Function at 0x1400c7019
Capabilities:
Get file size

Disassembly:
push rax
pushf
mov eax, 0xcfb20b86
pushf
not eax
add eax, 0xe73d116d
xor eax, 0x91d90435
rol eax, 0xf9
popf
pushf
not eax
add eax, 0x8cb78137
xor eax, 0xafc14015
rol eax, 0x22
popf
pushf
not eax
add eax, 0xaaceb534
xor eax, 0x8120409a
rol eax, 0x31
popf
cmp eax, 4
jne 0x1400c7069
popf
pop rax
jmp 0x1400c736e
cmp eax, 0
jne 0x1400c7078
popf
pop rax
jmp 0x1400c70b4
cmp eax, 3
jne 0x1400c7087
popf
pop rax
jmp 0x1400c72c8
cmp eax, 1
jne 0x1400c7096
popf
pop rax
jmp 0x1400c71bb
cmp eax, 5
jne 0x1400c70a5
popf
pop rax
jmp 0x1400c73cc
cmp eax, 2
jne 0x1400c70b4
popf
pop rax
jmp 0x1400c7209
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x91be233d
pushf
not edx
add edx, 0x87da7b21
xor edx, 0xee632e46
rol edx, 0x9d
popf
pushf
not edx
add edx, 0xa5006aa2
xor edx, 0x92fe1e8f
rol edx, 0xd0
popf
pushf
not edx
add edx, 0xf57bc053
xor edx, 0xdf22a3f4
rol edx, 0xe4
popf
pushf
not edx
add edx, 0xe34b6fe6
xor edx, 0xd79284a0
rol edx, 0xf9
popf
mov dword [rsp + 0x20], 3
jmp 0x1400c7133
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400c7175
push rax
pushf
mov eax, 0x4533bc92
pushf
not eax
add eax, 0xd29a7cff
xor eax, 0xa29518f0
rol eax, 0x93
popf
pushf
not eax
add eax, 0x83e04d4e
xor eax, 0xbefecdad
rol eax, 0x5f
popf
jmp 0x1400c705a
push rax
pushf
mov eax, 0x5bf84cab
pushf
not eax
add eax, 0x928d779c
xor eax, 0x9c950153
rol eax, 0xfa
popf
pushf
not eax
add eax, 0x9c241e05
xor eax, 0xe0e29227
rol eax, 0x80
popf
pushf
not eax
add eax, 0xe92390fa
xor eax, 0xff850188
rol eax, 0xc7
popf
jmp 0x1400c705a
xor eax, eax
add rsp, 0x40
pop rdi
ret
mov qword [rsp + 0x50], rbx
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x58], rsi
jmp 0x1400c7219
call qword [sym.imp.KERNEL32.dll_GetFileSize]
xor ecx, ecx
movsxd rbx, eax
mov rdx, rbx
mov r8d, 0xc828a1d3
pushf
not r8d
add r8d, 0xcc797ed4
xor r8d, 0xd173e1a7
rol r8d, 0x18
popf
pushf
not r8d
add r8d, 0x85e197a7
xor r8d, 0xe543238e
rol r8d, 0x21
popf
pushf
not r8d
add r8d, 0xd378636c
xor r8d, 0xa1a71d4f
rol r8d, 0x24
popf
pushf
not r8d
add r8d, 0x9b479f5d
xor r8d, 0xc36cb08d
rol r8d, 0x18
popf
lea r9d, [rcx + 4]
jmp 0x1400c7296
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor r9d, r9d
mov qword [rsp + 0x20], 0
mov rdx, rax
mov r8d, ebx
mov rcx, rdi
mov rsi, rax
jmp 0x1400c72b5
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rbx, qword [rsp + 0x50]
test eax, eax
je 0x1400c73cc
cmp dword [rsi], 0x905a4d
jne 0x1400c7315
push rax
pushf
mov eax, 0xa40fe819
pushf
not eax
add eax, 0xbaa2f26c
xor eax, 0xdeb0f52b
rol eax, 0x2e
popf
pushf
not eax
add eax, 0xdbb77d55
xor eax, 0x9a2d01dd
rol eax, 0xec
popf
pushf
not eax
add eax, 0xda01f888
xor eax, 0x9958e46a
rol eax, 1
popf
jmp 0x1400c705a
push rax
pushf
mov eax, 0x8ea41dfa
pushf
not eax
add eax, 0xa27ed0b8
xor eax, 0x89b36828
rol eax, 0x9c
popf
pushf
not eax
add eax, 0x856dc04e
xor eax, 0x9e773b8e
rol eax, 0xe9
popf
pushf
not eax
add eax, 0xcf618f06
xor eax, 0x8e4ee998
rol eax, 0xb8
popf
pushf
not eax
add eax, 0x8aebd368
xor eax, 0x880a7183
rol eax, 0x9e
popf
jmp 0x1400c705a
mov rcx, rdi
jmp 0x1400c7372
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rsi
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov rcx, rdi
jmp 0x1400c73d0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0xa4dbf522
pushf
not r8d
add r8d, 0xb26a8636
xor r8d, 0xef02fbab
rol r8d, 0xea
popf
pushf
not r8d
add r8d, 0xdf055c58
xor r8d, 0xad5a79cd
rol r8d, 0xa7
popf
mov rcx, rsi
jmp 0x1400c7414
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rsi, qword [rsp + 0x58]
xor eax, eax
add rsp, 0x40
pop rdi
ret