Function at 0x1400c874c
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xe0
mov rax, qword [0x14016d608]
xor rax, rsp
mov qword [rbp + 0x1f], rax
xor r13d, r13d
mov rbx, r9
and dword [rbp - 0x45], r13d
mov r14, rcx
mov rcx, qword [0x14016d090]
lea r12, [0x14016d090]
cmp rcx, r12
je 0x1400c87b7
test byte [rcx + 0x1c], 4
je 0x1400c87b7
cmp byte [rcx + 0x19], 4
jb 0x1400c87b7
mov rcx, qword [rcx + 0x10]
lea r8, [0x14014e5a0]
mov edx, 0xe3
call fcn.140004968
mov rcx, qword [r14]
lea rdx, [rbp - 0x39]
and qword [rbp - 0x19], r13
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x1400c881a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
mov rcx, qword [0x14016d090]
cmp rcx, r12
je 0x1400c880f
test byte [rcx + 0x1c], 4
je 0x1400c880f
cmp byte [rcx + 0x19], 2
jb 0x1400c880f
mov r9, qword [r14]
lea r8, [0x14014e5a0]
mov rcx, qword [rcx + 0x10]
mov edx, 0xe4
mov dword [rsp + 0x20], eax
call fcn.140004a90
mov rcx, qword [0x14016d090]
mov r13d, 8
jmp 0x1400c8eba
mov edi, 0x10000
xor ecx, ecx
mov edx, edi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp - 9], rax
mov r15, rax
test rax, rax
jne 0x1400c8846
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
lea r13d, [r15 + 3]
jmp 0x1400c8eb3
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea esi, [r9 + 1]
mov edx, esi
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbp - 0x19], rax
test rax, rax
jne 0x1400c8874
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
lea r13d, [rsi + 7]
jmp 0x1400c8ea9
and dword [rbp - 0x21], r13d
and dword [rbp - 0x1d], r13d
mov rcx, qword [0x14016d090]
cmp rcx, r12
je 0x1400c88a9
test byte [rcx + 0x1c], 4
je 0x1400c88a9
cmp byte [rcx + 0x19], 5
jb 0x1400c88a9
mov rcx, qword [rcx + 0x10]
lea r8, [0x14014e5a0]
mov edx, 0xe5
call fcn.140004968
mov rcx, qword [r14]
lea r9, [rbp - 0x31]
mov r8d, edi
mov rdx, r15
call fcn.1400b98c4
mov rcx, qword [r14]
lea r8, [rbp - 0x45]
mov r9d, esi
lea rdx, [rbp - 0x31]
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x1400c8916
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
mov rcx, qword [0x14016d090]
cmp rcx, r12
je 0x1400c890b
test byte [rcx + 0x1c], 4
je 0x1400c890b
cmp byte [rcx + 0x19], 2
jb 0x1400c890b
mov rcx, qword [rcx + 0x10]
lea r8, [0x14014e5a0]
mov edx, 0xe6
mov r9d, eax
call fcn.140004988
mov r13d, 4
jmp 0x1400c8ea9
mov r9d, dword [rbp - 0x45]
cmp r9d, edi
je 0x1400c8958
mov rcx, qword [0x14016d090]
cmp rcx, r12
je 0x1400c8950
test byte [rcx + 0x1c], 4
je 0x1400c8950
cmp byte [rcx + 0x19], 2
jb 0x1400c8950
mov edx, 0xe7
mov dword [rsp + 0x20], edi
mov rcx, qword [rcx + 0x10]
lea r8, [0x14014e5a0]
call fcn.14000f654
mov dword [rbx], 0x45d
jmp 0x1400c890b
mov r8d, 0x10
lea rdx, [0x14014e178]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_RtlCompareMemory]
cmp rax, 0x10
je 0x1400c8ea9
lea rax, [rbp - 0x49]
mov rdx, r15
lea r9, [rbp + 0xf]
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x11]
call fcn.1400cb684
test al, al
jne 0x1400c89d3
mov rcx, qword [0x14016d090]
cmp rcx, r12
je 0x1400c89c2
test byte [rcx + 0x1c], 4
je 0x1400c89c2
cmp byte [rcx + 0x19], 2
jb 0x1400c89c2
mov edx, pe_nt_image_headers64
mov rcx, qword [rcx + 0x10]
lea r8, [0x14014e5a0]
call fcn.140004968
mov dword [rbx], 0x570
mov r13d, 9
jmp 0x1400c8ea9
mov sil, byte [rbp - 0x49]
mov r8, qword [rbp - 0x39]
mov al, sil
neg al
sbb edi, edi
and edi, 0xfffffe00
add edi, 0x400
mov ecx, edi
cmp r8, rcx
jl 0x1400c8f23
mov r9d, 0x1ff
mov rax, r8
cqo
and rdx, r9
add rax, rdx
and rax, r9
cmp rax, rdx
jne 0x1400c8f23
sub r8, rcx
mov rax, r8
mov dword [rbp - 0x21], r8d
shr rax, 0x20
mov dword [rbp - 0x1d], eax
mov rcx, qword [0x14016d090]
cmp rcx, r12
je 0x1400c8a5c
test byte [rcx + 0x1c], 4
je 0x1400c8a5c
cmp byte [rcx + 0x19], 5
jb 0x1400c8a5c
mov rcx, qword [rcx + 0x10]
mov edx, 0xea
mov dword [rsp + 0x20], r8d
mov r9d, eax
lea r8, [0x14014e5a0]
call fcn.14000f654
mov rcx, qword [r14]
lea r9, [rbp - 0x31]
mov r8d, edi
mov rdx, r15
call fcn.1400b98c4
mov rcx, qword [r14]
lea r8, [rbp - 0x45]
mov r9d, 1
lea rdx, [rbp - 0x31]
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x1400c8a96
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
jmp 0x1400c890b
mov r9d, dword [rbp - 0x45]
cmp r9d, edi
je 0x1400c8ad5
mov rcx, qword [0x14016d090]
cmp rcx, r12
je 0x1400c8950
test byte [rcx + 0x1c], 4
je 0x1400c8950
cmp byte [rcx + 0x19], 2
jb 0x1400c8950
mov edx, 0xeb
mov dword [rsp + 0x20], 0x400
jmp 0x1400c8940
lea rax, [rbp - 0x49]
mov rdx, r15
lea r9, [rbp - 1]
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x41]
call fcn.1400cb684
test al, al
jne 0x1400c8b53
test sil, sil
je 0x1400c8b25
mov rcx, qword [0x14016d090]
cmp rcx, r12
je 0x1400c89c2
test byte [rcx + 0x1c], 4
je 0x1400c89c2
cmp byte [rcx + 0x19], 2
jb 0x1400c89c2
mov edx, 0xec
jmp 0x1400c89b2
mov rcx, qword [0x14016d090]
cmp rcx, r12
je 0x1400c89c2
test byte [rcx + 0x1c], 4
je 0x1400c89c2
cmp byte [rcx + 0x19], 2
jb 0x1400c89c2
mov edx, 0xed
jmp 0x1400c89b2
test sil, sil
jne 0x1400c8ba7
lea rax, [rbp - 0x49]
lea rdx, [r15 + 0x200]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 1]
lea r8, [rbp - 0x41]
call fcn.1400cb684
test al, al
jne 0x1400c8ba7
mov rcx, qword [0x14016d090]
cmp rcx, r12
je 0x1400c89c2
test byte [rcx + 0x1c], 4
je 0x1400c89c2
cmp byte [rcx + 0x19], 2
jb 0x1400c89c2
mov edx, 0xee
jmp 0x1400c89b2
mov r12, qword [rbp + 0xf]
cmp qword [rbp - 1], r12
jne 0x1400c8d29
mov rax, qword [rbp + 0x17]
cmp qword [rbp + 7], rax
jne 0x1400c8d29
mov rdi, qword [rbp - 0x11]
cmp rdi, qword [rbp - 0x41]
je 0x1400c8c7f
mov rcx, qword [0x14016d090]
lea r12, [0x14016d090]
cmp rcx, r12
je 0x1400c89c2
test byte [rcx + 0x1c], 4
je 0x1400c8c10
cmp byte [rcx + 0x19], 2
jb 0x1400c8c10
mov rcx, qword [rcx + 0x10]
lea r8, [0x14014e5a0]
mov edx, 0xf2
call fcn.140004968
mov rcx, qword [0x14016d090]
cmp rcx, r12
je 0x1400c89c2
test byte [rcx + 0x1c], 4
je 0x1400c8c45
cmp byte [rcx + 0x19], 2
jb 0x1400c8c45
mov r9, qword [rbp - 0x41]
lea r8, [0x14014e5a0]
mov rcx, qword [rcx + 0x10]
mov edx, 0xf3
call fcn.1400abd10
mov rcx, qword [0x14016d090]
cmp rcx, r12
je 0x1400c89c2
test byte [rcx + 0x1c], 4
je 0x1400c89c2
cmp byte [rcx + 0x19], 2
jb 0x1400c89c2
mov edx, 0xf4
mov r9, rdi
mov rcx, qword [rcx + 0x10]
lea r8, [0x14014e5a0]
call fcn.1400abd10
jmp 0x1400c89c2
cmp sil, byte [rbp - 0x49]
je 0x1400c8ea2
mov rcx, qword [0x14016d090]
lea r12, [0x14016d090]
cmp rcx, r12
je 0x1400c89c2
test byte [rcx + 0x1c], 4
je 0x1400c8cc8
cmp byte [rcx + 0x19], 2
jb 0x1400c8cc8
mov rcx, qword [rcx + 0x10]
lea r8, [0x14014e5a0]
mov edx, 0xf5
call fcn.140004968
mov rcx, qword [0x14016d090]
cmp rcx, r12
je 0x1400c89c2
test byte [rcx + 0x1c], 4
je 0x1400c8cfe
cmp byte [rcx + 0x19], 2
jb 0x1400c8cfe
movzx r9d, byte [rbp - 0x49]
lea r8, [0x14014e5a0]
mov rcx, qword [rcx + 0x10]
mov edx, 0xf6
call fcn.1400abd10
mov rcx, qword [0x14016d090]
cmp rcx, r12
je 0x1400c89c2
test byte [rcx + 0x1c], 4
je 0x1400c89c2
cmp byte [rcx + 0x19], 2
jb 0x1400c89c2
movzx r9d, sil
mov edx, 0xf7
jmp 0x1400c8c6a
mov rcx, qword [0x14016d090]
lea rdi, [0x14016d090]
cmp rcx, rdi
je 0x1400c8d5d
test byte [rcx + 0x1c], 4
je 0x1400c8d5d
cmp byte [rcx + 0x19], 2
jb 0x1400c8d5d
mov rcx, qword [rcx + 0x10]
lea r8, [0x14014e5a0]
mov edx, 0xef
call fcn.140004968
mov dword [rbx], 0x570
mov r13d, 9
mov rcx, qword [0x14016d090]
cmp rcx, rdi
je 0x1400c8ea2
test byte [rcx + 0x1c], 4
je 0x1400c8e14
cmp byte [rcx + 0x19], 2
jb 0x1400c8e14
movzx eax, byte [rbp + 0xe]
mov edx, 0xf0
movzx r8d, byte [rbp + 0xd]
movzx r10d, byte [rbp + 0xc]
movzx r11d, byte [rbp + 0xb]
movzx ebx, byte [rbp + 0xa]
movzx edi, byte [rbp + 9]
movzx esi, byte [rbp + 8]
movzx r14d, byte [rbp + 7]
movzx r15d, word [rbp + 5]
movzx r12d, word [rbp + 3]
mov r9d, dword [rbp - 1]
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], r8d
lea r8, [0x14014e5a0]
mov dword [rsp + 0x58], r10d
mov dword [rsp + 0x50], r11d
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r12d
call fcn.14000f698
mov rcx, qword [0x14016d090]
lea rdi, [0x14016d090]
mov r12, qword [rbp + 0xf]
cmp rcx, rdi
je 0x1400c8ea2
test byte [rcx + 0x1c], 4
je 0x1400c8ea2
cmp byte [rcx + 0x19], 2
jb 0x1400c8ea2
movzx eax, byte [rbp + 0x1e]
mov edx, 0xf1
movzx ecx, byte [rbp + 0x1d]
mov r9d, r12d
movzx r8d, byte [rbp + 0x1c]
movzx r10d, byte [rbp + 0x1b]
movzx r11d, byte [rbp + 0x1a]
movzx ebx, byte [rbp + 0x19]
movzx edi, byte [rbp + 0x18]
movzx esi, byte [rbp + 0x17]
movzx r14d, word [rbp + 0x15]
movzx r15d, word [rbp + 0x13]
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], ecx
mov rcx, qword [0x14016d090]
mov dword [rsp + 0x58], r8d
lea r8, [0x14014e5a0]
mov dword [rsp + 0x50], r10d
mov dword [rsp + 0x48], r11d
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r15d
call fcn.14000f698
lea r12, [0x14016d090]
mov rcx, qword [rbp - 9]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [0x14016d090]
mov rax, qword [rbp - 0x19]
test rax, rax
je 0x1400c8ed3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14016d090]
cmp rcx, r12
je 0x1400c8ef9
test byte [rcx + 0x1c], 4
je 0x1400c8ef9
cmp byte [rcx + 0x19], 4
jb 0x1400c8ef9
mov rcx, qword [rcx + 0x10]
lea r8, [0x14014e5a0]
mov edx, 0xf8
call fcn.140004968
mov eax, r13d
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.14013cc00
mov rbx, qword [rsp + 0x128]
add rsp, 0xe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [0x14016d090]
cmp rcx, r12
je 0x1400c89c2
test byte [rcx + 0x1c], 4
je 0x1400c89c2
cmp byte [rcx + 0x19], 2
jb 0x1400c89c2
mov r9d, dword [rbp - 0x35]
mov edx, 0xe9
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x20], r8d
lea r8, [0x14014e5a0]
call fcn.14000f654
jmp 0x1400c89c2