Function at 0x10001f248
Capabilities:
Get file size
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
push rdi
push r12
push r15
sub rsp, 0x50
xor ebx, ebx
mov r12, rdx
mov rbp, rcx
mov qword [rax - 0x38], rbx
mov qword [rax - 0x28], rbx
cmp rcx, rbx
je 0x10001f467
cmp rdx, 0xffffffffffffffff
je 0x10001f467
mov r15d, 0x80070000
cmp r8, rbx
je 0x10001f370
test byte [r8 + 0x40], 8
jne 0x10001f370
mov rcx, r8
or rdi, 0xffffffffffffffff
call fcn.1000193d4
cmp eax, 0xfeedf001
je 0x10001f2bb
cmp eax, 0xfeedf002
jne 0x10001f2c4
call fcn.100019360
mov r8, rax
cmp r8, rbx
je 0x10001f2c4
mov rdi, qword [r8 + 8]
xor eax, eax
lea rdx, [rsp + 0x38]
mov rcx, rdi
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x70], rbx
mov dword [rsp + 0x3c], eax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp eax, ebx
jne 0x10001f31c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
movzx eax, ax
or eax, r15d
cmp edx, ebx
cmovle eax, edx
cmp eax, ebx
jge 0x10001f30f
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, r15d
cmp eax, ebx
cmovle edi, eax
jmp 0x10001f314
mov edi, 0x80004005
cmp edi, ebx
jl 0x10001f44b
mov r8, qword [rsp + 0x38]
lea rdx, [0x10000f5c8]
lea rcx, [rsp + 0x70]
call fcn.1000132ac
cmp eax, ebx
mov edi, eax
jl 0x10001f351
mov r9, qword [rsp + 0x70]
lea rdx, [0x10000f5d8]
xor r8d, r8d
mov rcx, rbp
call fcn.10003036c
mov edi, eax
cmp qword [rsp + 0x70], rbx
je 0x10001f372
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x70]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x10001f372
mov edi, ebx
cmp edi, ebx
jl 0x10001f44b
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x30]
mov rcx, rbp
call fcn.100030280
cmp eax, ebx
mov edi, eax
jl 0x10001f42a
mov rdi, qword [rsp + 0x30]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
mov eax, 0xffffffff
not rcx
lea rbp, [rcx + rcx]
cmp rbp, rax
ja 0x10001f3b9
mov edi, ebx
jmp 0x10001f3c0
mov ebp, eax
mov edi, 0x80070216
cmp edi, ebx
jl 0x10001f42a
mov rdx, qword [rsp + 0x30]
lea r8d, [rbp - 2]
lea r9, [rsp + 0x70]
mov rcx, r12
mov dword [rsp + 0x70], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, ebx
je 0x10001f3fb
mov eax, dword [rsp + 0x70]
mov ecx, ebp
sub rcx, 2
cmp rax, rcx
jne 0x10001f3fb
mov edi, ebx
jmp 0x10001f42a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
movzx eax, ax
or eax, r15d
cmp edx, ebx
cmovle eax, edx
cmp eax, ebx
jge 0x10001f425
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, r15d
cmp eax, ebx
cmovle edi, eax
jmp 0x10001f42a
mov edi, 0x80004005
cmp qword [rsp + 0x30], rbx
je 0x10001f447
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x30]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp edi, ebx
jge 0x10001f460
movzx edx, di
mov ecx, 0x1f
cmp edx, ebx
cmovne ecx, edx
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp edi, ebx
setge bl
mov eax, ebx
jmp 0x10001f474
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r12
pop rdi
ret