Function at 0x140008d4e
Capabilities:
Get file size

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x1f8
xor eax, eax
cmp qword [0x1400cfd48], 0
mov r12d, ecx
mov ecx, 0x40
mov rbp, rdx
mov rsi, r8
lea rdi, [rsp + 0xf0]
mov dword [rsp + 0x61], 0x5c2e5c5c
rep stosd dword [rdi], eax
mov dword [rsp + 0x64], 0x3a235c
jne 0x140008ea4
xor r8d, r8d
xor r9d, r9d
mov r13, qword [0x14011c6a0]
xor edx, edx
mov dword [rsp + 0x28], r8d
mov ecx, 0xfde9
lea r8, [0x14008a0e4]
mov qword [rsp + 0x20], r9
or r9d, 0xffffffff
call r13
mov ebx, eax
cmp eax, 1
jg 0x140008dd0
xor edi, edi
jmp 0x140008e07
movsxd rcx, eax
mov edx, 2
call sub.msvcrt.dll_vfprintf
mov rdi, rax
test rax, rax
je 0x140008dcc
or r9d, 0xffffffff
xor edx, edx
mov dword [rsp + 0x28], ebx
mov ecx, 0xfde9
mov qword [rsp + 0x20], rax
lea r8, [0x14008a0e4]
call r13
cmp ebx, eax
je 0x140008e0b
xor ebx, ebx
jmp 0x140008e85
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
mov rbx, rax
test rax, rax
jne 0x140008e85
mov r13, qword [0x1400b5f50]
cmp word [r13], 0x3f
jbe 0x140008e39
lea rcx, [0x14008a0ea]
call fcn.140038472
jmp 0x140008e07
mov r8d, 0x800
xor edx, edx
mov rcx, rdi
call qword [0x14011c648]
mov rbx, rax
test rax, rax
je 0x140008e6c
movzx eax, word [r13]
lea edx, [rax + 1]
mov word [r13], dx
mov rdx, qword [0x1400b5f40]
mov qword [rdx + rax*8], rbx
jmp 0x140008e85
call fcn.14003893c
mov rdx, rdi
lea rcx, [0x14008a113]
mov r8, rax
call fcn.140038472
jmp 0x140008e07
mov rcx, rdi
call fcn.1400796c8
lea rdx, str.NtQueryVolumeInformationFile
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_SetVolumeLabelA]
mov qword [0x1400cfd48], rax
test rbp, rbp
je 0x140008ead
mov byte [rbp], 0
test rsi, rsi
je 0x140008eb6
xor ecx, ecx
mov dword [rsi], ecx
test r12d, r12d
js 0x140008f17
lea eax, [r12 - 0x80]
mov dword [rsp + 0x4c], eax
cmp eax, 0x40
jbe 0x140008ee3
mov r8d, 0x456
lea rdx, str.drive.c
lea rcx, str._DriveIndex___DRIVE_INDEX_MIN____DriveIndex___DRIVE_INDEX_MAX_
call qword [sym.imp.msvcrt.dll_memmove]
lea rbx, [rsp + 0x87]
mov ecx, 0x69
mov rdx, rbx
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
mov dword [rsp + 0x5c], eax
mov edx, eax
test eax, eax
jne 0x140008f20
call fcn.14003893c
lea rcx, str.GetLogicalDriveStrings_failed:__s
mov rdx, rax
call fcn.140038472
xor edi, edi
xor ebx, ebx
jmp 0x14000915e
cmp eax, 0x69
jbe 0x140008f39
mov r8d, 0x69
lea rcx, str.GetLogicalDriveStrings:_Buffer_too_small__required__lu_vs.__zu_
call fcn.140038472
jmp 0x140008f17
xor r14d, r14d
xor edi, edi
movsx r13d, byte [rbx]
test r13b, r13b
je 0x1400090b8
mov ecx, r13d
call qword [0x14011cac8]
test eax, eax
je 0x1400090a6
mov ecx, r13d
call qword [0x14011cc00]
mov rcx, rbx
mov byte [rbx], al
call qword [sym.imp.KERNEL32.DLL_K32GetModuleFileLCIDToLocaleName]
mov r13d, eax
lea eax, [rax - 2]
cmp eax, 1
ja 0x1400090a6
movsx ecx, byte [rbx]
call qword [0x14011cc00]
lea rdx, [rsp + 0x61]
lea r9, str.._c:
or r8, 0xffffffffffffffff
mov qword [rsp + 0x40], rdx
mov edx, 7
mov rcx, qword [rsp + 0x40]
mov dword [rsp + 0x20], eax
call qword [sym.imp.msvcrt.dll_clearerr]
xor edx, edx
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x30], rdx
mov r8d, 3
mov edx, 0x80000000
mov dword [rsp + 0x38], 0xbb8
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov byte [rsp + 0x67], 0
call fcn.1400393a6
mov r15, rax
cmp rax, 0xffffffffffffffff
jne 0x140009023
call qword [sym.imp.KERNEL32.DLL_PeekNamedPipe]
cmp eax, 0x102
jne 0x1400090a6
movsx ecx, byte [rbx]
call qword [0x14011cc00]
lea rcx, str.Warning:_Time_out_while_trying_to_query_drive__c
mov edx, eax
call fcn.140038472
jmp 0x1400090a6
mov rax, qword [0x1400cfd48]
test rax, rax
jne 0x14000905b
mov rdx, qword [rsp + 0x40]
mov rcx, r15
call fcn.140008c26
mov edx, eax
lea rax, [r15 - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140009085
mov dword [rsp + 0x40], edx
mov rcx, r15
call qword [sym.imp.KERNEL32.DLL_CreateDirectorCreateEventACreateFileA]
mov edx, dword [rsp + 0x40]
jmp 0x140009085
mov dword [rsp + 0x20], 4
lea rdx, [rsp + 0x70]
lea r8, [rsp + 0x68]
mov rcx, r15
mov r9d, 8
call rax
test eax, eax
jne 0x14000902f
test byte [rsp + 0x6c], 4
je 0x14000902f
jmp 0x1400090a6
cmp dword [rsp + 0x4c], edx
jne 0x1400090a6
test rbp, rbp
je 0x14000909b
mov dl, byte [rbx]
movsxd rax, edi
inc edi
mov byte [rbp + rax], dl
test rsi, rsi
je 0x1400090a3
mov dword [rsi], r13d
inc r14d
mov rcx, rbx
call fcn.1400797e8
lea rbx, [rbx + rax + 1]
jmp 0x140008f3e
test r14d, r14d
jne 0x140009159
test rsi, rsi
je 0x140009159
mov ecx, r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call fcn.1400077b5
xor r9d, r9d
xor r8d, r8d
mov edx, 0x700a0
mov r12, rax
xor eax, eax
mov dword [rsp + 0x28], 0x100
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x5c]
mov rcx, r12
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.DLL_GetFileSizeEx]
mov ebx, eax
lea rax, [r12 - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000912d
mov rcx, r12
call qword [sym.imp.KERNEL32.DLL_CreateDirectorCreateEventACreateFileA]
test ebx, ebx
je 0x14000915e
cmp dword [rsp + 0x5c], 0
je 0x14000915e
mov eax, dword [rsp + 0xf8]
cmp eax, 0xc
jne 0x14000914c
mov dword [rsi], 3
jmp 0x14000915e
cmp eax, 0xb
jne 0x14000915e
mov dword [rsi], 2
jmp 0x14000915e
mov ebx, 1
test rbp, rbp
je 0x14000916b
movsxd rdi, edi
mov byte [rbp + rdi], 0
mov eax, ebx
add rsp, 0x1f8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret