Function at 0x140007977
Capabilities:
Get file size

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x3c8
xor eax, eax
mov dword [rsp + 0x410], ecx
xor ecx, ecx
mov rbp, rdx
mov ebx, r9d
mov dword [rsp + 0x5c], ecx
lea rdi, [rsp + 0x70]
mov ecx, 0x20
mov edx, 0x10
rep stosd dword [rdi], eax
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x420], r8d
call fcn.140036cb3
cmp dword [rsp + 0x410], 0
jns 0x1400079d3
xor esi, esi
jmp 0x140007e5c
mov eax, dword [rsp + 0x410]
mov r8d, 0x107
lea rdx, str.drive.c
lea rcx, str._DriveIndex___DRIVE_INDEX_MIN____DriveIndex___DRIVE_INDEX_MAX_
add eax, 0xffffff80
mov dword [rsp + 0x4c], eax
cmp eax, 0x40
ja 0x140007abd
mov qword [rsp + 0x40], 0xffffffffffffffff
xor esi, esi
mov r12d, 1
test esi, esi
lea r14, [rsp + 0x1b8]
jne 0x140007a50
mov edx, 0x104
mov rcx, r14
call qword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
mov qword [rsp + 0x40], rax
inc rax
jne 0x140007a98
test ebx, ebx
jne 0x1400079cc
call fcn.14003893c
lea rcx, str.Could_not_access_first_GUID_volume:__s
mov rdx, rax
call fcn.140038472
jmp 0x1400079cc
mov rcx, qword [rsp + 0x40]
mov r8d, 0x104
mov rdx, r14
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
test eax, eax
jne 0x140007a98
call qword [sym.imp.KERNEL32.DLL_PeekNamedPipe]
cmp eax, 0x12
je 0x140007d81
test ebx, ebx
jne 0x140007d81
call fcn.14003893c
lea rcx, str.Could_not_access_next_GUID_volume:__s
mov rdx, rax
call fcn.140038472
jmp 0x140007d81
mov rcx, r14
call fcn.1400797e8
mov r13, rax
cmp rax, 4
ja 0x140007ac3
mov r8d, 0x11b
lea rdx, str.drive.c
lea rcx, str.len___4
call qword [sym.imp.msvcrt.dll_memmove]
mov rdi, qword [sym.imp.msvcrt.dll_freopen]
mov r8d, 4
lea rdx, [0x140089a1a]
mov rcx, r14
call rdi
test eax, eax
je 0x140007af6
mov r8d, 0x11c
lea rdx, str.drive.c
lea rcx, str.safe_strnicmp_volume_name__volume_start__4___0
jmp 0x140007abd
cmp byte [rsp + r13 + 0x1b7], 0x5c
lea r15, [r13 - 1]
je 0x140007b1b
mov r8d, 0x11d
lea rdx, str.drive.c
lea rcx, str.volume_name_len___1___
jmp 0x140007abd
mov rcx, r14
call qword [sym.imp.KERNEL32.DLL_K32GetModuleFileLCIDToLocaleName]
sub eax, 2
cmp eax, 1
ja 0x140007ba1
lea r13, [rsp + 0x2bc]
lea rcx, [rsp + 0x1bc]
mov byte [rsp + r15 + 0x1b8], 0
mov r8d, 0x104
mov rdx, r13
call qword [0x14011c6c0]
test eax, eax
je 0x140007b86
mov r8d, 0xd
lea rdx, str.DeviceCdRom
mov rcx, r13
call rdi
test eax, eax
je 0x140007be8
mov r8d, 0xe
lea rdx, str.DeviceFloppy
mov rcx, r13
call rdi
test eax, eax
jne 0x140007ba8
jmp 0x140007be8
test ebx, ebx
jne 0x140007ba1
call fcn.14003893c
mov rdx, r14
lea rcx, str.Failed_to_get_device_path_for_GUID_volume__s:__s
mov r8, rax
call fcn.140038472
inc esi
jmp 0x140007a0f
xor edx, edx
mov dword [rsp + 0x38], 0xbb8
xor r9d, r9d
mov rcx, r14
mov qword [rsp + 0x30], rdx
mov r8d, 3
mov edx, 0x80000000
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call fcn.1400393a6
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140007c15
jmp 0x140007bfd
test ebx, ebx
jne 0x140007ba1
mov rdx, r13
lea rcx, str.Skipping_GUID_volume_for__s
call fcn.140038472
jmp 0x140007ba1
test ebx, ebx
jne 0x140007ba1
call fcn.14003893c
mov rdx, r14
lea rcx, str.Could_not_open_GUID_volume__s:__s
mov r8, rax
jmp 0x140007b9c
xor eax, eax
mov dword [rsp + 0x28], 0xc8
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x5c]
mov rcx, rdi
lea r13, [rdi - 1]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xf0]
mov edx, 0x560000
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.DLL_GetFileSizeEx]
test eax, eax
je 0x140007e4e
cmp dword [rsp + 0x5c], 0
je 0x140007e1f
xor r14d, r14d
cmp r13, 0xfffffffffffffffd
ja 0x140007c7c
mov rcx, rdi
or r14, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.DLL_CreateDirectorCreateEventACreateFileA]
mov eax, dword [rsp + 0xf0]
test eax, eax
jne 0x140007ca0
lea rdx, [rsp + 0x1b8]
lea rcx, str.Ignoring_volume__s_because_it_has_no_extents...
test ebx, ebx
jne 0x140007d76
jmp 0x140007cbb
dec eax
je 0x140007cc5
test ebx, ebx
jne 0x140007d76
lea rdx, [rsp + 0x1b8]
lea rcx, str.Ignoring_volume__s_because_it_has_more_than_one_extent__RAID__...
call fcn.140038472
jmp 0x140007d76
mov eax, dword [rsp + 0x4c]
cmp eax, dword [rsp + 0xf8]
jne 0x140007d76
mov eax, dword [rsp + 0x68]
cmp eax, 0x10
jne 0x140007cf7
mov edx, 0x10
lea rcx, str.Error:_Trying_to_process_a_disk_with_more_than__d_partitions_
xor esi, esi
call fcn.140038472
jmp 0x140007e0a
cmp dword [rsp + 0x420], 0
je 0x140007d0a
mov byte [rsp + r15 + 0x1b8], 0x5c
mov rdx, qword [rsp + 0x100]
lea rdi, [rsp + 0x1b8]
lea rcx, [rsp + 0x60]
mov r8d, 1
mov qword [rsp + rax*8 + 0x70], rdx
mov rdx, rdi
call fcn.140036cf3
test ebx, ebx
jne 0x140007d76
test r12d, r12d
mov r13, qword [0x1400b6b80]
je 0x140007d55
cmp dword [r13], 0
je 0x140007d73
lea rcx, str.Windows_volumes_from_this_device:
call fcn.140038472
cmp dword [r13], 0
je 0x140007d73
mov r8, qword [rsp + 0x100]
mov rdx, rdi
lea rcx, str.__s___lld
call fcn.140038472
xor r12d, r12d
inc esi
inc r14
je 0x140007a0f
mov ecx, dword [rsp + 0x68]
xor esi, esi
test ecx, ecx
je 0x140007e0a
xor edx, edx
lea r8, [rsp + 0x70]
xor eax, eax
test rbp, rbp
je 0x140007dae
mov eax, edx
cmp qword [r8 + rdx*8], rbp
je 0x140007daa
inc rdx
cmp edx, ecx
jb 0x140007d99
inc eax
cmp eax, ecx
jae 0x140007dca
mov rdx, qword [rsp + 0x60]
mov rsi, qword [rdx + rax*8]
test rsi, rsi
je 0x140007e0a
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_fprintf]
mov rsi, rax
jmp 0x140007e0a
mov r8d, dword [rsp + 0x420]
mov ecx, dword [rsp + 0x410]
mov r9d, ebx
mov rdx, rbp
call fcn.1400077fe
mov rsi, rax
test rax, rax
je 0x140007e0a
mov edx, 0x20
mov rcx, rax
call fcn.1400797c8
test rax, rax
je 0x140007e0a
lea rcx, str.Warning:_Using_physical_device_to_access_partition_data
call fcn.140038472
cmp qword [rsp + 0x40], 0xffffffffffffffff
je 0x140007e5c
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
jmp 0x140007e5c
lea rdx, str._empty_data_
test ebx, ebx
jne 0x140007e36
lea rcx, str.Could_not_get_Disk_Extents:__s
call fcn.140038472
cmp r13, 0xfffffffffffffffd
ja 0x140007d81
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_CreateDirectorCreateEventACreateFileA]
jmp 0x140007ba1
test ebx, ebx
jne 0x140007e36
call fcn.14003893c
mov rdx, rax
jmp 0x140007e2a
lea rcx, [rsp + 0x60]
call fcn.140036e20
mov rax, rsi
add rsp, 0x3c8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret