Function at 0x140015700
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xe8
movaps xmmword [rsp + 0xd0], xmm8
movdqa xmmword [rsp + 0xc0], xmm7
movaps xmmword [rsp + 0xb0], xmm6
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov r14, rcx
lea rdx, [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
cmp qword [rsp + 0x150], 0
mov ecx, 0xfbff202f
mov edx, 0x4f520ba
cmove edx, ecx
mov dword [rsp + 0x3c], edx
mov qword [rsp + 0x58], rsi
test rsi, rsi
mov ecx, 0x35ba103a
mov edx, 0x81cf8349
cmove edx, ecx
mov dword [rsp + 0x40], edx
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x68], rdi
test rdi, rdi
mov eax, 0xa47ed9f1
mov edi, 0x69fa44cb
cmove edi, eax
mov qword [rsp + 0x60], rbx
test rbx, rbx
mov eax, 0xf2b2101a
mov ebp, 0x99573c19
cmove ebp, eax
mov eax, 0xbc879b11
movdqa xmm6, xmmword [0x140037a40]
pcmpeqd xmm7, xmm7
movdqa xmm8, xmmword [0x140037a50]
jmp 0x1400157e0
cmp dword [rsp + 0x2c], 0x454e
mov eax, 0x66a052fa
mov ecx, 0xe0497012
cmove eax, ecx
nop word cs:[rax + rax]
mov ecx, eax
cmp eax, 0xf2b21019
jg 0x140015850
cmp ecx, 0xa47ed9f0
jle 0x1400158b0
cmp ecx, 0xbd56d953
jle 0x140015948
cmp ecx, 0xe014cda9
jle 0x140015a60
cmp ecx, 0xe014cdaa
je 0x140015c0a
cmp ecx, 0xe0497012
je 0x140015c25
mov eax, ecx
cmp ecx, 0xf20ec196
jne 0x1400157e0
mov eax, dword [rsp + 0x34]
add eax, 0x34
cmp ebx, eax
mov eax, 0x898c073f
mov ecx, 0xf434b977
cmova eax, ecx
jmp 0x1400157e0
cmp ecx, 0x37657443
jg 0x140015900
cmp ecx, 0xfc39741b
jg 0x140015991
cmp ecx, 0xf4352416
jle 0x140015a93
cmp ecx, 0xf4352417
je 0x140015c72
cmp ecx, 0xf6dddee1
je 0x140015cfb
mov eax, ecx
cmp ecx, 0xfbff202f
jne 0x1400157e0
mov eax, 0xd5353063
xor esi, esi
jmp 0x1400157e0
cmp ecx, 0x898c073e
jg 0x1400159cc
cmp ecx, 0x84d2268a
jle 0x140015af6
cmp ecx, 0x84d2268b
je 0x140015d0c
cmp ecx, 0x85435896
je 0x140015d1e
mov eax, ecx
cmp ecx, 0x86db6956
jne 0x1400157e0
or r12d, 4
mov eax, 0x638a99f2
jmp 0x1400157e0
cmp ecx, 0x638a99f1
jg 0x140015a20
cmp ecx, 0x462baff8
jle 0x140015b1e
cmp ecx, 0x462baff9
je 0x140015d2c
cmp ecx, 0x4b62ba24
je 0x140015d36
mov eax, ecx
cmp ecx, 0x5d257095
jne 0x1400157e0
mov eax, 0x898c073f
jmp 0x1400157e0
cmp ecx, 0xb6ad3a01
jle 0x140015b5c
cmp ecx, 0xb6ad3a02
je 0x140015d47
cmp ecx, 0xb9cfd8c3
je 0x140015d64
mov eax, ecx
cmp ecx, 0xbc879b11
jne 0x1400157e0
cmp dword [rsp + 0x44], 0
mov eax, 0x55d452b
mov ecx, 0x91a0b4ec
cmove eax, ecx
jmp 0x1400157e0
cmp ecx, 0x4f520b9
jle 0x140015b8b
cmp ecx, 0x4f520ba
je 0x140015db8
cmp ecx, 0x55d452b
je 0x140015e8a
mov eax, ecx
cmp ecx, 0x35ba103a
jne 0x1400157e0
mov eax, dword [rsp + 0x3c]
jmp 0x1400157e0
cmp ecx, 0x9519d8e8
jle 0x140015bb5
cmp ecx, 0x9519d8e9
je 0x140015eaf
cmp ecx, 0x99573c19
je 0x140015eb9
mov eax, ecx
cmp ecx, 0xa0344c26
jne 0x1400157e0
mov rcx, r14
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp eax, 0x29
mov eax, 0xfc39741c
mov ecx, 0xf4352417
cmovae eax, ecx
jmp 0x1400157e0
cmp ecx, 0x69fa44ca
jle 0x140015bde
cmp ecx, 0x69fa44cb
je 0x140015ecb
cmp ecx, 0x73618324
je 0x140015edc
mov eax, ecx
cmp ecx, 0x784f5e4a
jne 0x1400157e0
or r12d, 0x10
mov eax, 0xb6ad3a02
jmp 0x1400157e0
cmp ecx, 0xbd56d954
je 0x1400157c1
cmp ecx, 0xbe8de38a
jne 0x140015fe0
mov eax, r15d
xor eax, 0xfffffffb
test eax, r15d
mov eax, 0x86db6956
mov ecx, 0x638a99f2
cmove eax, ecx
jmp 0x1400157e0
mov eax, edi
cmp ecx, 0xf2b2101a
je 0x1400157e0
mov eax, ecx
cmp ecx, 0xf434b977
jne 0x1400157e0
mov edx, dword [rsp + 0x34]
mov rcx, r14
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov qword [rsp + 0x20], 0
mov rcx, r14
lea rdx, [rsp + 0x2c]
mov r8d, 4
lea r9, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [rsp + 0x2c], 0x5a4d
mov eax, 0xbd56d954
jmp 0x1400157ce
cmp ecx, 0x81cf8349
je 0x140015ef7
mov eax, ecx
cmp ecx, 0x82ef2c6f
jne 0x1400157e0
or r12d, 0x20
mov eax, 0xe014cdaa
jmp 0x1400157e0
cmp ecx, 0x37657444
je 0x140015fa8
mov eax, ecx
cmp ecx, 0x41761fd1
jne 0x1400157e0
or r12d, 0x1000000
mov eax, r15d
not eax
or eax, 0xfffffffe
cmp eax, 0xffffffff
mov eax, 0x9519d8e9
mov ecx, 0x37657444
cmove eax, ecx
jmp 0x1400157e0
mov eax, dword [rsp + 0x40]
cmp ecx, 0xa47ed9f1
je 0x1400157e0
mov eax, ecx
cmp ecx, 0xa7cd97dc
jne 0x1400157e0
or r12d, 0x80000000
mov eax, 0x41761fd1
jmp 0x1400157e0
mov eax, ebp
cmp ecx, 0xfc39741c
je 0x1400157e0
mov eax, ecx
cmp ecx, 0xfed5fe
jne 0x1400157e0
or r12d, 2
mov eax, 0xbe8de38a
jmp 0x1400157e0
cmp ecx, 0x898c073f
je 0x140015fb9
mov eax, ecx
cmp ecx, 0x91a0b4ec
jne 0x1400157e0
mov eax, 0xd5353063
mov esi, 0x200
jmp 0x1400157e0
cmp ecx, 0x638a99f2
je 0x140015fc3
mov eax, ecx
cmp ecx, 0x66a052fa
jne 0x1400157e0
cmp dword [rsp + 0x2c], 0x454c
mov eax, 0x84d2268b
jmp 0x1400157ce
mov eax, r15d
xor eax, 0xffffffef
test eax, r15d
mov eax, 0xf6dddee1
mov ecx, 0xa7cd97dc
cmove eax, ecx
jmp 0x1400157e0
mov eax, dword [0x140044d38]
mov ecx, dword [0x140044d3c]
lea edx, [rax - 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete al
cmp ecx, 0xa
setl r8b
xor r8b, al
mov r8d, 0x4b62ba24
mov r9d, 0xb9cfd8c3
cmovne r8d, r9d
cmp edx, 0xffffffff
mov eax, r8d
cmove eax, r9d
cmp ecx, 0xa
cmovge eax, r8d
jmp 0x1400157e0
mov rcx, r14
xor edx, edx
xor r8d, r8d
xor r9d, r9d
mov rax, qword [sym.imp.KERNEL32.dll_SetFilePointer]
call rax
mov qword [rsp + 0x20], 0
mov rcx, r14
lea rdx, [rsp + 0x32]
mov r8d, 2
lea r9, [rsp + 0x38]
mov r13, qword [sym.imp.KERNEL32.dll_ReadFile]
call r13
mov rcx, r14
mov edx, 0x24
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov qword [rsp + 0x20], 0
mov rcx, r14
lea rdx, [rsp + 0x34]
mov r8d, 4
lea r9, [rsp + 0x38]
call r13
movzx eax, word [rsp + 0x32]
cmp eax, 0x54ad
mov eax, 0x898c073f
mov ecx, 0xf20ec196
cmove eax, ecx
jmp 0x1400157e0
or r12d, 0x40000000
mov eax, 0x41761fd1
jmp 0x1400157e0
cmp dword [rsp + 0x2c], 0x4550
mov eax, 0x5d257095
jmp 0x1400157ce
or r12d, 1
mov eax, 0x73618324
jmp 0x1400157e0
mov eax, 0x5d257095
jmp 0x1400157e0
or r12d, 0x400000
mov eax, 0xb9cfd8c3
jmp 0x1400157e0
mov eax, r15d
not eax
or eax, 0xffffffdf
cmp eax, 0xffffffff
mov eax, 0x82ef2c6f
mov ecx, 0xe014cdaa
cmove eax, ecx
jmp 0x1400157e0
mov eax, dword [0x140044d38]
mov ecx, dword [0x140044d3c]
lea edx, [rax + 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete al
cmp ecx, 0xa
setl r8b
xor r8b, al
mov r8d, 0x4b62ba24
mov r9d, 0x462baff9
cmovne r8d, r9d
cmp edx, 0xffffffff
mov eax, r8d
cmove eax, r9d
cmp ecx, 0xa
cmovge eax, r8d
or r12d, 0x400000
jmp 0x1400157e0
mov rax, qword [rsp + 0x8c]
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
lea rdx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [rsp + 0x48]
mov eax, dword [rsp + 0x50]
shl ecx, 9
add ecx, 0xffff8800
movzx edx, word [rsp + 0x4a]
shl edx, 5
mov r8d, edx
xor r8d, 0xfffffe00
and r8d, edx
mov r9d, r8d
not r9d
mov edx, ecx
not edx
mov r10d, r9d
and r10d, 0x3b73
and r8d, 0xc480
or r8d, r10d
or r9d, edx
and edx, 0x3b73
and ecx, 0xc400
or ecx, edx
xor ecx, r8d
not r9d
movzx r8d, word [rsp + 0x4e]
mov edx, r8d
xor edx, 0xffe0
and edx, r8d
or edx, r9d
or edx, ecx
shl eax, 0xb
movd xmm0, dword [rsp + 0x52]
pmullw xmm0, xmm6
pxor xmm0, xmm7
por xmm0, xmm8
pxor xmm0, xmm7
movd ecx, xmm0
xor ecx, eax
pextrw eax, xmm0, 1
or eax, ecx
movzx eax, ax
shl edx, 0x10
or edx, eax
mov rax, qword [rsp + 0x150]
mov dword [rax], edx
mov eax, 0xfbff202f
jmp 0x1400157e0
mov r15d, dword [rsp + 0x78]
mov eax, r15d
not eax
or eax, 0xfffffffe
cmp eax, 0xffffffff
mov eax, 0x85435896
mov ecx, 0x73618324
cmove eax, ecx
xor r12d, r12d
jmp 0x1400157e0
mov eax, 0xa0344c26
jmp 0x1400157e0
mov rax, qword [rsp + 0x60]
mov dword [rax], r12d
mov eax, 0xf2b2101a
jmp 0x1400157e0
mov rax, qword [rsp + 0x68]
mov dword [rax], ebx
mov eax, 0xa47ed9f1
jmp 0x1400157e0
mov eax, r15d
xor eax, 0xfffffffd
test eax, r15d
mov eax, 0xfed5fe
mov ecx, 0xbe8de38a
cmove eax, ecx
jmp 0x1400157e0
mov rcx, qword [rsp + 0x84]
movabs r8, 0xfe624e212ac18000
add rcx, r8
mov rax, rcx
movabs r9, 0xd6bf94d5e57a42bd
imul r9
add rdx, rcx
mov rax, rdx
shr rax, 0x3f
sar rdx, 0x17
add rdx, rax
mov r10, qword [rsp + 0x58]
mov qword [r10], rdx
mov rcx, qword [rsp + 0x8c]
movabs rax, 0xdf8775560e6f004b
add rcx, rax
add rcx, r8
sub rcx, rax
mov rax, rcx
imul r9
add rdx, rcx
mov rax, rdx
shr rax, 0x3f
sar rdx, 0x17
add rdx, rax
mov qword [r10 + 8], rdx
mov rcx, qword [rsp + 0x7c]
movabs rax, 0x90a5219d917f2448
sub rcx, rax
add rax, r8
add rcx, rax
mov rax, rcx
imul r9
add rdx, rcx
mov rax, rdx
shr rax, 0x3f
sar rdx, 0x17
add rdx, rax
mov qword [r10 + 0x10], rdx
mov eax, 0x35ba103a
jmp 0x1400157e0
or r12d, 0x800000
mov eax, 0xa0344c26
jmp 0x1400157e0
mov eax, 0xfc39741c
jmp 0x1400157e0
mov eax, r15d
not eax
or eax, 0xffffffef
cmp eax, 0xffffffff
mov eax, 0x784f5e4a
mov ecx, 0xb6ad3a02
cmove eax, ecx
jmp 0x1400157e0
mov eax, ecx
cmp ecx, 0xd5353063
jne 0x1400157e0
mov eax, esi
movaps xmm6, xmmword [rsp + 0xb0]
movaps xmm7, xmmword [rsp + 0xc0]
movaps xmm8, xmmword [rsp + 0xd0]
add rsp, 0xe8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret