Function at 0x1400c0754
Capabilities:
Check if file exists
Get file attributes
Get file size
Get system information on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xe8
and qword [rbp - 0x71], 0
xor ebx, ebx
and dword [rsp + 0x48], ebx
mov r14, rcx
mov rcx, qword [rcx + 0x68]
xor r13d, r13d
and dword [rbp - 0x7d], ebx
xor r12d, r12d
and qword [rbp - 0x79], rbx
or qword [rbp + 0x6f], 0xffffffffffffffff
mov qword [rsp + 0x40], rbx
mov qword [rbp - 0x69], r13
mov qword [rbp - 0x61], r12
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
je 0x1400c07b9
shr edi, 4
not edi
and edi, 1
jmp 0x1400c07bb
xor edi, edi
xor ecx, ecx
call fcn.140079c60
xor ecx, ecx
call fcn.140079c60
xor esi, esi
mov r15d, 0x8007000d
test edi, edi
je 0x1400c085a
and qword [rsp + 0x30], rbx
lea r8d, [rsi + 1]
mov rcx, qword [r14 + 0x68]
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x1400c0834
lea rdx, [rbp - 0x39]
mov qword [rbp + 0x6f], rcx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400c0834
cmp qword [rbp - 0x39], 0x200000
jle 0x1400c085a
mov esi, r15d
mov ecx, r15d
jmp 0x1400c0855
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400c0845
mov esi, 0x80004005
jmp 0x1400c0853
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov ecx, esi
call fcn.140079c40
mov ecx, esi
call fcn.140079c60
lea rcx, [rbp + 0x6f]
call fcn.140076840
test esi, esi
jns 0x1400c087a
mov ecx, esi
call fcn.140079c40
jmp 0x1400c0b99
mov rcx, qword [r14 + 0x68]
lea r8, [rbp - 0x71]
lea rdx, [rbp + 0x6f]
call fcn.1400a2a30
mov esi, eax
test eax, eax
jns 0x1400c0895
mov ecx, eax
jmp 0x1400c0870
lea r8, [rsp + 0x40]
xor edx, edx
lea rcx, [0x1403cad70]
call fcn.1400f4880
mov esi, eax
test eax, eax
jns 0x1400c08bf
mov ecx, eax
call fcn.140079c40
mov rbx, qword [rsp + 0x40]
jmp 0x1400c0b99
mov rbx, qword [rsp + 0x40]
mov rax, qword [rbx]
mov rdi, qword [rax + 0x18]
mov rax, qword [0x1403c1610]
mov rcx, rdi
call rax
mov r8d, dword [rbp + 0x6f]
mov rax, rdi
mov rdx, qword [rbp - 0x71]
xor r9d, r9d
mov rcx, rbx
call rax
mov esi, eax
test eax, eax
js 0x1400c0891
mov rax, qword [rbx]
mov rdi, qword [rax + 0x30]
mov rax, qword [0x1403c1610]
mov rcx, rdi
call rax
mov rax, rdi
lea rdx, [rbp - 0x59]
mov rcx, rbx
call rax
mov esi, eax
test eax, eax
js 0x1400c0891
cmp dword [rbp - 0x51], 1
je 0x1400c092a
mov esi, r15d
mov ecx, r15d
jmp 0x1400c0870
cmp dword [rbp - 0x49], 1
jb 0x1400c091f
mov rax, qword [rbx]
mov rdi, qword [rax + 0x30]
mov rax, qword [0x1403c1610]
mov rcx, rdi
call rax
mov rax, rdi
lea rdx, [rbp - 0x59]
mov rcx, rbx
call rax
mov esi, eax
test eax, eax
js 0x1400c0891
cmp dword [rbp - 0x51], 1
jne 0x1400c091f
mov r15d, dword [rbp - 0x49]
xor r14d, r14d
test r15d, r15d
je 0x1400c0a01
test r13, r13
je 0x1400c0995
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [r13 - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.140079c60
and qword [rbp - 0x69], 0
test r12, r12
je 0x1400c09bb
mov rax, qword [r12]
mov rdi, qword [rax + 0x10]
mov rax, qword [0x1403c1610]
mov rcx, rdi
call rax
mov rax, rdi
mov rcx, r12
call rax
and qword [rbp - 0x61], 0
mov rdx, rbx
lea rcx, [rbp - 0x69]
call fcn.1400c388c
mov esi, eax
test eax, eax
js 0x1400c0891
xor r8d, r8d
lea rdx, [rbp - 0x69]
lea rcx, [rsp + 0x48]
call fcn.1400ba2a4
mov esi, eax
test eax, eax
js 0x1400c0891
inc r14d
cmp r14d, r15d
jae 0x1400c0a01
mov r12, qword [rbp - 0x61]
mov r13, qword [rbp - 0x69]
jmp 0x1400c096f
mov rax, qword [rbx]
mov rdi, qword [rax + 0x28]
mov rax, qword [0x1403c1610]
mov rcx, rdi
call rax
mov rax, rdi
lea rdx, [rbp + 0x77]
mov rcx, rbx
call rax
mov esi, eax
test eax, eax
js 0x1400c0891
mov rax, qword [rbx]
mov rdi, qword [rax + 0x30]
mov rax, qword [0x1403c1610]
mov rcx, rdi
call rax
mov rax, rdi
lea rdx, [rbp - 0x59]
mov rcx, rbx
call rax
mov esi, eax
test eax, eax
js 0x1400c0891
cmp dword [rbp - 0x51], 4
je 0x1400c0a63
mov esi, 0x8007000d
jmp 0x1400c086e
mov r13, qword [rbp + 0x67]
lea r8, [rsp + 0x40]
mov r15, qword [rbp - 0x49]
lea rdx, [rbp + 0x6f]
mov edi, dword [rbp - 0x41]
mov rcx, r13
mov r12d, dword [rbp + 0x77]
and qword [rsp + 0x40], 0
call fcn.1400c5580
mov esi, eax
test eax, eax
jns 0x1400c0a98
mov ecx, eax
call fcn.140079c40
jmp 0x1400c0afe
mov r14, qword [rsp + 0x40]
lea rax, [0x140013358]
mov qword [rbp - 0x29], rax
lea rdx, [rbp - 0x31]
xor r9d, r9d
mov dword [rbp - 0xd], edi
mov edi, dword [rbp + 0x6f]
lea rax, [rbp + 0x7f]
mov qword [rbp - 0x21], rax
mov rax, qword [rbp - 0x71]
lea r8d, [r9 + 0x3c]
mov qword [rbp - 0x15], rax
lea ecx, [r8 + 0x7d]
mov qword [rbp - 5], r14
mov qword [rbp - 0x31], 3
mov dword [rbp - 0x19], r12d
mov dword [rbp - 9], edi
mov qword [rbp + 3], r15
call sub.ntdll.dll_NtQuerySystemInformation
mov esi, dword [rbp + 0x7f]
test esi, esi
jns 0x1400c0af4
mov ecx, esi
jmp 0x1400c0a91
mov rcx, rdi
xor eax, eax
mov rdi, r14
rep stosb byte [rdi], al
mov ecx, esi
call fcn.140079c60
lea rcx, [rsp + 0x40]
call fcn.14005a9b4
cmp esi, 0x8007000d
jne 0x1400c0b29
lea rcx, [r13 + 0x98]
xor edx, edx
call fcn.1400ba148
xor esi, esi
jmp 0x1400c0b99
test esi, esi
js 0x1400c086e
lea rdi, [r13 + 0x98]
xor edx, edx
mov rcx, rdi
call fcn.1400ba148
mov r14, qword [rdi + 8]
mov r12d, dword [rdi]
mov r13d, dword [rdi + 4]
and qword [rdi + 8], 0
mov eax, dword [rsp + 0x48]
mov dword [rdi], eax
mov eax, dword [rbp - 0x7d]
mov dword [rdi + 4], eax
mov r15, qword [rdi + 8]
test r15, r15
je 0x1400c0b7b
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r15
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rbp - 0x79]
mov qword [rdi + 8], rax
xor eax, eax
test r14, r14
mov dword [rsp + 0x48], r12d
mov dword [rbp - 0x7d], r13d
cmovne rax, r14
mov qword [rbp - 0x79], rax
mov ecx, esi
call fcn.140079c60
lea rcx, [rsp + 0x48]
call fcn.1400a330c
lea rcx, [rbp - 0x69]
call fcn.1400b88d0
test rbx, rbx
je 0x1400c0bd3
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rax, qword [0x1403c1610]
mov rcx, rdi
call rax
mov rax, rdi
mov rcx, rbx
call rax
lea rcx, [rbp - 0x71]
call fcn.14009bf9c
mov eax, esi
add rsp, 0xe8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret