Function at 0x6c8c20
Capabilities:
Get file size

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
add rsp, 0xffffffffffffff80
mov ebx, dword [rcx + 0x168]
mov edi, ebx
and edi, 3
mov rsi, rcx
test ebx, 0x20000000
je 0x6c8e50
mov dword [rsp + 0x60], ebx
mov qword [rsp + 0x78], 0
cmp edi, 1
je 0x6c8ec0
test bl, 8
jne 0x6c8c80
xor ecx, ecx
call sub.msvcrt.dll__umask
mov ecx, eax
mov ebp, eax
call sub.msvcrt.dll__umask
cmp edi, 3
je 0x6c8cde
jmp 0x6c8eec
xor ecx, ecx
and ebx, 0xfffffff4
call sub.msvcrt.dll__umask
or ebx, 2
mov ecx, eax
mov ebp, eax
call sub.msvcrt.dll__umask
mov edx, 0x12019f
mov eax, ebx
and eax, 0x10000000
cmp eax, 1
mov eax, ebx
sbb r8d, r8d
and eax, 0x700
and r8d, 7
cmp eax, 0x300
je 0x6c8f30
jg 0x6c8d00
cmp eax, 0x100
je 0x6c8ea0
cmp eax, 0x200
je 0x6c8e90
test eax, eax
je 0x6c8eb0
mov qword [rsi + 0x88], 0xfffffffffffff019
mov dword [rsi + 0x14c], 0x57
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp eax, 0x500
je 0x6c8d1f
jle 0x6c8e30
cmp eax, 0x600
je 0x6c8e90
cmp eax, 0x700
jne 0x6c8cde
mov r9d, 1
mov eax, pe_nt_image_headers64
test bh, 1
je 0x6c8d45
not ebp
and ebp, dword [rsi + 0x158]
xor eax, eax
and ebp, 0x80
sete al
sub eax, 0xffffff80
test bl, 0x40
je 0x6c8d55
or eax, 0x4000100
or edx, 0x10000
mov ecx, eax
or ch, 1
test bh, 0x10
cmovne eax, ecx
mov ecx, ebx
and ecx, 0x30
cmp ecx, 0x10
je 0x6c8f10
cmp ecx, 0x20
je 0x6c8f00
test ecx, ecx
jne 0x6c8cde
test ebx, 0x2000000
je 0x6c8d9d
test dl, 4
je 0x6c8d98
test dl, 2
je 0x6c8cde
and edx, 0xfffffffb
or eax, 0x20000000
mov ecx, ebx
and ecx, 0xc000000
cmp ecx, 0x4000000
je 0x6c8f20
cmp ecx, 0x8000000
je 0x6c8f20
test ecx, ecx
jne 0x6c8cde
or eax, 0x2000000
mov dword [rsp + 0x20], r9d
mov rcx, qword [rsi + 0x150]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], eax
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x6c9140
mov edx, ebx
mov rcx, rax
call qword [sym.imp.msvcrt.dll__open_osfhandle]
mov edi, eax
test eax, eax
js 0x6c9090
and ebx, 0x20000000
jne 0x6c8f40
movsxd rdi, edi
mov qword [rsi + 0x88], rdi
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r9d, 3
cmp eax, 0x400
je 0x6c8d25
jmp 0x6c8cde
xor ecx, ecx
call sub.msvcrt.dll__umask
mov ecx, eax
mov ebp, eax
call sub.msvcrt.dll__umask
cmp edi, 3
je 0x6c8cde
lea rax, [0x00d11c10]
mov edx, dword [rax + rdi*4]
test bl, 8
je 0x6c8c9b
and edx, 0xfffffffd
or edx, 4
jmp 0x6c8c9b
mov r9d, 5
jmp 0x6c8d25
mov r9d, 4
jmp 0x6c8d25
mov r9d, 3
jmp 0x6c8d25
mov edx, ebx
mov eax, ebx
and edx, 0xfffffffc
and eax, 8
or edx, 2
mov ebx, edx
test eax, eax
jne 0x6c8c80
xor ecx, ecx
mov edi, 2
call sub.msvcrt.dll__umask
mov ecx, eax
mov ebp, eax
call sub.msvcrt.dll__umask
lea rax, [0x00d11c10]
mov edx, dword [rax + rdi*4]
jmp 0x6c8c9b
or eax, 0x8000000
jmp 0x6c8d7f
or eax, 0x10000000
jmp 0x6c8d7f
or eax, 0x80000000
jmp 0x6c8dc5
mov r9d, 2
jmp 0x6c8d25
mov r9d, 0x18
lea r8, [rsp + 0x40]
mov edx, 1
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetFileInformationByHandleEx]
test eax, eax
je 0x6c9104
movzx eax, byte [rsp + 0x55]
mov byte [rsp + 0x64], al
test al, al
je 0x6c9190
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x68], 0xffffffffffffffff
movzx ebx, dil
lea rcx, [0x010a6200]
lea rbp, [0x00e1d200]
call sub.KERNEL32.DLL_EnterCriticalSection
mov rax, rbx
shl rax, 4
add rax, rbp
mov r10, qword [rax]
test r10, r10
mov r12, r10
setne r11b
and r12d, 0xf
jne 0x6c91f0
test r11b, r11b
je 0x6c91f0
mov r9, qword [rax + 8]
mov r12d, 0x10
lea rdx, [r9 + 0x28]
mov eax, 1
cmp edi, dword [r9]
jne 0x6c8ff7
jmp 0x6c9068
mov ecx, dword [rdx]
lea r8, [rax + 1]
add rdx, 0x28
cmp edi, ecx
je 0x6c9180
mov rax, r8
cmp r12, rax
ja 0x6c8fe2
mov rcx, qword [r9 + 0x280]
test rcx, rcx
je 0x6c9035
nop dword [rax + rax]
mov rdx, rcx
xor eax, eax
cmp edi, dword [rdx]
je 0x6c9122
add eax, 1
add rdx, 0x28
cmp eax, 0x10
jne 0x6c9015
mov rcx, qword [rcx + 0x280]
test rcx, rcx
jne 0x6c9010
mov r12d, r10d
and r12d, 0xf
jne 0x6c9047
test r11b, r11b
jne 0x6c9238
shl rbx, 4
mov eax, r12d
add r10, 1
add rbp, rbx
lea r9, [rax + rax*4]
mov rax, qword [rbp + 8]
mov qword [rbp], r10
lea r9, [rax + r9*8]
mov dword [r9], edi
movdqa xmm0, xmmword [rsp + 0x60]
movdqa xmm1, xmmword [rsp + 0x70]
lea rcx, [0x010a6200]
movups xmmword [r9 + 8], xmm0
movups xmmword [r9 + 0x18], xmm1
call sub.KERNEL32.DLL_LeaveCriticalSection
jmp 0x6c8e1a
call qword [sym.imp.msvcrt.dll__errno]
cmp dword [rax], 0x18
jne 0x6c91c0
mov qword [rsi + 0x88], 0xfffffffffffff01e
mov dword [rsi + 0x14c], 4
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x6c8cf3
mov eax, dword [rsp + 0x60]
mov edx, dword [rsp + 0x70]
mov rcx, rbp
mov qword [rsp + 0x28], 0
mov r9d, dword [rsp + 0x74]
and eax, 3
mov dword [rsp + 0x20], edx
cmp eax, 1
sbb eax, eax
xor edx, edx
and eax, 0xfffffffe
lea r8d, [rax + 4]
call qword [sym.imp.KERNEL32.DLL_CreateFileMappingA]
mov qword [rsp + 0x68], rax
test rax, rax
jne 0x6c8f84
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [rsi + 0x14c], eax
mov ecx, eax
call fcn.006c72f0
cdqe
mov qword [rsi + 0x88], rax
jmp 0x6c90b4
lea rax, [rax + rax*4]
lea r9, [rcx + rax*8]
test r9, r9
jne 0x6c9068
jmp 0x6c9035
mov rdi, qword [sym.imp.KERNEL32.DLL_GetLastError]
call rdi
cmp eax, 0x50
jne 0x6c9160
and ebx, 0x500
cmp ebx, 0x100
je 0x6c920a
call rdi
mov dword [rsi + 0x14c], eax
mov ecx, eax
call fcn.006c72f0
cdqe
mov qword [rsi + 0x88], rax
jmp 0x6c8cf3
lea rax, [rax + rax*4]
lea r9, [r9 + rax*8]
jmp 0x6c912a
lea rdx, [rsp + 0x70]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetFileSizeEx]
test eax, eax
je 0x6c9104
cmp qword [rsp + 0x70], 0
jne 0x6c90c2
mov qword [rsp + 0x68], 0xffffffffffffffff
jmp 0x6c8f84
mov rbx, qword [sym.imp.KERNEL32.DLL_GetLastError]
call rbx
test eax, eax
je 0x6c9224
call rbx
mov dword [rsi + 0x14c], eax
mov ecx, eax
call fcn.006c72f0
cdqe
mov qword [rsi + 0x88], rax
jmp 0x6c90b4
mov rax, rbx
shl rax, 4
mov r9, qword [rbp + rax + 8]
test r12, r12
jne 0x6c8fcf
jmp 0x6c8ffc
mov qword [rsi + 0x88], 0xfffffffffffff01c
mov dword [rsi + 0x14c], 0x50
jmp 0x6c8cf3
mov dword [rsi + 0x14c], 0xfffff002
mov ecx, 0xfffff002
jmp 0x6c9112
mov ecx, 0x288
call fcn.006c2830
test rax, rax
je 0x6c9268
mov rdx, rbx
shl rdx, 4
add rdx, rbp
mov rcx, qword [rdx + 8]
mov r10, qword [rdx]
mov qword [rax + 0x280], rcx
mov qword [rdx + 8], rax
jmp 0x6c9047
lea rdx, [0x00d119ce]
mov ecx, 0xe
call fcn.006c7230
nop
nop word [rax + rax]