Function at 0x14000e680
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x590]
sub rsp, 0x690
mov rax, qword [0x14003d0f8]
xor rax, rsp
mov qword [rbp + 0x580], rax
mov r14, qword [0x140045b10]
xor r15d, r15d
mov qword [rsp + 0x60], rcx
mov r12d, 1
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x58], r12d
mov qword [rsp + 0x48], r14
test r14, r14
je 0x14001ccdc
mov rcx, qword [rcx + 0x78]
test rcx, rcx
je 0x14001ccba
call fcn.1400109f4
mov rbx, rax
movzx eax, word [rax]
cmp ax, 0x3a
jne 0x14000ecff
add rbx, 2
mov esi, r15d
nop
movzx edi, word [rbx]
lea rcx, [0x1400342d0]
movzx edx, di
call qword [sym.imp.msvcrt.dll_wcschr]
nop dword [rax + rax]
test rax, rax
jne 0x14000e75e
movzx edx, di
lea rcx, str.:_n_r_t
call qword [sym.imp.msvcrt.dll_wcschr]
nop dword [rax + rax]
test rax, rax
jne 0x14000e75e
mov eax, esi
lea ecx, [rsi + 1]
add rbx, 2
mov esi, ecx
mov word [rsp + rax*2 + 0x70], di
cmp ecx, 0x7f
jb 0x14000e710
mov edi, dword [r14 + 0xc]
mov rcx, r14
mov eax, esi
mov dword [rsp + 0x54], edi
mov word [rsp + rax*2 + 0x70], r15w
call fcn.140010494
mov r13d, eax
cmp eax, 0xffffffff
je 0x14001ccdc
mov ecx, eax
call qword [sym.imp.msvcrt.dll__get_osfhandle]
nop dword [rax + rax]
mov rcx, rax
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileSize]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x60]
mov esi, eax
mov dword [rsp + 0x5c], eax
mov rcx, qword [rcx + 0x78]
call fcn.1400109f4
cmp byte [0x140045b25], r15b
mov rbx, rax
je 0x14000e8a1
mov r8d, 4
lea rdx, str.:EOF
mov rcx, rax
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
jne 0x14000e8a1
movzx ecx, word [rbx + 8]
test cx, cx
jne 0x14000ed0e
mov dword [r14 + 0xc], esi
mov byte [0x140045b08], r12b
mov ecx, r13d
call fcn.14000d208
mov eax, r15d
mov rcx, qword [rbp + 0x580]
xor rcx, rsp
call fcn.140018f90
lea r11, [rsp + 0x690]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
movzx edx, si
lea rcx, [0x1400342d0]
call qword [sym.imp.msvcrt.dll_wcschr]
nop dword [rax + rax]
test rax, rax
jne 0x14001ce8c
cmp word [rdi], 0x3a
je 0x14000eb7a
test r14, r14
je 0x14000e88b
mov edx, 0x3a
mov rcx, r14
call qword [sym.imp.msvcrt.dll_wcschr]
nop dword [rax + rax]
mov r14, rax
test rax, rax
jne 0x14000eb13
mov r14, qword [rsp + 0x48]
cmp byte [0x140045b08], 1
je 0x14000e801
mov edi, dword [rsp + 0x54]
lea rbx, [0x140049c00]
jmp 0x14000e9b7
cmp byte [rdi + 1], 0xa
jne 0x14000eaed
mov esi, edi
mov byte [rdi + 2], 0
sub esi, r12d
xor r9d, r9d
add esi, 2
xor r8d, r8d
mov rcx, r14
lea edx, [rsi + r15]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFilePointer]
nop dword [rax + rax]
mov r10d, dword [0x140041928]
xor r15d, r15d
cmp r10d, 0x2b
jb 0x14001ce0d
cmp r10d, 0xc42c
jae 0x14001ce0d
mov edx, 1
lea rax, [rbp + 0x170]
mov dword [rsp + 0x28], 0x200
mov r9d, esi
mov qword [rsp + 0x20], rax
mov r8, r12
mov ecx, r10d
call qword [sym.imp.api_ms_win_core_string_l1_1_0.dll_MultiByteToWideChar]
nop dword [rax + rax]
mov esi, eax
mov dword [rsp + 0x40], eax
mov r12d, dword [rsp + 0x58]
lea rbx, [0x140049c00]
mov edi, dword [rsp + 0x54]
test eax, eax
je 0x14000ed32
test esi, esi
je 0x14000ed3a
cmp esi, 0xffffffff
je 0x14000ed32
cmp word [rbp + 0x170], 0
je 0x14000ed32
cmp word [rsp + 0x70], 0
je 0x14000ed32
mov eax, esi
add rax, rax
cmp rax, 0x402
jae 0x14000ed7c
mov edx, 0x3a
mov word [rbp + rax + 0x170], r15w
lea rcx, [rbp + 0x170]
call qword [sym.imp.msvcrt.dll_wcschr]
nop dword [rax + rax]
mov r14, rax
test rax, rax
jne 0x14000eb13
mov r14, qword [rsp + 0x48]
cmp dword [0x140041924], 0
jne 0x14001cce4
mov ecx, r13d
call qword [sym.imp.msvcrt.dll__get_osfhandle]
nop dword [rax + rax]
mov r9d, 1
xor r8d, r8d
mov rcx, rax
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFilePointer]
nop dword [rax + rax]
mov dword [r14 + 0xc], eax
cmp eax, edi
jl 0x14000e9fe
test r12d, r12d
je 0x14000ed76
mov ecx, r13d
call qword [sym.imp.msvcrt.dll__get_osfhandle]
nop dword [rax + rax]
mov rcx, rax
mov r14, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileType]
nop dword [rax + rax]
btr eax, 0xf
mov rcx, r14
cmp eax, 2
je 0x14001ccef
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rdi, rbx
mov r12, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFilePointer]
nop dword [rax + rax]
lea rcx, [0x140058470]
mov r15d, eax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_AcquireSRWLockShared]
nop dword [rax + rax]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov r8d, 0x200
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
nop dword [rax + rax]
lea rcx, [0x140058470]
mov ebx, eax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseSRWLockShared]
nop dword [rax + rax]
mov esi, dword [rsp + 0x40]
test ebx, ebx
je 0x14001cd0f
test esi, esi
je 0x14000ed27
mov r10d, dword [0x140041928]
mov ecx, esi
mov dword [rsp + 0x50], ecx
mov edx, esi
cmp r10d, 0xfde9
je 0x14001cd1a
test edx, edx
jle 0x14000e8e3
cmp ecx, 3
jl 0x14000eaed
movzx eax, byte [rdi]
cmp al, 0xa
je 0x14001cd78
cmp al, 0xd
je 0x14000e8ad
movzx eax, byte [rdi]
lea rdx, [0x140058150]
cmp byte [rax + rdx], 0
jne 0x14001cd87
inc rdi
dec ecx
mov dword [rsp + 0x50], ecx
test ecx, ecx
jg 0x14000ead5
jmp 0x14000e8e3
mov rbx, r14
add r14, 2
cmp word [rbx], 0xa
je 0x14000eb36
lea rax, [rbp + 0x170]
cmp rbx, rax
je 0x14000eb36
sub rbx, 2
cmp word [rbx], 0xa
jne 0x14000eb20
cmp word [rbx], 0x3a
je 0x14000eb40
add rbx, 2
mov rdi, rbx
test rbx, rbx
je 0x14000e85c
nop dword [rax]
movzx esi, word [rdi]
movzx ecx, si
call qword [sym.imp.msvcrt.dll_iswspace]
nop dword [rax + rax]
test eax, eax
je 0x14000e83d
cmp si, 0xa
je 0x14000e83d
add rdi, 2
jmp 0x14000eb50
test rbx, rbx
je 0x14001ce9a
mov edx, 0xa
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_wcschr]
nop dword [rax + rax]
mov r14, rax
test rax, rax
je 0x14001ce9d
movzx ebx, word [rdi]
movzx ecx, bx
call qword [sym.imp.msvcrt.dll_iswspace]
nop dword [rax + rax]
test eax, eax
jne 0x14001cf5d
movzx edx, bx
lea rcx, [0x1400342d0]
call qword [sym.imp.msvcrt.dll_wcschr]
nop dword [rax + rax]
test rax, rax
jne 0x14001cf68
movzx eax, word [rdi]
cmp ax, 0x3a
jne 0x14001cf7a
add rdi, 2
test rdi, rdi
je 0x14000ec2b
movzx ebx, word [rdi]
movzx ecx, bx
call qword [sym.imp.msvcrt.dll_iswspace]
nop dword [rax + rax]
test eax, eax
jne 0x14001cf89
movzx edx, bx
lea rcx, [0x1400342d0]
call qword [sym.imp.msvcrt.dll_wcschr]
nop dword [rax + rax]
test rax, rax
jne 0x14001cf94
mov esi, r15d
nop
movzx ebx, word [rdi]
lea rcx, str.:_n_r_t
movzx edx, bx
call qword [sym.imp.msvcrt.dll_wcschr]
nop dword [rax + rax]
test rax, rax
jne 0x14000ec88
movzx edx, bx
lea rcx, [0x1400342d8]
call qword [sym.imp.msvcrt.dll_wcschr]
nop dword [rax + rax]
test rax, rax
jne 0x14000ec88
cmp bx, 0x5e
je 0x14001cfa6
mov eax, esi
lea ecx, [rsi + 1]
add rdi, 2
mov esi, ecx
mov word [rbp + rax*2 + 0x70], bx
cmp ecx, 0x7f
jb 0x14000ec30
mov eax, esi
lea rdx, [rbp + 0x70]
lea rcx, [rsp + 0x70]
mov word [rbp + rax*2 + 0x70], r15w
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x14000e866
mov rax, qword [rsp + 0x60]
test byte [rax + 0x80], 1
je 0x14001cfb3
mov al, 1
mov byte [0x140045b08], al
call fcn.140018438
test r14, r14
je 0x14001cfba
lea rcx, [rbp + 0x170]
sub r14, rcx
add r14, 2
sar r14, 1
test al, al
jne 0x14001cfd7
mov rbx, qword [rsp + 0x48]
add dword [rbx + 0xc], r14d
mov r14, rbx
jmp 0x14000e890
cmp ax, 0x2b
jne 0x14000e70b
jmp 0x14000e707
call qword [sym.imp.msvcrt.dll_iswspace]
nop dword [rax + rax]
test eax, eax
jne 0x14000e7f6
jmp 0x14000e8a1
xor r15d, r15d
mov eax, r15d
jmp 0x14000e931
test esi, esi
jne 0x14001d017
test r12d, r12d
je 0x14001d017
mov ecx, r13d
call qword [sym.imp.msvcrt.dll__get_osfhandle]
nop dword [rax + rax]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFilePointer]
nop dword [rax + rax]
mov r12d, r15d
mov dword [rsp + 0x58], r15d
jmp 0x14000e9b2
mov esi, dword [rsp + 0x40]
jmp 0x14000ed32
call fcn.140019168
int3
mov rcx, r14
call fcn.1400096b4
mov rax, qword [r14 + 0x1d0]
xor edx, edx
mov ecx, 0x2330
mov qword [0x140045b10], rax
call fcn.140003278
mov eax, r12d
jmp 0x14000e80c
call fcn.14002e904
nop
jmp 0x14000e9c4
lea r9, [rsp + 0x40]
mov r8d, 0x200
lea rdx, [rbp + 0x170]
call fcn.140027ec0
mov esi, dword [rsp + 0x40]
jmp 0x14000e941
xor r15d, r15d
mov eax, r15d
jmp 0x14000e931
test r15d, r15d
jne 0x14000eacd
movzx r8d, word [0x140049c00]
movzx eax, word [0x14003596c]
sub r8d, eax
jne 0x14001cd49
movzx r8d, byte [0x140049c02]
movzx eax, byte [0x14003596e]
sub r8d, eax
test r8d, r8d
jne 0x14000eacd
add esi, 0xfffffffd
lea r15d, [r8 + 3]
mov ecx, esi
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x50], ecx
lea r12, [0x140049c03]
lea rdi, [0x140049c03]
mov edx, esi
jmp 0x14000eacd
cmp byte [rdi + 1], 0xd
je 0x14000e8b7
jmp 0x14000eae5
cmp ecx, 1
je 0x14001cd98
add rdi, 2
add ecx, 0xfffffffe
jmp 0x14000eb06
lea rcx, [0x140058470]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_AcquireSRWLockShared]
nop dword [rax + rax]
xor r15d, r15d
lea rdx, [rdi + 1]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], r15
mov rcx, r14
lea r8d, [r15 + 1]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
nop dword [rax + rax]
lea rcx, [0x140058470]
mov ebx, eax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseSRWLockShared]
nop dword [rax + rax]
test ebx, ebx
je 0x14001cdfd
cmp dword [rsp + 0x50], r15d
je 0x14001cdfd
mov r10d, dword [0x140041928]
inc esi
jmp 0x14000e8e6
mov esi, r15d
mov dword [rsp + 0x40], r15d
mov eax, r15d
jmp 0x14000e931
cmp r10d, 0xc435
ja 0x14001ce4b
je 0x14001ce84
cmp r10d, 0x2a
je 0x14001ce84
cmp r10d, 0xc42b
jbe 0x14000e8fd
cmp r10d, 0xc42e
jbe 0x14001ce84
cmp r10d, 0xc431
je 0x14001ce84
cmp r10d, 0xc433
je 0x14001ce84
jmp 0x14000e8fd
cmp r10d, 0xdeb3
ja 0x14001ce74
cmp r10d, 0xdeaa
jae 0x14001ce84
cmp r10d, 0xcec8
je 0x14001ce84
cmp r10d, 0xd698
je 0x14001ce84
jmp 0x14000e8fd
lea eax, [r10 - 0xfde8]
cmp eax, 1
ja 0x14000e8fd
mov edx, r15d
jmp 0x14000e902
test si, si
je 0x14000e85c
jmp 0x14000eb74
mov r14, r15
mov ecx, r13d
call qword [sym.imp.msvcrt.dll__get_osfhandle]
nop dword [rax + rax]
mov r9d, 1
xor r8d, r8d
mov rcx, rax
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFilePointer]
nop dword [rax + rax]
cmp eax, dword [rsp + 0x5c]
je 0x14000eba3
mov esi, dword [rsp + 0x40]
cmp esi, 0x200
je 0x14000eba3
lea rax, [rbp + 0x170]
sub rbx, rax
sar rbx, 1
sub esi, ebx
call fcn.140018438
test al, al
je 0x14001cf2c
mov ecx, dword [0x140041928]
lea r8, [rbp + 0x170]
mov qword [rsp + 0x38], r15
mov r9d, esi
mov qword [rsp + 0x30], r15
xor edx, edx
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
call qword [sym.imp.api_ms_win_core_string_l1_1_0.dll_WideCharToMultiByte]
nop dword [rax + rax]
mov esi, eax
mov ecx, r13d
neg esi
call qword [sym.imp.msvcrt.dll__get_osfhandle]
nop dword [rax + rax]
mov r9d, 1
xor r8d, r8d
mov rcx, rax
mov edx, esi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFilePointer]
nop dword [rax + rax]
nop
jmp 0x14000e88b
cmp bx, 0xa
jne 0x14001cf71
jmp 0x14000ebbd
test bx, bx
je 0x14000ebdc
add rdi, 2
jmp 0x14000eba3
cmp ax, 0x2b
jne 0x14000ebed
jmp 0x14000ebe9
cmp bx, 0xa
jne 0x14001cf9d
jmp 0x14000ec0c
test bx, bx
je 0x14000ec2b
add rdi, 2
jmp 0x14000ebf2
movzx ebx, word [rdi + 2]
add rdi, 2
jmp 0x14000ec73
xor al, al
jmp 0x14000ecc1
test al, al
je 0x14001cfc5
mov r9d, dword [rsp + 0x40]
jmp 0x14001cfda
mov r14, qword [rsp + 0x48]
mov eax, dword [rsp + 0x40]
add dword [r14 + 0xc], eax
jmp 0x14000e890
mov r9d, r14d
mov ecx, dword [0x140041928]
lea r8, [rbp + 0x170]
mov qword [rsp + 0x38], r15
xor edx, edx
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
call qword [sym.imp.api_ms_win_core_string_l1_1_0.dll_WideCharToMultiByte]
nop dword [rax + rax]
mov r14, qword [rsp + 0x48]
add dword [r14 + 0xc], eax
jmp 0x14000e890
mov rbx, qword [rsp + 0x48]
mov rcx, rbx
call fcn.1400096b4
mov rax, qword [rbx + 0x1d0]
lea r8, [rsp + 0x70]
mov edx, 1
mov qword [0x140045b10], rax
mov ecx, 0x400023ab
call fcn.140003278
mov r15d, 1
jmp 0x14000e801