Function at 0x140010be4
Capabilities:
Get file size
Move file

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xab8]
sub rsp, 0xb90
mov rax, qword [0x14005b178]
xor rax, rsp
mov qword [rbp + 0xa80], rax
mov rdi, rcx
lea rcx, [rbp + 0x681]
xor ebx, ebx
xor edx, edx
mov r8d, 0x3ff
mov byte [rbp + 0x680], bl
call fcn.140018a40
mov esi, 0x104
lea rcx, [rbp + 0x61]
mov r8d, esi
xor edx, edx
mov byte [rbp + 0x60], bl
call fcn.140018a40
lea rcx, [rbp + 0x171]
mov r8d, esi
xor edx, edx
mov byte [rbp + 0x170], bl
call fcn.140018a40
lea rcx, [rsp + 0x51]
mov r8d, esi
xor edx, edx
mov byte [rsp + 0x50], bl
call fcn.140018a40
test rdi, rdi
je 0x140010f46
or rsi, 0xffffffffffffffff
mov rax, rsi
inc rax
cmp byte [rdi + rax], bl
jne 0x140010c8a
test rax, rax
je 0x140010f46
mov r12d, 0x105
lea rcx, [rsp + 0x50]
mov r8, rdi
mov edx, r12d
call fcn.1400130d8
mov r15d, ebx
mov dword [rsp + 0x40], ebx
mov edi, 0x400
mov r13d, 1
lea rcx, [rbp + 0x281]
xor edx, edx
mov r8d, 0x3ff
mov dword [rsp + 0x44], ebx
mov byte [rbp + 0x280], bl
call fcn.140018a40
lea rax, [rsp + 0x50]
test rax, rax
je 0x140010ddb
lea rcx, [rsp + 0x50]
mov rax, rsi
inc rax
cmp byte [rcx + rax], bl
jne 0x140010cf7
test rax, rax
je 0x140010ddb
lea rcx, [rsp + 0x50]
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
call fcn.140007508
mov r15, rax
cmp rax, rsi
je 0x140010dd6
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r14d, eax
cmp eax, 0xffffffff
je 0x140010dcd
mov esi, ebx
test eax, eax
je 0x140010dcd
mov edx, r14d
mov ecx, r13d
sub edx, esi
call fcn.140011430
mov edi, eax
mov eax, 0x400
cmp edi, eax
cmova edi, eax
test edi, edi
je 0x140010d94
lea r12, [rbp + 0x280]
mov r13d, edi
mov edx, 0xff
xor ecx, ecx
call fcn.140011430
mov byte [r12], al
inc r12
dec r13
jne 0x140010d76
mov r13d, 1
lea r9, [rsp + 0x44]
lea rdx, [rbp + 0x280]
mov r8d, edi
mov rcx, r15
mov dword [rsp + 0x44], ebx
call fcn.1400078ac
test eax, eax
je 0x140010dc2
cmp edi, dword [rsp + 0x44]
jne 0x140010dc2
add esi, dword [rsp + 0x44]
cmp esi, r14d
jb 0x140010d4f
mov edi, 0x400
mov r12d, 0x105
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r15d, dword [rsp + 0x40]
mov edx, edi
mov ecx, r13d
call fcn.140011430
mov edi, eax
test eax, eax
je 0x140010e0b
lea rsi, [rbp + 0x680]
mov r14d, edi
mov edx, 0xff
xor ecx, ecx
call fcn.140011430
mov byte [rsi], al
add rsi, r13
sub r14, r13
jne 0x140010df5
lea rax, [rsp + 0x50]
test rax, rax
je 0x140010e29
lea rdx, [rbp + 0x680]
lea rcx, [rsp + 0x50]
mov r8d, edi
call fcn.140010f78
lea r8, [rsp + 0x50]
lea rcx, [rbp + 0x60]
mov rdx, r12
call fcn.1400130d8
lea rcx, [rbp + 0x60]
mov edx, 0x5c
call fcn.140012f94
test rax, rax
je 0x140010f3a
or rsi, 0xffffffffffffffff
mov rcx, rsi
inc rcx
cmp byte [rax + rcx], bl
jne 0x140010e58
mov byte [rax + 1], bl
lea rdx, [rbp + 0x60]
mov rax, rsi
inc rax
cmp byte [rdx + rax], bl
jne 0x140010e6a
mov r9d, 0x104
mov r8d, ecx
lea rcx, [rbp + 0x170]
sub r9d, eax
call fcn.140011630
test eax, eax
je 0x140010ec4
lea r8, [rbp + 0x170]
lea rcx, [rbp + 0x60]
mov rdx, r12
call fcn.14001486c
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x50]
call fcn.1400158c0
test eax, eax
jne 0x140010ec4
lea r8, [rbp + 0x60]
lea rcx, [rsp + 0x50]
mov rdx, r12
call fcn.1400130d8
add r15d, r13d
mov edi, 0x400
mov dword [rsp + 0x40], r15d
cmp r15d, 3
jl 0x140010cc3
mov rax, qword [0x1400a07f0]
test rax, rax
jne 0x140010f01
lea edx, [rax + 0x25]
xor ecx, ecx
call fcn.140007338
mov qword [0x1400a07f0], rax
test rax, rax
jne 0x140010f01
mov eax, ebx
jmp 0x140010f08
lea rcx, [rsp + 0x50]
call rax
test eax, eax
lea rcx, [rsp + 0x50]
mov rdx, r12
cmovne ebx, r13d
call fcn.140010a84
lea rcx, [rbp + 0x60]
mov rdx, r12
call fcn.140010a84
lea rcx, [rbp + 0x170]
mov rdx, r12
call fcn.140010a84
mov eax, ebx
jmp 0x140010f48
lea rcx, [rbp + 0x60]
mov rdx, r12
call fcn.140010a84
xor eax, eax
mov rcx, qword [rbp + 0xa80]
xor rcx, rsp
call fcn.140012b40
lea r11, [rsp + 0xb90]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret