Function at 0x1400fea30
Capabilities:
Get file size
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbx
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
xor r12d, r12d
mov rcx, rdx
lea rdx, [rbp - 8]
mov qword [rbp - 0x10], r12
mov edi, r12d
mov qword [rbp - 8], r12
mov r13, r9
or rbx, 0xffffffffffffffff
call fcn.140079440
mov r14, qword [rbp - 8]
mov r15d, eax
test eax, eax
js 0x1400fec07
xor r15d, r15d
lea r8d, [rbx + 6]
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov dword [rsp + 0x28], r15d
mov edx, 0x80000000
mov rcx, r14
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea rcx, [rax + 1]
test rcx, 0xfffffffffffffffe
jne 0x1400feae7
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400feace
mov r15d, 0x80004005
jmp 0x1400feadf
movzx r15d, ax
or r15d, 0x80070000
test eax, eax
cmovle r15d, eax
mov ecx, r15d
jmp 0x1400fec09
mov rcx, rax
lea rdx, [rbp - 0x20]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r12d, eax
cmp eax, 0xffffffff
jne 0x1400feb0a
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor r12d, r12d
jmp 0x1400feac2
cmp dword [rbp - 0x20], r15d
je 0x1400feb25
mov ecx, 0x80070057
mov r15d, ecx
call fcn.14007ac40
xor r12d, r12d
jmp 0x1400fec0e
cmp r12d, 0x100000
ja 0x1400feb10
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r12
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x1400feb55
mov rdx, rax
mov rdi, rax
test rax, rax
jne 0x1400feb60
mov r15d, 0x8007000e
mov ecx, r15d
jmp 0x1400feb18
mov rcx, rbx
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x1c]
mov r8d, r12d
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400feaff
cmp dword [rbp - 0x1c], r12d
je 0x1400feb87
mov r15d, 0x8000ffff
jmp 0x1400feb5b
mov r15, qword [rbp + 0x40]
mov r15, qword [r15 + 0xb8]
mov rax, qword [r15]
mov rdi, qword [rax + 0x18]
mov rax, qword [0x1403d25b8]
mov rcx, rdi
call rax
lea rcx, [rbp - 0x18]
mov rax, rdi
mov qword [rsp + 0x20], rcx
lea r9, [rbp - 0x10]
mov rcx, r15
mov r8d, r12d
mov rdx, rsi
call rax
xor r12d, r12d
mov r15d, eax
test eax, eax
jns 0x1400febd6
mov ecx, eax
call fcn.14007ac40
mov rdi, rsi
jmp 0x1400fec0e
mov r8, qword [rbp + 0x50]
mov r9, r13
mov edx, dword [rbp - 0x18]
mov rcx, qword [rbp - 0x10]
call fcn.140100adc
mov r15d, eax
test eax, eax
js 0x1400febca
mov rcx, qword [rbp + 0x48]
lea rdx, [r13 + 0x20]
call fcn.14007ab14
mov r15d, eax
mov rdi, rsi
test eax, eax
jns 0x1400fec0e
mov ecx, eax
call fcn.14007ac40
mov ecx, r15d
call fcn.14007ace8
test r14, r14
je 0x1400fec37
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [r14 - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.14007ace8
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x1400fec4a
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbp - 0x10], r12
test rdi, rdi
je 0x1400fec63
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400fec76
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0xb8]
mov eax, r15d
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret