Function at 0x14004be80
Capabilities:
Get file size
Read file on windows

Disassembly:
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x58
mov r13, qword [0x1401050e0]
mov rdi, rdx
mov r12, rcx
mov byte [rsp + 0x20], 1
mov rcx, r13
xor r9d, r9d
or r8, 0xffffffffffffffff
xor edx, edx
call fcn.14008b8b0
xor al, al
mov qword [rsp + 0x90], rbx
or r15, 0xffffffffffffffff
mov byte [rsp + 0xa0], al
mov rax, qword [0x1400fca58]
xor r14b, r14b
mov byte [rsp + 0x98], r14b
lea esi, [r15 + 0x11]
mov r8d, dword [rax + 0x13c]
btr r8d, 0x1f
mov dword [rsp + 0x40], r8d
nop
mov rax, rdi
movzx ecx, word [rax]
cmp cx, 0x20
je 0x14004bf02
cmp cx, 9
jne 0x14004bf08
add rax, 2
jmp 0x14004bef3
cmp word [rax], 0x2a
jne 0x14004c069
movzx ebx, word [rax + 2]
lea rdi, [rax + 2]
test ebx, 0xffffff80
jne 0x14004bf35
mov edx, 2
mov ecx, ebx
call fcn.1400aae54
test eax, eax
je 0x14004bf35
and ebx, 0xffffffdf
movzx eax, bx
cmp eax, 0x43
je 0x14004c03d
cmp eax, 0x4d
je 0x14004bfd0
cmp eax, 0x50
je 0x14004bf65
cmp eax, 0x54
jne 0x14004c048
mov byte [rsp + 0xa0], 1
jmp 0x14004c048
lea rcx, [rdi + 2]
call fcn.1400abe8c
movzx edx, word [rdi]
mov dword [rsp + 0x40], eax
test dx, dx
je 0x14004bfb3
nop word [rax + rax]
lea rcx, [0x1400dfa00]
mov eax, SafeArrayAllocDescriptor
nop dword [rax]
cmp dx, ax
je 0x14004c037
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x14004bf90
movzx edx, word [rdi + 2]
add rdi, 2
test dx, dx
jne 0x14004bf80
mov rax, qword [0x1400fca58]
mov dl, 1
mov rcx, r12
mov dword [rax + 0x40], 0x57
call fcn.140035980
jmp 0x14004c4cd
lea rcx, [rdi + 2]
call fcn.14000ec40
test al, al
lea rcx, [rdi + 2]
mov r8d, 0xa
cmovne r8d, esi
xor edx, edx
call fcn.1400ac2c0
movzx r8d, word [rdi]
mov r15, rax
test r8w, r8w
je 0x14004bfb3
nop dword [rax]
lea rdx, [0x1400dfa00]
mov ecx, SafeArrayAllocDescriptor
nop dword [rax]
cmp r8w, cx
je 0x14004c037
movzx ecx, word [rdx + 2]
add rdx, 2
test cx, cx
jne 0x14004c010
movzx r8d, word [rdi + 2]
add rdi, 2
test r8w, r8w
jne 0x14004c000
jmp 0x14004bfb3
add rdi, 0xfffffffffffffffe
jmp 0x14004c048
mov r14b, 1
mov byte [rsp + 0x98], r14b
cmp word [rdi], 0
je 0x14004bef0
add rdi, 2
cmp word [rdi], 0
je 0x14004bef0
add rdi, 2
jmp 0x14004bef0
xor esi, esi
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0x8000000
mov edx, 0x80000000
mov rcx, rdi
mov dword [rsp + 0x20], 3
lea r8d, [rsi + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x14004c0ba
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x1400fca58]
mov dl, 1
mov dword [rcx + 0x40], eax
jmp 0x14004c4c0
lea rdx, [rsp + 0x4c]
mov qword [rsp + 0x48], rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, 0xffffffff
mov dword [rsp + 0x48], eax
cmp eax, ecx
jne 0x14004c0e9
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14004c0f4
mov ecx, 0xffffffff
mov rbx, qword [rsp + 0x48]
cmp rbx, 0xffffffffffffffff
jne 0x14004c158
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x1400fca58]
mov dword [rcx + 0x40], eax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x1400fca58]
lea rdx, [0x1400df778]
cmp byte [rax + 0x150], sil
jne 0x14004c141
mov rcx, qword [0x140100e80]
xor r9d, r9d
or r8, 0xffffffffffffffff
mov byte [rsp + 0x20], 1
call fcn.14008b8b0
jmp 0x14004c4c8
lea r9, [0x1400e8268]
xor r8d, r8d
mov rcx, r12
call fcn.140035860
jmp 0x14004c4c8
cmp rbx, r15
cmova rbx, r15
cmp rbx, rcx
jbe 0x14004c182
lea r9, [0x1400e8268]
xor r8d, r8d
lea rdx, str.Out_of_memory.
mov rcx, r12
call fcn.140035b40
jmp 0x14004c4c8
test rbx, rbx
jne 0x14004c1a1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x1400fca58]
xor edx, edx
mov dword [rax + 0x40], esi
jmp 0x14004c4c0
test r14b, r14b
je 0x14004c28c
movzx eax, byte [r13 + 0x23]
test al, al
jne 0x14004c1bb
mov rax, qword [r13 + 0x10]
movzx eax, byte [rax + 0x23]
cmp al, 2
je 0x14004c28c
mov rax, rbx
mov byte [rsp + 0x20], sil
and eax, 1
mov r8, rbx
shr r8, 1
mov r15b, 1
add r8, rax
movzx r9d, r15b
xor edx, edx
mov rcx, r13
call fcn.14008b8b0
cmp eax, 1
jne 0x14004c2bd
xor r8d, r8d
mov edx, eax
mov rcx, r13
call fcn.140001450
mov rdi, rax
test rax, rax
je 0x14004c2bd
lea r9, [rsp + 0xa8]
mov qword [rsp + 0x20], rsi
mov r8d, ebx
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x1400fca58]
mov dword [rcx + 0x40], eax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14d, r14d
je 0x14004c454
movzx ebp, byte [rsp + 0x98]
test bpl, bpl
jne 0x14004c3d0
mov ecx, dword [rsp + 0xa8]
cmp ecx, 3
jb 0x14004c2cd
cmp byte [rdi], 0xef
jne 0x14004c2cd
cmp byte [rdi + 1], 0xbb
jne 0x14004c2cd
cmp byte [rdi + 2], 0xbf
jne 0x14004c2cd
lea r8d, [rcx - 3]
mov r9d, 0xfde9
lea rdx, [rdi + 3]
jmp 0x14004c3b8
lea rcx, [rbx + 2]
xor r15b, r15b
call fcn.1400a8428
mov rdi, rax
test rax, rax
jne 0x14004c20a
lea r9, [0x1400e8268]
xor r8d, r8d
lea rdx, str.Out_of_memory.
mov rcx, r12
call fcn.140035b40
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x14004c4c8
cmp ecx, 2
jb 0x14004c3a0
cmp byte [rdi], 0xff
jne 0x14004c3a0
cmp byte [rdi + 1], 0xfe
jne 0x14004c3a0
lea rdx, [rdi + 2]
add ecx, 0xfffffffe
mov r8d, ecx
mov r9b, 1
shr r8, 1
mov rcx, r13
mov byte [rsp + 0x20], sil
call fcn.14008b8b0
test eax, eax
cmove r14d, esi
test rdi, rdi
je 0x14004c319
mov rcx, rdi
call fcn.1400ac350
xor r8d, r8d
mov rcx, r13
lea edx, [r8 + 1]
call fcn.140001450
mov rbx, rax
movzx eax, byte [rsp + 0xa0]
test al, al
je 0x14004c477
mov rcx, r13
call fcn.140015ea0
mov qword [rsp + 0x98], rax
lea r8, [0x1400e6804]
lea rax, [rsp + 0x98]
mov r9d, 1
mov qword [rsp + 0x38], rax
lea rdx, [0x1400e5bf8]
mov qword [rsp + 0x30], rsi
mov eax, 0xffffffff
mov qword [rsp + 0x28], 0xffffffffffffffff
mov rcx, rbx
mov dword [rsp + 0x20], eax
call fcn.140088ba0
mov rdx, qword [rsp + 0x98]
mov rcx, r13
call fcn.140015e50
jmp 0x14004c477
mov r9d, dword [rsp + 0x40]
mov rdx, rdi
cmp r9d, 0x4b0
je 0x14004c2f0
mov r8d, ecx
mov rcx, r13
call fcn.14008c6c0
test eax, eax
jne 0x14004c30c
mov r14d, esi
jmp 0x14004c30c
movzx eax, byte [r13 + 0x23]
test al, al
jne 0x14004c3e1
mov rax, qword [r13 + 0x10]
movzx eax, byte [rax + 0x23]
cmp al, 2
jne 0x14004c42f
mov edx, dword [rsp + 0xa8]
mov rcx, rdi
call fcn.14008b690
cmp eax, 1
mov rcx, rdi
sete sil
call fcn.1400ac350
test esi, esi
je 0x14004c4a1
mov rcx, qword [0x140100e80]
lea rdx, [0x1400cc024]
xor r9d, r9d
mov byte [rsp + 0x20], 1
or r8, 0xffffffffffffffff
call fcn.14008b8b0
jmp 0x14004c4c8
mov ecx, dword [rsp + 0xa8]
test cl, 1
je 0x14004c441
mov byte [rcx + rdi], sil
inc ecx
mov ebx, ecx
mov word [rcx + rdi], si
mov rcx, r13
call fcn.140015e10
mov qword [rax], rbx
jmp 0x14004c477
mov rcx, r13
mov word [rdi], si
call fcn.140015e10
mov qword [rax], rsi
test r15b, r15b
jne 0x14004c46f
mov rcx, rdi
call fcn.1400ac350
movzx ebp, byte [rsp + 0x98]
cmp byte [r13 + 0x23], sil
jne 0x14004c481
mov r13, qword [r13 + 0x10]
cmp byte [r13 + 0x23], 2
jne 0x14004c4a5
cmp qword [0x140105f98], rsi
je 0x14004c4a5
lea rcx, [0x140105f80]
call fcn.140004fc0
test eax, eax
jne 0x14004c4ba
xor eax, eax
jmp 0x14004c4c8
and byte [r13 + 0x21], 0x86
movzx eax, byte [r13 + 0x21]
test bpl, bpl
je 0x14004c4ba
or al, 1
mov byte [r13 + 0x21], al
test r14d, r14d
sete dl
mov rcx, r12
call fcn.140035980
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x90]
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret