Function at 0x1400c7c37
Capabilities:
Get file size

Disassembly:
push rax
pushf
mov eax, 0x3ad1d016
pushf
not eax
add eax, 0xb4e15049
xor eax, 0xe36b55e6
rol eax, 0x3a
popf
pushf
not eax
add eax, 0xf1b8591b
xor eax, 0x9f52c5c3
rol eax, 0x84
popf
cmp eax, 4
jne 0x1400c7c74
popf
pop rax
jmp 0x1400c7f3f
cmp eax, 0
jne 0x1400c7c83
popf
pop rax
jmp 0x1400c7cbf
cmp eax, 3
jne 0x1400c7c92
popf
pop rax
jmp 0x1400c7ebe
cmp eax, 1
jne 0x1400c7ca1
popf
pop rax
jmp 0x1400c7dc4
cmp eax, 5
jne 0x1400c7cb0
popf
pop rax
jmp 0x1400c7f8a
cmp eax, 2
jne 0x1400c7cbf
popf
pop rax
jmp 0x1400c7dff
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x5c2b65d2
pushf
not edx
add edx, 0x9ae8165f
xor edx, 0xf54bc318
rol edx, 0x86
popf
pushf
not edx
add edx, 0xd86a60f5
xor edx, 0xfbc1ce8f
rol edx, 0xce
popf
pushf
not edx
add edx, 0xea494b45
xor edx, 0xbef602f1
rol edx, 0x46
popf
mov dword [rsp + 0x20], 3
jmp 0x1400c7d29
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400c7d7e
push rax
pushf
mov eax, 0xf04874d4
pushf
not eax
add eax, 0xb52f347d
xor eax, 0xcfbfcccd
rol eax, 0xbf
popf
pushf
not eax
add eax, 0xaf52ad83
xor eax, 0xf702edd7
rol eax, 0xc3
popf
pushf
not eax
add eax, 0xb81edcd8
xor eax, 0xe2e5ec99
rol eax, 0x83
popf
jmp 0x1400c7c65
push rax
pushf
mov eax, 0x63f2f893
pushf
not eax
add eax, 0x98fd436e
xor eax, 0x9bc6bbdf
rol eax, 0xbe
popf
pushf
not eax
add eax, 0xcca97331
xor eax, 0x8e3d6930
rol eax, 0xca
popf
pushf
not eax
add eax, 0xd5f859fe
xor eax, 0xa878da40
rol eax, 0x60
popf
jmp 0x1400c7c65
xor eax, eax
add rsp, 0x40
pop rdi
ret
mov qword [rsp + 0x50], rbx
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x58], rsi
jmp 0x1400c7e0f
call qword [sym.imp.KERNEL32.dll_GetFileSize]
xor ecx, ecx
movsxd rbx, eax
mov rdx, rbx
mov r8d, 0x45822842
pushf
not r8d
add r8d, 0xb504c3d0
xor r8d, 0x97d72379
rol r8d, 0x47
popf
pushf
not r8d
add r8d, 0xb843c1e8
xor r8d, 0xfa09427d
rol r8d, 0x59
popf
pushf
not r8d
add r8d, 0xf88a55aa
xor r8d, 0xf9d0a22c
rol r8d, 0x25
popf
pushf
not r8d
add r8d, 0xe595128e
xor r8d, 0x9c199ce7
rol r8d, 0xa6
popf
lea r9d, [rcx + 4]
jmp 0x1400c7e8c
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor r9d, r9d
mov qword [rsp + 0x20], 0
mov rdx, rax
mov r8d, ebx
mov rcx, rdi
mov rsi, rax
jmp 0x1400c7eab
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rbx, qword [rsp + 0x50]
test eax, eax
je 0x1400c7f8a
cmp dword [rsi], 0x905a4d
jne 0x1400c7ef9
push rax
pushf
mov eax, 0x2b048f1d
pushf
not eax
add eax, 0x959868cb
xor eax, 0xc6a37b2e
rol eax, 0x60
popf
pushf
not eax
add eax, 0x9f342790
xor eax, 0xf303870c
rol eax, 0x39
popf
jmp 0x1400c7c65
push rax
pushf
mov eax, 0x341fb38c
pushf
not eax
add eax, 0xb0163c6b
xor eax, 0xa23f0a79
rol eax, 0xbd
popf
pushf
not eax
add eax, 0xb6988331
xor eax, 0xd1814027
rol eax, 0x41
popf
pushf
not eax
add eax, 0x8e4c6040
xor eax, 0xb2903a49
rol eax, 0x47
popf
jmp 0x1400c7c65
mov rcx, rdi
jmp 0x1400c7f43
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rsi
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov rcx, rdi
jmp 0x1400c7f8e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0xcb89b29e
pushf
not r8d
add r8d, 0xb6c10aba
xor r8d, 0xfd13a6f9
rol r8d, 0xd3
popf
pushf
not r8d
add r8d, 0xb52c4eda
xor r8d, 0x9008f1d0
rol r8d, 0x7f
popf
pushf
not r8d
add r8d, 0xb64951ce
xor r8d, 0x9b3f9b9c
rol r8d, 0x55
popf
mov rcx, rsi
jmp 0x1400c7feb
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rsi, qword [rsp + 0x58]
xor eax, eax
add rsp, 0x40
pop rdi
ret