Function at 0x1000dc46c
Capabilities:
Get file size

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe8
mov rax, qword [0x100165138]
xor rax, rsp
mov qword [rsp + 0xd0], rax
xor r13d, r13d
mov rbx, r9
mov rdi, r8
and dword [rsp + 0x74], r13d
mov r12, rdx
mov rbp, rcx
mov rcx, qword [0x1001653b8]
lea rsi, [0x1001653b8]
lea r15d, [r13 + 4]
cmp rcx, rsi
je 0x1000dc4de
test byte [rcx + 0x1c], r15b
je 0x1000dc4de
cmp byte [rcx + 0x19], r15b
jb 0x1000dc4de
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003188]
mov edx, 0xe5
call fcn.10001c7b8
and qword [rsp + 0xa0], r13
test rdi, rdi
je 0x1000dc4ee
mov byte [rdi], r13b
test r12, r12
je 0x1000dc503
xor edx, edx
mov r8d, 0x200
mov rcx, r12
call sub.msvcrt.dll_memset
mov rcx, qword [rbp]
lea rdx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x1000dc565
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
mov r12, qword [0x1001653b8]
cmp r12, rsi
je 0x1000dc55a
test byte [r12 + 0x1c], r15b
je 0x1000dc55a
cmp byte [r12 + 0x19], 2
jb 0x1000dc55a
mov r9, qword [rbp]
mov rcx, qword [r12 + 0x10]
lea r8, [0x100003188]
mov edx, 0xe6
mov dword [rsp + 0x20], eax
call fcn.1000c2b34
mov r13d, 8
jmp 0x1000dc83b
mov edx, 0x10000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r14, rax
test rax, rax
jne 0x1000dc58b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r13d, [r14 + 3]
mov dword [rbx], eax
jmp 0x1000dc82d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xa0], rax
test rax, rax
jne 0x1000dc5bd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13d, 8
mov dword [rbx], eax
jmp 0x1000dc82d
and dword [rsp + 0x98], r13d
and dword [rsp + 0x9c], r13d
mov rcx, qword [0x1001653b8]
cmp rcx, rsi
je 0x1000dc5fa
test byte [rcx + 0x1c], r15b
je 0x1000dc5fa
cmp byte [rcx + 0x19], 5
jb 0x1000dc5fa
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003188]
mov edx, 0xe7
call fcn.10001c7b8
mov rcx, qword [rbp]
lea r9, [rsp + 0x88]
mov r8d, 0x10000
mov rdx, r14
call fcn.1000d33d4
mov rcx, qword [rbp]
lea r8, [rsp + 0x74]
lea rdx, [rsp + 0x88]
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x1000dc682
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
mov r12, qword [0x1001653b8]
cmp r12, rsi
je 0x1000dc8f1
test byte [r12 + 0x1c], r15b
je 0x1000dc8f1
cmp byte [r12 + 0x19], 2
jb 0x1000dc8f1
mov rcx, qword [r12 + 0x10]
lea r8, [0x100003188]
mov edx, 0xe8
mov r9d, eax
call fcn.10001c7dc
jmp 0x1000dc8f1
mov r9d, dword [rsp + 0x74]
cmp r9d, 0x10000
je 0x1000dc6c6
mov rcx, qword [0x1001653b8]
cmp rcx, rsi
je 0x1000dc8eb
test byte [rcx + 0x1c], r15b
je 0x1000dc8eb
cmp byte [rcx + 0x19], 2
jb 0x1000dc8eb
mov edx, 0xe9
mov dword [rsp + 0x20], 0x10000
jmp 0x1000dc8db
lea rdx, [0x10000d0e0]
mov r8d, 0x10
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_RtlCompareMemory]
cmp rax, 0x10
je 0x1000dcdf8
and qword [rsp + 0x28], r13
lea rax, [rsp + 0x70]
lea r9, [rsp + 0xc0]
lea r8, [rsp + 0xa8]
mov rdx, r14
mov rcx, rbp
mov qword [rsp + 0x20], rax
call fcn.1000df4e4
test al, al
jne 0x1000dc742
mov rcx, qword [0x1001653b8]
cmp rcx, rsi
je 0x1000dccbf
test byte [rcx + 0x1c], r15b
je 0x1000dccbf
cmp byte [rcx + 0x19], 2
jb 0x1000dccbf
mov edx, 0xea
jmp 0x1000dc9f4
mov sil, byte [rsp + 0x70]
mov rcx, qword [rsp + 0x80]
mov al, sil
neg al
sbb edi, edi
and edi, 0xfffffe00
add edi, 0x400
mov r8d, edi
cmp rcx, r8
jl 0x1000dcda7
mov r9d, 0x1ff
mov rax, rcx
cqo
and rdx, r9
add rax, rdx
and rax, r9
cmp rax, rdx
jne 0x1000dcda7
sub rcx, r8
mov r8, rcx
mov dword [rsp + 0x98], ecx
shr r8, 0x20
mov dword [rsp + 0x9c], r8d
mov rax, qword [0x1001653b8]
lea rdx, [0x1001653b8]
cmp rax, rdx
je 0x1000dc7df
test byte [rax + 0x1c], r15b
je 0x1000dc7df
cmp byte [rax + 0x19], 5
jb 0x1000dc7df
mov dword [rsp + 0x20], ecx
mov rcx, qword [rax + 0x10]
mov r9d, r8d
lea r8, [0x100003188]
mov edx, 0xec
call fcn.10001e8b4
mov rcx, qword [rbp]
lea r9, [rsp + 0x88]
mov r8d, edi
mov rdx, r14
call fcn.1000d33d4
mov rcx, qword [rbp]
lea r8, [rsp + 0x74]
lea rdx, [rsp + 0x88]
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x1000dc8a5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13d, r15d
mov dword [rbx], eax
lea rsi, [0x1001653b8]
test r14, r14
je 0x1000dc83b
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x1000dc84e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r12, qword [0x1001653b8]
cmp r12, rsi
je 0x1000dc87e
test byte [r12 + 0x1c], r15b
je 0x1000dc87e
cmp byte [r12 + 0x19], r15b
jb 0x1000dc87e
mov rcx, qword [r12 + 0x10]
lea r8, [0x100003188]
mov edx, 0xfa
call fcn.10001c7b8
mov eax, r13d
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.10014e480
add rsp, 0xe8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov r9d, dword [rsp + 0x74]
cmp r9d, edi
je 0x1000dc8f9
mov rcx, qword [0x1001653b8]
lea rsi, [0x1001653b8]
cmp rcx, rsi
je 0x1000dc8eb
test byte [rcx + 0x1c], r15b
je 0x1000dc8eb
cmp byte [rcx + 0x19], 2
jb 0x1000dc8eb
mov edx, 0xed
mov dword [rsp + 0x20], 0x400
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003188]
call fcn.10001e8b4
mov dword [rbx], 0x45d
mov r13d, r15d
jmp 0x1000dc82d
and qword [rsp + 0x28], r13
lea rax, [rsp + 0x70]
lea r9, [rsp + 0xb0]
lea r8, [rsp + 0x78]
mov rdx, r14
mov rcx, rbp
mov qword [rsp + 0x20], rax
call fcn.1000df4e4
test al, al
jne 0x1000dc990
test sil, sil
je 0x1000dc95e
mov rcx, qword [0x1001653b8]
lea rsi, [0x1001653b8]
cmp rcx, rsi
je 0x1000dccbf
test byte [rcx + 0x1c], r15b
je 0x1000dccbf
cmp byte [rcx + 0x19], 2
jb 0x1000dccbf
mov edx, 0xee
jmp 0x1000dc9f4
mov rcx, qword [0x1001653b8]
lea rsi, [0x1001653b8]
cmp rcx, rsi
je 0x1000dccbf
test byte [rcx + 0x1c], r15b
je 0x1000dccbf
cmp byte [rcx + 0x19], 2
jb 0x1000dccbf
mov edx, 0xef
jmp 0x1000dc9f4
test sil, sil
jne 0x1000dca09
and qword [rsp + 0x28], r13
lea rax, [rsp + 0x70]
lea rdx, [r14 + 0x200]
lea r9, [rsp + 0xb0]
lea r8, [rsp + 0x78]
mov rcx, rbp
mov qword [rsp + 0x20], rax
call fcn.1000df4e4
test al, al
jne 0x1000dca09
mov rcx, qword [0x1001653b8]
lea rsi, [0x1001653b8]
cmp rcx, rsi
je 0x1000dccbf
test byte [rcx + 0x1c], r15b
je 0x1000dccbf
cmp byte [rcx + 0x19], 2
jb 0x1000dccbf
mov edx, 0xf0
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003188]
call fcn.10001c7b8
jmp 0x1000dccbf
lea rax, [rsp + 0xb0]
lea rcx, [rsp + 0xc0]
mov rdx, qword [rax]
cmp rdx, qword [rcx]
jne 0x1000dca2f
mov rdx, qword [rax + 8]
cmp rdx, qword [rcx + 8]
jne 0x1000dca2f
xor eax, eax
jmp 0x1000dca34
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000dcc12
mov rcx, qword [0x1001653b8]
lea rsi, [0x1001653b8]
cmp rcx, rsi
je 0x1000dca70
test byte [rcx + 0x1c], r15b
je 0x1000dca70
cmp byte [rcx + 0x19], 2
jb 0x1000dca70
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003188]
mov edx, 0xf1
call fcn.10001c7b8
mov dword [rbx], 0x570
mov r13d, 9
mov r12, qword [0x1001653b8]
cmp r12, rsi
je 0x1000dc82d
test byte [r12 + 0x1c], r15b
je 0x1000dcb48
cmp byte [r12 + 0x19], 2
jb 0x1000dcb48
movzx r9d, byte [rsp + 0xbc]
movzx eax, byte [rsp + 0xbf]
movzx ecx, byte [rsp + 0xbe]
movzx r8d, byte [rsp + 0xbd]
movzx r10d, byte [rsp + 0xbb]
movzx r11d, byte [rsp + 0xba]
movzx ebx, byte [rsp + 0xb9]
movzx edi, byte [rsp + 0xb8]
movzx esi, word [rsp + 0xb6]
movzx ebp, word [rsp + 0xb4]
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], ecx
mov rcx, qword [r12 + 0x10]
mov dword [rsp + 0x58], r8d
mov dword [rsp + 0x50], r9d
mov r9d, dword [rsp + 0xb0]
mov dword [rsp + 0x48], r10d
mov dword [rsp + 0x40], r11d
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
lea r8, [0x100003188]
mov edx, 0xf2
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], ebp
call fcn.10005c71c
lea rsi, [0x1001653b8]
mov r12, qword [0x1001653b8]
cmp r12, rsi
je 0x1000dc82d
test byte [r12 + 0x1c], r15b
je 0x1000dc82d
cmp byte [r12 + 0x19], 2
jb 0x1000dc82d
movzx r9d, byte [rsp + 0xcc]
movzx eax, byte [rsp + 0xcf]
movzx ecx, byte [rsp + 0xce]
movzx r8d, byte [rsp + 0xcd]
movzx r10d, byte [rsp + 0xcb]
movzx r11d, byte [rsp + 0xca]
movzx ebx, byte [rsp + 0xc9]
movzx edi, byte [rsp + 0xc8]
movzx esi, word [rsp + 0xc6]
movzx ebp, word [rsp + 0xc4]
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], ecx
mov rcx, qword [r12 + 0x10]
mov dword [rsp + 0x58], r8d
mov dword [rsp + 0x50], r9d
mov r9d, dword [rsp + 0xc0]
mov dword [rsp + 0x48], r10d
mov dword [rsp + 0x40], r11d
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
lea r8, [0x100003188]
mov edx, 0xf3
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], ebp
call fcn.10005c71c
jmp 0x1000dc826
mov rdi, qword [rsp + 0xa8]
cmp rdi, qword [rsp + 0x78]
je 0x1000dccd0
mov rcx, qword [0x1001653b8]
lea rsi, [0x1001653b8]
cmp rcx, rsi
je 0x1000dccbf
test byte [rcx + 0x1c], r15b
je 0x1000dcc64
cmp byte [rcx + 0x19], 2
jb 0x1000dcc64
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003188]
mov edx, 0xf4
call fcn.10001c7b8
mov rcx, qword [0x1001653b8]
cmp rcx, rsi
je 0x1000dccbf
test byte [rcx + 0x1c], r15b
je 0x1000dcc96
cmp byte [rcx + 0x19], 2
jb 0x1000dcc96
mov r9, qword [rsp + 0x78]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003188]
mov edx, 0xf5
call fcn.10001d680
mov rcx, qword [0x1001653b8]
cmp rcx, rsi
je 0x1000dccbf
test byte [rcx + 0x1c], r15b
je 0x1000dccbf
cmp byte [rcx + 0x19], 2
jb 0x1000dccbf
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003188]
mov edx, 0xf6
mov r9, rdi
call fcn.10001d680
mov dword [rbx], 0x570
mov r13d, 9
jmp 0x1000dc82d
cmp sil, byte [rsp + 0x70]
je 0x1000dcd88
mov rcx, qword [0x1001653b8]
lea rdi, [0x1001653b8]
cmp rcx, rdi
je 0x1000dcd77
test byte [rcx + 0x1c], r15b
je 0x1000dcd1a
cmp byte [rcx + 0x19], 2
jb 0x1000dcd1a
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003188]
mov edx, 0xf7
call fcn.10001c7b8
mov rcx, qword [0x1001653b8]
cmp rcx, rdi
je 0x1000dcd77
test byte [rcx + 0x1c], r15b
je 0x1000dcd4d
cmp byte [rcx + 0x19], 2
jb 0x1000dcd4d
movzx r9d, byte [rsp + 0x70]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003188]
mov edx, pe_nt_image_headers64
call fcn.10001d680
mov rcx, qword [0x1001653b8]
cmp rcx, rdi
je 0x1000dcd77
test byte [rcx + 0x1c], r15b
je 0x1000dcd77
cmp byte [rcx + 0x19], 2
jb 0x1000dcd77
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003188]
movzx r9d, sil
mov edx, 0xf9
call fcn.10001d680
mov dword [rbx], 0x570
mov r13d, 9
jmp 0x1000dc826
test r12, r12
je 0x1000dc826
mov rcx, r12
mov rdx, r14
mov r8d, 0x200
call sub.msvcrt.dll_memcpy
jmp 0x1000dc826
mov rax, qword [0x1001653b8]
lea rsi, [0x1001653b8]
cmp rax, rsi
je 0x1000dccbf
test byte [rax + 0x1c], r15b
je 0x1000dccbf
cmp byte [rax + 0x19], 2
jb 0x1000dccbf
mov r9d, dword [rsp + 0x84]
mov dword [rsp + 0x20], ecx
mov rcx, qword [rax + 0x10]
lea r8, [0x100003188]
mov edx, 0xeb
call fcn.10001e8b4
jmp 0x1000dccbf
test rdi, rdi
je 0x1000dc82d
mov byte [rdi], 1
jmp 0x1000dc82d