If you have an SSL policy that decrypts the traffic for inspection, any file policy happens post-decryption in the Snort order of operations - so it should inspect the files.
Few people use Firepower for widespread decryption of all incoming traffic though. It's generally more advisable to put AMP on the endpoints for things like that.
