Function at 0x1400b24d0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x330
mov rax, qword [0x14036a3c8]
xor rax, rsp
mov qword [rsp + 0x320], rax
mov r15, rdx
call fcn.14006d8b0
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.1400684a0
nop
call fcn.14006d8c0
mov rcx, rax
call fcn.1400694e0
xor ebx, ebx
test al, al
je 0x1400b26a7
mov rdx, r15
lea rcx, [rsp + 0x60]
call fcn.140068a80
lea rcx, [rsp + 0x60]
call fcn.1400687f0
mov rcx, rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], Ordinal_133
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rbx + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x1400b25da
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test eax, eax
je 0x1400b25da
mov dword [rsp + 0x40], ebx
mov ebp, esi
lea rdx, [0x1403243e8]
mov ecx, esi
call fcn.140241530
mov rdi, rax
test rax, rax
je 0x1400b2788
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x40]
mov r8d, esi
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x40], esi
je 0x1400b2788
mov rcx, rdi
call fcn.140240d18
nop
lea rcx, [rsp + 0x60]
call fcn.140003e80
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], Ordinal_133
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x1400b2678
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test eax, eax
je 0x1400b2678
mov dword [rsp + 0x44], ebx
mov ebp, esi
lea rdx, [0x1403243e8]
mov ecx, esi
call fcn.140241530
mov rdi, rax
test rax, rax
je 0x1400b2678
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x44]
mov r8d, esi
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x44], esi
je 0x1400b279b
mov rcx, rdi
call fcn.140240d18
xor eax, eax
mov rcx, qword [rsp + 0x320]
xor rcx, rsp
call fcn.140240e30
lea r11, [rsp + 0x330]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
call fcn.14006d8c0
nop
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140068a60
call fcn.14006dd30
test al, al
je 0x1400b26ca
call fcn.14006d8d0
jmp 0x1400b26e2
lea rcx, [rsp + 0x60]
call fcn.1400687f0
mov rcx, rax
xor edx, edx
lea r8d, [rdx + 2]
call fcn.14008e580
mov rsi, rax
test rax, rax
je 0x1400b25da
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
mov r8b, 1
mov rdx, r15
mov rcx, rsi
call fcn.14008ded0
test eax, eax
jne 0x1400b271f
mov r14d, dword [rsp + 0x31c]
test r14d, r14d
jne 0x1400b2739
call fcn.14006dd30
test al, al
jne 0x1400b25da
mov rcx, rsi
call fcn.14008dcc0
jmp 0x1400b25da
mov rbp, r14
mov rcx, r14
call fcn.140241020
mov rdi, rax
mov dword [rsp + 0x20], 3
mov r9d, r14d
mov r8, rax
mov edx, dword [rsp + 0x48]
mov rcx, rsi
call fcn.14008ecb0
test eax, eax
je 0x1400b2776
cmp eax, 0x600
je 0x1400b2776
mov rcx, rdi
call fcn.140240d18
jmp 0x1400b271f
call fcn.14006dd30
test al, al
jne 0x1400b2788
mov rcx, rsi
call fcn.14008dcc0
nop
lea rcx, [rsp + 0x60]
call fcn.140003e80
test rdi, rdi
je 0x1400b25e4
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r14, rax
test rax, rax
je 0x1400b2853
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x1400b2853
mov r8, rbp
mov rdx, rdi
mov rcx, rax
call fcn.1402430d0
mov qword [rsp + 0x50], rbx
lea r8, [rsp + 0x50]
mov edx, 1
mov rcx, r14
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov rsi, rbx
mov rbp, qword [rsp + 0x50]
test rbp, rbp
je 0x1400b2850
mov ecx, Ordinal_27
call sub.gdiplus.dll_GdipAlloc
mov rsi, rax
test rax, rax
je 0x1400b282c
lea rax, vtable.Gdiplus::Image.0
mov qword [rsi], rax
lea rdx, [rsi + 8]
mov qword [rdx], rbx
mov rcx, rbp
call sub.gdiplus.dll_GdipLoadImageFromStream
mov dword [rsi + 0x10], eax
mov dword [rsi + 0x10], ebx
test eax, eax
je 0x1400b2850
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rdi
call fcn.140240d18
mov rax, rbx
jmp 0x1400b267a
mov rbx, rsi
mov rcx, rdi
call fcn.140240d18
mov rax, rbx
jmp 0x1400b267a