Function at 0x140004344
Capabilities:
Get file size
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov dword [rax + 0x10], edx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
xor edi, edi
mov r12, r9
and qword [rax - 0x48], rdi
mov r13, r8
and dword [rax - 0x50], edi
xor r9d, r9d
mov edx, 0x80000000
lea esi, [rdi + 1]
lea r15d, [rdi + 3]
mov r8d, esi
mov dword [rax - 0x58], r15d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
nop dword [rax + rax]
mov rbx, rax
or r14, 0xffffffffffffffff
inc rax
test rax, 0xfffffffffffffffe
jne 0x1400043ae
mov rbx, r14
mov cl, sil
jmp 0x1400043b0
xor cl, cl
xor eax, eax
test cl, cl
cmove rax, rbx
test rax, rax
jne 0x1400043ee
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jne 0x1400043d4
mov esi, 0x80004005
jmp 0x1400043e2
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov ecx, esi
call fcn.1400040a0
jmp 0x1400045e2
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
lea rdx, [rsp + 0x44]
seta al
xor ecx, ecx
test al, al
cmove rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
nop dword [rax + rax]
mov ebp, eax
cmp eax, 0xffffffff
je 0x1400043bd
cmp dword [rsp + 0x44], edi
je 0x140004428
mov ecx, 0x80070057
mov esi, ecx
jmp 0x1400043e4
lea rax, [rbx - 1]
mov r8d, r15d
cmp rax, 0xfffffffffffffffd
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x88]
seta al
xor ecx, ecx
test al, al
cmove rcx, rbx
and qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
nop dword [rax + rax]
test eax, eax
je 0x1400043bd
cmp dword [rsp + 0x40], 2
mov al, byte [rsp + 0x89]
mov cl, byte [rsp + 0x88]
jb 0x140004482
cmp cl, 0xfe
jne 0x1400044a4
cmp al, 0xff
je 0x1400044b3
cmp dword [rsp + 0x40], r15d
jne 0x1400044eb
cmp cl, 0xef
jne 0x1400044eb
cmp al, 0xbb
jne 0x1400044eb
cmp byte [rsp + 0x8a], 0xbf
jne 0x1400044eb
mov r15d, esi
add ebp, 0xfffffffd
jmp 0x140004515
cmp cl, 0xff
jne 0x140004482
cmp al, 0xfe
jne 0x140004482
mov r15d, 2
lea rax, [rbx - 1]
mov r9d, esi
cmp rax, 0xfffffffffffffffd
mov edx, r14d
seta al
xor ecx, ecx
test al, al
cmove rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
nop dword [rax + rax]
add ebp, 0xfffffffe
mov eax, ebp
and eax, esi
test al, al
je 0x140004515
jmp 0x14000441f
xor r15d, r15d
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
seta al
xor ecx, ecx
test al, al
cmove rcx, rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
nop dword [rax + rax]
lea r14d, [rbp + 2]
mov ecx, 0x80070216
cmp r14d, ebp
jae 0x14000452b
call fcn.1400040a0
cmp r14d, ebp
sbb esi, esi
and esi, ecx
mov ecx, esi
call fcn.1400040c0
cmp r14d, ebp
jb 0x1400043e2
mov edx, r14d
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x140004565
mov esi, 0x8007000e
jmp 0x1400043e2
lea rax, [rbx - 1]
mov r8d, ebp
cmp rax, 0xfffffffffffffffd
lea r9, [rsp + 0x40]
mov rdx, rdi
seta al
xor ecx, ecx
test al, al
cmove rcx, rbx
and qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
nop dword [rax + rax]
test eax, eax
je 0x1400043bd
cmp ebp, dword [rsp + 0x40]
je 0x1400045ad
mov ecx, 0x8000ffff
jmp 0x140004424
cmp r14d, 2
jb 0x1400045a3
lea eax, [r14 - 1]
mov dword [r12], ebp
mov byte [rax + rdi], 0
lea eax, [r14 - 2]
mov byte [rax + rdi], 0
mov rax, rdi
mov qword [r13], rax
xor edi, edi
mov rax, qword [rsp + 0xa0]
test rax, rax
je 0x1400045e0
mov dword [rax], r15d
xor esi, esi
mov ecx, esi
call fcn.1400040c0
test rdi, rdi
je 0x1400045fd
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop dword [rax + rax]
lea rcx, [rbx - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140004616
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
lea r11, [rsp + 0x50]
mov eax, esi
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret