Function at 0x6c0b20
Capabilities:
Get file size

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
add rsp, 0xffffffffffffff80
mov ebx, dword [rcx + 0x168]
mov edi, ebx
and edi, 3
mov rsi, rcx
test ebx, 0x20000000
je 0x6c0d50
mov dword [rsp + 0x60], ebx
mov qword [rsp + 0x78], 0
cmp edi, 1
je 0x6c0dc0
test bl, 8
jne 0x6c0b80
xor ecx, ecx
call sub.msvcrt.dll__umask
mov ecx, eax
mov ebp, eax
call sub.msvcrt.dll__umask
cmp edi, 3
je 0x6c0bde
jmp 0x6c0dec
xor ecx, ecx
and ebx, 0xfffffff4
call sub.msvcrt.dll__umask
or ebx, 2
mov ecx, eax
mov ebp, eax
call sub.msvcrt.dll__umask
mov edx, 0x12019f
mov eax, ebx
and eax, 0x10000000
cmp eax, 1
mov eax, ebx
sbb r8d, r8d
and eax, 0x700
and r8d, 7
cmp eax, 0x300
je 0x6c0e30
jg 0x6c0c00
cmp eax, 0x100
je 0x6c0da0
cmp eax, 0x200
je 0x6c0d90
test eax, eax
je 0x6c0db0
mov qword [rsi + 0x88], 0xfffffffffffff019
mov dword [rsi + 0x14c], 0x57
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp eax, 0x500
je 0x6c0c1f
jle 0x6c0d30
cmp eax, 0x600
je 0x6c0d90
cmp eax, 0x700
jne 0x6c0bde
mov r9d, 1
mov eax, pe_nt_image_headers64
test bh, 1
je 0x6c0c45
not ebp
and ebp, dword [rsi + 0x158]
xor eax, eax
and ebp, 0x80
sete al
sub eax, 0xffffff80
test bl, 0x40
je 0x6c0c55
or eax, 0x4000100
or edx, 0x10000
mov ecx, eax
or ch, 1
test bh, 0x10
cmovne eax, ecx
mov ecx, ebx
and ecx, 0x30
cmp ecx, 0x10
je 0x6c0e10
cmp ecx, 0x20
je 0x6c0e00
test ecx, ecx
jne 0x6c0bde
test ebx, 0x2000000
je 0x6c0c9d
test dl, 4
je 0x6c0c98
test dl, 2
je 0x6c0bde
and edx, 0xfffffffb
or eax, 0x20000000
mov ecx, ebx
and ecx, 0xc000000
cmp ecx, 0x4000000
je 0x6c0e20
cmp ecx, 0x8000000
je 0x6c0e20
test ecx, ecx
jne 0x6c0bde
or eax, 0x2000000
mov dword [rsp + 0x20], r9d
mov rcx, qword [rsi + 0x150]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], eax
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x6c1040
mov edx, ebx
mov rcx, rax
call qword [sym.imp.msvcrt.dll__open_osfhandle]
mov edi, eax
test eax, eax
js 0x6c0f90
and ebx, 0x20000000
jne 0x6c0e40
movsxd rdi, edi
mov qword [rsi + 0x88], rdi
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r9d, 3
cmp eax, 0x400
je 0x6c0c25
jmp 0x6c0bde
xor ecx, ecx
call sub.msvcrt.dll__umask
mov ecx, eax
mov ebp, eax
call sub.msvcrt.dll__umask
cmp edi, 3
je 0x6c0bde
lea rax, [0x00af2af0]
mov edx, dword [rax + rdi*4]
test bl, 8
je 0x6c0b9b
and edx, 0xfffffffd
or edx, 4
jmp 0x6c0b9b
mov r9d, 5
jmp 0x6c0c25
mov r9d, 4
jmp 0x6c0c25
mov r9d, 3
jmp 0x6c0c25
mov edx, ebx
mov eax, ebx
and edx, 0xfffffffc
and eax, 8
or edx, 2
mov ebx, edx
test eax, eax
jne 0x6c0b80
xor ecx, ecx
mov edi, 2
call sub.msvcrt.dll__umask
mov ecx, eax
mov ebp, eax
call sub.msvcrt.dll__umask
lea rax, [0x00af2af0]
mov edx, dword [rax + rdi*4]
jmp 0x6c0b9b
or eax, 0x8000000
jmp 0x6c0c7f
or eax, 0x10000000
jmp 0x6c0c7f
or eax, 0x80000000
jmp 0x6c0cc5
mov r9d, 2
jmp 0x6c0c25
mov r9d, 0x18
lea r8, [rsp + 0x40]
mov edx, 1
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetFileInformationByHandleEx]
test eax, eax
je 0x6c1004
movzx eax, byte [rsp + 0x55]
mov byte [rsp + 0x64], al
test al, al
je 0x6c1090
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x68], 0xffffffffffffffff
movzx ebx, dil
lea rcx, [0x00de2100]
lea rbp, [0x00b59100]
call sub.KERNEL32.DLL_EnterCriticalSection
mov rax, rbx
shl rax, 4
add rax, rbp
mov r10, qword [rax]
test r10, r10
mov r12, r10
setne r11b
and r12d, 0xf
jne 0x6c10f0
test r11b, r11b
je 0x6c10f0
mov r9, qword [rax + 8]
mov r12d, 0x10
lea rdx, [r9 + 0x28]
mov eax, 1
cmp edi, dword [r9]
jne 0x6c0ef7
jmp 0x6c0f68
mov ecx, dword [rdx]
lea r8, [rax + 1]
add rdx, 0x28
cmp edi, ecx
je 0x6c1080
mov rax, r8
cmp r12, rax
ja 0x6c0ee2
mov rcx, qword [r9 + 0x280]
test rcx, rcx
je 0x6c0f35
nop dword [rax + rax]
mov rdx, rcx
xor eax, eax
cmp edi, dword [rdx]
je 0x6c1022
add eax, 1
add rdx, 0x28
cmp eax, 0x10
jne 0x6c0f15
mov rcx, qword [rcx + 0x280]
test rcx, rcx
jne 0x6c0f10
mov r12d, r10d
and r12d, 0xf
jne 0x6c0f47
test r11b, r11b
jne 0x6c1138
shl rbx, 4
mov eax, r12d
add r10, 1
add rbp, rbx
lea r9, [rax + rax*4]
mov rax, qword [rbp + 8]
mov qword [rbp], r10
lea r9, [rax + r9*8]
mov dword [r9], edi
movdqa xmm0, xmmword [rsp + 0x60]
movdqa xmm1, xmmword [rsp + 0x70]
lea rcx, [0x00de2100]
movups xmmword [r9 + 8], xmm0
movups xmmword [r9 + 0x18], xmm1
call sub.KERNEL32.DLL_LeaveCriticalSection
jmp 0x6c0d1a
call qword [sym.imp.msvcrt.dll__errno]
cmp dword [rax], 0x18
jne 0x6c10c0
mov qword [rsi + 0x88], 0xfffffffffffff01e
mov dword [rsi + 0x14c], 4
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x6c0bf3
mov eax, dword [rsp + 0x60]
mov edx, dword [rsp + 0x70]
mov rcx, rbp
mov qword [rsp + 0x28], 0
mov r9d, dword [rsp + 0x74]
and eax, 3
mov dword [rsp + 0x20], edx
cmp eax, 1
sbb eax, eax
xor edx, edx
and eax, 0xfffffffe
lea r8d, [rax + 4]
call qword [sym.imp.KERNEL32.DLL_CreateFileMappingA]
mov qword [rsp + 0x68], rax
test rax, rax
jne 0x6c0e84
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [rsi + 0x14c], eax
mov ecx, eax
call fcn.006bf1f0
cdqe
mov qword [rsi + 0x88], rax
jmp 0x6c0fb4
lea rax, [rax + rax*4]
lea r9, [rcx + rax*8]
test r9, r9
jne 0x6c0f68
jmp 0x6c0f35
mov rdi, qword [sym.imp.KERNEL32.DLL_GetLastError]
call rdi
cmp eax, 0x50
jne 0x6c1060
and ebx, 0x500
cmp ebx, 0x100
je 0x6c110a
call rdi
mov dword [rsi + 0x14c], eax
mov ecx, eax
call fcn.006bf1f0
cdqe
mov qword [rsi + 0x88], rax
jmp 0x6c0bf3
lea rax, [rax + rax*4]
lea r9, [r9 + rax*8]
jmp 0x6c102a
lea rdx, [rsp + 0x70]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetFileSizeEx]
test eax, eax
je 0x6c1004
cmp qword [rsp + 0x70], 0
jne 0x6c0fc2
mov qword [rsp + 0x68], 0xffffffffffffffff
jmp 0x6c0e84
mov rbx, qword [sym.imp.KERNEL32.DLL_GetLastError]
call rbx
test eax, eax
je 0x6c1124
call rbx
mov dword [rsi + 0x14c], eax
mov ecx, eax
call fcn.006bf1f0
cdqe
mov qword [rsi + 0x88], rax
jmp 0x6c0fb4
mov rax, rbx
shl rax, 4
mov r9, qword [rbp + rax + 8]
test r12, r12
jne 0x6c0ecf
jmp 0x6c0efc
mov qword [rsi + 0x88], 0xfffffffffffff01c
mov dword [rsi + 0x14c], 0x50
jmp 0x6c0bf3
mov dword [rsi + 0x14c], 0xfffff002
mov ecx, 0xfffff002
jmp 0x6c1012
mov ecx, 0x288
call fcn.006ba730
test rax, rax
je 0x6c1168
mov rdx, rbx
shl rdx, 4
add rdx, rbp
mov rcx, qword [rdx + 8]
mov r10, qword [rdx]
mov qword [rax + 0x280], rcx
mov qword [rdx + 8], rax
jmp 0x6c0f47
lea rdx, [0x00af28ae]
mov ecx, 0xe
call fcn.006bf130
nop
nop word [rax + rax]