Function at 0x140025400
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
xor esi, esi
xor r14d, r14d
mov rbp, r8
mov r12, rdx
mov r15, rcx
mov dword [rsp + 0x40], esi
cmp qword [rcx + 0xb0], rsi
jbe 0x1400254c0
mov rax, qword [rcx + 0xa8]
mov rbx, qword [rax]
cmp rbx, rax
je 0x1400254c0
mov rcx, qword [rbx + 0x10]
cmp byte [rcx + 0x40], 0
je 0x1400254a8
add rcx, 0x20
cmp qword [rcx + 0x18], 0x10
jb 0x14002545e
mov rcx, qword [rcx]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rcx, rax
xor edx, edx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, rdi
lea esi, [rax + 0x1800]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400254ad
mov esi, 0x2000
mov rbx, qword [rbx]
add r14d, esi
cmp rbx, qword [r15 + 0xa8]
jne 0x140025446
mov esi, dword [rsp + 0x40]
cmp qword [r12], 0
je 0x1400254d8
xor eax, eax
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea ebx, [r14 + 1]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r14, qword [rsp + 0x98]
mov r12, 0xffffffffffffffff
mov qword [r14], rax
cmp qword [r15 + 0xb0], 0
jbe 0x140025705
mov rax, qword [r15 + 0xa8]
mov rbx, qword [rax]
cmp rbx, rax
je 0x140025705
mov qword [rsp + 0xa0], r13
nop
mov rdi, qword [rbx + 0x10]
mov rax, qword [rdi + 0x38]
mov r13d, esi
lea rsi, [rdi + 0x20]
add r13, qword [r14]
cmp byte [rdi + 0x40], 0
mov qword [rsp + 0x48], r13
je 0x140025693
mov rcx, rsi
cmp rax, 0x10
jb 0x14002555d
mov rcx, qword [rsi]
cmp qword [rdi + 0x18], 0x10
mov r9, rdi
jb 0x14002556a
mov r9, qword [rdi]
mov qword [rsp + 0x20], rcx
lea rdx, str.___s_r_nContent_Disposition:_form_data__name__s___filename__s__r_n_r_n
mov rcx, r13
mov r8, rbp
call fcn.1400272f0
mov rdx, r12
inc rdx
cmp byte [rdx + rbp], 0
jne 0x140025584
add edx, dword [rdi + 0x30]
mov r15d, dword [rdi + 0x10]
add r15d, 0x3c
add r15d, edx
cmp qword [rsi + 0x18], 0x10
jb 0x1400255a5
mov rsi, qword [rsi]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov rcx, rsi
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x1400256da
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, r15d
lea r9, [rsp + 0xa8]
add r13, rcx
mov r14d, eax
xor eax, eax
mov rdx, r13
mov r8d, 0x400
mov dword [rsp + 0xa8], eax
mov rcx, rsi
mov qword [rsp + 0x20], rax
mov edi, eax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14002566b
nop word [rax + rax]
mov eax, dword [rsp + 0xa8]
test eax, eax
je 0x14002566b
cmp edi, r14d
ja 0x14002566b
add edi, eax
mov qword [rsp + 0x20], 0
mov edx, edi
lea r9, [rsp + 0xa8]
add rdx, r13
mov r8d, 0x400
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140025630
mov rcx, qword [rsp + 0x48]
add edi, r15d
mov edx, 0xa0d
mov word [rdi + rcx], dx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, qword [rsp + 0x98]
lea r15d, [rdi + 2]
jmp 0x1400256da
cmp rax, 0x10
jb 0x14002569c
mov rsi, qword [rsi]
cmp qword [rdi + 0x18], 0x10
mov r9, rdi
jb 0x1400256a9
mov r9, qword [rdi]
mov r8, rbp
mov qword [rsp + 0x20], rsi
lea rdx, str.___s_r_nContent_Disposition:_form_data__name__s__r_n_r_n_s_r_n
mov rcx, r13
call fcn.1400272f0
mov rax, r12
inc rax
cmp byte [rax + rbp], 0
jne 0x1400256c3
mov r15d, dword [rdi + 0x10]
add eax, dword [rdi + 0x30]
add r15d, 0x31
add r15d, eax
mov esi, dword [rsp + 0x40]
mov rax, qword [rsp + 0x90]
add esi, r15d
mov rbx, qword [rbx]
mov dword [rsp + 0x40], esi
cmp rbx, qword [rax + 0xa8]
jne 0x140025530
mov r13, qword [rsp + 0xa0]
mov rax, qword [r14]
mov ecx, 0x2d2d
mov ebx, esi
mov r8, r12
mov word [rbx + rax], cx
inc r8
cmp byte [r8 + rbp], 0
jne 0x140025716
mov rcx, qword [r14]
mov rdx, rbp
add rcx, 2
add rcx, rbx
call fcn.1400bd846
mov rcx, r12
inc rcx
cmp byte [rcx + rbp], 0
jne 0x140025735
mov rax, qword [r14]
add rcx, rbx
mov dword [rcx + rax + 2], 0xa0d2d2d
nop dword [rax]
inc r12
cmp byte [r12 + rbp], 0
jne 0x140025750
lea eax, [rsi + 6]
add eax, r12d
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret