Function at 0x1400736d0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x100
mov rax, qword [0x140124440]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov r12, rdx
mov rbx, rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdx
xor esi, esi
mov dword [rsp + 0x40], esi
lea r14, [rsi - 1]
cmp qword [rdx + 0x10], rsi
jne 0x140073c00
lea rdx, [rcx + 0x80]
mov rax, qword [0x140124228]
sub rax, qword [0x140124220]
cmp rax, 0x20
jae 0x14007375d
cmp r12, rdx
je 0x140073c00
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 7
jbe 0x140073750
mov rdx, qword [rdx]
mov rcx, r12
call fcn.140027b60
jmp 0x140073c00
mov r10, qword [rdx + 0x10]
mov r9, rdx
mov r11, qword [rdx + 0x18]
cmp r11, 7
jbe 0x140073771
mov r9, qword [rdx]
test r10, r10
je 0x1400737a8
lea rcx, [r10 - 1]
mov rax, r14
cmp rcx, r14
cmovb rax, rcx
lea r8, [r9 + rax*2]
cmp word [r8], 0x5c
je 0x1400737a0
nop
cmp r8, r9
je 0x1400737a8
sub r8, 2
cmp word [r8], 0x5c
jne 0x140073790
sub r8, r9
sar r8, 1
jmp 0x1400737ab
mov r8, r14
xorps xmm0, xmm0
movups xmmword [rbp - 0x21], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x11], xmm1
cmp r10, r8
cmovb r8, r10
cmp r11, 7
jbe 0x1400737ca
mov rdx, qword [rdx]
lea rcx, [rbp - 0x21]
call fcn.1400034a0
mov r14d, 0x20
mov dword [rsp + 0x40], r14d
mov r15, qword [0x140124220]
mov r13, qword [0x140124228]
cmp r15, r13
je 0x140073b8e
lea rbx, [0x1400d4c9c]
nop dword [rax]
mov rax, qword [r15 + 0x10]
mov r10, r15
cmp qword [r15 + 0x18], 7
jbe 0x140073811
mov r10, qword [r15]
cmp rax, 2
jb 0x1400738ac
dec rax
lea r11, [r10 + rax*2]
mov rax, r10
nop word [rax + rax]
mov rcx, r11
sub rcx, rax
sar rcx, 1
mov rdx, rsi
je 0x14007385a
cmp word [rax], 0x3a
je 0x140073857
cmp rcx, 1
je 0x14007385a
dec rcx
add rax, 2
cmp word [rax], 0x3a
jne 0x140073844
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x1400738ac
mov r8d, 2
mov rdx, rbx
mov r9, rax
sub r9, rbx
movzx ecx, word [r9 + rdx]
cmp cx, word [rdx]
jne 0x1400738a6
add rdx, 2
sub r8, 1
jne 0x140073871
sub rax, r10
sar rax, 1
cmp rax, 0xffffffffffffffff
je 0x1400738ac
mov rdx, r15
lea rcx, [rbp - 0x61]
call fcn.140007a70
mov rdi, rax
or r14d, 4
jmp 0x14007390d
add rax, 2
jmp 0x140073830
lea r8, [0x1400d3188]
lea rdx, [rbp - 0x21]
lea rcx, [rbp - 0x41]
call fcn.1400730a0
nop
or r14d, 1
mov dword [rsp + 0x40], r14d
mov rdx, r15
cmp qword [r15 + 0x18], 7
jbe 0x1400738d7
mov rdx, qword [r15]
mov r8, qword [r15 + 0x10]
mov rcx, rax
call fcn.140049d00
movups xmm0, xmmword [rax]
movups xmmword [rbp - 1], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xf], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
or r14d, 8
lea rdi, [rbp - 1]
or r14d, 2
mov dword [rsp + 0x40], r14d
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rbp - 0x71], rsi
mov qword [rbp - 0x69], rsi
mov rsi, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 7
jbe 0x140073930
mov rdi, qword [rdi]
movabs rax, 0x7ffffffffffffffe
cmp rsi, rax
ja 0x140073d85
cmp rsi, 7
ja 0x140073962
mov qword [rbp - 0x71], rsi
mov qword [rbp - 0x69], 7
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x58], xmm0
jmp 0x140073a15
mov rbx, rsi
or rbx, 7
cmp rbx, rax
jbe 0x140073981
mov rbx, rax
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x1400739b1
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x140073daf
add rcx, rcx
cmp rcx, 0x1000
jb 0x1400739e0
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140073daf
mov rcx, rax
call fcn.140099a10
mov rcx, rax
test rax, rax
je 0x140073d91
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400739ee
test rcx, rcx
je 0x1400739ec
call fcn.140099a10
jmp 0x1400739ee
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rbp - 0x71], rsi
mov qword [rbp - 0x69], rbx
lea r8, [rsi*2 + 2]
mov rdx, rdi
mov rcx, rax
call fcn.1400c27d0
lea rbx, [0x1400d4c9c]
test r14b, 4
je 0x140073a78
and r14d, 0xfffffffb
mov dword [rsp + 0x40], r14d
mov rdx, qword [rbp - 0x49]
cmp rdx, 7
jbe 0x140073a64
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x61]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140073a5f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140073d97
call fcn.140099a4c
xor esi, esi
mov qword [rbp - 0x51], rsi
mov qword [rbp - 0x49], 7
mov word [rbp - 0x61], si
jmp 0x140073a7a
xor esi, esi
test r14b, 2
je 0x140073aca
and r14d, 0xfffffffd
mov dword [rsp + 0x40], r14d
mov rdx, qword [rbp + 0x17]
cmp rdx, 7
jbe 0x140073aca
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140073ac4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140073d9d
call fcn.140099a4c
nop
test r14b, 1
je 0x140073b29
and r14d, 0xfffffffe
mov dword [rsp + 0x40], r14d
mov rdx, qword [rbp - 0x29]
cmp rdx, 7
jbe 0x140073b19
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140073b14
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140073da3
call fcn.140099a4c
mov qword [rbp - 0x31], rsi
mov qword [rbp - 0x29], 7
mov word [rbp - 0x41], si
lea rcx, [rsp + 0x58]
call fcn.140068da0
test al, al
jne 0x140073c9c
mov rdx, qword [rbp - 0x69]
cmp rdx, 7
jbe 0x140073b7c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140073b77
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140073da9
call fcn.140099a4c
add r15, 0x20
cmp r15, r13
jne 0x140073800
mov rbx, qword [rsp + 0x48]
cmp qword [r12 + 0x10], 0
jne 0x140073bb9
lea rdx, [rbx + 0x80]
cmp r12, rdx
je 0x140073bb9
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 7
jbe 0x140073bb0
mov rdx, qword [rdx]
mov rcx, r12
call fcn.140027b60
nop
mov rdx, qword [rbp - 9]
cmp rdx, 7
jbe 0x140073bf9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140073bf4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140073d8b
call fcn.140099a4c
mov r14, 0xffffffffffffffff
mov rcx, r12
call fcn.140068da0
test al, al
je 0x140073d53
mov rcx, r12
cmp qword [r12 + 0x18], 7
jbe 0x140073c1f
mov rcx, qword [r12]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140073d53
mov qword [rsp + 0x48], 0
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140073d49
mov rsi, qword [rsp + 0x48]
mov rcx, rsi
call fcn.140099f40
mov rbx, rax
test rax, rax
je 0x140073d0d
mov r8, rsi
xor edx, edx
mov rcx, rax
call fcn.1400c2e70
xor eax, eax
jmp 0x140073d10
lea rax, [rsp + 0x58]
cmp r12, rax
je 0x140073cc3
lea rdx, [rsp + 0x58]
cmp qword [rbp - 0x69], 7
cmova rdx, qword [rsp + 0x58]
mov r8, qword [rbp - 0x71]
mov rcx, r12
call fcn.140027b60
nop
mov rdx, qword [rbp - 0x69]
cmp rdx, 7
jbe 0x140073b89
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140073d03
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140073da9
call fcn.140099a4c
jmp 0x140073b89
mov rbx, rax
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
mov r8d, dword [rsp + 0x48]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140073d3c
movsxd rax, dword [rbx + 0x3c]
mov r14d, dword [rax + rbx + 8]
test rbx, rbx
je 0x140073d49
mov rcx, rbx
call fcn.140099a4c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, r12
call fcn.140027430
mov rax, r14
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.140099ec0
mov rbx, qword [rsp + 0x150]
add rsp, 0x100
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400278a0
nop
call fcn.1400a0a3c
nop
call fcn.1400a0a3c
nop
call fcn.1400a0a3c
nop
call fcn.1400a0a3c
nop
call fcn.1400a0a3c
nop
call fcn.1400a0a3c
nop
call fcn.1400271f0
int3