Function at 0x18001af60
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4e0]
sub rsp, 0x5e0
mov rax, qword [0x18002e518]
xor rax, rsp
mov qword [rbp + 0x4d0], rax
mov rdi, r8
mov qword [rsp + 0x50], r8
lea r8d, [rcx - 0x13]
mov qword [rsp + 0x40], rdx
mov dword [rsp + 0x48], ecx
mov esi, ecx
mov dword [rsp + 0x34], r8d
cmp ecx, r8d
jbe 0x18001b97d
mov r13, qword [rsp + 0x70]
lea ebx, [rcx - 0x100]
mov r14, qword [rsp + 0x78]
lea r10, [0x180000000]
movzx r15d, byte [rsp + 0x30]
xor r9d, r9d
mov r12, qword [rsp + 0x78]
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x3c], ebx
movzx ebx, byte [rsp + 0x30]
lea r11d, [r9 + 0x65]
mov r8d, dword [rsp + 0x3c]
nop dword [rax + rax]
cmp r8d, 0x35
ja case.default.0x18001b021
mov eax, r8d
movzx eax, byte [r10 + rax + 0x1ba08]
mov ecx, dword [r10 + rax*4 + 0x1b9b8]
add rcx, r10
jmp rcx
cmp qword [rdx], 0
mov edi, r9d
jbe 0x18001b476
mov rsi, qword [rsp + 0x50]
mov r13, qword [rsp + 0x40]
nop word [rax + rax]
movzx edx, byte [rsi]
lea rcx, str._02X
call fcn.180024a20
inc edi
mov eax, edi
and eax, 0x80000007
jge 0x18001b061
dec eax
or eax, 0xfffffff8
inc eax
test eax, eax
jne 0x18001b071
lea rcx, [0x1800279d8]
call fcn.180024a20
inc rsi
movsxd rax, edi
cmp rax, qword [r13]
jb 0x18001b040
mov r13, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x50]
mov esi, dword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
lea r10, [0x180000000]
mov r8d, dword [rsp + 0x3c]
xor r9d, r9d
lea r11d, [r9 + 0x65]
jmp case.0x18001b021.19
mov eax, 0x7075
mov byte [rbp + 0x1a2], 0
mov word [rbp + 0x1a0], ax
mov qword [rbp - 0x78], r9
jmp case.0x18001b021.19
xorps xmm0, xmm0
mov dword [rsp + 0x68], 0xffffffff
mov ecx, 0x202
mov qword [rbp - 0x4c], r9
lea rdx, [rbp - 0x40]
mov dword [rbp - 0x60], 0x1c
movdqu xmmword [rbp - 0x5c], xmm0
call qword [rsp + 0x78]
test eax, eax
je 0x18001b08b
mov edi, 0x13
nop word [rax + rax]
cmp edi, 0x26e
ja 0x18001b2d9
je 0x18001b2a0
cmp edi, 0x11f
ja 0x18001b1e2
je 0x18001b1d6
mov eax, edi
sub eax, 0x13
je 0x18001b1b0
sub eax, 0x43
je 0x18001b18b
sub eax, 0x43
je 0x18001b16c
xor r9d, r9d
cmp eax, 0x43
jne 0x18001b450
movzx eax, word [0x1800279e1]
mov word [rbp + 0x16b], ax
movzx eax, byte [0x1800279e3]
mov byte [rbp + 0x16d], al
mov byte [rbp + 0x16a], 0x65
jmp 0x18001b450
mov r8d, 3
lea rdx, [0x180027a48]
lea rcx, [rbp + 0x160]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x18001b44d
mov eax, dword [0x180027afc]
mov dword [rbp + 0x162], eax
movzx eax, byte [0x180027b00]
mov byte [rbp + 0x166], al
mov byte [rbp + 0x167], 0
jmp 0x18001b44d
mov r8d, 2
mov byte [rbp + 0x160], 0
lea rdx, [0x180027a35]
lea rcx, [rbp + 0x160]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x18001b44d
mov byte [rbp + 0x16e], 0
jmp 0x18001b44d
mov eax, edi
sub eax, 0x162
je 0x18001b25c
sub eax, 0x43
je 0x18001b230
sub eax, 0x43
je 0x18001b224
cmp eax, 0x43
jne 0x18001b44d
lea r8d, [rax - 0x3f]
mov word [rbp + 0x1c0], PathYetAnotherMakeUniqueName
lea rdx, [0x180027b33]
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x18001b44d
mov byte [rbp + 0x17c], 0
jmp 0x18001b44d
movzx eax, word [0x180027b4c]
mov word [rbp + 0x177], ax
movzx eax, byte [0x180027b4e]
mov byte [rbp + 0x179], al
mov eax, 0x6574
mov word [rbp + 0x17a], ax
jmp 0x18001b44d
mov r8d, 2
lea rdx, [0x180027a58]
lea rcx, [rbp + 0x160]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov eax, dword [0x180027a80]
mov dword [rbp + 0x170], eax
movzx eax, byte [0x180027a84]
mov byte [rbp + 0x174], al
mov eax, 0x7250
mov word [rbp + 0x175], ax
jmp 0x18001b44d
mov r8d, 2
lea rdx, [0x180027a01]
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r8d, 1
lea rdx, [0x180027a11]
lea rcx, [rbp + 0x1c7]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x18001b44d
cmp edi, 0x3bd
ja 0x18001b38b
je 0x18001b37f
mov eax, edi
sub eax, 0x2b1
je 0x18001b367
sub eax, 0x43
je 0x18001b327
sub eax, 0x43
je 0x18001b319
xor r9d, r9d
cmp eax, 0x43
jne 0x18001b450
mov byte [rsp + 0x38], 1
mov byte [rsp + 0x30], 1
jmp 0x18001b450
mov word [rbp + 0x1d0], 0x57
jmp 0x18001b44d
mov r8d, 4
lea rdx, [0x180027ab5]
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r8d, 2
lea rdx, [0x180027ac9]
lea rcx, [rbp + 0x1ce]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rbp + 0x1d0], 0
jmp 0x18001b44d
mov eax, 0x545f
mov byte [rbp + 0x1ca], 0
mov word [rbp + 0x1c8], ax
jmp 0x18001b44d
xor r9d, r9d
mov qword [rbp - 0x80], r9
jmp 0x18001b450
mov eax, edi
sub eax, 0x400
je 0x18001b438
sub eax, 0x43
je 0x18001b3f7
sub eax, 0x43
je 0x18001b3b0
cmp eax, 0x43
je case.0x18001b021.0
jmp 0x18001b44d
cmp byte [rsp + 0x30], 0
je 0x18001b3c0
mov rcx, r13
call qword [sym.imp.GDI32.dll_DeleteEnhMetaFile]
movzx eax, byte [rsp + 0x38]
xor r9d, r9d
test r14, r14
mov ecx, r9d
cmovne ecx, eax
mov byte [rsp + 0x38], cl
cmp cl, r9b
je 0x18001b3f3
lea rdx, [rbp - 0x80]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
xor bl, bl
jmp 0x18001b450
xor r9d, r9d
lea rax, [rbp + 0x1c0]
xor edx, edx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], pe_nt_image_headers64
lea r8d, [r9 + 4]
lea rcx, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
xor r9d, r9d
mov r14, rax
movzx eax, byte [rsp + 0x30]
test r13, r13
mov ecx, r9d
cmovne ecx, eax
mov byte [rsp + 0x30], cl
jmp 0x18001b450
lea rcx, [rbp + 0x160]
call qword [sym.imp.GDI32.dll_GetEnhMetaFileA]
mov r13, rax
mov qword [rsp + 0x70], rax
xor r9d, r9d
add edi, 0x43
cmp edi, 0x50c
jb 0x18001b100
mov rdx, qword [rsp + 0x40]
lea r10, [0x180000000]
mov r8d, dword [rsp + 0x3c]
mov r11d, 0x65
mov rdi, qword [rsp + 0x50]
mov eax, dword [rsp + 0x34]
dec esi
dec r8d
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x3c], r8d
cmp esi, eax
ja 0x18001b000
jmp case.0x18001b021.0
movzx eax, word [0x180027b9c]
mov word [rbp + 0x1ac], ax
movzx eax, byte [0x180027b9e]
mov byte [rbp + 0x1ae], al
mov byte [rbp + 0x1af], 0
jmp case.0x18001b021.19
mov r8d, 4
lea rdx, [0x180027c53]
lea rcx, [rbp + 0x1a8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov word [rbp + 0x1b3], 0x73
jmp 0x18001b08b
mov r8d, 5
lea rdx, [0x180027c8a]
lea rcx, [rbp + 0x1b8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov eax, 0x57
mov byte [rbp + 0x1bd], 0
mov word [rbp + 0x198], ax
mov dword [rbp + 0x199], 0x74534153
jmp 0x18001b08b
mov dword [rbp + 0x1b4], 0x46657469
mov byte [rbp + 0x1b8], 0
jmp case.0x18001b021.19
mov rdx, rdi
mov dword [rsp + 0x60], 0x1c
mov ecx, 0x5b
mov dword [rsp + 0x64], 0x104
call fcn.18001c710
test al, al
jne 0x18001b08b
mov edi, 0xc
nop dword [rax]
nop word [rax + rax]
lea r10, [0x180000000]
cmp edi, 0xc
ja case.default.0x18001b58d
mov eax, edi
mov ecx, dword [r10 + rax*4 + 0x1ba40]
add rcx, r10
jmp rcx
mov r8d, 1
mov dword [rbp + 0x178], 0x72
lea rdx, [0x180027c9c]
lea rcx, [rbp + 0x160]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
lea r10, [0x180000000]
jmp case.default.0x18001b58d
movzx eax, word [0x180027ca0]
mov word [rbp + 0x18b], ax
movzx eax, byte [0x180027ca2]
mov byte [rbp + 0x18d], al
lea rax, [rbp + 0x188]
dec rax
cmp byte [rax + 1], 0
lea rax, [rax + 1]
jne 0x18001b5e4
movzx ecx, word [0x180027ca4]
mov word [rax], cx
mov word [rbp + 0x18e], 0x73
jmp case.default.0x18001b58d
movabs rax, 0x6700690052
mov qword [rbp + 0x160], rax
mov eax, 0x68
mov word [rbp + 0x166], ax
jmp case.default.0x18001b58d
mov r11d, 0x65
mov r15b, 1
mov word [rbp + 0x192], r11w
jmp 0x18001b7d2
mov r8d, 1
lea rdx, [0x180027ca8]
lea rcx, [rbp + 0x160]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov eax, dword [0x180027cac]
lea rdx, [0x180027cb4]
mov dword [rbp + 0x17e], eax
lea rcx, [rbp + 0x160]
movzx eax, word [0x180027cb0]
mov r8d, 2
mov word [rbp + 0x182], ax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
lea r10, [0x180000000]
mov dword [rbp + 0x188], 0x7a616c
jmp case.default.0x18001b58d
xor eax, eax
lea rdx, [0x180027cbc]
lea rcx, [rbp + 0x168]
mov word [rbp + 0x168], ax
lea r8d, [rax + 2]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
lea r10, [0x180000000]
mov dword [rbp + 0x16a], PathYetAnotherMakeUniqueName
jmp case.default.0x18001b58d
movsd xmm0, qword [str.bleB]
movzx eax, word [0x180027cd0]
mov dword [rbp + 0x16c], 0x6f
mov dword [rbp + 0x16e], 0x75
movsd qword [rbp + 0x170], xmm0
mov word [rbp + 0x178], ax
jmp case.default.0x18001b58d
xor eax, eax
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x5c]
mov dword [rsp + 0x58], eax
mov rcx, r12
call sub.IMM32.dll_ImmGetConversionStatus
test eax, eax
jne 0x18001b73b
xor r15b, r15b
lea r10, [0x180000000]
jmp case.default.0x18001b58d
test r15b, r15b
je 0x18001b5b3
mov r8d, dword [rsp + 0x58]
mov rcx, r12
mov edx, dword [rsp + 0x5c]
call sub.IMM32.dll_ImmSetConversionStatus
lea r10, [0x180000000]
jmp case.default.0x18001b58d
lea r8, [rbp + 0x1e0]
xor edx, edx
lea rcx, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
mov r9d, 7
mov dword [rsp + 0x28], 0x104
lea rax, [rbp + 0x2b0]
mov edx, 0x800
lea r8, [rbp + 0x188]
mov qword [rsp + 0x20], rax
lea ecx, [r9 + 0x78]
call qword [sym.imp.KERNEL32.dll_LCMapStringA]
lea r10, [0x180000000]
jmp case.default.0x18001b58d
xor r9d, r9d
mov r12d, r9d
mov dword [rsp + 0x5c], r9d
lea r11d, [r9 + 0x65]
jmp 0x18001b7d5
mov dword [rbp + 0x18f], 0x726f74
jmp case.default.0x18001b58d
xor bl, bl
mov r11d, 0x65
xor r9d, r9d
dec edi
lea eax, [rdi + 0xf9]
cmp eax, 0xf8
ja 0x18001b570
mov rdx, qword [rsp + 0x40]
mov r8d, dword [rsp + 0x3c]
jmp 0x18001b476
lea rcx, [0x1800279d8]
call fcn.180024a20
jmp 0x18001b08b
mov r8d, 3
lea rdx, [0x180027ce7]
lea rcx, [rbp + 0x1a9]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x18001b08b
mov ecx, PathYetAnotherMakeUniqueName
call fcn.18000c840
mov rbx, rax
jmp 0x18001b08b
test rdi, rdi
je case.0x18001b021.19
mov rcx, qword [rdi]
test rcx, rcx
je 0x18001b8a0
mov esi, r9d
cmp r9w, word [rdi + 8]
jge 0x18001b890
mov r13, qword [rsp + 0x50]
mov rdi, r9
nop dword [rax]
mov rdx, qword [r13]
xor r8d, r8d
mov rdx, qword [rdx + rdi]
lea ecx, [r8 + 0x10]
call fcn.18000ca50
movsx eax, word [r13 + 8]
lea rdi, [rdi + 8]
inc esi
cmp esi, eax
jl 0x18001b860
mov rdi, qword [rsp + 0x50]
mov r13, qword [rsp + 0x70]
mov rcx, qword [rdi]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov esi, dword [rsp + 0x48]
mov r11d, 0x65
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x18001b8b3
mov r8d, r11d
xor edx, edx
call fcn.180023560
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x18001b08b
mov eax, dword [rsp + 0x60]
lea r9, [rbp - 0x60]
mov rdx, qword [rbp - 0x70]
lea r8, [rbp + 0x1a8]
mov rcx, qword [rbp - 0x78]
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], eax
call sub.IMM32.dll_ImmGetConversionListA
mov r9d, dword [rsp + 0x64]
lea r8, [rbp + 0x3c0]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.SHELL32.dll_DragQueryFileA]
jmp 0x18001b08b
mov eax, 0x61
mov word [rbp + 0x19d], ax
mov eax, 0x72
mov word [rbp + 0x19e], ax
mov eax, 0x74
mov word [rbp + 0x19f], ax
jmp case.0x18001b021.19
lea r8, [rbp + 0x198]
mov qword [rbp - 0x70], r9
mov edx, r11d
mov qword [rbp - 0x68], r9
lea rcx, str.ws2_32.dll
call fcn.180003f80
mov qword [rsp + 0x78], rax
jmp 0x18001b08b
mov byte [rbp + 0x1ac], 0
jmp case.0x18001b021.19
mov byte [rbp + 0x1a8], 0x43
jmp case.0x18001b021.19
mov byte [rbp + 0x1a9], 0
jmp case.0x18001b021.19
movzx ebx, byte [rsp + 0x30]
movzx eax, bl
mov rcx, qword [rbp + 0x4d0]
xor rcx, rsp
call fcn.1800250d0
lea r11, [rsp + 0x5e0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret