Function at 0x140005260
Capabilities:
Get file size
Parse pe header

Disassembly:
mov r11, rsp
push rbx
push r14
sub rsp, 0x88
xor eax, eax
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
mov qword [r11 - 0x18], r12
mov rdi, rdx
mov qword [r11 - 0x20], r13
mov qword [r11 - 0x60], rax
lea rdx, [r11 - 0x40]
xor r14d, r14d
mov qword [r11 - 0x28], r15
mov r12, r8
mov qword [r11 - 0x58], rax
mov qword [r11 - 0x50], rax
mov qword [r11 - 0x48], rax
mov rbx, r14
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x38], rax
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x60], rcx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x1400052e1
lea r9, str.GetFileSizeEx__
lea rcx, str..QHImageHlp.c
xor r8d, r8d
mov edx, 0x11e
call fcn.1400090d0
jmp 0x140005b65
mov ecx, 0x4000
mov dword [rsp + 0x68], 0x4000
call fcn.140010e78
mov rbx, rax
test rax, rax
jne 0x140005304
lea ecx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov qword [rsp + 0x60], rbx
test rbx, rbx
jne 0x140005331
lea r9, [0x140023318]
lea rcx, str..QHImageHlp.c
xor r8d, r8d
mov edx, 0x223
call fcn.1400090d0
mov rbx, r14
jmp 0x140005b65
lea r9, [rsp + 0x38]
mov r8d, 0x40
mov rdx, rdi
xor ecx, ecx
call fcn.1400050e0
test eax, eax
je 0x140005b62
mov eax, 0x5a4d
cmp word [rdi], ax
jne 0x140005b18
movsxd rax, dword [rdi + 0x3c]
test eax, eax
jle 0x140005b18
lea r9, [rsp + 0x38]
lea rdx, [rsp + 0x20]
mov rcx, rax
mov r8d, 4
call fcn.1400050e0
test eax, eax
je 0x140005b5d
cmp dword [rsp + 0x20], 0x4550
je 0x1400053b8
lea r9, str._rN_f
lea rcx, str..QHImageHlp.c
mov edx, 0x22e
mov r8d, 1
call fcn.1400092c0
mov rbx, r14
jmp 0x140005b65
movsxd rax, dword [rdi + 0x3c]
mov dword [r12 + 0xa0], r14d
mov rsi, rax
cmp eax, 0x110
jb 0x140005401
mov r8d, 0x90
lea r9, [rsp + 0x38]
mov rdx, rdi
lea ecx, [r8 - 0x10]
call fcn.1400050e0
test eax, eax
je 0x140005b58
cmp dword [rdi], 0x82c8851f
jne 0x140005401
mov dword [r12 + 0xa0], 0x80
lea r9, [rsp + 0x38]
lea rcx, [rsi + 4]
mov r8d, 0x14
mov rdx, rdi
call fcn.1400050e0
test eax, eax
je 0x140005b53
add rsi, 0x18
lea r9, [rsp + 0x38]
lea rdx, [rsp + 0xa0]
mov rcx, rsi
mov r8d, 2
call fcn.1400050e0
test eax, eax
je 0x140005b4e
movzx eax, word [rsp + 0xa0]
mov ecx, 0x10b
cmp ax, cx
jne 0x140005495
movzx eax, word [rdi + 0x10]
cmp ax, 0x78
jae 0x140005489
lea r9, [0x140023578]
lea rcx, str..QHImageHlp.c
mov edx, 0x248
mov r8d, 1
call fcn.1400092c0
mov rbx, r14
jmp 0x140005b65
mov ebx, 1
mov ebp, 0xe0
jmp 0x1400054df
mov ecx, 0x20b
cmp ax, cx
jne 0x140005af5
mov ax, word [rdi + 0x10]
mov ecx, 0x88
cmp ax, cx
jae 0x1400054d7
lea r9, [0x140023578]
lea rcx, str..QHImageHlp.c
mov edx, 0x24e
mov r8d, 1
call fcn.1400092c0
mov rbx, r14
jmp 0x140005b65
mov ebx, r14d
mov ebp, 0xf0
mov r15w, word [rdi + 2]
movzx eax, ax
cmp eax, ebp
cmovb ebp, eax
test ebp, ebp
je 0x14000550b
lea r9, [rsp + 0x38]
mov r8d, ebp
mov rdx, rdi
mov rcx, rsi
call fcn.1400050e0
test eax, eax
je 0x140005b49
test ebx, ebx
je 0x140005575
lea eax, [rsi + 0x40]
mov dword [r12], eax
lea eax, [rsi + 0x80]
mov dword [r12 + 4], eax
mov eax, dword [rdi + 0x80]
mov dword [r12 + 0xc], eax
mov eax, dword [rdi + 0x84]
mov dword [r12 + 0x14], eax
mov eax, dword [rdi + 0x40]
mov byte [r12 + 0x9c], r14b
mov dword [r12 + 0x10], eax
cmp word [rdi + 0x44], 1
jne 0x140005562
mov byte [r12 + 0x9d], 1
mov rbx, qword [rdi + 0x70]
mov qword [rsp + 0x30], rbx
jmp 0x1400055d4
mov byte [r12 + 0x9d], r14b
mov rbx, qword [rdi + 0x70]
mov qword [rsp + 0x30], rbx
jmp 0x1400055d4
lea eax, [rsi + 0x40]
mov dword [r12], eax
lea eax, [rsi + 0x90]
mov dword [r12 + 4], eax
mov eax, dword [rdi + 0x90]
mov dword [r12 + 0xc], eax
mov eax, dword [rdi + 0x94]
mov dword [r12 + 0x14], eax
mov eax, dword [rdi + 0x40]
mov byte [r12 + 0x9c], 1
mov dword [r12 + 0x10], eax
cmp word [rdi + 0x44], 1
jne 0x1400055c0
mov byte [r12 + 0x9d], 1
jmp 0x1400055c8
mov byte [r12 + 0x9d], r14b
mov rbx, qword [rdi + 0x80]
mov qword [rsp + 0x30], rbx
mov eax, dword [r12 + 4]
mov dword [r12 + 0x18], r14d
mov byte [r12 + 0x9e], r14b
add eax, 4
mov dword [r12 + 8], eax
mov eax, ebp
add rsi, rax
mov dword [r12 + 0xb0], esi
cmp dword [r12 + 0xa0], r14d
je 0x140005621
cmp byte [r12 + 0x9c], r14b
jne 0x140005621
cmp byte [r12 + 0x9d], r14b
je 0x140005621
mov r13d, 1
jmp 0x140005624
mov r13d, r14d
test ebx, ebx
jne 0x140005631
test r13d, r13d
je 0x140005aea
mov eax, 0x333
mov edx, 0xfffe
lea ecx, [rdx + 1]
mov word [rsp + 0xa0], ax
cmp r15w, ax
jbe 0x140005651
mov r15d, eax
jmp 0x14000565b
cmp r15w, cx
jne 0x14000565b
mov r15w, dx
movzx eax, r15w
lea ebp, [rax + rax*4]
shl ebp, 3
mov ecx, ebp
call fcn.140004f20
mov r10, rax
mov qword [rsp + 0x28], rax
test rax, rax
jne 0x14000569e
lea r9, [0x140023318]
lea rcx, str..QHImageHlp.c
xor r8d, r8d
mov edx, 0x289
call fcn.1400090d0
mov rbx, qword [rsp + 0x28]
jmp 0x140005b65
test ebp, ebp
je 0x1400056c2
lea r9, [rsp + 0x38]
mov r8d, ebp
mov rdx, rax
mov rcx, rsi
call fcn.1400050e0
test eax, eax
je 0x140005b42
mov r10, qword [rsp + 0x28]
add dword [r12 + 0xb0], ebp
test r13d, r13d
je 0x14000571e
mov r9, r10
movzx r8d, r14w
cmp r14w, r15w
jae 0x14000571e
nop dword [rax]
mov edx, dword [r9]
lea rcx, str.INIT
cmp edx, dword [rcx]
jne 0x1400056fc
mov dl, byte [r9 + 4]
cmp dl, byte [rcx + 4]
jne 0x1400056fc
mov eax, r14d
jmp 0x140005701
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x140005715
inc r8w
add r9, 0x28
cmp r8w, r15w
jb 0x1400056e0
jmp 0x14000571e
mov byte [r12 + 0x9e], 1
mov edx, dword [rsp + 0x34]
movzx r9d, r15w
mov r8, r10
mov ecx, ebx
call fcn.140005bc0
mov ebp, eax
test eax, eax
je 0x140005add
lea r9, [rsp + 0x38]
mov rcx, rbp
mov r8d, 0x10
mov rdx, rdi
call fcn.1400050e0
test eax, eax
je 0x140005a8d
mov bx, word [rdi + 0xe]
mov r13d, 0x1000
lea eax, [rbp + 0x10]
add bx, word [rdi + 0xc]
cmp bx, r13w
jbe 0x140005772
mov ebx, r13d
movzx r8d, bx
shl r8d, 3
test r8d, r8d
je 0x140005796
lea r9, [rsp + 0x38]
mov ecx, eax
mov rdx, rdi
call fcn.1400050e0
test eax, eax
je 0x140005a7d
mov ecx, 0xffff
mov rax, rdi
cmp bx, cx
jne 0x1400057a8
mov ebx, 0xfffe
movzx ecx, r14w
cmp r14w, bx
jae 0x140005a6d
bt dword [rax], 0x1f
jb 0x1400057c2
cmp word [rax], 0xa
je 0x1400057de
inc cx
add rax, 8
cmp cx, bx
jb 0x1400057b6
mov rbx, qword [rsp + 0x28]
mov r14d, 1
jmp 0x140005b65
cmp cx, bx
jae 0x1400059fd
mov esi, dword [rax + 4]
bt esi, 0x1f
jae 0x140005acd
btr esi, 0x1f
lea r9, [rsp + 0x38]
mov r8d, 0x10
add esi, ebp
mov rdx, rdi
mov ecx, esi
call fcn.1400050e0
test eax, eax
je 0x140005a5d
mov bx, word [rdi + 0xe]
add esi, 0x10
add bx, word [rdi + 0xc]
cmp bx, r13w
jbe 0x14000582b
mov ebx, r13d
movzx r8d, bx
shl r8d, 3
test r8d, r8d
je 0x14000584f
lea r9, [rsp + 0x38]
mov ecx, esi
mov rdx, rdi
call fcn.1400050e0
test eax, eax
je 0x140005a4d
mov ecx, 0xffff
mov rax, rdi
cmp bx, cx
jne 0x140005864
mov ecx, 0xfffe
mov bx, cx
movzx ecx, r14w
cmp r14w, bx
jae 0x140005a3d
mov edx, 0x360
bt dword [rax], 0x1f
jb 0x140005882
cmp word [rax], dx
je 0x14000589e
inc cx
add rax, 8
cmp cx, bx
jb 0x140005877
mov rbx, qword [rsp + 0x28]
mov r14d, 1
jmp 0x140005b65
cmp cx, bx
jae 0x1400059ed
mov esi, dword [rax + 4]
bt esi, 0x1f
jae 0x140005abd
btr esi, 0x1f
lea r9, [rsp + 0x38]
mov r8d, 0x10
add esi, ebp
mov rdx, rdi
mov ecx, esi
call fcn.1400050e0
test eax, eax
je 0x140005a2d
mov bx, word [rdi + 0xe]
add esi, 0x10
add bx, word [rdi + 0xc]
cmp bx, r13w
jbe 0x1400058eb
mov ebx, r13d
movzx r8d, bx
shl r8d, 3
test r8d, r8d
je 0x14000590f
lea r9, [rsp + 0x38]
mov ecx, esi
mov rdx, rdi
call fcn.1400050e0
test eax, eax
je 0x140005a1d
mov eax, 0xffff
mov rcx, rdi
cmp bx, ax
jne 0x140005924
mov eax, 0xfffe
mov bx, ax
movzx eax, r14w
cmp r14w, bx
jae 0x140005a0d
bt dword [rcx], 0x1f
jae 0x140005954
inc ax
add rcx, 8
cmp ax, bx
jb 0x140005932
mov rbx, qword [rsp + 0x28]
mov r14d, 1
jmp 0x140005b65
cmp ax, bx
jae 0x1400059dd
mov eax, dword [rcx + 4]
bt eax, 0x1f
jb 0x140005aad
lea ecx, [rbp + rax]
lea r9, [rsp + 0x38]
mov r8d, 0x10
mov rdx, rdi
call fcn.1400050e0
test eax, eax
je 0x140005b3b
cmp dword [rdi + 4], 0x80
jne 0x140005a9d
mov rbx, qword [rsp + 0x28]
mov ecx, dword [rdi]
movzx r9d, r15w
mov r8, rbx
mov edx, 0x80
call fcn.140005bc0
lea rdx, [r12 + 0x1c]
lea r9, [rsp + 0x38]
mov ecx, eax
mov r8d, 0x80
call fcn.1400050e0
test eax, eax
je 0x140005b65
mov dword [r12 + 0x18], ebp
mov r14d, 1
jmp 0x140005b65
mov rbx, qword [rsp + 0x28]
mov r14d, 1
jmp 0x140005b65
mov rbx, qword [rsp + 0x28]
mov r14d, 1
jmp 0x140005b65
mov rbx, qword [rsp + 0x28]
mov r14d, 1
jmp 0x140005b65
mov rbx, qword [rsp + 0x28]
mov r14d, 1
jmp 0x140005b65
mov rbx, qword [rsp + 0x28]
mov r14d, 1
jmp 0x140005b65
mov rbx, qword [rsp + 0x28]
mov r14d, 1
jmp 0x140005b65
mov rbx, qword [rsp + 0x28]
mov r14d, 1
jmp 0x140005b65
mov rbx, qword [rsp + 0x28]
mov r14d, 1
jmp 0x140005b65
mov rbx, qword [rsp + 0x28]
mov r14d, 1
jmp 0x140005b65
mov rbx, qword [rsp + 0x28]
mov r14d, 1
jmp 0x140005b65
mov rbx, qword [rsp + 0x28]
mov r14d, 1
jmp 0x140005b65
mov rbx, qword [rsp + 0x28]
mov r14d, 1
jmp 0x140005b65
mov rbx, qword [rsp + 0x28]
mov r14d, 1
jmp 0x140005b65
mov rbx, qword [rsp + 0x28]
mov r14d, 1
jmp 0x140005b65
mov rbx, qword [rsp + 0x28]
mov r14d, 1
jmp 0x140005b65
mov rbx, qword [rsp + 0x28]
mov r14d, 1
jmp 0x140005b65
mov rbx, qword [rsp + 0x28]
mov r14d, 1
jmp 0x140005b65
mov rbx, r14
mov r14d, 1
jmp 0x140005b65
lea r9, str._rN_e
lea rcx, str..QHImageHlp.c
mov edx, 0x252
mov r8d, 1
call fcn.1400092c0
mov rbx, r14
jmp 0x140005b65
lea r9, str._rN_f
lea rcx, str..QHImageHlp.c
mov edx, 0x229
mov r8d, 1
call fcn.1400092c0
mov rbx, r14
jmp 0x140005b65
mov rbx, qword [rsp + 0x28]
jmp 0x140005b65
mov rbx, qword [rsp + 0x28]
jmp 0x140005b65
mov rbx, r14
jmp 0x140005b65
mov rbx, r14
jmp 0x140005b65
mov rbx, r14
jmp 0x140005b65
mov rbx, r14
jmp 0x140005b65
mov rbx, r14
jmp 0x140005b65
mov rbx, r14
mov rcx, qword [rsp + 0x60]
mov r15, qword [rsp + 0x70]
mov r13, qword [rsp + 0x78]
mov r12, qword [rsp + 0x80]
mov rdi, qword [rsp + 0xb8]
mov rsi, qword [rsp + 0xb0]
mov rbp, qword [rsp + 0xa8]
test rcx, rcx
je 0x140005b9e
call fcn.140010e38
test rbx, rbx
je 0x140005bab
mov rcx, rbx
call fcn.140010e38
mov eax, r14d
add rsp, 0x88
pop r14
pop rbx
ret