Function at 0x14015f630
Capabilities:
Get file size
Get file version info
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x188
lea rax, [rsp + 0x148]
lea rcx, str.dabbled_evaporator
mov rdi, rax
mov rsi, rcx
mov ecx, 0x13
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x160]
lea rcx, str.Liaises_barricades
mov rdi, rax
mov rsi, rcx
mov ecx, 0x13
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0xa0]
lea rcx, str.soak
mov rdi, rax
mov rsi, rcx
mov ecx, 5
rep movsb byte [rdi], byte [rsi]
movabs rax, 0x7b77d3289ba126
mov qword [rsp + 0x48], rax
movabs rax, 0x77431284bf464d
cmp qword [rsp + 0x48], rax
jle 0x14015fdf9
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x100], rax
movabs rax, 0x7b77d3289ba126
cmp qword [rsp + 0x100], rax
je 0x14015f6de
jmp 0x14015f71a
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
movzx ecx, al
mov eax, dword [rsp + 0x58]
shr eax, cl
mov ecx, dword [section..data]
mov edx, dword [rsp + 0x64]
shl edx, cl
mov ecx, edx
cmp eax, ecx
jbe 0x14015f718
mov r8, qword [rsp + 0x48]
mov edx, dword [rsp + 0x58]
mov cx, 0x1f
call fcn.14015ec30
nop
jmp 0x14015f734
movabs rax, 0x73d686c01a50ff
mov rcx, qword [rsp + 0x48]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov byte [rsp + 0x41], 0x82
movzx eax, byte [rsp + 0x41]
mov byte [rsp + 0xb8], al
cmp byte [rsp + 0xb8], 0x82
je 0x14015f751
jmp 0x14015f7b9
movzx eax, byte [rsp + 0x41]
mov byte [rsp + 0x50], al
mov byte [rsp + 0x40], 0x23
movabs rax, 0x7022d2127346f0
mov rcx, qword [rsp + 0x1a8]
or rcx, rax
mov rax, rcx
cmp rax, qword [rsp + 0x1a0]
jbe 0x14015f7a5
lea rax, [rsp + 0x48]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0x88], rax
mov eax, 0x655
mov word [rsp + 0x44], ax
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x64], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x68], rax
jmp 0x14015f7cf
mov rax, qword [rsp + 0x68]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x40]
add eax, ecx
mov rcx, qword [rsp + 0x68]
mov byte [rcx], al
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x70], eax
mov eax, dword [rsp + 0x58]
mov ecx, dword [rsp + 0x64]
sub ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x70]
mov edx, dword [rsp + 0x60]
and edx, ecx
mov ecx, edx
cmp eax, ecx
je 0x14015f84b
movzx eax, byte [rsp + 0x40]
mov byte [rsp + 0xbc], al
cmp byte [rsp + 0xbc], 0x1c
je 0x14015f80b
jmp 0x14015f81c
mov rax, qword [rsp + 0x48]
shl rax, 0x1a
mov rcx, qword [rsp + 0x78]
mov qword [rcx], rax
movsx eax, word [rsp + 0x44]
xor eax, 0x498
mov word [rsp + 0x44], ax
mov r9, qword [rsp + 0x48]
mov r8d, 0x9c
mov edx, 0x3d
mov rcx, qword [rsp + 0x48]
call fcn.14015f140
nop
jmp 0x14015fd6e
mov eax, dword [rsp + 0x70]
mov ecx, dword [rsp + 0x60]
add ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x58]
mov edx, dword [rsp + 0x64]
sub edx, ecx
mov ecx, edx
cmp eax, ecx
jne 0x14015fd6e
movzx eax, byte [rsp + 0x41]
or eax, 0x3c
movzx ecx, byte [rsp + 0x50]
cmp eax, ecx
jne 0x14015f937
mov eax, dword [rsp + 0x64]
movzx ecx, al
mov eax, dword [rsp + 0x70]
shr eax, cl
mov ecx, dword [rsp + 0x60]
mov edx, dword [rsp + 0x58]
and edx, ecx
mov ecx, edx
cmp eax, ecx
je 0x14015f904
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x1a0], rax
movzx r9d, word [rsp + 0x44]
mov r8w, 0xc4
movzx edx, word [rsp + 0x44]
mov ecx, 0xf
call fcn.14015ebc0
mov r8d, 0x71
mov edx, 0xbe
mov rcx, qword [rsp + 0x108]
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov dword [rsp + 0x74], eax
mov rax, qword [rsp + 0x1a0]
mov rcx, qword [rsp + 0x1a8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
jmp 0x14015f935
movsx eax, byte [rsp + 0x40]
add eax, 0x14
mov rcx, qword [rsp + 0x68]
movsx ecx, byte [rcx]
cmp eax, ecx
jle 0x14015f935
movabs rax, 0x7cb6630a183f66
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x78]
mov qword [rcx], rax
jmp 0x14015f957
lea rax, [rsp + 0x41]
mov qword [rsp + 0xd8], rax
movzx eax, byte [rsp + 0x40]
mov byte [rsp + 0x42], al
mov eax, 0x430
mov word [rsp + 0x54], ax
lea rax, [rsp + 0x44]
mov qword [rsp + 0xd0], rax
movzx eax, byte [rsp + 0x41]
mov byte [rsp + 0xc0], al
cmp byte [rsp + 0xc0], 0x82
je 0x14015f97f
jmp 0x14015fc63
mov rax, qword [rsp + 0xd0]
movsx eax, word [rax]
add eax, 0x7f
movsx ecx, word [rsp + 0x44]
cmp eax, ecx
jl 0x14015fb9d
lea rax, [rsp + 0x70]
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x1a8]
mov qword [rsp + 0xe8], rax
mov eax, dword [rsp + 0x60]
movzx ecx, al
mov eax, dword [rsp + 0x70]
shr eax, cl
mov rcx, qword [rsp + 0x98]
mov edx, dword [rsp + 0x58]
mov ecx, dword [rcx]
xor ecx, edx
cmp eax, ecx
je 0x14015f9fa
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
mov dword [rsp + 0xac], eax
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x1a0], rax
jmp 0x14015fa8e
movabs rax, 0x7b6f6d549f4b74
mov rcx, qword [rsp + 0x48]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x78]
cmp rax, qword [rcx]
je 0x14015fa8e
mov rax, qword [rsp + 0x98]
mov eax, dword [rax]
mov dword [rsp + 0xb4], eax
cmp dword [rsp + 0xb4], 0x2993
je 0x14015fa39
jmp 0x14015fa8e
mov rdx, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0x1a0]
call fcn.14015f630
mov rax, qword [rsp + 0xd8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x41]
sub eax, ecx
mov rcx, qword [rsp + 0xd8]
mov byte [rcx], al
movzx eax, word [rsp + 0x54]
add eax, 0xc1
mov word [rsp + 0x54], ax
mov rcx, qword [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov dword [rsp + 0xa8], eax
mov rax, qword [rsp + 0x68]
movzx eax, byte [rax]
mov byte [rsp + 0x5c], al
movzx eax, byte [rsp + 0x41]
mov byte [rsp + 0x80], al
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x110], rax
mov rax, qword [rsp + 0x98]
mov eax, dword [rax]
mov dword [rsp + 0x90], eax
cmp dword [rsp + 0x90], 0
je 0x14015fae3
cmp dword [rsp + 0x90], 0xd0c
je 0x14015fb0e
jmp 0x14015fb9d
mov dword [rsp + 0xc4], 0x7f00
lea rax, [rsp + 0x48]
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0x98]
mov eax, dword [rax]
mov dword [rsp + 0x58], eax
jmp 0x14015fb9d
mov rax, qword [rsp + 0x68]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x5c]
sub eax, ecx
movsx ecx, byte [rsp + 0x40]
movsx edx, byte [rsp + 0x42]
add ecx, edx
cmp eax, ecx
je 0x14015fb43
mov rax, qword [rsp + 0x68]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x42]
sub eax, ecx
mov rcx, qword [rsp + 0x68]
mov byte [rcx], al
lea rdx, [rsp + 0xc4]
mov rcx, qword [rsp + 0x108]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x74], eax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x1a8], rax
lea rcx, [rsp + 0x42]
call qword [sym.imp.KERNEL32.dll_GetNumaHighestNodeNumber]
mov dword [rsp + 0xb0], eax
mov rax, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0x48]
mov rax, qword [rax]
and rax, rcx
mov rcx, qword [rsp + 0xf0]
mov qword [rcx], rax
mov edx, 1
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
mov dword [rsp + 0xcc], eax
mov rdx, qword [rsp + 0x1a8]
mov rcx, qword [rsp + 0x88]
call fcn.14015f630
nop
mov rax, qword [rsp + 0x68]
movzx eax, byte [rax]
mov byte [rsp + 0xc8], al
cmp byte [rsp + 0xc8], 0x7e
je 0x14015fbe8
jmp 0x14015fbea
jmp 0x14015fc07
movabs rax, 0x75c1c443d7ceab
mov rcx, qword [rsp + 0x48]
or rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x78]
mov qword [rcx], rax
movsx eax, byte [rsp + 0x42]
mov rcx, qword [rsp + 0x68]
movsx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x40], al
mov rax, qword [rsp + 0x48]
shl rax, 6
mov rcx, qword [rsp + 0x78]
mov qword [rcx], rax
mov r8d, 0xfd
lea rdx, [rsp + 0x148]
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
mov dword [rsp + 0xa8], eax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x1a0], rax
jmp 0x14015fd50
mov rax, qword [rsp + 0x78]
mov rax, qword [rax]
movabs rcx, 0x7bff9e47142cb9
add rax, rcx
mov qword [rsp + 0x48], rax
movzx eax, byte [rsp + 0x42]
mov byte [rsp + 0x94], al
cmp byte [rsp + 0x94], 0x19
je 0x14015fca6
cmp byte [rsp + 0x94], 0x5b
je 0x14015fd3a
jmp 0x14015fd50
movsx eax, word [rsp + 0x44]
and eax, 0x2bd
mov rcx, qword [rsp + 0xd0]
mov word [rcx], ax
mov ecx, 0xf3
call qword [sym.imp.KERNEL32.dll_SetConsoleCP]
mov dword [rsp + 0xac], eax
mov rax, qword [rsp + 0xd0]
movzx r9d, word [rax]
movzx r8d, word [rsp + 0x54]
movzx edx, word [rsp + 0x44]
mov ecx, 0x8a
call fcn.14015ebc0
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x58], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x54]
mov r8d, 0xdd
lea rdx, [rsp + 0x44]
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_WriteFileEx]
mov dword [rsp + 0x74], eax
mov rax, qword [rsp + 0x68]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x42]
sub eax, ecx
mov rcx, qword [rsp + 0x68]
mov byte [rcx], al
jmp 0x14015fd50
mov rax, qword [rsp + 0xd8]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x50]
add eax, ecx
mov byte [rsp + 0x41], al
mov rax, qword [rsp + 0x78]
mov r9, qword [rax]
mov r8d, LBItemFromPt
mov edx, 0x16
mov rcx, qword [rsp + 0x48]
call fcn.14015f140
nop
lea r9, [rsp + 0x88]
mov r8d, 0x53
lea rdx, [rsp + 0x118]
mov rcx, qword [rsp + 0x118]
call qword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
mov dword [rsp + 0xb0], eax
mov rax, qword [rsp + 0x68]
movsx eax, byte [rax]
sub eax, 0x56
mov byte [rsp + 0x40], al
movabs rax, 0x785f91b40c4cca
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x78]
mov qword [rcx], rax
movzx r9d, word [rsp + 0x44]
mov r8w, 0x61
movzx edx, word [rsp + 0x44]
mov ecx, 0x24
call fcn.14015ebc0
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
mov dword [rsp + 0xcc], eax
mov rax, qword [rsp + 0x1a8]
mov qword [rsp + 0x1a0], rax
movabs rax, 0x736f2eba068091
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
movabs rcx, 0x70bfa72faf3bec
cmp rax, rcx
je 0x14015ff6f
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x120], rax
movabs rax, 0x798f6c2f21f881
cmp qword [rsp + 0x120], rax
je 0x14015fe57
jmp 0x14015ff19
lea r9, [rsp + 0x48]
mov r8d, 0x82
mov edx, 0x7b
mov rcx, qword [rsp + 0x138]
call sub.VERSION.dll_GetFileVersionInfoA
mov dword [rsp + 0x74], eax
mov r9w, 0xa6
mov r8w, 0xcd
mov dx, 0x82
mov ecx, 0xdf
call fcn.14015ebc0
movabs rax, 0x74b888b1395add
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x74]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x74]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x160]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xf8]
mov r8, qword [rsp + 0x140]
lea rdx, str.C:dodgyArguesShowers
mov ecx, 0xfc
call sub.VERSION.dll_VerFindFileA
mov dword [rsp + 0x58], eax
movabs rax, 0x74be7f68bb31b2
mov rcx, qword [rsp + 0x48]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
jmp 0x14015ff6f
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x128]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xf8]
mov r8, qword [rsp + 0x128]
lea rdx, str.C:ReadmittedDeliberatelyInitiatesPaves
mov ecx, 0x41
call sub.VERSION.dll_VerFindFileA
mov dword [rsp + 0x64], eax
mov eax, 0xde
add rsp, 0x188
pop rdi
pop rsi
ret