Function at 0x140026840
Capabilities:
Get file size
Read file on windows

Disassembly:
xchg r9, rbx
mov qword [rsp + 0x10], r9
xchg rbx, r9
nop
mov qword [rsp - 8], rbp
sub rsp, 8
nop
push 0x663b7d6a
mov qword [rsp], rsi
nop
sub rsp, 8
mov qword [rsp], rdi
nop
push 0x65a8b3
mov qword [rsp], r12
nop
push 0x18885a5c
mov qword [rsp], r13
nop
push 0x50c0d242
mov qword [rsp], r14
push rdx
mov qword [rsp], r15
sub rsp, 0x40
xchg rbx, r10
mov r10, rdx
xchg rbx, r10
xchg rsi, rcx
mov rcx, rsi
xchg rsi, rcx
cmp qword [rcx], 0
jne 0x1400268b8
call 0x140026350
test al, al
je 0x140026912
mov rcx, rbx
call fcn.14002aff0
xchg rsi, rax
mov rcx, rsi
xchg rsi, rax
xor r13d, r13d
xchg r13, rbp
mov qword [rsp + 0x30], rbp
xchg rbp, r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 0x507d670a
xor dword [rsp + 0x20], 0x507d6709
xor r9d, r9d
mov edx, 0x658c96fe
add edx, 0x1a736902
lea r8d, [r13 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xchg r15, rax
mov rax, r15
xchg r15, rax
test rax, rax
jne 0x140026919
xor al, al
jmp 0x140026d67
xor r12b, r12b
xor edx, edx
xchg rcx, r9
mov r9, r15
xchg r9, rcx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r14d, eax
test eax, eax
je 0x140026d54
lea ecx, [rax + 1]
mov ebx, ecx
call fcn.1401102d8
mov rbp, rax
test rax, rax
je 0x140026964
mov r8d, ebx
xor edx, edx
xchg r13, rax
mov rcx, r13
xchg r13, rax
call sub.VCRUNTIME140.dll_memset
jmp 0x14002696d
xchg r11, rbp
mov r11, r13
xchg rbp, r11
xchg rbp, r15
mov qword [rsp + 0x98], r15
xchg rbp, r15
mov dword [rsp + 0x80], r13d
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x80]
mov r8d, r14d
xchg rbp, r10
mov rdx, r10
xchg rbp, r10
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
setne r12b
test eax, eax
je 0x140026d43
mov edx, dword [rsi + 8]
test edx, edx
je 0x1400269cb
lea rcx, [rsi + 0x20]
call fcn.140026060
mov dword [rsi + 8], r13d
movabs rax, 0x8523977557e98
sub rax, 0xc574c2f
movabs rbx, 0xc56291d8450db
add rbx, 0x6595417b
cmp qword [0x140128040], rax
je 0x140026b49
mov rax, qword [0x140128050]
cmp rax, rbx
je 0x140026b49
cmp byte [0x140128eb8], 0
jne 0x140026a4d
push rax
xor eax, ebx
push rax
xor rax, qword [rsp + 8]
shr rax, 0x20
ror rbx, 0x20
xor eax, ebx
ror rbx, 0x20
shl rax, 0x20
xor rax, qword [rsp]
add rsp, 0x10
lea rdx, [0x140026230]
mov ecx, 0x3c4c291b
sub ecx, 0x3c4c291a
call rax
mov ecx, 0x2ee11bfe
sub ecx, 0x2ee11bfd
call fcn.140110294
xchg rbp, rax
mov rdi, rbp
xchg rbp, rax
movabs rax, 0x5826a6c3a9d7ae4
xor rax, 0x7a1f7aac
mov rbx, qword [rsi + 0x10]
push rbx
xor ebx, eax
push rbx
xor rbx, qword [rsp + 8]
shr rbx, 0x20
ror rax, 0x20
xor ebx, eax
ror rax, 0x20
shl rbx, 0x20
or rbx, qword [rsp]
add rsp, 0x10
xchg rdi, r14
mov rcx, r14
xchg rdi, r14
movabs rax, 0x582359261eafba7
add rax, 0x165a76b2
push rcx
xor ecx, eax
push rcx
xor rcx, qword [rsp + 8]
shr rcx, 0x20
ror rax, 0x20
xor ecx, eax
ror rax, 0x20
shl rcx, 0x20
xor rcx, qword [rsp]
add rsp, 0x10
xchg r9, rcx
mov qword [rsp + 0x90], r9
xchg r9, rcx
lea rdx, [rsp + 0x90]
lea rcx, [0x140128ea8]
call fcn.14000aa40
xchg rdi, rbx
mov qword [rax], rdi
xchg rbx, rdi
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 0x6cbd0d51
sub dword [rsp + 0x20], 0x6cbd0d4d
mov r9d, r14d
xor r8d, r8d
xchg rbp, r15
mov rdx, r15
xchg rbp, r15
lea ecx, [r8 + 1]
call rdi
movabs rbx, 0xc56297eb6ad8c
add rbx, 0x7fffffff
xor rbx, 0x7daf3fdd
jmp 0x140026bab
movabs rcx, 0x5ffe3dcd8eed
sub rcx, 0x5061cdc
mov rax, qword [rsi + 0x10]
push rax
xor eax, ecx
push rax
xor rax, qword [rsp + 8]
shr rax, 0x20
ror rcx, 0x20
xor eax, ecx
ror rcx, 0x20
shl rax, 0x20
or rax, qword [rsp]
add rsp, 0x10
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 0x19cc3dea
xor dword [rsp + 0x20], 0x19cc3dee
mov r9d, r14d
xor r8d, r8d
xchg rdx, rbp
mov rbp, rdx
xchg rdx, rbp
lea ecx, [r8 + 1]
call rax
mov r14d, eax
mov dword [rsi + 8], eax
movabs rax, 0x852394810cbe9
add rax, 0x22ed6680
cmp qword [0x140128040], rax
je 0x140026cf0
mov rax, qword [0x140128050]
cmp rax, rbx
je 0x140026cf0
cmp byte [0x140128eb8], 0
jne 0x140026c22
push rax
xor eax, ebx
push rax
xor rax, qword [rsp + 8]
shr rax, 0x20
ror rbx, 0x20
xor eax, ebx
ror rbx, 0x20
shl rax, 0x20
or rax, qword [rsp]
add rsp, 0x10
lea rdx, [0x140026230]
mov ecx, 0x4249eb60
xor ecx, 0x4249eb61
call rax
mov ecx, 0x79b29dc4
sub ecx, 0x79b29dc3
call fcn.140110294
xchg r12, rax
mov rdi, r12
xchg r12, rax
movabs rax, 0x5826f6827e2c88b
add rax, 0x7fffffff
add rax, 0x8a397be
xchg rbx, r11
mov r11, qword [rsi + 0x40]
xchg rbx, r11
push rbx
xor ebx, eax
push rbx
xor rbx, qword [rsp + 8]
shr rbx, 0x20
ror rax, 0x20
xor ebx, eax
ror rax, 0x20
shl rbx, 0x20
xor rbx, qword [rsp]
add rsp, 0x10
xchg r8, rdi
mov rdi, r8
xchg rdi, r8
movabs rax, 0x582359232ec627b
add rax, 0x45590fde
push r8
xor r8d, eax
push r8
xor r8, qword [rsp + 8]
shr r8, 0x20
ror rax, 0x20
xor r8d, eax
ror rax, 0x20
shl r8, 0x20
xor r8, qword [rsp]
add rsp, 0x10
mov qword [rsp + 0x90], r8
lea rdx, [rsp + 0x90]
lea rcx, [0x140128ea8]
call fcn.14000aa40
mov qword [rax], rbx
mov edx, 0x657a0978
sub edx, 0x657a0977
mov ecx, r14d
call rdi
jmp 0x140026d43
movabs rax, 0x5afa13922197
add rax, 0x7fffffff
add rax, 0x3530f07b
mov r8, qword [rsi + 0x40]
push r8
xor r8d, eax
push r8
xor r8, qword [rsp + 8]
shr r8, 0x20
ror rax, 0x20
xor r8d, eax
ror rax, 0x20
shl r8, 0x20
xor r8, qword [rsp]
add rsp, 0x10
mov edx, 0x76a66829
sub edx, 0x76a66828
mov ecx, r14d
call r8
nop
test rbp, rbp
je 0x140026d54
mov rcx, rbp
call fcn.1401102d0
xchg rcx, r15
mov r15, rcx
xchg rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, r12b
xchg rbx, r15
mov r15, qword [rsp + 0x88]
xchg r15, rbx
add rsp, 0x40
nop
add rsp, 8
xchg qword [rsp - 8], r15
push rcx
push rbx
xchg qword [rsp + 0x10], r14
pop rbx
pop rcx
add rsp, 8
push rax
push rax
push rdx
xchg qword [rsp + 0x18], r13
pop rdx
pop rax
pop rax
add rsp, 8
push rdx
push rax
push rcx
push rax
push rdx
xchg qword [rsp + 0x28], r12
add rsp, 0x30
nop
mov rdi, qword [rsp]
add rsp, 8
nop
mov rsi, qword [rsp]
add rsp, 8
push rbx
push rcx
push rdx
push rbx
push rax
push rcx
xchg qword [rsp + 0x30], rbp
pop rcx
pop rax
pop rbx
pop rdx
pop rcx
pop rbx
add rsp, 8
ret