Function at 0x14001c8e0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x70
lea rdx, [rax + 0x24]
mov dword [rax + 0x18], 5
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x98], eax
cmp eax, 0x100000
jae 0x14001cba8
cmp dword [rsp + 0x9c], 0
jne 0x14001cba8
mov qword [rsp + 0x68], rbx
lea ecx, [rax + 1]
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x48], r14
call fcn.140094b74
mov r8d, dword [rsp + 0x98]
lea r9, [rsp + 0x88]
xor r12d, r12d
mov rdx, rax
mov rcx, rdi
mov qword [rsp + 0x20], r12
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x98]
cmp dword [rsp + 0x88], eax
jne 0x14001cb99
cmp eax, 2
jbe 0x14001ca4a
cmp byte [rbx], 0xfe
jne 0x14001c9c9
cmp byte [rbx + 1], 0xff
jne 0x14001c9c9
test al, 1
jne 0x14001cb99
mov r9d, r12d
test eax, eax
je 0x14001c9c9
nop word [rax + rax]
lea eax, [r9 + 1]
mov edx, r9d
mov ecx, eax
add r9d, 2
movzx eax, byte [rax + rbx]
movzx r8d, byte [rdx + rbx]
mov byte [rcx + rbx], r8b
mov byte [rdx + rbx], al
mov eax, dword [rsp + 0x98]
cmp r9d, eax
jb 0x14001c9a0
cmp eax, 2
jbe 0x14001ca4a
cmp byte [rbx], 0xff
jne 0x14001ca4a
cmp byte [rbx + 1], 0xfe
jne 0x14001ca4a
shr eax, 1
mov qword [rsp + 0x60], rbp
mov ecx, eax
mov ebp, eax
lea edi, [rax - 1]
call fcn.140094b74
mov qword [rsp + 0x38], r12
lea r8, [rbx + 2]
mov qword [rsp + 0x30], r12
mov r9d, edi
mov dword [rsp + 0x28], edi
mov edx, 0x200
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov r14, rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edx, 1
mov byte [r14 + rbp - 1], r12b
mov rcx, rbx
call fcn.140062970
mov rbp, qword [rsp + 0x60]
mov rax, r14
mov rsi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x68]
mov r12, qword [rsp + 0x50]
add rsp, 0x70
pop rdi
ret
cmp eax, 3
jbe 0x14001cb14
cmp byte [rbx], 0xef
jne 0x14001cb14
cmp byte [rbx + 1], 0xbb
jne 0x14001cb14
cmp byte [rbx + 2], 0xbf
jne 0x14001cb14
lea edi, [rax - 3]
mov qword [rsp + 0x40], r15
movsxd rcx, edi
mov eax, 2
inc rcx
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140094b74
mov r9d, edi
mov dword [rsp + 0x28], edi
lea r8, [rbx + 3]
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
mov r15, rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rdi, eax
lea rcx, [rdi + 1]
mov word [r15 + rdi*2], r12w
call fcn.140094b74
mov qword [rsp + 0x38], r12
mov r9d, edi
mov qword [rsp + 0x30], r12
mov r8, r15
mov dword [rsp + 0x28], edi
mov edx, 0x200
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rcx, r15
mov byte [rdi + rsi], r12b
call fcn.140062970
mov rcx, rbx
call fcn.140062970
mov r15, qword [rsp + 0x40]
mov rax, rsi
jmp 0x14001ca30
cmp eax, 4
jbe 0x14001cb8d
lea r8, [rsp + 0x90]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
test eax, eax
je 0x14001cb86
mov eax, dword [rsp + 0x98]
shr eax, 1
mov esi, eax
lea rcx, [rax + 1]
call fcn.140094b74
mov qword [rsp + 0x38], r12
mov r9d, esi
mov qword [rsp + 0x30], r12
mov r8, rbx
mov dword [rsp + 0x28], esi
mov edx, 0x200
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edx, 1
mov byte [rsi + rdi], r12b
mov rcx, rbx
call fcn.140062970
mov rax, rdi
jmp 0x14001ca30
mov eax, dword [rsp + 0x98]
mov byte [rax + rbx], r12b
mov rax, rbx
jmp 0x14001ca30
mov rcx, rbx
call fcn.140062970
xor eax, eax
jmp 0x14001ca30
xor eax, eax
add rsp, 0x70
pop rdi
ret