Function at 0x1400bc0e4
Capabilities:
Check if file exists
Get file attributes
Get file size
Get system information on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xf8
and qword [rbp - 0x71], 0
xor eax, eax
and dword [rsp + 0x48], eax
mov r14, rcx
mov rcx, qword [rcx + 0x68]
xor ebx, ebx
and qword [rsp + 0x50], rax
xor r12d, r12d
or qword [rbp + 0x6f], 0xffffffffffffffff
xor r13d, r13d
mov qword [rsp + 0x58], rax
and qword [rsp + 0x58], rax
mov qword [rsp + 0x40], rbx
mov qword [rbp - 0x79], r12
mov dword [rsp + 0x4c], r13d
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
je 0x1400bc154
shr edi, 4
not edi
and edi, 1
jmp 0x1400bc156
xor edi, edi
xor ecx, ecx
call fcn.140078324
xor ecx, ecx
call fcn.140078324
xor esi, esi
mov r15d, 0x8007000d
test edi, edi
je 0x1400bc1fe
and qword [rsp + 0x30], rbx
lea r8d, [rsi + 1]
mov rcx, qword [r14 + 0x68]
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea rcx, [rax + 1]
test rcx, 0xfffffffffffffffe
jne 0x1400bc1d4
or qword [rbp + 0x6f], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400bc1c2
mov esi, 0x80004005
jmp 0x1400bc1d0
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov ecx, esi
jmp 0x1400bc1f9
lea rdx, [rbp - 0x69]
mov qword [rbp + 0x6f], rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400bc1b1
cmp qword [rbp - 0x69], 0x200000
jle 0x1400bc1fe
mov esi, r15d
mov ecx, r15d
call fcn.140078308
mov ecx, esi
call fcn.140078324
lea rcx, [rbp + 0x6f]
call fcn.140074d74
test esi, esi
jns 0x1400bc21e
mov ecx, esi
call fcn.140078308
jmp 0x1400bc561
mov rcx, qword [r14 + 0x68]
lea r8, [rbp - 0x71]
lea rdx, [rbp + 0x6f]
call fcn.1400c19b0
mov esi, eax
test eax, eax
jns 0x1400bc239
mov ecx, eax
jmp 0x1400bc214
lea r8, [rsp + 0x40]
xor edx, edx
lea rcx, [0x1403a9d30]
call fcn.1400edcd4
mov esi, eax
test eax, eax
jns 0x1400bc263
mov ecx, eax
call fcn.140078308
mov rbx, qword [rsp + 0x40]
jmp 0x1400bc561
mov rbx, qword [rsp + 0x40]
mov rax, qword [rbx]
mov rdi, qword [rax + 0x18]
mov rcx, rdi
call qword [0x1403a2250]
mov r8d, dword [rbp + 0x6f]
xor r9d, r9d
mov rdx, qword [rbp - 0x71]
mov rcx, rbx
call rdi
mov esi, eax
test eax, eax
js 0x1400bc235
mov rax, qword [rbx]
mov rdi, qword [rax + 0x30]
mov rcx, rdi
call qword [0x1403a2250]
lea rdx, [rbp - 0x59]
mov rcx, rbx
call rdi
mov esi, eax
test eax, eax
js 0x1400bc235
cmp dword [rbp - 0x51], 1
je 0x1400bc2be
mov esi, r15d
mov ecx, r15d
jmp 0x1400bc214
cmp dword [rbp - 0x49], 1
jb 0x1400bc2b3
mov rax, qword [rbx]
mov rdi, qword [rax + 0x30]
mov rcx, rdi
call qword [0x1403a2250]
lea rdx, [rbp - 0x59]
mov rcx, rbx
call rdi
mov esi, eax
test eax, eax
js 0x1400bc235
cmp dword [rbp - 0x51], 1
jne 0x1400bc2b3
mov r15, qword [rbp - 0x49]
xor r14d, r14d
test r15d, r15d
je 0x1400bc3c7
mov rdi, qword [rsp + 0x58]
test rdi, rdi
je 0x1400bc329
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rdi - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.140078324
and qword [rsp + 0x58], 0
test r12, r12
je 0x1400bc349
mov rax, qword [r12]
mov rdi, qword [rax + 0x10]
mov rcx, rdi
call qword [0x1403a2250]
mov rcx, r12
call rdi
and qword [rbp - 0x79], 0
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.1400bf384
mov esi, eax
test eax, eax
js 0x1400bc235
test r13d, r13d
je 0x1400bc382
mov rax, qword [rsp + 0x50]
lea rdx, [rbp - 0x69]
mov rcx, qword [rsp + 0x58]
mov qword [rbp - 0x69], rax
mov dword [rbp - 0x61], r13d
call fcn.1400bd098
jmp 0x1400bc384
xor eax, eax
lea r8, [rsp + 0x58]
mov edx, eax
lea rcx, [rsp + 0x48]
call fcn.1400bf16c
mov esi, eax
test eax, eax
jns 0x1400bc3a2
mov ecx, eax
call fcn.140078308
mov ecx, esi
call fcn.140078324
test esi, esi
js 0x1400bc212
inc r14d
cmp r14d, r15d
jae 0x1400bc3c7
mov r12, qword [rbp - 0x79]
mov r13d, dword [rsp + 0x4c]
jmp 0x1400bc2fd
mov rax, qword [rbx]
mov rdi, qword [rax + 0x28]
mov rcx, rdi
call qword [0x1403a2250]
lea rdx, [rbp + 0x77]
mov rcx, rbx
call rdi
mov esi, eax
test eax, eax
js 0x1400bc235
mov rax, qword [rbx]
mov rdi, qword [rax + 0x30]
mov rcx, rdi
call qword [0x1403a2250]
lea rdx, [rbp - 0x59]
mov rcx, rbx
call rdi
mov esi, eax
test eax, eax
js 0x1400bc235
cmp dword [rbp - 0x51], 4
je 0x1400bc41d
mov esi, 0x8007000d
jmp 0x1400bc212
mov r13, qword [rbp + 0x67]
lea r8, [rsp + 0x40]
mov r15, qword [rbp - 0x49]
lea rdx, [rbp + 0x6f]
mov edi, dword [rbp - 0x41]
mov rcx, r13
mov r12d, dword [rbp + 0x77]
and qword [rsp + 0x40], 0
call fcn.1400c0e18
mov esi, eax
test eax, eax
jns 0x1400bc452
mov ecx, eax
call fcn.140078308
jmp 0x1400bc4b8
mov r14, qword [rsp + 0x40]
lea rax, [0x14002c5a0]
mov qword [rbp - 0x31], rax
lea rdx, [rbp - 0x39]
xor r9d, r9d
mov dword [rbp - 0x11], edi
mov edi, dword [rbp + 0x6f]
lea rax, [rbp + 0x7f]
mov qword [rbp - 0x29], rax
mov rax, qword [rbp - 0x71]
lea r8d, [r9 + 0x48]
mov qword [rbp - 0x19], rax
lea ecx, [r8 + 0x71]
mov qword [rbp - 1], r14
mov qword [rbp - 0x39], 3
mov dword [rbp - 0x21], r12d
mov dword [rbp - 9], edi
mov qword [rbp + 7], r15
call sub.ntdll.dll_NtQuerySystemInformation
mov esi, dword [rbp + 0x7f]
test esi, esi
jns 0x1400bc4ae
mov ecx, esi
jmp 0x1400bc44b
mov rcx, rdi
xor eax, eax
mov rdi, r14
rep stosb byte [rdi], al
mov ecx, esi
call fcn.140078324
lea rcx, [rsp + 0x40]
call fcn.14005a080
cmp esi, 0x8007000d
jne 0x1400bc4e3
lea rcx, [r13 + 0x98]
xor edx, edx
call fcn.1400b5ea0
xor esi, esi
jmp 0x1400bc561
test esi, esi
js 0x1400bc212
lea rdi, [r13 + 0x98]
xor edx, edx
mov rcx, rdi
call fcn.1400b5ea0
mov r13, qword [rdi + 8]
mov r15d, dword [rdi]
mov r12d, dword [rdi + 4]
and qword [rdi + 8], 0
mov eax, dword [rsp + 0x48]
mov dword [rdi], eax
mov eax, dword [rsp + 0x4c]
mov dword [rdi + 4], eax
mov r14, qword [rdi + 8]
test r14, r14
je 0x1400bc53b
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
and qword [rdi + 8], 0
mov rax, qword [rsp + 0x50]
lea rcx, [rbp + 0x67]
and qword [rbp + 0x67], 0
mov qword [rdi + 8], rax
mov dword [rsp + 0x48], r15d
mov dword [rsp + 0x4c], r12d
mov qword [rsp + 0x50], r13
call fcn.1400abc70
mov ecx, esi
call fcn.140078324
xor edx, edx
lea rcx, [rsp + 0x48]
call fcn.1400b5ea0
lea rcx, [rsp + 0x50]
call fcn.1400abc70
lea rcx, [rsp + 0x58]
call fcn.1400b4788
test rbx, rbx
je 0x1400bc5a2
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rcx, rdi
call qword [0x1403a2250]
mov rcx, rbx
call rdi
lea rcx, [rbp - 0x71]
call fcn.1400abeec
mov eax, esi
add rsp, 0xf8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret