Function at 0x14002f130
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x1a0], rbx
mov rax, qword [0x1401d5e90]
xor rax, rsp
mov qword [rbp + 0x40], rax
mov r12, rdx
mov r14, rcx
mov qword [rbp - 0x48], rcx
xor r13d, r13d
mov dword [rsp + 0x40], r13d
lea rcx, [0x1401d59a8]
mov rax, qword [0x1401d59a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [r14], rax
mov r15d, 1
mov r9d, r15d
mov dword [rsp + 0x40], r15d
mov r8d, dword [0x1401ddd80]
mov ecx, r8d
imul ecx, r8d
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xb
sub ecx, edx
cmp ecx, 0xa
jne 0x14002f1f1
mov ecx, r13d
lea rdx, [rbp - 0x40]
nop dword [rax]
mov eax, dword [rdx]
imul eax, eax, 0xf7
add r8d, eax
inc ecx
lea rdx, [rdx + 4]
movsxd rax, ecx
cmp rax, 0x78
jb 0x14002f1d0
mov dword [0x1401ddd80], r8d
mov rax, qword [r12]
mov edi, 3
cmp dword [rax - 0x10], 0
je 0x14002f275
movzx eax, word [rax]
cmp ax, word [0x140161a84]
jne 0x14002f211
mov eax, r13d
jmp 0x14002f216
sbb eax, eax
or eax, r9d
test eax, eax
je 0x14002f275
lea rcx, [rbp - 0x68]
call fcn.14002d830
nop
mov r9d, edi
mov dword [rsp + 0x40], edi
mov rdx, qword [rax]
mov eax, r13d
test rdx, rdx
setne al
test eax, eax
jne 0x14002f246
mov ecx, 0x80004005
call fcn.140001920
int3
mov rax, qword [r12]
sub rdx, rax
nop dword [rax]
movzx ecx, word [rax]
cmp cx, word [rax + rdx]
jne 0x14002f267
add rax, 2
test cx, cx
jne 0x14002f250
mov eax, r13d
jmp 0x14002f26c
sbb eax, eax
or eax, 1
test eax, eax
je 0x14002f275
xor sil, sil
jmp 0x14002f278
mov sil, 1
or rbx, 0xffffffffffffffff
test r9b, 2
je 0x14002f2a2
and r9d, 0xfffffffd
mov dword [rsp + 0x40], r9d
mov rdx, qword [rbp - 0x68]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], ebx
jg 0x14002f2a2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test sil, sil
je 0x14002f325
lea rcx, [rbp - 0x60]
call fcn.14002d830
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [r14]
sub rdi, 0x18
cmp rcx, rdi
je 0x14002f304
cmp dword [rdi + 0x10], 0
jl 0x14002f2f7
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14002f2f7
call fcn.1400028c0
mov rsi, rax
lock add dword [rdi + 0x10], 0xffffffff
jg 0x14002f2ee
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rsi + 0x18]
mov qword [r14], rax
jmp 0x14002f304
mov r8d, dword [rdx - 0x10]
mov rcx, r14
call fcn.140002770
nop
mov rdx, qword [rbp - 0x60]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14002f81d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14002f81d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov rcx, qword [r12]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
mov qword [rbp - 0x78], rax
cmp rax, 0xffffffffffffffff
jne 0x14002f3bb
lea rcx, [rbp - 0x80]
call fcn.14002d830
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [r14]
sub rdi, 0x18
cmp rcx, rdi
je 0x14002f3b2
cmp dword [rdi + 0x10], 0
jl 0x14002f3a5
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14002f3a5
call fcn.1400028c0
mov rsi, rax
lock add dword [rdi + 0x10], r12d
jg 0x14002f39c
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rsi + 0x18]
mov qword [r14], rax
jmp 0x14002f3b2
mov r8d, dword [rdx - 0x10]
mov rcx, r14
call fcn.140002770
nop
mov rdx, qword [rbp - 0x80]
jmp 0x14002f308
xor eax, eax
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x60]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x14002f452
lea rcx, [rbp - 0x58]
call fcn.14002d830
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [r14]
sub rdi, 0x18
cmp rcx, rdi
je 0x14002f431
cmp dword [rdi + 0x10], 0
jl 0x14002f424
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14002f424
call fcn.1400028c0
mov rsi, rax
lock add dword [rdi + 0x10], 0xffffffff
jg 0x14002f41b
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rsi + 0x18]
mov qword [r14], rax
jmp 0x14002f431
mov r8d, dword [rdx - 0x10]
mov rcx, r14
call fcn.140002770
nop
mov rdx, qword [rbp - 0x58]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14002f814
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14002f814
cmp dword [rsp + 0x64], 0
je 0x14002f4bf
lea rcx, [rbp - 0x70]
call fcn.14002d830
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [r14]
sub rdi, 0x18
cmp rcx, rdi
je 0x14002f4b6
cmp dword [rdi + 0x10], 0
jl 0x14002f4a9
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14002f4a9
call fcn.1400028c0
mov rsi, rax
lock add dword [rdi + 0x10], 0xffffffff
jg 0x14002f4a0
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rsi + 0x18]
mov qword [r14], rax
jmp 0x14002f4b6
mov r8d, dword [rdx - 0x10]
mov rcx, r14
call fcn.140002770
nop
mov rdx, qword [rbp - 0x70]
jmp 0x14002f435
cmp dword [rsp + 0x60], 0
je 0x14002f814
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r13
mov edx, dword [rsp + 0x60]
lea rcx, [rsp + 0x48]
call fcn.14002f9d0
mov dword [rsp + 0x78], r13d
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x78]
mov r8d, dword [rsp + 0x60]
mov rsi, qword [rsp + 0x48]
mov rdx, rsi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14002f535
test rsi, rsi
je 0x14002f814
mov rcx, rsi
call fcn.1400d7280
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r13
jmp 0x14002f814
xor r12b, r12b
xor r13b, r13b
movzx eax, byte [rsi]
cmp al, 0xff
jne 0x14002f552
cmp byte [rsi + 1], 0xfe
jne 0x14002f552
mov r12b, 1
mov edi, 2
jmp 0x14002f586
cmp al, 0xfe
jne 0x14002f56a
cmp byte [rsi + 1], 0xff
jne 0x14002f56a
mov r12b, 1
movzx r13d, r12b
mov edi, 2
jmp 0x14002f586
cmp al, 0xef
jne 0x14002f635
cmp byte [rsi + 1], 0xbb
jne 0x14002f635
cmp byte [rsi + 2], 0xbf
jne 0x14002f635
movsxd rdx, edi
add rdx, rsi
mov rdi, qword [rsp + 0x50]
cmp rdx, rdi
jne 0x14002f5a0
mov rdi, rsi
mov qword [rsp + 0x50], rsi
jmp 0x14002f5bb
cmp rsi, rdx
je 0x14002f5bb
sub rdi, rdx
mov r8, rdi
mov rcx, rsi
call fcn.1400d72d0
add rdi, rsi
mov qword [rsp + 0x50], rdi
test r13b, r13b
je 0x14002f63a
mov rcx, rsi
cmp rsi, rdi
je 0x14002f5e7
nop dword [rax + rax]
movzx r8d, byte [rcx + 1]
movzx edx, byte [rcx]
mov byte [rcx + 1], dl
mov byte [rcx], r8b
add rcx, 2
cmp rcx, rdi
jne 0x14002f5d0
mov eax, dword [0x1401ddd80]
mov ecx, eax
imul ecx, eax
imul ecx, eax
mov eax, 0x30c30c31
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 0xb
jne 0x14002f63a
mov r8d, r15d
mov eax, r15d
mov edx, 0xc1
nop dword [rax + rax]
lea ecx, [rax + r8]
lea r8d, [rax]
mov eax, ecx
dec edx
jns 0x14002f620
mov dword [0x1401ddd80], ecx
jmp 0x14002f63a
mov rdi, qword [rsp + 0x50]
sub rdi, rsi
cmp byte [rsi + rdi - 1], 0
je 0x14002f6d5
lea rdx, [rdi + 1]
lea rcx, [rsp + 0x48]
call fcn.14002f9d0
mov r8d, dword [0x1401ddd80]
lea ecx, [r8 + 1]
imul ecx, r8d
mov eax, 0x38e38e39
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 0xd
jne 0x14002f6a9
cmp r8d, 1
jle 0x14002f6a2
nop dword [rax + rax]
mov eax, r8d
cdq
idiv r15d
inc r15d
add r15d, edx
cmp r15d, r8d
jl 0x14002f690
mov dword [0x1401ddd80], r15d
mov rsi, qword [rsp + 0x48]
mov byte [rsi + rdi], 0
test r12b, r12b
je 0x14002f78b
lea rdx, [rdi + 2]
lea rcx, [rsp + 0x48]
call fcn.14002f9d0
mov rsi, qword [rsp + 0x48]
mov byte [rsi + rdi + 1], 0
jmp 0x14002f6f7
test r12b, r12b
je 0x14002f78b
lea rdx, [rdi + 2]
lea rcx, [rsp + 0x48]
call fcn.14002f9d0
mov rsi, qword [rsp + 0x48]
mov word [rsi + rdi], 0
lea rcx, [0x1401d59a8]
mov rax, qword [0x1401d59a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
test rsi, rsi
je 0x14002f74f
test rsi, 0xffffffffffff0000
jne 0x14002f740
movzx edi, si
mov ecx, edi
call fcn.1400019e0
test rax, rax
je 0x14002f762
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140002a60
jmp 0x14002f762
mov rax, rbx
inc rax
cmp word [rsi + rax*2], 0
jne 0x14002f743
jmp 0x14002f751
xor eax, eax
mov r8d, eax
mov rdx, rsi
lea rcx, [rsp + 0x68]
call fcn.140002770
nop
lea rdx, [rsp + 0x68]
mov rcx, r14
call fcn.1400026d0
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14002f7e6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14002f7e6
lea rcx, [0x1401d59a8]
mov rax, qword [0x1401d59a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x70], rax
mov rdx, rsi
lea rcx, [rsp + 0x70]
call fcn.140003a70
nop
lea rdx, [rsp + 0x70]
mov rcx, r14
call fcn.1400026d0
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14002f7da
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, r14
mov rcx, r14
call fcn.14002cc00
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14002f810
call fcn.1400d7280
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov r12, qword [rbp - 0x78]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, r14
mov rcx, qword [rbp + 0x40]
xor rcx, rsp
call fcn.1400d72a0
mov rbx, qword [rsp + 0x1a0]
add rsp, 0x150
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret