Function at 0x14010cb6c
Capabilities:
Get file size

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xf0
mov qword [rbp - 9], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x14045cbf0]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r13, rdx
mov r14, rcx
xor r15d, r15d
mov r12d, r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r15 + 7]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x48], rax
cmp rax, 0xffffffffffffffff
jne 0x14010cbf1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
jmp 0x14010d120
mov ecx, 0x30
call fcn.1400be454
mov rsi, rax
test rax, rax
je 0x14010cc29
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsi], rax
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], r15
mov qword [rsi + 0x20], r15
jmp 0x14010cc2c
mov rsi, r15
mov qword [rbp - 0x69], rsi
mov qword [rbp - 0x61], r15
mov rdx, rsi
lea rcx, [rbp - 0x29]
call fcn.1400a4868
mov rdx, qword [rbp - 0x61]
mov rcx, qword [rax]
mov qword [rbp - 0x61], rcx
mov qword [rax], rdx
mov rdi, qword [rbp - 0x29]
test rdi, rdi
je 0x14010cc7a
lock dec dword [rdi + 8]
jne 0x14010cc75
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lock dec dword [rdi + 0xc]
jne 0x14010cc75
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
mov rbx, qword [rsp + 0x48]
mov r8, rsi
mov rdx, rsi
lea rcx, [rbp - 0x69]
call fcn.1400020a0
nop
test r13, r13
jne 0x14010cc94
mov ecx, r15d
jmp 0x14010cca6
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
mov rdx, r13
mov rcx, qword [rbp - 0x69]
call fcn.14000c9f8
lea rdx, [rbp - 0x3d]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rbp - 0x41], eax
cmp eax, 0xffffffff
jne 0x14010ccd8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
jmp 0x14010d0d3
mov rcx, qword [rbp - 0x41]
mov rax, qword [rbp - 0x69]
mov qword [rax + 8], rcx
mov r13b, 1
mov qword [rbp - 0x71], r15
mov dword [rsp + 0x40], r15d
test r13b, r13b
je 0x14010d0ac
mov rax, qword [r14]
mov rcx, r14
call qword [rax + 0x30]
mov rdx, qword [r14]
mov rcx, r14
call qword [rdx + 0x10]
test al, al
jne 0x14010d0a6
xor eax, eax
mov qword [rbp - 1], rax
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], rax
lea rax, [rbp - 0x71]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], r15d
lea r9, [rsp + 0x40]
mov r8d, 0x18
lea rdx, [rbp - 1]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_BackupRead]
test eax, eax
jne 0x14010cd61
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
jmp 0x14010d052
cmp dword [rsp + 0x40], r15d
jne 0x14010cd6d
mov r13b, r15b
jmp 0x14010ccf0
cmp dword [rbp + 0xf], r15d
jbe 0x14010cfd4
mov edx, 2
mov r8d, edx
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax]
test rax, rax
je 0x14010d098
lea rdi, [rax + 0x18]
mov qword [rbp - 0x79], rdi
cmp dword [rdi - 0xc], 2
jl 0x14010d08d
mov dword [rdi - 0x10], 2
mov word [rdi + 4], r15w
mov r9d, 4
lea r8, [rbp + 0x13]
mov edx, r9d
mov rcx, rdi
call fcn.1400be954
nop
mov ecx, dword [rbp + 0xf]
sub rcx, 4
call fcn.1400b9290
mov rsi, rax
mov qword [rbp - 0x49], rax
mov r8d, dword [rbp + 0xf]
add r8d, 0xfffffffc
mov dword [rsp + 0x40], r15d
lea rax, [rbp - 0x71]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], r15d
lea r9, [rsp + 0x40]
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_BackupRead]
test eax, eax
jne 0x14010ce25
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
jmp 0x14010cfab
mov r8d, dword [rsp + 0x40]
test r8d, r8d
je 0x14010d05c
shr r8d, 1
lea r9, section..data
mov rdx, rsi
lea rcx, [rbp - 0x21]
call fcn.14000c328
nop
mov rdi, qword [rbp - 0x21]
mov r8d, dword [rdi - 0x10]
mov rdx, rdi
lea rcx, [rbp - 0x79]
call fcn.14000c0c4
nop
lea rdx, [rdi - 0x18]
or rsi, 0xffffffffffffffff
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14010ce7d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov ecx, 0x10
call fcn.1400be454
mov rbx, rax
test rax, rax
je 0x14010cea9
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx], rax
jmp 0x14010ceac
mov rbx, r15
mov qword [rbp - 0x59], rbx
mov qword [rbp - 0x51], r15
mov rdx, rbx
lea rcx, [rbp - 0x19]
call fcn.1400a48c4
mov rdx, qword [rbp - 0x51]
mov rcx, qword [rax]
mov qword [rbp - 0x51], rcx
mov qword [rax], rdx
mov rdi, qword [rbp - 0x19]
test rdi, rdi
je 0x14010ceff
mov eax, esi
lock xadd dword [rdi + 8], eax
add eax, esi
jne 0x14010ceff
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, esi
lock xadd dword [rdi + 0xc], eax
add eax, esi
jne 0x14010ceff
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
mov r8, rbx
mov rdx, rbx
lea rcx, [rbp - 0x59]
call fcn.1400020a0
nop
mov rax, qword [rbp - 0x79]
mov r8d, dword [rax - 0x10]
add r8d, 0xfffffffa
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x79]
call fcn.140024c5c
nop
mov rdx, rax
mov rcx, qword [rbp - 0x59]
call fcn.14000c244
nop
mov rdx, qword [rbp - 0x39]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14010cf54
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rbp + 7]
mov rax, qword [rbp - 0x59]
mov qword [rax + 8], rcx
mov rcx, qword [rbp - 0x69]
add rcx, 0x10
lea rdx, [rbp - 0x59]
call fcn.1400356a4
nop
mov rdi, qword [rbp - 0x51]
test rdi, rdi
je 0x14010cfa3
mov eax, esi
lock xadd dword [rdi + 8], eax
add eax, esi
jne 0x14010cfa3
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, esi
lock xadd dword [rdi + 0xc], eax
add eax, esi
jne 0x14010cfa3
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
mov rsi, qword [rbp - 0x49]
mov rdi, qword [rbp - 0x79]
mov rcx, rsi
call fcn.1400bee7c
nop
lea rdx, [rdi - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14010cfcf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rbp + 7]
test rax, rax
jle 0x14010d052
cmp dword [rbp - 1], 9
jne 0x14010d02d
cmp eax, 0x10000
ja 0x14010d09e
mov ecx, eax
call fcn.1400b9290
mov rdi, rax
lea rax, [rbp - 0x71]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], r15d
lea r9, [rsp + 0x40]
mov r8d, dword [rbp + 7]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_BackupRead]
mov rcx, rdi
call fcn.1400bee7c
jmp 0x14010d052
lea rcx, [rbp - 0x71]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x11]
mov qword [rsp + 0x20], rcx
lea r9, [rbp - 0x31]
mov r8d, dword [rbp + 0xb]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_BackupSeek]
test r12d, r12d
jne 0x14010d0ac
jmp 0x14010ccf0
mov r12d, 0xd
mov rcx, rsi
call fcn.1400bee7c
nop
lea rdx, [rdi - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14010d086
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x48]
jmp 0x14010d0ac
mov ecx, 0x80070057
call fcn.14000cbb8
int3
call fcn.140021aa0
int3
mov r12d, 0xd
jmp 0x14010d0ac
mov r12d, 0x4c7
lea rax, [rbp - 0x71]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_BackupRead]
mov rcx, qword [rbp - 0x69]
mov rax, qword [rcx + 0x18]
cmp qword [rcx + 0x10], rax
je 0x14010d0f4
test r12d, r12d
jne 0x14010d0f4
lea rcx, [r14 + 0x20]
mov rax, qword [rcx]
lea rdx, [rbp - 0x69]
call qword [rax]
nop
mov rdi, qword [rbp - 0x61]
test rdi, rdi
je 0x14010d120
lock dec dword [rdi + 8]
jne 0x14010d11b
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lock dec dword [rdi + 0xc]
jne 0x14010d11b
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
mov rbx, qword [rsp + 0x48]
test rbx, rbx
je 0x14010d12e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r12d
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1400be110
mov rbx, qword [rsp + 0x140]
add rsp, 0xf0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret