Function at 0x140158f40
Capabilities:
Get file size
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
test rcx, rcx
mov rbx, rcx
mov r12, rdx
mov qword [rsp + 0xe0], r8
mov dword [rsp + 0xe8], r9d
je 0x140157e14
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [0x1402a44a0]
mov qword [rsp + 0x48], rax
call rax
mov rdi, qword [0x1402a44c8]
test rdi, rdi
jne 0x1401578cc
jmp 0x140157b64
mov rdi, qword [rdi]
test rdi, rdi
je 0x140157b64
lea rcx, [rdi + 0x28]
mov rdx, rbx
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x1401578c0
mov rsi, qword [rdi + 0x20]
mov eax, dword [rdi + 0x18]
test rsi, rsi
jne 0x140157eef
test eax, eax
jne 0x140157b64
mov rdx, qword [rdi + 0x10]
test rdx, rdx
je 0x140157b64
mov rcx, rdx
mov qword [rsp + 0x58], rdx
call sub.msvcrt.dll_strlen
lea r8, [rax + 1]
mov rcx, r8
mov qword [rsp + 0x50], r8
call sub.msvcrt.dll_malloc
test rax, rax
mov rdi, rax
mov qword [rsp + 0x60], rax
je 0x140157b64
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x1402a44a0]
mov qword [rsp + 0x58], rax
call rax
xor r9d, r9d
mov rcx, rdi
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
mov r8d, 2
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov rdi, rax
je 0x1401579b6
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov ebp, eax
je 0x1401579ad
lea eax, [rax + rax]
cmp ebp, eax
jb 0x140157cb1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call fcn.14016b5d8
lea rcx, [0x1402a44a0]
mov rax, qword [rsp + 0x48]
call rax
mov rdi, qword [0x1402a44c8]
test rdi, rdi
jne 0x1401579ec
jmp 0x140157c21
mov rdi, qword [rdi]
test rdi, rdi
je 0x140157c21
lea rcx, [rdi + 0x28]
mov rdx, rbx
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x1401579e0
test rsi, rsi
je 0x140157eb3
mov qword [rdi + 0x20], rsi
lea rcx, [0x1402a44a0]
mov rax, qword [rsp + 0x58]
call rax
test rsi, rsi
je 0x140157b71
mov ebx, dword [rsi + 0x38]
cmp ebx, 2
jbe 0x140157bb0
mov r9, qword [rsi + 0x40]
test r9, r9
je 0x140157bb0
mov rcx, r12
mov qword [rsp + 0x50], r9
call sub.msvcrt.dll_strlen
mov r10, r12
mov dword [rsp + 0x48], eax
xor r8d, r8d
mov r9, qword [rsp + 0x50]
jmp 0x140157a8a
shl r8d, 4
add r10, 1
add r8d, eax
mov edx, r8d
mov ecx, r8d
and edx, 0xf0000000
and ecx, 0xfffffff
mov eax, edx
shr eax, 0x18
xor eax, ecx
test edx, edx
cmovne r8d, eax
movsx eax, byte [r10]
test al, al
jne 0x140157a60
mov eax, r8d
xor edx, edx
lea ecx, [rbx - 2]
div ebx
mov eax, r8d
mov r11d, ebx
mov r14d, dword [rsi + 0x10]
movzx r13d, word [rsi + 0x14]
mov qword [rsp + 0xd8], r12
mov r12, rsi
mov edi, edx
xor edx, edx
div ecx
lea r15d, [rdx + 1]
mov ebp, r15d
sub r11d, r15d
mov esi, r15d
sub ebp, ebx
mov r15d, r11d
mov r8d, ebp
mov rbp, r9
jmp 0x140157b26
mov eax, dword [rdx]
bswap eax
cmp dword [rsp + 0x48], eax
ja 0x140157b17
mov edx, dword [rdx + 4]
mov rax, qword [r12]
bswap edx
mov edx, edx
mov rcx, qword [rsp + 0xd8]
add rdx, rax
mov dword [rsp + 0x50], r8d
call sub.msvcrt.dll_strcmp
test eax, eax
mov r8d, dword [rsp + 0x50]
je 0x140157e83
lea eax, [rdi + r8]
lea edx, [rdi + rsi]
cmp edi, r15d
cmovb eax, edx
mov edi, eax
mov eax, edi
test r14d, r14d
mov eax, dword [rbp + rax*4]
je 0x140157b33
bswap eax
test eax, eax
je 0x140157ca1
lea ebx, [rax - 1]
cmp ebx, r13d
jae 0x140157b17
mov rax, qword [r12 + 0x28]
mov edx, ebx
test r14d, r14d
lea rdx, [rax + rdx*8]
jne 0x140157ae0
mov eax, dword [rsp + 0x48]
cmp eax, dword [rdx]
ja 0x140157b17
mov rax, qword [r12]
mov edx, dword [rdx + 4]
jmp 0x140157af5
lea rcx, [0x1402a44a0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp qword [rsp + 0xe0], 0
je 0x140157e30
cmp dword [rsp + 0xe8], 1
je 0x140157e30
mov rax, qword [rsp + 0xe0]
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
movzx r13d, word [rsi + 0x14]
xor ebp, ebp
jmp 0x140157be2
mov edx, dword [r14 + rax*8 + 4]
mov rcx, r12
bswap edx
mov edx, edx
add rdx, rbx
call sub.msvcrt.dll_strcmp
test eax, eax
js 0x140157c14
je 0x140157c70
lea ebp, [r15 + 1]
cmp ebp, r13d
jae 0x140157b71
mov edi, dword [rsi + 0x10]
mov rbx, qword [rsi]
mov r14, qword [rsi + 0x28]
lea r15d, [rbp + r13]
shr r15d, 1
test edi, edi
mov eax, r15d
jne 0x140157bc0
mov edx, dword [r14 + rax*8 + 4]
mov rcx, r12
add rdx, rbx
call sub.msvcrt.dll_strcmp
test eax, eax
jns 0x140157bd8
cmp ebp, r15d
mov r13d, r15d
jb 0x140157bf1
jmp 0x140157b71
mov rax, qword [rsp + 0x58]
lea rcx, [0x1402a44a0]
call rax
mov rcx, qword [rsi]
call fcn.14016b5d8
mov rcx, qword [rsi + 0x18]
call fcn.14016b5d8
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x140157c60
nop dword [rax]
mov rbx, qword [rcx]
call fcn.14016b5d8
test rbx, rbx
mov rcx, rbx
jne 0x140157c50
mov rcx, rsi
call fcn.14016b5d8
jmp 0x140157b71
cmp qword [rsp + 0xe0], 0
mov r9d, dword [rsp + 0xe8]
mov edx, r15d
mov rcx, rsi
setne r8b
movzx r8d, r8b
call fcn.140157410
mov qword [rsp + 0xe0], rax
jmp 0x140157b8e
mov rsi, r12
mov r12, qword [rsp + 0xd8]
jmp 0x140157bb5
mov ecx, eax
call sub.msvcrt.dll_malloc
test rax, rax
mov r15, rax
mov qword [rsp + 0x50], rax
je 0x1401579ad
mov eax, ebp
lea r14, [rsp + 0x7c]
mov rbp, qword [sym.imp.KERNEL32.dll_ReadFile]
mov qword [rsp + 0x68], rax
mov r13, rax
jmp 0x140157cf2
mov eax, dword [rsp + 0x7c]
cmp r13, rax
ja 0x140157d0d
add r15, rax
sub r13, rax
je 0x140157d25
mov qword [rsp + 0x20], 0
mov r9, r14
mov r8d, r13d
mov rdx, r15
mov rcx, rdi
call rbp
test eax, eax
jne 0x140157ce1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call fcn.14016b5d8
jmp 0x1401579b6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x50]
mov r14d, dword [rax]
cmp r14d, 0x950412de
setne bpl
cmp r14d, 0xde120495
je 0x140157d53
test bpl, bpl
jne 0x140157ed6
mov ecx, 1
mov edx, 0x48
call sub.msvcrt.dll_calloc
test rax, rax
mov rdi, rax
mov rcx, qword [rsp + 0x50]
je 0x140157ee3
mov rax, qword [rsp + 0x68]
movzx ebp, bpl
mov qword [rdi], rcx
mov dword [rdi + 0x10], ebp
add rax, rcx
cmp r14d, 0x950412de
mov qword [rdi + 8], rax
je 0x140157e3d
mov edx, dword [rcx + 4]
test edx, edx
jne 0x140157ebf
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 8]
bswap eax
cmp eax, 0xfffe
ja 0x140157ebf
mov rcx, qword [rsp + 0x50]
mov word [rdi + 0x14], ax
mov edx, dword [rcx + 0xc]
bswap edx
mov edx, edx
add rdx, rcx
mov qword [rdi + 0x28], rdx
mov edx, dword [rcx + 0x10]
bswap edx
mov edx, edx
add rdx, rcx
mov qword [rdi + 0x30], rdx
mov edx, dword [rcx + 0x14]
bswap edx
mov dword [rdi + 0x38], edx
mov edx, dword [rcx + 0x18]
bswap edx
mov edx, edx
add rdx, qword [rsp + 0x50]
mov ecx, eax
mov qword [rdi + 0x40], rdx
mov edx, 2
call sub.msvcrt.dll_calloc
test rax, rax
mov qword [rdi + 0x18], rax
je 0x140157ebf
mov rsi, rdi
jmp 0x1401579b6
mov rbx, qword [0x1402a4488]
lea rax, [0x1402827fb]
test rbx, rbx
cmove rbx, rax
jmp 0x140157892
mov qword [rsp + 0xe0], r12
jmp 0x140157b8e
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 4]
test eax, eax
jne 0x140157ebf
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 8]
cmp eax, 0xfffe
ja 0x140157ebf
mov rcx, qword [rsp + 0x50]
mov word [rdi + 0x14], ax
mov edx, dword [rcx + 0xc]
add rdx, rcx
mov qword [rdi + 0x28], rdx
mov edx, dword [rcx + 0x10]
add rdx, rcx
mov qword [rdi + 0x30], rdx
mov edx, dword [rcx + 0x14]
mov dword [rdi + 0x38], edx
mov edx, dword [rcx + 0x18]
jmp 0x140157dea
cmp qword [rsp + 0xe0], 0
mov r9d, dword [rsp + 0xe8]
mov edx, ebx
mov rcx, r12
setne r8b
movzx r8d, r8b
call fcn.140157410
mov qword [rsp + 0xe0], rax
jmp 0x140157b8e
mov dword [rdi + 0x18], 1
jmp 0x140157a09
mov rcx, qword [rsp + 0x50]
call fcn.14016b5d8
mov rcx, rdi
call fcn.14016b5d8
jmp 0x1401579b6
mov rcx, rax
call fcn.14016b5d8
jmp 0x1401579b6
call fcn.14016b5d8
xor esi, esi
jmp 0x1401579b6
lea rcx, [0x1402a44a0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x140157a17
xor r9d, r9d
xor r8d, r8d
jmp 0x140157860