Function at 0x140001008
Capabilities:
Get file size
Write file on windows

Disassembly:
jmp 0x14000110c
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
or qword [rbp - 0x20], 0xffffffffffffffff
xor r13d, r13d
mov ebx, 1
mov dword [rbp - 0x18], r13d
mov dword [rbp + 0x50], ebx
mov r15d, r13d
mov dword [rbp + 0x58], r13d
mov rdi, rdx
mov r14d, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_HeapSetInformation]
nop dword [rax + rax]
lea ecx, [rbx + 0x6f]
call fcn.140003cb8
test rax, rax
je 0x140001188
lea r8, [rbp + 0x50]
mov rcx, rax
call fcn.140001dd8
mov ebx, dword [rbp + 0x50]
mov rsi, rax
jmp 0x14000118b
mov rsi, r13
mov qword [rbp - 8], rsi
test rsi, rsi
je 0x140001aec
test ebx, ebx
jne 0x140001aec
mov rcx, rsi
call fcn.140001fe0
lea edx, [rbx + 1]
mov dword [rsp + 0x28], r13d
mov r9d, edx
lea r8d, [rbx + 3]
mov rcx, rsi
call fcn.1400025d8
mov ebx, 4
mov dword [rsp + 0x28], r13d
mov r8d, ebx
mov rcx, rsi
lea r12d, [rbx - 2]
mov edx, r12d
lea r9d, [rbx - 3]
call fcn.1400025d8
lea edx, [rbx + 7]
mov dword [rsp + 0x28], r13d
lea r9d, [rbx - 3]
mov rcx, rsi
lea r8d, [rbx + 8]
call fcn.1400025d8
lea edx, [rbx + 9]
mov dword [rsp + 0x28], 1
lea r9d, [rbx - 1]
mov rcx, rsi
lea r8d, [rbx + 0xa]
call fcn.1400025d8
lea edx, [rbx + 0xb]
mov dword [rsp + 0x28], r13d
lea r9d, [rbx - 3]
mov rcx, rsi
lea r8d, [rbx + 0xc]
call fcn.1400025d8
mov r9d, ebx
mov dword [rsp + 0x28], r13d
lea edx, [rbx + 0xf]
mov rcx, rsi
lea r8d, [rbx + 0x10]
call fcn.1400025d8
mov r9d, r12d
mov dword [rsp + 0x28], r13d
lea edx, [rbx + 0xd]
mov rcx, rsi
lea r8d, [rbx + 0xe]
call fcn.1400025d8
mov r8, rdi
mov edx, r14d
mov rcx, rsi
call fcn.140002810
mov r8, rdi
mov edx, r14d
mov rcx, rsi
call fcn.140002810
test eax, eax
je 0x140001ac9
lea edx, [rbx - 3]
mov rcx, rsi
call fcn.140002b10
test rax, rax
jne 0x140001ac9
mov r12, qword gs:[0x58]
lea edx, [rax + 2]
mov rcx, rsi
mov ebx, 0x10
mov rdi, qword [r12]
call fcn.140002b10
mov dword [rdi + rbx], eax
mov edx, 0xb
mov rcx, rsi
mov ebx, 0x18
call fcn.140002b10
mov edx, 0xf
mov dword [rbx + rdi], eax
mov rcx, rsi
call fcn.140002b10
mov ebx, 0xd
mov qword [rbp - 0x10], rax
mov edx, ebx
mov rcx, rsi
call fcn.140002aac
mov r14d, 0x24
test eax, eax
je 0x14000130c
mov edx, ebx
mov rcx, rsi
call fcn.140002b10
mov rcx, rax
mov dword [r14 + rdi], 1
mov eax, 0x1c
mov dword [rax + rdi], ecx
mov ebx, 0x13
mov rcx, rsi
mov edx, ebx
call fcn.140002aac
test eax, eax
je 0x14000132d
mov edx, ebx
mov rcx, rsi
call fcn.140002b10
mov qword [rbp - 0x18], rax
mov rcx, qword [rsi + 0x68]
test rcx, rcx
je 0x140001354
mov ebx, r13d
xor edx, edx
jmp 0x14000134a
cmp dword [rax], r13d
je 0x140001372
mov rcx, qword [rsi + 0x68]
inc ebx
mov edx, ebx
call fcn.140002ee8
test rax, rax
jne 0x14000133d
mov rax, r13
mov ecx, 0x28
mov qword [rcx + rdi], rax
mov rcx, rsi
test rax, rax
jne 0x140001378
call fcn.140002278
jmp 0x140001ad6
mov rax, qword [rax + 0x30]
jmp 0x140001357
mov ebx, 0x11
mov edx, ebx
call fcn.140002aac
test eax, eax
je 0x140001395
mov edx, ebx
mov rcx, rsi
call fcn.140002b10
mov r15, rax
mov ecx, 0x28
call fcn.140003cb8
mov r14, rax
test rax, rax
je 0x1400013e8
lea rax, [0x140004010]
xor ecx, ecx
mov qword [r14], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
nop dword [rax + rax]
mov ebx, 0x200
mov qword [r14 + 0x20], rax
mov ecx, ebx
call fcn.140003cb8
mov ecx, ebx
mov qword [r14 + 8], rax
call fcn.140003cb8
mov qword [r14 + 0x10], rax
mov dword [r14 + 0x18], 0x100
jmp 0x1400013eb
mov r14, r13
mov rbx, qword [r12]
mov eax, 8
mov edi, eax
mov qword [rax + rbx], r14
test r14, r14
je 0x140001aec
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov ecx, 0x28
lea r14, [0x140001b90]
mov rdx, r14
mov rcx, qword [rcx + rbx]
call qword [sym.imp.WINTRUST.dll_CryptCATCDFOpen]
nop dword [rax + rax]
mov r12d, 0x10
mov r13, rax
mov ecx, dword [rbx + r12]
test rax, rax
jne 0x140001473
test ecx, ecx
je 0x140001aec
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [rdi + rbx]
lea r8, [0x140004418]
mov r9d, eax
mov edx, 0x1b5a
call fcn.140001d30
jmp 0x140001aec
test ecx, ecx
je 0x1400014a5
mov rcx, qword [rdi + rbx]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1f42
call fcn.140001d88
mov rcx, qword [rdi + rbx]
mov r8, rax
mov eax, 0x28
mov edx, 0x1f41
mov r9, qword [rax + rbx]
call fcn.140001d30
mov r8, r14
xor edx, edx
jmp 0x1400014e6
cmp dword [rbx + r12], 0
je 0x1400014dc
mov rcx, qword [rdi + rbx]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1f44
call fcn.140001d88
mov r9, qword [r14 + 8]
mov r8, rax
mov rcx, qword [rdi + rbx]
mov edx, 0x1f41
call fcn.140001d30
lea r8, [0x140001b90]
mov rdx, r14
mov rcx, r13
call qword [sym.imp.WINTRUST.dll_CryptCATCDFEnumCatAttributes]
nop dword [rax + rax]
mov r14, rax
test rax, rax
jne 0x1400014ac
xor r14d, r14d
test r15, r15
je 0x140001569
mov qword [rsp + 0x30], r14
lea r8d, [r14 + 5]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov edx, 0xc0000000
mov dword [rsp + 0x20], 2
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CreateFileW]
nop dword [rax + rax]
mov qword [rbp - 0x20], rax
cmp rax, 0xffffffffffffffff
jne 0x140001569
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov rdx, r15
lea rcx, str.Error_creating__S:___x
mov r8d, eax
call qword [sym.imp.msvcrt.dll_printf]
nop dword [rax + rax]
jmp 0x140001aec
mov rax, qword [rbp - 0x10]
lea r9, [rbp - 0x28]
mov qword [rsp + 0x28], r14
lea r8, [0x140001b90]
xor edx, edx
mov dword [rsp + 0x20], eax
mov rcx, r13
mov qword [rbp - 0x28], r14
mov dword [rbp + 0x50], r14d
call qword [sym.imp.WINTRUST.dll_CryptCATCDFEnumMembersByCDFTagEx]
nop dword [rax + rax]
mov r15, rax
mov r12d, 0x1b5a
test rax, rax
je 0x140001900
mov rsi, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
je 0x14000160d
mov eax, 0x10
cmp dword [rbx + rax], r14d
je 0x1400015ed
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [rdi + rbx]
lea r8, [0x140004450]
mov r9d, eax
mov edx, r12d
call fcn.140001d30
mov eax, 0x18
cmp dword [rax + rbx], r14d
je 0x1400018c6
mov eax, 0x14
mov dword [rax + rbx], 1
jmp 0x1400018c6
cmp rsi, 0xffffffffffffffff
je 0x1400016fb
mov rcx, qword [rbp - 0x28]
lea rdx, [rbp - 0x30]
mov rcx, qword [rcx + 0x10]
call fcn.140001014
mov r14, rax
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14000162f
and qword [rsp + 0x20], 0
lea r9, [rbp - 0x2c]
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop dword [rax + rax]
cmp dword [rbp - 0x30], 0
je 0x140001663
mov rcx, r14
call fcn.140003cf8
and qword [rsp + 0x20], 0
lea r9, [rbp - 0x2c]
mov r8d, 3
lea rdx, [0x140004494]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x28]
lea rdx, [rbp - 0x30]
mov rcx, qword [rcx + 8]
call fcn.140001014
mov r14, rax
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x1400016a1
and qword [rsp + 0x20], 0
lea r9, [rbp - 0x2c]
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop dword [rax + rax]
cmp dword [rbp - 0x30], 0
je 0x1400016d5
mov rcx, r14
call fcn.140003cf8
xor r14d, r14d
lea r9, [rbp - 0x2c]
lea rdx, [0x140004498]
mov qword [rsp + 0x20], r14
mov rcx, rsi
lea r8d, [r14 + 1]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop dword [rax + rax]
cmp dword [rbp - 0x18], r14d
jbe 0x1400017f5
mov rcx, qword [rbp - 0x28]
xor r9d, r9d
mov qword [rsp + 0x30], r14
mov edx, 0x80000000
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 3
mov rcx, qword [rcx + 0x10]
lea r8d, [r9 + 5]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
nop dword [rax + rax]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x1400017ae
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
nop dword [rax + rax]
cmp eax, dword [rbp - 0x18]
jae 0x14000179a
cmp eax, 0xffffffff
je 0x14000179a
mov eax, 0x10
mov dword [rbp + 0x58], 1
cmp dword [rbx + rax], 0
je 0x14000179a
mov rcx, qword [rdi + rbx]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1f45
call fcn.140001d88
mov r9, qword [rbp - 0x28]
mov r8, rax
mov rcx, qword [rdi + rbx]
mov edx, 0x1f41
mov r9, qword [r9 + 0x10]
call fcn.140001d30
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
xor r14d, r14d
jmp 0x1400017f5
mov eax, 0x10
xor r14d, r14d
cmp dword [rbx + rax], r14d
je 0x1400017de
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [rdi + rbx]
lea r8, str.CreateFile
mov r9d, eax
mov edx, r12d
call fcn.140001d30
mov eax, 0x18
cmp dword [rax + rbx], r14d
je 0x1400017f5
mov eax, 0x14
mov dword [rax + rbx], 1
mov eax, 0x10
cmp dword [rbx + rax], r14d
je 0x140001828
mov rcx, qword [rdi + rbx]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1f43
call fcn.140001d88
mov rcx, qword [rdi + rbx]
mov r8, rax
mov r9, r15
mov edx, 0x1f41
call fcn.140001d30
mov r8, qword [rbp - 0x28]
lea rax, [0x140001b90]
inc dword [rbp + 0x50]
xor r9d, r9d
mov rdx, r15
mov qword [rsp + 0x20], rax
mov rcx, r13
call qword [sym.imp.WINTRUST.dll_CryptCATCDFEnumAttributesWithCDFTag]
nop dword [rax + rax]
mov r14, rax
test rax, rax
je 0x1400018c3
mov esi, 0x10
lea r12, [0x140001b90]
cmp dword [rbx + rsi], 0
je 0x140001893
mov rcx, qword [rbx + rdi]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1f44
call fcn.140001d88
mov r9, qword [r14 + 8]
mov r8, rax
mov rcx, qword [rbx + rdi]
mov edx, 0x1f41
call fcn.140001d30
mov r8, qword [rbp - 0x28]
mov r9, r14
mov rdx, r15
mov qword [rsp + 0x20], r12
mov rcx, r13
call qword [sym.imp.WINTRUST.dll_CryptCATCDFEnumAttributesWithCDFTag]
nop dword [rax + rax]
mov r14, rax
test rax, rax
jne 0x140001864
mov rsi, qword [rbp - 0x20]
mov r12d, 0x1b5a
xor r14d, r14d
mov rax, qword [rbp - 0x10]
lea r9, [rbp - 0x28]
mov qword [rsp + 0x28], r14
lea r8, [0x140001b90]
mov rdx, r15
mov dword [rsp + 0x20], eax
mov rcx, r13
call qword [sym.imp.WINTRUST.dll_CryptCATCDFEnumMembersByCDFTagEx]
nop dword [rax + rax]
mov r15, rax
test rax, rax
jne 0x1400015b0
mov rsi, qword [rbp - 8]
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov r15d, eax
test eax, eax
je 0x140001945
mov eax, 0x10
cmp dword [rbx + rax], r14d
je 0x140001934
mov rcx, qword [rdi + rbx]
lea r8, [0x140004450]
mov r9d, r15d
mov edx, r12d
call fcn.140001d30
mov eax, 0x14
mov r14d, eax
mov dword [rax + rbx], 1
jmp 0x14000194b
mov r14d, 0x14
mov eax, 0x10
cmp dword [rbx + rax], 0
je 0x140001982
cmp dword [rbp + 0x50], 0
jne 0x140001982
mov rcx, qword [rdi + rbx]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1b5b
call fcn.140001d88
mov rcx, qword [rdi + rbx]
mov r8, rax
mov r9d, r15d
mov edx, r12d
call fcn.140001d30
mov rcx, r13
call qword [sym.imp.WINTRUST.dll_CryptCATCDFClose]
nop dword [rax + rax]
xor r13d, r13d
test eax, eax
jne 0x1400019d7
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov r15d, eax
mov eax, 0x10
cmp dword [rbx + rax], r13d
je 0x1400019c8
mov rcx, qword [rdi + rbx]
lea r8, [0x1400044b8]
mov r9d, r15d
mov edx, r12d
call fcn.140001d30
mov eax, 0x18
cmp dword [rax + rbx], r13d
jne 0x140001aec
mov eax, 0x24
mov r12d, eax
cmp dword [rax + rbx], r13d
je 0x140001a39
mov rcx, qword [rdi + rbx]
mov edx, 0x2336
mov eax, 0x28
mov r8, qword [rax + rbx]
call fcn.140001d30
mov ecx, 0x1c
mov r8d, dword [rcx + rbx]
mov rcx, qword [rdi + rbx]
cmp r15d, r8d
je 0x140001a25
mov r9d, r15d
mov dword [rbx + r14], 1
mov edx, 0x1b58
call fcn.140001d30
jmp 0x140001a33
mov edx, 0x2334
mov dword [rbx + r14], r13d
call fcn.140001d30
mov r13d, dword [rbp + 0x50]
jmp 0x140001aa6
mov r13d, dword [rbp + 0x50]
xor r8d, r8d
mov edx, dword [rbp + 0x58]
mov ecx, 0x20
test r13d, r13d
jle 0x140001a6d
cmp dword [rcx + rbx], r8d
jne 0x140001a71
test edx, edx
jne 0x140001a6d
cmp dword [rbx + r14], r8d
jne 0x140001a6d
mov rcx, qword [rdi + rbx]
mov edx, 0x2334
call fcn.140001d30
jmp 0x140001aa6
cmp dword [rcx + rbx], r8d
mov rcx, qword [rbx + rdi]
je 0x140001a7e
mov edx, 0x1b5c
jmp 0x140001a87
test edx, edx
je 0x140001a8e
mov edx, 0x1b5d
call fcn.140001d30
jmp 0x140001a9e
mov r9d, r15d
mov r8d, r15d
mov edx, 0x2335
call fcn.140001d30
mov dword [rbx + r14], 1
mov eax, 0x18
mov rdi, rbx
cmp dword [rax + rbx], 0
je 0x140001b07
test r13d, r13d
jne 0x140001b07
cmp dword [r12 + rbx], r13d
jne 0x140001b07
mov dword [rbx + r14], 1
jmp 0x140001b07
mov rcx, rsi
call fcn.140002278
test rax, rax
je 0x140001aec
mov rdx, rax
lea rcx, [0x140004410]
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov rax, qword gs:[0x58]
mov ebx, 0x14
mov r14d, ebx
mov rdi, qword [rax]
mov dword [rbx + rdi], 1
test rsi, rsi
je 0x140001b20
mov rax, qword [rsi]
mov edx, 1
mov rcx, rsi
mov rax, qword [rax]
call qword [0x140004370]
mov eax, 8
mov ebx, eax
mov rcx, qword [rdi + rax]
test rcx, rcx
je 0x140001b46
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [0x140004370]
and qword [rdi + rbx], 0
mov rax, qword [rbp - 0x20]
cmp rax, 0xffffffffffffffff
je 0x140001b5f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov eax, dword [rdi + r14]
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret