Function at 0x140099130
Capabilities:
Get file size
Read file on windows

Disassembly:
push rdi
push r12
push r13
sub rsp, 0x570
xor r13d, r13d
mov rdi, rdx
mov r12, rcx
mov dword [rcx + 0x344], r13d
mov word [rcx + 0x348], r13w
add rcx, 0x34c
xor edx, edx
mov r8d, 0x3e8
call sub.msvcrt.dll_memset
mov r8d, dword [rdi]
mov rdi, qword [rdi + 8]
mov rdx, qword [rdi]
lea rcx, [rsp + 0x70]
mov byte [rsp + 0x70], 1
mov byte [rsp + 0x71], r13b
mov byte [rsp + 0x72], r13b
mov byte [rsp + 0x73], r13b
mov byte [rsp + 0x74], 0xd0
mov byte [rsp + 0x75], 0x8c
mov byte [rsp + 0x76], 0x9d
mov byte [rsp + 0x77], 0xdf
mov byte [rsp + 0x78], 1
mov byte [rsp + 0x79], 0x15
mov byte [rsp + 0x7a], 0xd1
mov byte [rsp + 0x7b], reloc.COMCTL32.dll_InitCommonControls
mov byte [rsp + 0x7c], 0x8c
mov byte [rsp + 0x7d], 0x7a
mov byte [rsp + 0x7e], r13b
mov byte [rsp + 0x7f], 0xc0
mov byte [rsp + 0x80], 0x4f
mov byte [rsp + 0x81], 0xc2
mov byte [rsp + 0x82], 0x97
mov byte [rsp + 0x83], 0xeb
cmp rdx, qword [rcx]
mov qword [rsp + 0x90], r13
mov dword [rsp + 0x98], r13d
mov dword [rsp + 0x9c], 0x1388
jne 0x14009921f
mov rdx, qword [rdi + 8]
cmp rdx, qword [rcx + 8]
jne 0x14009921f
mov edx, dword [rdi + 0x10]
cmp edx, dword [rcx + 0x10]
jne 0x14009921f
mov eax, r13d
jmp 0x140099224
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x14009924e
lea rcx, [rsp + 0x90]
mov rdx, rdi
call fcn.14009cf90
test eax, eax
jne 0x14009925d
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x14009924e
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
xor eax, eax
add rsp, 0x570
pop r13
pop r12
pop rdi
ret
mov qword [rsp + 0x598], rbx
lea rcx, [rsp + 0x1c2]
xor edx, edx
mov r8d, 0x100
mov qword [rsp + 0x5a0], rbp
mov word [rsp + 0x1c0], r13w
mov qword [rsp + 0x568], rsi
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x2d2]
xor edx, edx
mov r8d, 0x286
mov word [rsp + 0x2d0], r13w
call sub.msvcrt.dll_memset
xor edx, edx
lea rcx, [rsp + 0x142]
lea r8d, [rdx + 0x7e]
mov word [rsp + 0x140], r13w
call sub.msvcrt.dll_memset
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xb8]
movzx r8d, byte [rsp + 0xc0]
mov rax, rdx
mov rbp, rdx
shr rax, 0x30
shr rbp, 0x38
movzx esi, al
mov dword [rsp + 0x68], ebp
mov rax, rdx
shr rax, 0x28
mov dword [rsp + 0x60], esi
movzx ebx, al
mov rax, rdx
shr rax, 0x20
mov dword [rsp + 0x58], ebx
movzx r11d, al
mov rax, rdx
mov dword [rsp + 0x50], r11d
shr rax, 0x18
movzx r10d, al
mov rax, rdx
shr rdx, 8
mov dword [rsp + 0x48], r10d
movzx edi, dl
mov rdx, rcx
shr rax, 0x10
shr rcx, 0x20
shr rdx, 0x30
movzx r9d, al
movzx eax, cx
lea rcx, [rsp + 0x140]
mov dword [rsp + 0x40], r9d
mov r9d, dword [rsp + 0xb8]
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], r8d
mov dword [rsp + 0x28], edx
lea r8, str._8.8X__4.4X__4.4X__2.2X_2.2X__2.2X_2.2X_2.2X_2.2X_2.2X_2.2X
mov edx, 0x40
mov dword [rsp + 0x20], eax
call sub.msvcrt.dll__snwprintf
mov rbx, r13
mov edi, r13d
cmp dword [r12 + 0x2f0], ebx
jle 0x1400996bb
lea rsi, [0x1400a89b8]
nop
test rbx, rbx
js 0x1400993c8
cmp edi, dword [r12 + 0x2f0]
jge 0x1400993c8
mov rax, qword [r12 + 0x2d8]
mov ecx, dword [rax + rbx*4]
mov rax, qword [r12 + 0x2e0]
lea rdx, [rax + rcx*2]
jmp 0x1400993cb
mov rdx, r13
lea rax, [rsp + 0x1c0]
lea r9, [rsp + 0x2d0]
lea r8, [rsp + 0x140]
mov rcx, r12
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call fcn.1400981b0
test eax, eax
jne 0x140099412
add edi, 1
add rbx, 1
cmp edi, dword [r12 + 0x2f0]
jl 0x1400993a0
test eax, eax
je 0x1400996bb
xor r9d, r9d
mov qword [rsp + 0x30], r13
lea rcx, [rsp + 0x2d0]
lea r8d, [r9 + 3]
mov edx, 0x80000000
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rsi, rax
je 0x1400996bb
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x560], r14
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r14d, dword [r12 + 0x10]
cmp eax, r14d
mov ebx, eax
mov edi, r14d
jl 0x1400994b1
mov eax, dword [r12 + 0x14]
add edi, eax
cmp edi, ebx
jle 0x140099472
mov rbp, qword [r12 + 8]
movsxd rcx, edi
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
test rbp, rbp
mov dword [r12 + 0x10], edi
mov qword [r12 + 8], rax
je 0x1400994b1
cmp r14d, edi
mov rdx, rbp
mov rcx, rax
cmovl edi, r14d
movsxd r8, edi
call sub.msvcrt.dll_memcpy
mov rcx, rbp
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
cmp ebx, 0x32
mov r14, qword [rsp + 0x560]
jbe 0x1400994fc
mov rdx, qword [r12 + 8]
lea r9, [rsp + 0x590]
mov r8d, ebx
mov rcx, rsi
mov dword [rsp + 0x590], r13d
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rdx, qword [r12 + 8]
lea rcx, [r12 + 0x28]
mov r8d, 0xa0
mov r13d, eax
call sub.msvcrt.dll_memcpy
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r13d, r13d
je 0x1400996bb
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x1c0]
repne scasw ax, word [rdi]
mov eax, 0x7f
lea rdx, [rsp + 0x1c0]
not rcx
mov dword [r12 + 0x344], 1
sub rcx, 1
cmp ecx, 0x80
cmovge ecx, eax
movsxd rax, ecx
lea rcx, [r12 + 0x348]
lea rdi, [rax + rax]
mov r8, rdi
call sub.msvcrt.dll_memcpy
or rcx, 0xffffffffffffffff
xor eax, eax
mov word [rdi + r12 + 0x348], 0
lea rdi, [rsp + 0x2d0]
lea rdx, [rsp + 0x2d0]
repne scasw ax, word [rdi]
mov eax, 0x142
not rcx
sub rcx, 1
cmp ecx, 0x143
cmovge ecx, eax
movsxd rax, ecx
lea rcx, [r12 + 0x44a]
lea rdi, [rax + rax]
mov r8, rdi
call sub.msvcrt.dll_memcpy
mov word [rdi + r12 + 0x44a], 0
mov eax, dword [r12 + 0x84]
mov rcx, qword [r12 + 0x64]
mov dword [r12 + 0x720], eax
mov eax, dword [r12 + 0x90]
mov dword [r12 + 0x724], eax
mov eax, dword [r12 + 0xbc]
mov dword [r12 + 0x728], eax
mov eax, dword [r12 + 0xc0]
mov dword [r12 + 0x72c], eax
mov eax, dword [r12 + 0xc4]
mov dword [r12 + 0x730], eax
mov rax, qword [r12 + 0x34]
mov qword [r12 + 0x6d2], rax
mov rax, qword [r12 + 0x3c]
mov qword [r12 + 0x6da], rax
mov rax, qword [r12 + 0x44]
mov qword [r12 + 0x6e2], rax
mov rax, qword [r12 + 0x4c]
mov qword [r12 + 0x6ea], rax
mov rax, qword [r12 + 0x54]
mov qword [r12 + 0x6f2], rax
mov rax, qword [r12 + 0x5c]
mov qword [r12 + 0x6fa], rax
mov qword [r12 + 0x702], rcx
mov rcx, qword [r12 + 0x6c]
mov qword [r12 + 0x70a], rcx
mov rcx, qword [r12 + 0x74]
mov qword [r12 + 0x712], rcx
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x140099691
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov eax, 1
mov rbp, qword [rsp + 0x5a0]
mov rbx, qword [rsp + 0x598]
mov rsi, qword [rsp + 0x568]
add rsp, 0x570
pop r13
pop r12
pop rdi
ret
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x1400996cd
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
xor eax, eax
jmp 0x140099696