Function at 0x1401d9ff0
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x1b8
mov eax, 0xd23
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0x1c8]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 4
mov edx, 0x80000000
lea rcx, str.UnwoundeddifferentiationHashesNomenclaturePsychologist
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 2
mov edx, 0x40000000
lea rcx, str.PicturesquenesslanguidSquawks
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x100], rax
movzx eax, word [rsp + 0x40]
sub eax, 0x482
mov word [rsp + 0x40], ax
movabs rax, 0x64aecf49216656d2
cmp qword [rsp + 0x1c0], rax
jne 0x1401da175
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xc0]
mov r8, qword [rsp + 0xe0]
mov rdx, qword [rsp + 0xb0]
mov ecx, 0x1e
call sub.VERSION.dll_VerInstallFileA
mov dword [rsp + 0x64], eax
mov r9, qword [rsp + 0x1c0]
mov r8, qword [rsp + 0x1c0]
mov rdx, qword [rsp + 0x1c0]
mov rcx, qword [rsp + 0x1c0]
call fcn.1401d9380
movzx eax, word [rsp + 0x40]
add eax, 0x893
mov word [rsp + 0x40], ax
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0xe0]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [rsp + 0x54], eax
movabs rax, 0x4c3fb0052c8bb6e6
mov rcx, qword [rsp + 0x1c8]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
movzx eax, word [rsp + 0x40]
cmp eax, 0x96b
jge 0x1401da729
movzx eax, word [rsp + 0x40]
mov dword [rsp + 0x6c], eax
cmp dword [rsp + 0x6c], 0x562
je 0x1401da1ab
cmp dword [rsp + 0x6c], 0xdad
je 0x1401da277
jmp 0x1401da2b4
movzx eax, word [rsp + 0x40]
imul eax, eax, 0xebe
cmp eax, 0x2b0
jle 0x1401da200
mov rax, qword [rsp + 0x1c8]
sar rax, 0x13
mov qword [rsp + 0x48], rax
lea r9, [rsp + 0x54]
lea r8, [rsp + 0x48]
mov rdx, qword [rsp + 0xb0]
lea rcx, [rsp + 0x68]
call sub.VERSION.dll_VerQueryValueA
mov dword [rsp + 0xd4], eax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x1c8], rax
jmp 0x1401da275
movzx eax, word [rsp + 0x40]
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0x2fa
je 0x1401da21f
cmp dword [rsp + 0x70], 0xfc1
je 0x1401da264
jmp 0x1401da275
mov rdx, qword [rsp + 0x1c8]
mov rcx, qword [rsp + 0x1c0]
call fcn.1401d9ff0
lea r9, [rsp + 0x90]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x90]
call sub.WINSPOOL.DRV_FindNextPrinterChangeNotification
mov dword [rsp + 0x80], eax
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x64], eax
jmp 0x1401da275
mov rax, qword [rsp + 0x1c8]
shl rax, 0x29
mov qword [rsp + 0x48], rax
jmp 0x1401da2b4
mov rdx, qword [rsp + 0x1c8]
mov rcx, qword [rsp + 0x1c0]
call fcn.1401d9ff0
lea r9, [rsp + 0xe8]
mov r8d, 0xbe
mov edx, 0xc2
mov rcx, qword [rsp + 0xb8]
call sub.WINSPOOL.DRV_FindFirstPrinterChangeNotification
mov qword [rsp + 0xe8], rax
movzx eax, word [rsp + 0x40]
cmp eax, 0xe8f
jne 0x1401da2f4
movabs rax, 0x3065e120011dcf0a
mov rcx, qword [rsp + 0x1c8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
movabs rax, 0xb4df5c3b3158fada
mov qword [rsp + 0x1c0], rax
jmp 0x1401da3ed
movzx eax, word [rsp + 0x40]
or eax, 0x7bd
cmp eax, 0xf8
jl 0x1401da3ed
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 8
mov edx, 0xc0000000
lea rcx, str.Defiantlyconiferous_biliaryTransepts
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0xf0], rax
lea rdx, [rsp + 0x140]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xa0], eax
movabs rax, 0x217582708675a918
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
cmp rax, qword [rsp + 0x1c8]
jle 0x1401da39a
mov edx, 0x94
mov rcx, qword [rsp + 0x90]
call sub.WINSPOOL.DRV_ScheduleJob
mov dword [rsp + 0xd8], eax
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x7c], eax
mov eax, 0x738d
mov word [rsp + 0x44], ax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov edx, 0x753198
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xdc], eax
lea rdx, [rsp + 0x178]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0xc8], eax
movsx eax, word [rsp + 0x44]
mov dword [rsp + 0x74], eax
cmp dword [rsp + 0x74], 0x37df
je 0x1401da6b3
cmp dword [rsp + 0x74], 0x738d
je 0x1401da413
jmp 0x1401da6e9
movzx eax, word [rsp + 0x40]
cmp eax, 0x80f
je 0x1401da4f3
movzx eax, word [rsp + 0x44]
mov word [rsp + 0x60], ax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x50], ax
movsx eax, word [rsp + 0x44]
sub eax, 0x2692
movsx ecx, word [rsp + 0x60]
cmp eax, ecx
je 0x1401da4d8
movzx eax, word [rsp + 0x50]
mov dword [rsp + 0x78], eax
cmp dword [rsp + 0x78], 0x97c
je 0x1401da46d
cmp dword [rsp + 0x78], 0xf38
je 0x1401da4c3
jmp 0x1401da4d8
mov rax, qword [rsp + 0x58]
mov rax, qword [rax]
mov qword [rsp + 0x1c8], rax
movzx eax, word [rsp + 0x50]
mov dword [rsp + 0x9c], eax
cmp dword [rsp + 0x9c], 0x6e
je 0x1401da495
jmp 0x1401da4b1
mov rcx, qword [rsp + 0x90]
call sub.WINSPOOL.DRV_AbortPrinter
mov dword [rsp + 0x80], eax
call fcn.1401d9230
nop
jmp 0x1401da4c1
mov eax, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x64]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7c], eax
jmp 0x1401da4d8
mov rax, qword [rsp + 0x58]
mov rax, qword [rax]
add rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x58]
mov qword [rcx], rax
lea rax, [rsp + 0x1c8]
mov qword [rsp + 0x88], rax
mov dword [rsp + 0xa4], 0x43d42cca
mov rax, qword [rsp + 0x88]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0xf8], rcx
movzx ecx, al
mov rax, qword [rsp + 0xf8]
mov rax, qword [rax]
sar rax, cl
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x1c8]
shl rdx, cl
mov rcx, rdx
cmp rax, rcx
jg 0x1401da5be
movzx eax, word [rsp + 0x44]
mov word [rsp + 0x98], ax
mov rax, qword [rsp + 0x58]
mov rax, qword [rax]
mov qword [rsp + 0x120], rax
mov eax, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x64]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x7c], eax
mov edx, 0x1a93ca
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
mov dword [rsp + 0xcc], eax
lea rdx, [rsp + 0x128]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0xa0], eax
lea rax, [rsp + 0xa4]
mov qword [rsp + 0x130], rax
mov rax, qword [rsp + 0x1c0]
mov qword [rsp + 0x138], rax
jmp 0x1401da611
mov rax, qword [rsp + 0x1c0]
mov qword [rsp + 0x108], rax
movabs rax, 0x4940c9f6c428d93f
cmp qword [rsp + 0x108], rax
je 0x1401da5e4
jmp 0x1401da5f3
mov r8b, 0xa2
mov dl, 0xdf
mov cl, 0x65
call fcn.1401d98a0
nop
jmp 0x1401da611
mov rax, qword [rsp + 0x88]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x58]
mov qword [rcx], rax
lea r9, [rsp + 0x88]
mov r8d, 0x25
mov edx, 8
mov rcx, qword [rsp + 0xb8]
call sub.WINSPOOL.DRV_FindFirstPrinterChangeNotification
mov qword [rsp + 0xb8], rax
movabs rax, 0x7ae4a256dab3e7b4
mov qword [rsp + 0x1c0], rax
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
mov rax, qword [rax]
xor rax, rcx
mov rcx, qword [rsp + 0x88]
mov qword [rcx], rax
mov rax, qword [rsp + 0x88]
mov rdx, qword [rax]
mov rcx, qword [rsp + 0x1c0]
call fcn.1401d9ff0
lea r9, [rsp + 0x54]
lea r8, [rsp + 0x54]
lea rdx, [rsp + 0x90]
mov rcx, qword [rsp + 0x110]
call sub.WINSPOOL.DRV_FindNextPrinterChangeNotification
mov dword [rsp + 0xd0], eax
movzx eax, word [rsp + 0x40]
and eax, 0x41
mov word [rsp + 0x50], ax
jmp 0x1401da6e9
lea r9, [rsp + 0x44]
xor r8d, r8d
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x110]
call sub.WINSPOOL.DRV_ReadPrinter
mov dword [rsp + 0x68], eax
mov rax, qword [rsp + 0x58]
mov rax, qword [rax]
add rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x58]
mov qword [rcx], rax
mov r9, qword [rsp + 0x1c0]
mov r8, qword [rsp + 0x1c0]
mov rdx, qword [rsp + 0x1c0]
mov rcx, qword [rsp + 0x1c0]
call fcn.1401d9380
mov rax, qword [rsp + 0x58]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x1c8]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
lea r9, [rsp + 0xc0]
lea r8, [rsp + 0x48]
mov rdx, qword [rsp + 0x118]
lea rcx, [rsp + 0x68]
call sub.VERSION.dll_VerQueryValueA
mov dword [rsp + 0x68], eax
mov r8, qword [rsp + 0x1c8]
movzx edx, word [rsp + 0x40]
movzx ecx, word [rsp + 0x40]
call fcn.1401d9170
mov eax, 0xa
add rsp, 0x1b8
ret