14000c8e8
mov eax, r15d
mov rcx, qword [rbp + 0x580]
xor rcx, rsp
call fcn.1400182e0
lea r11, [rsp + 0x690]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
movzx edx, di
lea rcx, [0x140032340]
call qword [sym.imp.msvcrt.dll_wcschr]
test rax, rax
jne 0x14001c6e2
cmp word [rbx], 0x3a
je 0x14000e234
test r14, r14
je 0x14000df80
mov edx, 0x3a
mov rcx, r14
call qword [sym.imp.msvcrt.dll_wcschr]
mov r14, rax
test rax, rax
jne 0x14000e1d0
mov r14, qword [rsp + 0x48]
cmp byte [0x140043a88], 1
je 0x14000df03
mov edi, dword [rsp + 0x54]
lea rbx, [0x140047ba0]
jmp 0x14000e09a
cmp byte [rdi + 1], 0xa
jne 0x14000e1a0
mov esi, edi
mov byte [rdi + 2], 0
sub esi, r12d
xor r9d, r9d
add esi, 2
xor r8d, r8d
mov rcx, r14
lea edx, [rsi + r15]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFilePointer]
mov r10d, dword [0x14003f8a8]
xor r15d, r15d
cmp r10d, 0x2b
jb 0x14001c663
cmp r10d, 0xc42c
jae 0x14001c663
mov edx, 1
lea rax, [rbp + 0x170]
mov dword [rsp + 0x28], 0x200
mov r9d, esi
mov qword [rsp + 0x20], rax
mov r8, r12
mov ecx, r10d
call qword [sym.imp.api_ms_win_core_string_l1_1_0.dll_MultiByteToWideChar]
mov esi, eax
mov dword [rsp + 0x40], eax
mov r12d, dword [rsp + 0x58]
lea rbx, [0x140047ba0]
mov edi, dword [rsp + 0x54]
test eax, eax
je 0x14000e3b6
test esi, esi
je 0x14000e3be
cmp esi, 0xffffffff
je 0x14000e3b6
cmp word [rbp + 0x170], 0
je 0x14000e3b6
cmp word [rsp + 0x70], 0
je 0x14000e3b6
mov eax, esi
add rax, rax
cmp rax, 0x402
jae 0x14000e3fc
mov edx, 0x3a
mov word [rbp + rax + 0x170], r15w
lea rcx, [rbp + 0x170]
call qword [sym.imp.msvcrt.dll_wcschr]
mov r14, rax
test rax, rax
jne 0x14000e1d0
mov r14, qword [rsp + 0x48]
cmp dword [0x14003f8a4], 0
jne 0x14001c54c
mov ecx, r13d
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov r9d, 1
xor r8d, r8d
mov rcx, rax
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFilePointer]
mov dword [r14 + 0xc], eax
cmp eax, edi
jl 0x14000e0d5
test r12d, r12d
je 0x14000e3ee
mov ecx, r13d
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov rcx, rax
mov r14, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileType]
btr eax, 0xf
mov rcx, r14
cmp eax, 2
je 0x14001c557
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rdi, rbx
mov r12, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFilePointer]
lea rcx, [0x1400561f0]
mov r15d, eax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_AcquireSRWLockShared]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov r8d, 0x200
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
lea rcx, [0x1400561f0]
mov ebx, eax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseSRWLockShared]
mov esi, dword [rsp + 0x40]
test ebx, ebx
je 0x14001c577
test esi, esi
je 0x14000e3ab
mov r10d, dword [0x14003f8a8]
mov ecx, esi
mov dword [rsp + 0x50], ecx
mov edx, esi
cmp r10d, 0xfde9
je 0x14001c582
test edx, edx
jle 0x14000dfd2
cmp ecx, 3
jl 0x14000e1a0
movzx eax, byte [rdi]
cmp al, 0xa
je 0x14001c5e0
cmp al, 0xd
je 0x14000dfa2
movzx eax, byte [rdi]
lea rdx, [0x1400560f0]
cmp byte [rax + rdx], 0
jne 0x14001c5ef
inc rdi
dec ecx
mov dword [rsp + 0x50], ecx
test ecx, ecx
jg 0x14000e188
jmp 0x14000dfd2
mov rax, r14
add r14, 2
cmp word [rax], 0xa
je 0x14000e1f6
nop dword [rax]
lea rcx, [rbp + 0x170]
cmp rax, rcx
je 0x14000e1f6
sub rax, 2
cmp word [rax], 0xa
jne 0x14000e1e0
cmp word [rax], 0x3a
lea rsi, [rax + 2]
cmove rsi, rax
mov rbx, rsi
test rsi, rsi
je 0x14000df57
nop
movzx edi, word [rbx]
movzx ecx, di
call qword [sym.imp.msvcrt.dll_iswspace]
test eax, eax
je 0x14000df3e
cmp di, 0xa
je 0x14000df3e
add rbx, 2
jmp 0x14000e210
test rsi, rsi
je 0x14001c6f0
mov edx, 0xa
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_wcschr]
mov r14, rax
test rax, rax
je 0x14001c6f3
movzx edi, word [rbx]
movzx ecx, di
call qword [sym.imp.msvcrt.dll_iswspace]
test eax, eax
jne 0x14001c795
movzx edx, di
lea rcx, [0x140032340]
call qword [sym.imp.msvcrt.dll_wcschr]
test rax, rax
jne 0x14001c7a0
movzx eax, word [rbx]
cmp ax, 0x3a
jne 0x14001c7b2
add rbx, 2
test rbx, rbx
je 0x14000e2c7
movzx edi, word [rbx]
movzx ecx, di
call qword [sym.imp.msvcrt.dll_iswspace]
test eax, eax
jne 0x14001c7c1
movzx edx, di
lea rcx, [0x140032340]
call qword [sym.imp.msvcrt.dll_wcschr]
test rax, rax
jne 0x14001c7cc
mov esi, r15d
nop word [rax + rax]
movzx edi, word [rbx]
lea rcx, [0x140032330]
movzx edx, di
call qword [sym.imp.msvcrt.dll_wcschr]
test rax, rax
jne 0x14000e31c
movzx edx, di
lea rcx, [0x140032348]
call qword [sym.imp.msvcrt.dll_wcschr]
test rax, rax
jne 0x14000e31c
cmp di, 0x5e
je 0x14001c7de
mov eax, esi
lea ecx, [rsi + 1]
add rbx, 2
mov esi, ecx
mov word [rbp + rax*2 + 0x70], di
cmp ecx, 0x7f
jb 0x14000e2d0
mov eax, esi
lea rdx, [rbp + 0x70]
lea rcx, [rsp + 0x70]
mov word [rbp + rax*2 + 0x70], r15w
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x14000df61
mov rax, qword [rsp + 0x60]
test byte [rax + 0x80], 1
je 0x14001c7eb
mov al, 1
mov byte [0x140043a88], al
call fcn.14001710c
test r14, r14
je 0x14001c7f2
lea rcx, [rbp + 0x170]
sub r14, rcx
add r14, 2
sar r14, 1
test al, al
jne 0x14000e3f4
mov rbx, qword [rsp + 0x48]
add dword [rbx + 0xc], r14d
mov r14, rbx
jmp 0x14000df85
cmp ax, 0x2b
jne 0x14000de2b
jmp 0x14000de27
call qword [sym.imp.msvcrt.dll_iswspace]
test eax, eax
jne 0x14000def8
jmp 0x14000df96
xor r15d, r15d
mov eax, r15d
jmp 0x14000e01a
test esi, esi
jne 0x14001c844
test r12d, r12d
je 0x14001c844
mov ecx, r13d
call qword [sym.imp.msvcrt.dll__get_osfhandle]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFilePointer]
mov r12d, r15d
mov dword [rsp + 0x58], r15d
jmp 0x14000e095
mov esi, dword [rsp + 0x40]
jmp 0x14000e3b6
mov r9d, r14d
jmp 0x14001c7fb
call fcn.1400184b8
int3
mov rcx, r14
call fcn.140008fc0
mov rax, qword [r14 + 0x1d0]
xor edx, edx
mov ecx, 0x2330
mov qword [0x140043a90], rax
call fcn.140015118
mov eax, r12d
jmp 0x14000df0e
call fcn.14002c4b0
nop
jmp 0x14000e0a7
lea r9, [rsp + 0x40]
mov r8d, 0x200
lea rdx, [rbp + 0x170]
call fcn.140026884
mov esi, dword [rsp + 0x40]
jmp 0x14000e02a
xor r15d, r15d
mov eax, r15d
jmp 0x14000e01a
test r15d, r15d
jne 0x14000e180
movzx r8d, word [0x140047ba0]
movzx eax, word [0x1400338d4]
sub r8d, eax
jne 0x14001c5b1
movzx r8d, byte [0x140047ba2]
movzx eax, byte [0x1400338d6]
sub r8d, eax
test r8d, r8d
jne 0x14000e180
add esi, 0xfffffffd
lea r15d, [r8 + 3]
mov ecx, esi
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x50], ecx
lea r12, [0x140047ba3]
lea rdi, [0x140047ba3]
mov edx, esi
jmp 0x14000e180
cmp byte [rdi + 1], 0xd
je 0x14000dfac
jmp 0x14000e198
cmp ecx, 1
je 0x14001c600
add rdi, 2
add ecx, 0xfffffffe
jmp 0x14000e1b9
lea rcx, [0x1400561f0]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_AcquireSRWLockShared]
xor r15d, r15d
lea rdx, [rdi + 1]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], r15
mov rcx, r14
lea r8d, [r15 + 1]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
lea rcx, [0x1400561f0]
mov ebx, eax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseSRWLockShared]
test ebx, ebx
je 0x14001c653
cmp dword [rsp + 0x50], r15d
je 0x14001c653
mov r10d, dword [0x14003f8a8]
inc esi
jmp 0x14000dfd5
mov esi, r15d
mov dword [rsp + 0x40], r15d
mov eax, r15d
jmp 0x14000e01a
cmp r10d, 0xc435
ja 0x14001c6a1
je 0x14001c6da
cmp r10d, 0x2a
je 0x14001c6da
cmp r10d, 0xc42b
jbe 0x14000dfec
cmp r10d, 0xc42e
jbe 0x14001c6da
cmp r10d, 0xc431
je 0x14001c6da
cmp r10d, 0xc433
je 0x14001c6da
jmp 0x14000dfec
cmp r10d, 0xdeb3
ja 0x14001c6ca
cmp r10d, 0xdeaa
jae 0x14001c6da
cmp r10d, 0xcec8
je 0x14001c6da
cmp r10d, 0xd698
je 0x14001c6da
jmp 0x14000dfec
lea eax, [r10 - 0xfde8]
cmp eax, 1
ja 0x14000dfec
mov edx, r15d
jmp 0x14000dff1
test di, di
je 0x14000df57
jmp 0x14000e22e
mov r14, r15
mov ecx, r13d
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov r9d, 1
xor r8d, r8d
mov rcx, rax
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFilePointer]
cmp eax, dword [rsp + 0x5c]
je 0x14000e257
mov edi, dword [rsp + 0x40]
cmp edi, 0x200
je 0x14000e257
lea rax, [rbp + 0x170]
sub rsi, rax
sar rsi, 1
sub edi, esi
call fcn.14001710c
test al, al
je 0x14001c770
mov ecx, dword [0x14003f8a8]
lea r8, [rbp + 0x170]
mov qword [rsp + 0x38], r15
mov r9d, edi
mov qword [rsp + 0x30], r15
xor edx, edx
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
call qword [sym.imp.api_ms_win_core_string_l1_1_0.dll_WideCharToMultiByte]
mov edi, eax
mov ecx, r13d
neg edi
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov r9d, 1
xor r8d, r8d
mov rcx, rax
mov edx, edi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFilePointer]
nop
jmp 0x14000df80
cmp di, 0xa
jne 0x14001c7a9
jmp 0x14000e26b
test di, di
je 0x14000e284
add rbx, 2
jmp 0x14000e257
cmp ax, 0x2b
jne 0x14000e295
jmp 0x14000e291
cmp di, 0xa
jne 0x14001c7d5
jmp 0x14000e2ae
test di, di
je 0x14000e2c7
add rbx, 2
jmp 0x14000e29a
movzx edi, word [rbx + 2]
add rbx, 2
jmp 0x14000e307
xor al, al
jmp 0x14000e34f
test al, al
je 0x14001c832
mov r9d, dword [rsp + 0x40]
mov ecx, dword [0x14003f8a8]
lea r8, [rbp + 0x170]
mov qword [rsp + 0x38], r15
xor edx, edx
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
call qword [sym.imp.api_ms_win_core_string_l1_1_0.dll_WideCharToMultiByte]
mov r14, qword [rsp + 0x48]
add dword [r14 + 0xc], eax
jmp 0x14000df85
mov r14, qword [rsp + 0x48]
mov eax, dword [rsp + 0x40]
add dword [r14 + 0xc], eax
jmp 0x14000df85
mov rbx, qword [rsp + 0x48]
mov rcx, rbx
call fcn.140008fc0
mov rax, qword [rbx + 0x1d0]
lea r8, [rsp + 0x70]
mov edx, 1
mov qword [0x140043a90], rax
mov ecx, 0x400023ab
call fcn.140015118
mov r15d, 1
jmp 0x14000df03