Function at 0x14000ab6b
Capabilities:
Get file size

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x9d8
lea rax, [0x14008a833]
mov rbp, qword [0x14011d030]
mov ebx, dword [0x1400cf22c]
mov esi, dword [rsp + 0xa40]
mov r14d, esi
mov qword [rsp + 0x70], rax
lea rax, [0x14008a837]
mov r12d, edx
lea rdi, [rsp + 0x8c]
mov qword [rsp + 0x78], rax
lea rax, [0x14008a83b]
mov edx, 0x147
mov qword [rsp + 0x80], rax
mov eax, dword [0x1400cf230]
mov qword [rsp + 0xa20], rcx
mov ecx, 5
mov dword [rsp + 0x48], eax
xor eax, eax
rep stosd dword [rdi], eax
mov ecx, 0x24c
lea rdi, [rsp + 0xa0]
mov dword [rsp + 0xa30], r8d
rep stosd dword [rdi], eax
mov rdi, qword [0x1400b6630]
xor r8d, r8d
mov dword [rsp + 0xa38], r9d
mov dword [rsp + 0x88], 2
xor r9d, r9d
mov rcx, qword [rdi]
call rbp
xor r9d, r9d
mov rcx, qword [rdi]
mov edx, 0x150
movsxd r8, eax
call rbp
xor r8d, r8d
mov r9d, 0xca6
mov edx, 1
mov rbp, rax
movsxd rax, r12d
mov ecx, 1
mov rax, qword [rsp + rax*8 + 0x70]
mov qword [rsp + 0x20], rax
call fcn.14001ea8e
test rbp, rbp
jne 0x14000ac65
mov ebp, 0x200
cmp r12d, 2
je 0x14000b715
test esi, 4
je 0x14000acac
mov rax, qword [0x1400b66e0]
mov r8d, 0xa
mov edx, 0x1f6
lea r9, str.uefi_ntfs.img
mov rcx, qword [rax]
call fcn.140037311
lea rcx, str.Could_not_access_embedded_uefi_ntfs.img
mov r13d, eax
test r13, r13
jne 0x14000acaf
jmp 0x14000b53f
xor r13d, r13d
mov eax, dword [rsp + 0x48]
lea r15, [0x1400cf248]
xorps xmm0, xmm0
mov ecx, 0x160
mov rdi, r15
movups xmmword [0x1400cf210], xmm0
imul rbx, rax
xor eax, eax
rep stosd dword [rdi], eax
cmp r12d, 1
jne 0x14000ace1
mov ecx, 0x100000
jmp 0x14000ad0d
mov rax, qword [0x1400b66d0]
mov edx, 0x3fc
mov rcx, qword [rax]
call qword [0x14011cf60]
dec eax
jne 0x14000acda
lea rcx, [rbp + rbx - 1]
mov rax, rcx
cqo
idiv rbp
sub rcx, rdx
add rcx, rcx
cmp dword [0x1400cf238], 0xc
mov qword [0x1400cf290], rcx
je 0x14000ad31
mov rax, qword [0x1400b5fc0]
cmp dword [rax + 0xc], 0x3a98
jbe 0x14000ade8
test esi, 2
je 0x14000ade8
mov r8d, 0x907
cmp r12d, 1
jne 0x14000b34b
lea rdx, [0x14008a7d6]
mov rcx, r15
xor edi, edi
mov dword [0x1400cf214], edi
call fcn.140079860
mov rax, qword [0x1400cf290]
xor edx, edx
mov r8d, dword [0x1400cf230]
mov qword [0x1400cf298], 0x10400000
lea rcx, [rax + rbx + 0x103fffff]
lea r9, [rax + 0x10400000]
mov rax, rcx
div rbx
mov rax, rbp
sub rcx, rdx
cqo
idiv r8
mov qword [0x1400cf2e8], rcx
test rdx, rdx
jne 0x14000adbd
mov rax, rcx
xor edx, edx
div rbp
sub rcx, rdx
mov qword [0x1400cf2e8], rcx
mov r14d, esi
mov edi, 1
and r14d, 0xfffffffd
cmp rcx, r9
jae 0x14000adea
mov r8d, 0x910
lea rdx, str.drive.c
lea rcx, str.SelectedDrive.Partition_pi__1_.Offset___SelectedDrive.Partition_pi_.Offset__SelectedDrive.Partition_pi_.Size
call qword [sym.imp.msvcrt.dll_memmove]
xor edi, edi
test r14d, 1
je 0x14000aea6
mov r8d, 0x918
cmp r12d, 1
jne 0x14000b34b
mov r15d, edi
lea rsi, [0x1400cf220]
lea rdx, str.Microsoft_Reserved_Partition
inc edi
mov rax, r15
neg rax
and eax, 0x58
lea rcx, [rsi + rax + 0x28]
call fcn.140079860
imul rax, r15, 0x58
xor edx, edx
mov r9d, dword [0x1400cf230]
add rax, rsi
mov qword [rax + 0x78], 0x8000000
mov rax, qword [rax + 0x70]
lea rcx, [rbx + rax + 0x7ffffff]
mov rax, rcx
div rbx
mov eax, edi
imul rax, rax, 0x58
lea r8, [rsi + rax]
mov rax, rbp
sub rcx, rdx
cqo
idiv r9
mov qword [r8 + 0x70], rcx
test rdx, rdx
jne 0x14000ae84
mov rax, rcx
xor edx, edx
div rbp
sub rcx, rdx
mov qword [r8 + 0x70], rcx
imul rdx, r15, 0x58
and r14d, 0xfffffffe
mov r8d, 0x91f
mov rax, qword [rsi + rdx + 0x70]
add rax, 0x8000000
cmp rcx, rax
jb 0x14000add4
mov rax, qword [0x1400b6c20]
mov dword [0x1400cf210], edi
lea esi, [rdi + 1]
lea rdx, str.Main_Data_Partition
cmp dword [rax], 0
je 0x14000aec9
lea rdx, [0x14008a7d6]
mov eax, edi
lea r15, [0x1400cf220]
imul rax, rax, 0x58
lea rax, [r15 + rax + 0x28]
mov rcx, rax
mov qword [rsp + 0x50], rax
call fcn.140079860
test r14b, r14b
je 0x14000b012
test r14d, 0x10
je 0x14000af54
cmp qword [0x1400cf200], 0
mov r8d, 0x92e
lea rdx, str.drive.c
lea rcx, str.persistence_size___0
je 0x14000ade2
mov dword [0x1400cf218], esi
imul rsi, rsi, 0x58
lea rdx, str.Linux_Persistence
lea rcx, [r15 + rsi + 0x28]
call fcn.140079860
mov rax, qword [0x1400cf200]
xor edx, edx
lea rax, [rbx + rax - 1]
div rbx
imul rax, rbx
mov qword [r15 + rsi + 0x78], rax
lea esi, [rdi + 2]
test r14d, 2
je 0x14000af99
mov r13d, esi
lea r15, [0x1400cf220]
lea rdx, [0x14008a7d6]
mov dword [0x1400cf214], esi
imul r13, r13, 0x58
lea rcx, [r15 + r13 + 0x28]
call fcn.140079860
lea rax, [rbx + 0x103fffff]
cqo
idiv rbx
imul rax, rbx
mov qword [r15 + r13 + 0x78], rax
jmp 0x14000b010
test r14d, 4
je 0x14000afe3
mov r8d, esi
lea r9, [0x1400cf220]
lea rdx, [0x14008aa30]
mov dword [0x1400cf21c], esi
imul r15, r8, 0x58
lea rcx, [r9 + r15 + 0x28]
call fcn.140079860
lea rax, [r13 + rbx - 1]
xor edx, edx
lea r9, [0x1400cf220]
div rbx
imul rax, rbx
mov qword [r9 + r15 + 0x78], rax
jmp 0x14000b010
test r14d, 8
je 0x14000b012
mov r13d, esi
lea r15, [0x1400cf220]
lea rdx, str.BIOS_Compatibility
imul r13, r13, 0x58
lea rcx, [r15 + r13 + 0x28]
call fcn.140079860
mov qword [r15 + r13 + 0x78], rbx
inc esi
mov rax, qword [0x1400cf220]
cmp r12d, 1
jne 0x14000b02c
mov edx, dword [0x1400cf230]
imul rdx, rdx, 0x21
sub rax, rdx
lea edx, [rsi - 1]
lea r13, [0x1400cf220]
mov r8, rdx
imul rdx, rdx, 0x58
lea r9, [rdx + r13]
cmp edi, r8d
jae 0x14000b089
mov rdx, qword [r9 + 0x78]
sub r9, 0x58
cmp rdx, rax
jb 0x14000b06c
mov r8d, 0x949
lea rdx, str.drive.c
lea rcx, str.SelectedDrive.Partition_i_.Size___last_offset
jmp 0x14000ade2
sub rax, rdx
xor edx, edx
dec r8d
mov rcx, rax
div rbx
mov rax, rcx
sub rax, rdx
mov qword [r9 + 0xc8], rax
jmp 0x14000b041
mov edx, edi
lea r8, [0x1400cf220]
imul rdx, rdx, 0x58
add r8, rdx
mov rdx, qword [r8 + 0x70]
cmp rdx, rax
jb 0x14000b0bb
mov r8d, 0x94f
lea rdx, str.drive.c
lea rcx, str.last_offset___SelectedDrive.Partition_mi_.Offset
jmp 0x14000ade2
sub rax, rdx
xor edx, edx
mov r9d, dword [0x1400cf230]
mov rcx, rax
div rbx
mov rax, rbp
sub rcx, rdx
cqo
idiv r9
mov qword [r8 + 0x78], rcx
test rdx, rdx
jne 0x14000b0f0
mov rax, rcx
xor edx, edx
div rbp
sub rcx, rdx
mov qword [r8 + 0x78], rcx
test rcx, rcx
jne 0x14000b10d
mov rdx, qword [rsp + 0x50]
lea rcx, str.Error:_Invalid__S_size
call fcn.140038472
xor eax, eax
jmp 0x14000b71a
mov eax, dword [rsp + 0x48]
lea r15, [rsp + 0xa0]
xor ebp, ebp
shl eax, 7
mov dword [rsp + 0x50], eax
mov rcx, qword [r13 + 0x78]
xor r8d, r8d
mov edx, 1
call fcn.140038d8b
mov r9, qword [r13 + 0x70]
lea rdx, str.Partition
mov rbx, rax
lea rax, [r13 + 0x28]
mov rcx, rax
mov qword [rsp + 0x58], r9
mov qword [rsp + 0x48], rax
call fcn.140079880
mov qword [rsp + 0x20], rbx
mov r9, qword [rsp + 0x58]
lea r8, str._Partition
test rax, rax
lea rax, [0x140089da0]
mov rdx, qword [rsp + 0x48]
lea rcx, str._Creating__S_s__offset:__lld__size:__s_
cmovne r8, rax
call fcn.140038472
mov rcx, qword [r13 + 0x78]
mov eax, dword [rsp + 0x50]
mov edx, 1
cmp rax, rcx
cmovb ecx, dword [rsp + 0x50]
mov rax, qword [r13 + 0x70]
mov dword [rsp + 0x6c], ecx
mov ecx, ecx
mov qword [rsp + 0x58], rax
call sub.msvcrt.dll_vfprintf
mov rbx, rax
test rax, rax
je 0x14000b215
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0xa20]
call qword [0x14011c720]
test eax, eax
jne 0x14000b1df
mov rcx, rbx
call fcn.1400796c8
jmp 0x14000b215
mov dword [rsp + 0x20], 4
mov r8d, dword [rsp + 0x6c]
lea r9, [rsp + 0x6c]
mov rdx, rbx
mov rcx, qword [rsp + 0xa20]
call fcn.140039485
mov rcx, rbx
mov dword [rsp + 0x58], eax
call fcn.1400796c8
mov eax, dword [rsp + 0x58]
test eax, eax
jne 0x14000b22e
call fcn.14003893c
mov rdx, qword [rsp + 0x48]
lea rcx, str.Could_not_zero__S:__s
mov r8, rax
call fcn.140038472
mov rax, qword [r13 + 0x70]
lea ebx, [rbp + 1]
mov dword [r15 + 0x30], r12d
mov dword [r15 + 0x48], ebx
mov qword [r15 + 0x38], rax
mov rax, qword [r13 + 0x78]
mov byte [r15 + 0x4c], 1
mov qword [r15 + 0x40], rax
test r12d, r12d
jne 0x14000b33f
cmp edi, ebp
jne 0x14000b2c9
mov rax, qword [0x1400b6330]
cmp dword [rax], 0
setne byte [r15 + 0x51]
cmp dword [rsp + 0xa30], 5
jg 0x14000b299
cmp dword [rsp + 0xa30], 1
jg 0x14000b2b6
cmp dword [rsp + 0xa30], 0
je 0x14000b2af
cmp dword [rsp + 0xa30], 1
jne 0x14000b2bd
mov byte [r15 + 0x50], 0xc
jmp 0x14000b2c9
mov eax, dword [rsp + 0xa30]
sub eax, 6
cmp eax, 2
ja 0x14000b2bd
mov byte [r15 + 0x50], 0x83
jmp 0x14000b2c9
mov byte [r15 + 0x50], 0xe
jmp 0x14000b2c9
mov byte [r15 + 0x50], 7
jmp 0x14000b2c9
lea rcx, str.Unsupported_file_system
jmp 0x14000b53f
mov rcx, qword [rsp + 0x48]
lea rdx, [0x14008a7d6]
call fcn.140079858
test eax, eax
jne 0x14000b2e8
mov byte [r15 + 0x50], 0xef
jmp 0x14000b48d
mov rcx, qword [rsp + 0x48]
lea rdx, [0x14008aa30]
call fcn.140079858
test eax, eax
je 0x14000b2de
mov rcx, qword [rsp + 0x48]
lea rdx, str.Linux_Persistence
call fcn.140079858
test eax, eax
jne 0x14000b31c
mov byte [r15 + 0x50], 0x83
jmp 0x14000b48d
mov rcx, qword [rsp + 0x48]
lea rdx, str.BIOS_Compatibility
call fcn.140079858
test eax, eax
jne 0x14000b48d
mov byte [r15 + 0x50], 0xea
jmp 0x14000b48d
cmp r12d, 1
je 0x14000b35e
mov r8d, 0x992
lea rdx, str.drive.c
lea rcx, str.partition_style__PARTITION_STYLE_GPT
jmp 0x14000ade2
mov rcx, qword [rsp + 0x48]
lea rdx, [0x14008aa30]
call fcn.140079858
test eax, eax
jne 0x14000b3a9
movabs rax, 0xc79926b7b668c087
mov dword [r15 + 0x50], 0xebd0a0a2
mov qword [r15 + 0x58], rax
mov eax, 9
shl rax, 0x3c
mov word [r15 + 0x54], 0xb9e5
mov word [r15 + 0x56], 0x4433
mov qword [r15 + 0x70], rax
jmp 0x14000b475
mov rcx, qword [rsp + 0x48]
lea rdx, [0x14008a7d6]
call fcn.140079858
test eax, eax
jne 0x14000b3e3
mov dword [r15 + 0x50], 0xc12a7328
movabs rax, 0x3bc93ec9a0004bba
mov word [r15 + 0x54], 0xf81f
mov word [r15 + 0x56], 0x11d2
jmp 0x14000b471
mov rcx, qword [rsp + 0x48]
lea rdx, str.Linux_Persistence
call fcn.140079858
test eax, eax
jne 0x14000b41a
mov dword [r15 + 0x50], 0xfc63daf
movabs rax, 0xe47d47d8693d798e
mov word [r15 + 0x54], 0x8483
mov word [r15 + 0x56], 0x4772
jmp 0x14000b471
mov rcx, qword [rsp + 0x48]
lea rdx, str.Microsoft_Reserved_Partition
call fcn.140079858
test eax, eax
jne 0x14000b451
mov dword [r15 + 0x50], 0xe3c9e316
movabs rax, 0xae1502f02df97d81
mov word [r15 + 0x54], 0xb5c
mov word [r15 + 0x56], 0x4db8
jmp 0x14000b471
mov dword [r15 + 0x50], 0xebd0a0a2
movabs rax, 0xc79926b7b668c087
mov word [r15 + 0x54], 0xb9e5
mov word [r15 + 0x56], 0x4433
mov qword [r15 + 0x58], rax
lea rcx, [r15 + 0x60]
call qword [sym.imp.ole32.dll_CoCreateGuid]
mov rdx, qword [rsp + 0x48]
lea rcx, [r15 + 0x78]
call fcn.140079860
add r13, 0x58
add r15, 0x90
cmp ebx, esi
je 0x14000b4a3
mov ebp, ebx
jmp 0x14000b122
and r14d, 4
je 0x14000b57e
movsxd rax, dword [0x1400cf21c]
lea rbx, [0x1400cf220]
lea rcx, str.Writing_UEFI:NTFS_data...
imul rax, rax, 0x58
lea rdx, [rbx + rax + 0x28]
call fcn.140038472
movsxd rax, dword [0x1400cf21c]
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0xa20]
imul rax, rax, 0x58
mov rdx, qword [rbx + rax + 0x70]
call qword [0x14011c720]
lea rcx, str.__Could_not_set_position
test eax, eax
je 0x14000b53f
lea rax, [rsp + 0x6c]
xor ebx, ebx
mov edx, 0x1f6
mov r8d, 0xa
mov qword [rsp + 0x20], rax
mov rax, qword [0x1400b66e0]
lea r9, str.uefi_ntfs.img
mov dword [rsp + 0x28], ebx
mov rcx, qword [rax]
call fcn.1400371fc
mov rdx, rax
test rax, rax
jne 0x14000b549
lea rcx, str.__Could_not_access_source_image
call fcn.140038472
jmp 0x14000b106
mov dword [rsp + 0x20], 4
mov r8d, dword [rsp + 0x6c]
xor r9d, r9d
mov rcx, qword [rsp + 0xa20]
call fcn.140039485
test eax, eax
jne 0x14000b57e
call fcn.14003893c
lea rcx, str.__Write_error:__s
mov rdx, rax
jmp 0x14000b101
test r12d, r12d
jne 0x14000b5c4
xor r11d, r11d
cmp dword [rsp + 0xa38], 0
mov eax, 0x49464555
mov dword [rsp + 0x88], r11d
jne 0x14000b5a3
call qword [0x14011c5c0]
mov edi, 1
mov dword [rsp + 0x8c], eax
shl rdi, 0x22
mov dword [rsp + 0xa8], eax
mov qword [rsp + 0xa0], rdi
jmp 0x14000b63b
mov dword [rsp + 0x88], 1
lea rcx, [rsp + 0x8c]
call qword [sym.imp.ole32.dll_CoCreateGuid]
mov eax, dword [0x1400cf230]
mov rdx, qword [0x1400cf220]
mov dword [rsp + 0x9c], 0x10
movups xmm1, xmmword [rsp + 0x8c]
mov dword [rsp + 0xa0], 1
imul edi, eax, 0x22
mov dword [rsp + 0xa4], esi
imul eax, eax, 0x43
movups xmmword [rsp + 0xa8], xmm1
mov dword [rsp + 0xc8], 0x10
mov qword [rsp + 0xb8], rdi
sub rdx, rax
mov qword [rsp + 0xc0], rdx
xor r8d, r8d
xor r9d, r9d
xor r10d, r10d
mov rbx, qword [sym.imp.KERNEL32.DLL_GetFileSizeEx]
mov qword [rsp + 0x38], r8
mov rcx, qword [rsp + 0xa20]
mov edx, 0x7c058
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x88]
mov dword [rsp + 0x28], r9d
mov r9d, 0x18
mov qword [rsp + 0x20], r10
call rbx
test eax, eax
jne 0x14000b694
call fcn.14003893c
lea rcx, str.Could_not_reset_disk:__s
mov rdx, rax
jmp 0x14000b101
mov rcx, qword [rsp + 0xa20]
call fcn.14000a3ff
dec r12d
mov r9d, 0x930
jne 0x14000b6b6
imul esi, esi, 0x90
lea r9d, [rsi + 0x30]
xor eax, eax
xor edx, edx
lea r8, [rsp + 0xa0]
xor ecx, ecx
mov dword [rsp + 0x28], edx
mov edx, 0x7c054
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0xa20]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
call rbx
test eax, eax
jne 0x14000b6fe
call fcn.14003893c
lea rcx, str.Could_not_set_drive_layout:__s
mov rdx, rax
jmp 0x14000b101
mov rcx, qword [rsp + 0xa20]
call fcn.14000a3ff
test eax, eax
setne al
movzx eax, al
jmp 0x14000b71a
mov eax, 1
add rsp, 0x9d8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret