Function at 0x1400c0d24
Capabilities:
Check if file exists
Get file attributes
Get file size
Get system information on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xd8
xor esi, esi
mov r15, rcx
mov rcx, qword [rcx + 0x68]
mov ebx, esi
mov qword [rbp - 0x79], rbx
mov r12d, esi
mov qword [rbp + 0x7f], rsi
mov r13d, esi
mov qword [rbp - 0x61], rsi
or rdi, 0xffffffffffffffff
mov qword [rbp - 0x59], rsi
mov qword [rbp - 0x71], rsi
mov qword [rbp - 0x69], rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r14d, eax
cmp eax, 0xffffffff
je 0x1400c0d89
shr r14d, 4
not r14d
and r14d, 1
jmp 0x1400c0d8c
mov r14d, esi
xor ecx, ecx
call fcn.14007ace8
xor ecx, ecx
call fcn.14007ace8
test r14d, r14d
je 0x1400c0e2c
mov rcx, qword [r15 + 0x68]
xor r14d, r14d
mov qword [rsp + 0x30], r14
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r14 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x1400c0def
mov rcx, rax
lea rdx, [rbp + 0x6f]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x1400c0e17
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400c0e00
mov esi, 0x80004005
jmp 0x1400c0e0e
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov ecx, esi
call fcn.14007ac40
jmp 0x1400c0e2f
cmp qword [rbp + 0x6f], 0x200000
jle 0x1400c0e2f
mov eax, 0x8007000d
mov esi, eax
mov ecx, eax
jmp 0x1400c0e10
xor r14d, r14d
mov ecx, esi
call fcn.14007ace8
lea rax, [rdi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400c0e49
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jns 0x1400c0e59
mov ecx, esi
call fcn.14007ac40
jmp 0x1400c119b
mov rcx, qword [r15 + 0x68]
lea r8, [rbp + 0x7f]
lea rdx, [rbp + 0x6f]
call fcn.1400a4e44
mov esi, eax
test eax, eax
jns 0x1400c0e80
mov ecx, eax
call fcn.14007ac40
mov r12, qword [rbp + 0x7f]
jmp 0x1400c119b
lea r8, [rbp - 0x79]
xor edx, edx
lea rcx, [0x1403dd7f0]
call fcn.1400fbd7c
mov esi, eax
test eax, eax
jns 0x1400c0eac
mov ecx, eax
call fcn.14007ac40
mov r12, qword [rbp + 0x7f]
mov rbx, qword [rbp - 0x79]
jmp 0x1400c119b
mov rbx, qword [rbp - 0x79]
mov r12, qword [rbp + 0x7f]
mov rax, qword [rbx]
mov rdi, qword [rax + 0x18]
mov rax, qword [0x1403d25b8]
mov rcx, rdi
call rax
mov r8d, dword [rbp + 0x6f]
mov rax, rdi
xor r9d, r9d
mov rdx, r12
mov rcx, rbx
call rax
mov esi, eax
test eax, eax
jns 0x1400c0ee6
mov ecx, eax
jmp 0x1400c0e4f
mov rax, qword [rbx]
mov rdi, qword [rax + 0x30]
mov rax, qword [0x1403d25b8]
mov rcx, rdi
call rax
mov rax, rdi
lea rdx, [rbp - 0x49]
mov rcx, rbx
call rax
mov esi, eax
test eax, eax
js 0x1400c0edf
cmp dword [rbp - 0x41], 1
je 0x1400c0f1a
mov eax, 0x8007000d
mov esi, eax
jmp 0x1400c0edf
cmp dword [rbp - 0x39], 1
jb 0x1400c0f11
mov rax, qword [rbx]
mov rdi, qword [rax + 0x30]
mov rax, qword [0x1403d25b8]
mov rcx, rdi
call rax
mov rax, rdi
lea rdx, [rbp - 0x49]
mov rcx, rbx
call rax
mov esi, eax
test eax, eax
js 0x1400c0edf
cmp dword [rbp - 0x41], 1
jne 0x1400c0f11
mov r15d, dword [rbp - 0x39]
xor esi, esi
test r15d, r15d
je 0x1400c0feb
mov rdi, qword [rbp - 0x61]
test rdi, rdi
je 0x1400c0f83
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rdi - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.14007ace8
mov qword [rbp - 0x61], rsi
test r13, r13
je 0x1400c0fa8
mov rax, qword [r13]
mov rdi, qword [rax + 0x10]
mov rax, qword [0x1403d25b8]
mov rcx, rdi
call rax
mov rax, rdi
mov rcx, r13
call rax
mov qword [rbp - 0x59], rsi
mov rdx, rbx
lea rcx, [rbp - 0x61]
call fcn.1400c639c
mov esi, eax
test eax, eax
js 0x1400c0edf
xor r8d, r8d
lea rdx, [rbp - 0x61]
lea rcx, [rbp - 0x71]
call fcn.1400c03b0
mov esi, eax
test eax, eax
js 0x1400c0edf
inc r14d
cmp r14d, r15d
jae 0x1400c0feb
mov r13, qword [rbp - 0x59]
xor esi, esi
jmp 0x1400c0f5a
mov rax, qword [rbx]
mov rdi, qword [rax + 0x28]
mov rax, qword [0x1403d25b8]
mov rcx, rdi
call rax
mov rax, rdi
lea rdx, [rbp + 0x77]
mov rcx, rbx
call rax
xor r14d, r14d
mov esi, eax
test eax, eax
js 0x1400c0edf
mov rax, qword [rbx]
mov rdi, qword [rax + 0x30]
mov rax, qword [0x1403d25b8]
mov rcx, rdi
call rax
mov rax, rdi
lea rdx, [rbp - 0x49]
mov rcx, rbx
call rax
mov esi, eax
test eax, eax
js 0x1400c0edf
cmp dword [rbp - 0x41], 4
jne 0x1400c0f11
mov eax, dword [rbp - 0x31]
lea r8, [rbp - 0x79]
mov rdi, qword [rbp + 0x67]
lea rdx, [rbp + 0x6f]
mov r15d, dword [rbp + 0x77]
mov rcx, rdi
mov r13, qword [rbp - 0x39]
mov dword [rbp + 0x7f], eax
mov qword [rbp - 0x79], r14
call fcn.1400c65d4
mov r14, qword [rbp - 0x79]
mov esi, eax
test eax, eax
jns 0x1400c1083
mov ecx, eax
call fcn.14007ac40
jmp 0x1400c10ec
mov edi, dword [rbp + 0x6f]
lea rax, [0x140020bdc]
mov qword [rbp - 0x21], rax
lea rdx, [rbp - 0x29]
lea rax, [rbp - 0x51]
mov qword [rbp + 3], r14
xor r9d, r9d
mov qword [rbp - 0x19], rax
mov eax, dword [rbp + 0x7f]
mov dword [rbp - 1], edi
mov qword [rbp - 0x29], 3
lea r8d, [r9 + 0x3c]
mov dword [rbp - 0x11], r15d
lea ecx, [r8 + 0x7d]
mov qword [rbp - 0xd], r12
mov dword [rbp - 5], eax
mov qword [rbp + 0xb], r13
call sub.ntdll.dll_NtQuerySystemInformation
mov esi, dword [rbp - 0x51]
xor eax, eax
test esi, esi
jns 0x1400c10e0
mov ecx, esi
call fcn.14007ac40
jmp 0x1400c10e8
mov rcx, rdi
mov rdi, r14
rep stosb byte [rdi], al
mov rdi, qword [rbp + 0x67]
mov ecx, esi
call fcn.14007ace8
test r14, r14
je 0x1400c1101
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp esi, 0x8007000d
jne 0x1400c111f
lea rcx, [rdi + 0x98]
xor edx, edx
call fcn.140072da0
xor r14d, r14d
mov esi, r14d
jmp 0x1400c119b
xor r14d, r14d
test esi, esi
js 0x1400c0e4d
add rdi, 0x98
xor edx, edx
mov rcx, rdi
call fcn.140072da0
mov rax, qword [rdi + 8]
mov r15d, dword [rdi]
mov r13d, dword [rdi + 4]
mov qword [rdi + 8], r14
mov qword [rbp + 0x67], rax
mov eax, dword [rbp - 0x71]
mov dword [rdi], eax
mov eax, dword [rbp - 0x6d]
mov dword [rdi + 4], eax
mov r14, qword [rdi + 8]
test r14, r14
je 0x1400c1176
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbp - 0x69]
xor r14d, r14d
test rcx, rcx
mov dword [rbp - 0x71], r15d
mov eax, r14d
mov dword [rbp - 0x6d], r13d
cmovne rax, rcx
mov qword [rdi + 8], rax
mov rax, qword [rbp + 0x67]
mov qword [rbp - 0x69], rax
mov ecx, esi
call fcn.14007ace8
xor edx, edx
lea rcx, [rbp - 0x71]
call fcn.140072da0
mov rdi, qword [rbp - 0x69]
test rdi, rdi
je 0x1400c11ca
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rcx, [rbp - 0x61]
call fcn.140077494
test rbx, rbx
je 0x1400c11f3
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rax, qword [0x1403d25b8]
mov rcx, rdi
call rax
mov rax, rdi
mov rcx, rbx
call rax
test r12, r12
je 0x1400c120c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r12
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, esi
add rsp, 0xd8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret