Function at 0x1400ca160
Capabilities:
Get file size
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x1d8
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x14013aa80]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov r12, qword [rcx + 0x10]
call fcn.140079a80
mov rbx, rax
mov rcx, rsi
mov rdx, rdi
call fcn.140079aa0
mov r14, rax
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0xb8], 0
mov qword [rsp + 0xb0], 0
mov rax, qword [0x14013ca00]
mov rcx, qword [r12 + 0x20]
mov rcx, qword [rcx + 8]
lea r8, [rsp + 0xc0]
mov edx, 0x53
call qword [rax + 0x58]
test eax, eax
jne 0x1400ca24f
mov rdx, qword [rsp + 0xc0]
test rdx, rdx
je 0x1400ca24f
cmp qword [rbx + 8], 0
jne 0x1400ca208
cmp qword [rbx + 0x48], 0
je 0x1400ca282
mov rax, qword [r12 + 0x20]
cmp byte [rax + 0x6c], 0
je 0x1400ca282
mov dword [rsp + 0x20], 0
mov ecx, 6
mov edx, 1
xor r8d, r8d
mov r9d, 2
call fcn.1400adea0
test al, al
je 0x1400ca35b
lea rdx, str.schannel:_this_version_of_Windows_is_too_old_to_support_certificate_verification_via_CA_bundle_file.
mov rcx, rdi
call fcn.140079120
jmp 0x1400ca49f
lea rdx, [rsp + 0xd0]
mov r8d, 0x100
mov ecx, eax
call fcn.1400ba9b0
lea rdx, str.schannel:_Failed_to_read_remote_certificate_context:__s
mov rcx, rdi
mov r8, rax
call fcn.140079120
mov ebp, 0x3c
xor esi, esi
jmp 0x1400ca8ba
xor ecx, ecx
xor esi, esi
xorps xmm0, xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x70], xmm0
mov dword [rsp + 0x60], 0x20
xor eax, eax
cmp byte [r14 + 0xb3], 0
sete al
shl eax, 0x1d
mov r9, qword [rdx + 0x20]
lea r8, [rsp + 0xb8]
mov qword [rsp + 0x38], r8
lea r8, [rsp + 0x60]
mov qword [rsp + 0x20], r8
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x30], 0
xor r8d, r8d
call qword [sym.imp.CRYPT32.dll_CertGetCertificateChain]
test eax, eax
je 0x1400ca3b5
mov rax, qword [rsp + 0xb8]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
mov eax, dword [rax + 4]
cmp byte [rdi + 0x5dd], 0
mov ecx, 0xfffffffd
mov r8d, 0xfeffffbd
cmove r8d, ecx
and r8d, eax
je 0x1400ca3f8
test al, 4
jne 0x1400ca4ab
test eax, 0x10000
jne 0x1400ca624
test al, 0x20
jne 0x1400ca652
test al, 1
jne 0x1400ca6ff
test r8b, 0x40
jne 0x1400ca88c
lea rdx, str.schannel:_CertGetCertificateChain_error_mask:_0x_08x
mov rcx, rdi
call fcn.140079120
mov ebp, 0x3c
jmp 0x1400ca8ba
mov qword [rsp + 0x20], 0
mov ecx, 2
xor edx, edx
xor r8d, r8d
mov r9d, 0x2000
call qword [sym.imp.CRYPT32.dll_CertOpenStore]
test rax, rax
je 0x1400ca472
mov rsi, rax
mov rax, qword [rbx + 0x48]
test rax, rax
je 0x1400ca58a
mov rdx, qword [rax]
mov r8, qword [rax + 8]
mov qword [rsp + 0x20], rdi
lea r9, str._memory_blob_
mov rcx, rsi
call fcn.1400ca9b0
mov ebp, eax
jmp 0x1400ca760
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsp + 0xd0]
mov r8d, 0x100
mov ecx, eax
call fcn.1400ba880
lea rdx, str.schannel:_CertGetCertificateChain_failed:__s
mov rcx, rdi
mov r8, rax
call fcn.140079120
mov qword [rsp + 0xb8], 0
mov ebp, 0x3c
jmp 0x1400ca8ba
cmp byte [rbx + 0x6a], 0
je 0x1400ca630
mov r14, qword [r12 + 8]
mov r13, qword [rsp + 0xc0]
mov rcx, r14
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov qword [rsp + 0x40], rax
mov rcx, rdi
mov rdx, r13
xor r8d, r8d
xor r9d, r9d
call fcn.1400cad30
test eax, eax
je 0x1400ca637
mov ebp, eax
mov r12d, eax
mov rcx, r12
call qword [str.0__r_]
test rax, rax
je 0x1400ca6a0
mov rbx, rax
mov rcx, rdi
mov rdx, r13
mov r8, rax
mov r9d, ebp
call fcn.1400cad30
cmp eax, ebp
jne 0x1400ca6e6
mov ebp, 0x3c
xor r15d, r15d
jmp 0x1400ca4c5
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsp + 0xd0]
mov r8d, 0x100
mov ecx, eax
call fcn.1400ba880
lea rdx, str.schannel:_failed_to_create_certificate_store:__s
mov rcx, rdi
mov r8, rax
call fcn.140079120
mov ebp, 0x4d
xor esi, esi
jmp 0x1400ca8ba
lea rdx, str.schannel:_CertGetCertificateChain_trust_error_CERT_TRUST_IS_REVOKED
jmp 0x1400ca893
mov ebp, 0x1b
cmp r15, r12
jae 0x1400ca55d
cmp ebp, 0x3c
jne 0x1400ca55d
cmp byte [rbx + r15], 0
je 0x1400ca55d
lea rbp, [rbx + r15]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
test rax, rax
je 0x1400ca4b7
mov r13, rax
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rcx, r13
mov rdx, rax
mov r8, r14
mov r9, qword [rsp + 0x40]
call fcn.1400d1910
mov rcx, rdi
test al, al
je 0x1400ca526
lea rdx, str.schannel:_connection_hostname___s__validated_against_certificate_name___s_
mov r8, r14
mov r9, r13
call fcn.1400791f0
xor ebp, ebp
jmp 0x1400ca54b
lea rdx, str.schannel:_connection_hostname___s__did_not_match_against_certificate_name___s_
mov r8, r14
mov r9, r13
call fcn.1400791f0
mov rcx, rbp
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add r15, rax
inc r15
mov ebp, 0x3c
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
cmp r15, r12
jb 0x1400ca4c5
test ebp, ebp
je 0x1400ca8b1
cmp ebp, 0x3c
jne 0x1400ca8a2
lea rdx, str.schannel:_CertGetNameString___failed_to_match_connection_hostname___s__against_server_certificate_names
mov rcx, rdi
mov r8, r14
call fcn.140079120
mov ebp, 0x3c
jmp 0x1400ca8b1
mov r13, qword [rbx + 8]
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
test rax, rax
je 0x1400ca65e
mov r15, rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
mov rcx, rax
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x1400ca6ac
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400ca70b
mov rbp, qword [rsp + 0x60]
cmp rbp, 0x100001
jl 0x1400ca800
lea rdx, str.schannel:_CA_file_exceeds_max_size_of__u_bytes
mov rcx, rdi
mov r8d, 0x100000
call fcn.140079120
jmp 0x1400ca73b
lea rdx, str.schannel:_CertGetCertificateChain_trust_error_CERT_TRUST_IS_PARTIAL_CHAIN
jmp 0x1400ca893
xor ebp, ebp
jmp 0x1400ca8ba
lea rdx, str.schannel:_CertGetNameString___returned_no_certificate_name_information
mov rcx, rdi
call fcn.140079120
mov ebp, 0x3c
xor ebx, ebx
jmp 0x1400ca8b1
lea rdx, str.schannel:_CertGetCertificateChain_trust_error_CERT_TRUST_IS_UNTRUSTED_ROOT
jmp 0x1400ca893
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsp + 0xd0]
mov r8d, 0x100
mov ecx, eax
call fcn.1400ba880
lea rdx, str.schannel:_invalid_path_name_for_CA_file__s:__s
mov rcx, rdi
mov r8, r13
mov r9, rax
call fcn.140079120
xor ecx, ecx
call qword [0x140136438]
mov ebp, 0x4d
jmp 0x1400ca760
mov ebp, 0x1b
xor ebx, ebx
jmp 0x1400ca8b1
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsp + 0xd0]
mov r8d, 0x100
mov ecx, eax
call fcn.1400ba880
lea rdx, str.schannel:_failed_to_open_CA_file__s:__s
mov rcx, rdi
mov r8, r13
mov r9, rax
call fcn.140079120
mov ebp, 0x4d
xor r13d, r13d
jmp 0x1400ca74e
lea rdx, str.schannel:_CertGetNameString___returned_certificate_name_information_of_unexpected_size
mov rcx, rdi
call fcn.140079120
mov ebp, 0x3c
jmp 0x1400ca8b1
lea rdx, str.schannel:_CertGetCertificateChain_trust_error_CERT_TRUST_IS_NOT_TIME_VALID
jmp 0x1400ca893
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsp + 0xd0]
mov r8d, 0x100
mov ecx, eax
call fcn.1400ba880
lea rdx, str.schannel:_failed_to_determine_size_of_CA_file__s:__s
mov rcx, rdi
mov r8, r13
mov r9, rax
call fcn.140079120
mov ebp, 0x4d
xor r13d, r13d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r13
call qword [0x140136438]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test ebp, ebp
jne 0x1400ca8ba
xorps xmm0, xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
mov dword [rsp + 0x60], 0x50
mov qword [rsp + 0xa0], rsi
lea rcx, [rsp + 0x60]
lea rdx, [rsp + 0xb0]
call qword [sym.imp.CRYPT32.dll_CertCreateCertificateChainEngine]
test eax, eax
je 0x1400ca7c9
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xb0]
jmp 0x1400ca286
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsp + 0xd0]
mov r8d, 0x100
mov ecx, eax
call fcn.1400ba880
lea rdx, str.schannel:_failed_to_create_certificate_chain_engine:__s
mov rcx, rdi
mov r8, rax
call fcn.140079120
mov ebp, 0x4d
jmp 0x1400ca8ba
lea rcx, [rbp + 1]
call qword [str.0__r_]
mov qword [rsp + 0x48], rax
test rax, rax
je 0x1400ca929
mov qword [rsp + 0x50], r13
xor r13d, r13d
test rbp, rbp
mov qword [rsp + 0x58], r15
je 0x1400ca933
xor r15d, r15d
mov r8d, ebp
sub r8d, r13d
mov dword [rsp + 0xcc], 0
mov rax, qword [rsp + 0x48]
lea rdx, [rax + r15]
mov qword [rsp + 0x20], 0
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0xcc]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400ca964
mov eax, dword [rsp + 0xcc]
add r13d, eax
test eax, eax
cmove rbp, r15
mov r15, r13
cmp rbp, r13
ja 0x1400ca831
jmp 0x1400ca935
lea rdx, str.schannel:_CertGetCertificateChain_trust_error_CERT_TRUST_REVOCATION_STATUS_UNKNOWN
mov rcx, rdi
call fcn.140079120
mov ebp, 0x3c
jmp 0x1400ca8ba
lea rdx, str.schannel:_server_certificate_name_verification_failed
mov rcx, rdi
call fcn.140079120
mov rcx, rbx
call qword [0x140136438]
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x1400ca8cd
call qword [sym.imp.CRYPT32.dll_CertFreeCertificateChainEngine]
test rsi, rsi
je 0x1400ca8dd
mov rcx, rsi
xor edx, edx
call qword [sym.imp.CRYPT32.dll_CertCloseStore]
mov rcx, qword [rsp + 0xb8]
test rcx, rcx
je 0x1400ca8f0
call qword [sym.imp.CRYPT32.dll_CertFreeCertificateChain]
mov rcx, qword [rsp + 0xc0]
test rcx, rcx
je 0x1400ca903
call qword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1400d2000
mov eax, ebp
add rsp, 0x1d8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ebp, 0x1b
jmp 0x1400ca740
xor ebp, ebp
mov r13, qword [rsp + 0x48]
mov byte [r13 + rbp], 0
mov qword [rsp + 0x20], rdi
mov rcx, rsi
mov rdx, r13
mov r8, rbp
mov r9, qword [rsp + 0x50]
call fcn.1400ca9b0
mov ebp, eax
mov r15, qword [rsp + 0x58]
jmp 0x1400ca743
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsp + 0xd0]
mov r8d, 0x100
mov ecx, eax
call fcn.1400ba880
lea rdx, str.schannel:_failed_to_read_from_CA_file__s:__s
mov rcx, rdi
mov r8, qword [rsp + 0x50]
mov r9, rax
call fcn.140079120
mov ebp, 0x4d
mov r15, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x40]
mov r13, qword [rsp + 0x48]
jmp 0x1400ca748