Function at 0x6a1800
Capabilities:
Get file size

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
add rsp, 0xffffffffffffff80
mov ebx, dword [rcx + 0x168]
mov edi, ebx
and edi, 3
mov rsi, rcx
test ebx, 0x20000000
je 0x6a1a30
mov dword [rsp + 0x60], ebx
mov qword [rsp + 0x78], 0
cmp edi, 1
je 0x6a1aa0
test bl, 8
jne 0x6a1860
xor ecx, ecx
call sub.msvcrt.dll__umask
mov ecx, eax
mov ebp, eax
call sub.msvcrt.dll__umask
cmp edi, 3
je 0x6a18be
jmp 0x6a1acc
xor ecx, ecx
and ebx, 0xfffffff4
call sub.msvcrt.dll__umask
or ebx, 2
mov ecx, eax
mov ebp, eax
call sub.msvcrt.dll__umask
mov edx, 0x12019f
mov eax, ebx
and eax, 0x10000000
cmp eax, 1
mov eax, ebx
sbb r8d, r8d
and eax, 0x700
and r8d, 7
cmp eax, 0x300
je 0x6a1b10
jg 0x6a18e0
cmp eax, 0x100
je 0x6a1a80
cmp eax, 0x200
je 0x6a1a70
test eax, eax
je 0x6a1a90
mov qword [rsi + 0x88], 0xfffffffffffff019
mov dword [rsi + 0x14c], 0x57
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp eax, 0x500
je 0x6a18ff
jle 0x6a1a10
cmp eax, 0x600
je 0x6a1a70
cmp eax, 0x700
jne 0x6a18be
mov r9d, 1
mov eax, pe_nt_image_headers64
test bh, 1
je 0x6a1925
not ebp
and ebp, dword [rsi + 0x158]
xor eax, eax
and ebp, 0x80
sete al
sub eax, 0xffffff80
test bl, 0x40
je 0x6a1935
or eax, 0x4000100
or edx, 0x10000
mov ecx, eax
or ch, 1
test bh, 0x10
cmovne eax, ecx
mov ecx, ebx
and ecx, 0x30
cmp ecx, 0x10
je 0x6a1af0
cmp ecx, 0x20
je 0x6a1ae0
test ecx, ecx
jne 0x6a18be
test ebx, 0x2000000
je 0x6a197d
test dl, 4
je 0x6a1978
test dl, 2
je 0x6a18be
and edx, 0xfffffffb
or eax, 0x20000000
mov ecx, ebx
and ecx, 0xc000000
cmp ecx, 0x4000000
je 0x6a1b00
cmp ecx, 0x8000000
je 0x6a1b00
test ecx, ecx
jne 0x6a18be
or eax, 0x2000000
mov dword [rsp + 0x20], r9d
mov rcx, qword [rsi + 0x150]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], eax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x6a1d20
mov edx, ebx
mov rcx, rax
call qword [sym.imp.msvcrt.dll__open_osfhandle]
mov edi, eax
test eax, eax
js 0x6a1c70
and ebx, 0x20000000
jne 0x6a1b20
movsxd rdi, edi
mov qword [rsi + 0x88], rdi
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r9d, 3
cmp eax, 0x400
je 0x6a1905
jmp 0x6a18be
xor ecx, ecx
call sub.msvcrt.dll__umask
mov ecx, eax
mov ebp, eax
call sub.msvcrt.dll__umask
cmp edi, 3
je 0x6a18be
lea rax, [0x0090d890]
mov edx, dword [rax + rdi*4]
test bl, 8
je 0x6a187b
and edx, 0xfffffffd
or edx, 4
jmp 0x6a187b
mov r9d, 5
jmp 0x6a1905
mov r9d, 4
jmp 0x6a1905
mov r9d, 3
jmp 0x6a1905
mov edx, ebx
mov eax, ebx
and edx, 0xfffffffc
and eax, 8
or edx, 2
mov ebx, edx
test eax, eax
jne 0x6a1860
xor ecx, ecx
mov edi, 2
call sub.msvcrt.dll__umask
mov ecx, eax
mov ebp, eax
call sub.msvcrt.dll__umask
lea rax, [0x0090d890]
mov edx, dword [rax + rdi*4]
jmp 0x6a187b
or eax, 0x8000000
jmp 0x6a195f
or eax, 0x10000000
jmp 0x6a195f
or eax, 0x80000000
jmp 0x6a19a5
mov r9d, 2
jmp 0x6a1905
mov r9d, 0x18
lea r8, [rsp + 0x40]
mov edx, 1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandleEx]
test eax, eax
je 0x6a1ce4
movzx eax, byte [rsp + 0x55]
mov byte [rsp + 0x64], al
test al, al
je 0x6a1d70
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x68], 0xffffffffffffffff
movzx ebx, dil
lea rcx, [0x00c2c540]
lea rbp, [0x009a3540]
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, rbx
shl rax, 4
add rax, rbp
mov r10, qword [rax]
test r10, r10
mov r12, r10
setne r11b
and r12d, 0xf
jne 0x6a1dd0
test r11b, r11b
je 0x6a1dd0
mov r9, qword [rax + 8]
mov r12d, 0x10
lea rdx, [r9 + 0x28]
mov eax, 1
cmp edi, dword [r9]
jne 0x6a1bd7
jmp 0x6a1c48
mov ecx, dword [rdx]
lea r8, [rax + 1]
add rdx, 0x28
cmp edi, ecx
je 0x6a1d60
mov rax, r8
cmp r12, rax
ja 0x6a1bc2
mov rcx, qword [r9 + 0x280]
test rcx, rcx
je 0x6a1c15
nop dword [rax + rax]
mov rdx, rcx
xor eax, eax
cmp edi, dword [rdx]
je 0x6a1d02
add eax, 1
add rdx, 0x28
cmp eax, 0x10
jne 0x6a1bf5
mov rcx, qword [rcx + 0x280]
test rcx, rcx
jne 0x6a1bf0
mov r12d, r10d
and r12d, 0xf
jne 0x6a1c27
test r11b, r11b
jne 0x6a1e18
shl rbx, 4
mov eax, r12d
add r10, 1
add rbp, rbx
lea r9, [rax + rax*4]
mov rax, qword [rbp + 8]
mov qword [rbp], r10
lea r9, [rax + r9*8]
mov dword [r9], edi
movdqa xmm0, xmmword [rsp + 0x60]
movdqa xmm1, xmmword [rsp + 0x70]
lea rcx, [0x00c2c540]
movups xmmword [r9 + 8], xmm0
movups xmmword [r9 + 0x18], xmm1
call sub.KERNEL32.dll_LeaveCriticalSection
jmp 0x6a19fa
call qword [sym.imp.msvcrt.dll__errno]
cmp dword [rax], 0x18
jne 0x6a1da0
mov qword [rsi + 0x88], 0xfffffffffffff01e
mov dword [rsi + 0x14c], 4
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x6a18d3
mov eax, dword [rsp + 0x60]
mov edx, dword [rsp + 0x70]
mov rcx, rbp
mov qword [rsp + 0x28], 0
mov r9d, dword [rsp + 0x74]
and eax, 3
mov dword [rsp + 0x20], edx
cmp eax, 1
sbb eax, eax
xor edx, edx
and eax, 0xfffffffe
lea r8d, [rax + 4]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov qword [rsp + 0x68], rax
test rax, rax
jne 0x6a1b64
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi + 0x14c], eax
mov ecx, eax
call fcn.0069fed0
cdqe
mov qword [rsi + 0x88], rax
jmp 0x6a1c94
lea rax, [rax + rax*4]
lea r9, [rcx + rax*8]
test r9, r9
jne 0x6a1c48
jmp 0x6a1c15
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rdi
cmp eax, 0x50
jne 0x6a1d40
and ebx, 0x500
cmp ebx, 0x100
je 0x6a1dea
call rdi
mov dword [rsi + 0x14c], eax
mov ecx, eax
call fcn.0069fed0
cdqe
mov qword [rsi + 0x88], rax
jmp 0x6a18d3
lea rax, [rax + rax*4]
lea r9, [r9 + rax*8]
jmp 0x6a1d0a
lea rdx, [rsp + 0x70]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x6a1ce4
cmp qword [rsp + 0x70], 0
jne 0x6a1ca2
mov qword [rsp + 0x68], 0xffffffffffffffff
jmp 0x6a1b64
mov rbx, qword [sym.imp.KERNEL32.dll_GetLastError]
call rbx
test eax, eax
je 0x6a1e04
call rbx
mov dword [rsi + 0x14c], eax
mov ecx, eax
call fcn.0069fed0
cdqe
mov qword [rsi + 0x88], rax
jmp 0x6a1c94
mov rax, rbx
shl rax, 4
mov r9, qword [rbp + rax + 8]
test r12, r12
jne 0x6a1baf
jmp 0x6a1bdc
mov qword [rsi + 0x88], 0xfffffffffffff01c
mov dword [rsi + 0x14c], 0x50
jmp 0x6a18d3
mov dword [rsi + 0x14c], 0xfffff002
mov ecx, 0xfffff002
jmp 0x6a1cf2
mov ecx, 0x288
call fcn.0069b410
test rax, rax
je 0x6a1e48
mov rdx, rbx
shl rdx, 4
add rdx, rbp
mov rcx, qword [rdx + 8]
mov r10, qword [rdx]
mov qword [rax + 0x280], rcx
mov qword [rdx + 8], rax
jmp 0x6a1c27
lea rdx, [0x0090d64e]
mov ecx, 0xe
call fcn.0069fe10
nop
nop word [rax + rax]