Function at 0x417140
Capabilities:
Get file size

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xc8
mov ebx, dword [rcx + 0x168]
mov rsi, rcx
test ebx, 0x20000000
je 0x417195
mov edx, ebx
mov eax, ebx
mov dword [rsp + 0xa0], ebx
and eax, 0xfffffffc
and edx, 3
mov qword [rsp + 0xb8], 0
or eax, 2
cmp edx, 1
cmove ebx, eax
test bl, 8
je 0x4171f0
and ebx, 0xfffffff4
or ebx, 2
xor ecx, ecx
call sub.msvcrt.dll__umask
mov ecx, eax
mov edi, eax
call sub.msvcrt.dll__umask
mov eax, ebx
and eax, 3
cmp eax, 1
je 0x417690
cmp eax, 2
je 0x417280
test eax, eax
je 0x4176e1
mov qword [rsi + 0x88], 0xfffffffffffff019
mov dword [rsi + 0x14c], 0x57
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor ecx, ecx
call sub.msvcrt.dll__umask
mov ecx, eax
mov edi, eax
call sub.msvcrt.dll__umask
mov eax, ebx
and eax, 3
cmp eax, 1
je 0x4175b0
cmp eax, 2
je 0x417760
test eax, eax
jne 0x4171c4
nop dword [rax + rax]
test eax, eax
mov r10d, 0x120089
mov r9d, 0x130089
mov dword [rsp + 0x60], 0
mov dword [rsp + 0x5c], 0
mov r8d, 0x130089
mov dword [rsp + 0x50], 0x120089
mov dword [rsp + 0x58], 0x130089
mov ecx, 0x120089
mov dword [rsp + 0x54], 0x13008d
mov dword [rsp + 0x4c], 0x12008d
jne 0x4172d0
mov dword [rsp + 0x50], r10d
mov dword [rsp + 0x58], r9d
mov dword [rsp + 0x54], r8d
mov dword [rsp + 0x4c], ecx
jmp 0x4172e0
mov eax, ebx
and eax, 8
mov r10d, 0x12019b
mov r9d, 0x13019b
mov dword [rsp + 0x60], 2
mov dword [rsp + 0x5c], 4
mov r8d, 0x13019f
mov dword [rsp + 0x50], 0x120199
mov dword [rsp + 0x58], 0x130199
mov dword [rsp + 0x54], 0x13019d
mov ecx, 0x12019f
mov dword [rsp + 0x4c], 0x12019d
test eax, eax
je 0x41726b
mov dword [rsp + 0x60], 0
mov dword [rsp + 0x5c], 4
mov eax, ebx
and eax, 0x10000000
cmp eax, 1
sbb eax, eax
and eax, 7
mov dword [rsp + 0x64], eax
mov eax, ebx
and eax, 0x700
cmp eax, 0x300
je 0x417720
jg 0x417660
cmp eax, 0x100
je 0x417730
cmp eax, 0x200
je 0x417740
test eax, eax
jne 0x4171c4
mov dword [rsp + 0x7c], 3
test bh, 1
je 0x4175e5
mov eax, dword [rsi + 0x158]
not edi
and eax, 0x80
and eax, edi
cmp eax, 1
sbb r9d, r9d
not r9d
add r9d, 0x20000081
cmp eax, 1
sbb edi, edi
not edi
add edi, 0x28000081
cmp eax, 1
sbb r11d, r11d
not r11d
add r11d, 0x30000081
cmp eax, 1
sbb r10d, r10d
not r10d
add r10d, 0x10000081
cmp eax, 1
sbb ecx, ecx
not ecx
add ecx, 0x8000081
cmp eax, 1
sbb edx, edx
not edx
add edx, 0x20000181
cmp eax, 1
sbb r15d, r15d
not r15d
add r15d, 0x28000181
cmp eax, 1
sbb r14d, r14d
not r14d
add r14d, 0x30000181
cmp eax, 1
sbb r13d, r13d
not r13d
add r13d, 0x10000181
cmp eax, 1
sbb r12d, r12d
not r12d
add r12d, 0x8000181
cmp eax, 1
sbb ebp, ebp
not ebp
add ebp, 0x181
cmp eax, 1
sbb r8d, r8d
not r8d
add r8d, 0x24000181
cmp eax, 1
mov dword [rsp + 0x78], r8d
sbb r8d, r8d
not r8d
add r8d, 0x2c000181
cmp eax, 1
mov dword [rsp + 0x74], r8d
sbb r8d, r8d
not r8d
add r8d, 0x34000181
cmp eax, 1
mov dword [rsp + 0x70], r8d
sbb r8d, r8d
not r8d
add r8d, 0x14000181
cmp eax, 1
mov dword [rsp + 0x6c], r8d
sbb r8d, r8d
not r8d
add r8d, 0xc000181
cmp eax, 1
mov dword [rsp + 0x68], r8d
sbb r8d, r8d
not r8d
add r8d, 0x4000181
cmp eax, 1
sbb eax, eax
not eax
add eax, 0x81
test bl, 0x40
je 0x4174b5
mov eax, dword [rsp + 0x58]
mov r9d, dword [rsp + 0x78]
mov ebp, r8d
mov edi, dword [rsp + 0x74]
mov r11d, dword [rsp + 0x70]
mov r10d, dword [rsp + 0x6c]
mov ecx, dword [rsp + 0x68]
mov dword [rsp + 0x50], eax
mov eax, r8d
mov r8d, dword [rsp + 0x54]
mov edx, r9d
mov r15d, edi
mov r14d, r11d
mov r13d, r10d
mov r12d, ecx
mov dword [rsp + 0x4c], r8d
test bh, 0x10
je 0x4174cb
mov r9d, edx
mov edi, r15d
mov r11d, r14d
mov r10d, r13d
mov ecx, r12d
mov eax, ebp
mov ebp, ebx
and ebp, 0x30
cmp ebp, 0x10
je 0x417700
cmp ebp, 0x20
je 0x4176f0
test ebp, ebp
jne 0x4171c4
test ebx, 0x2000000
je 0x417511
mov edx, dword [rsp + 0x5c]
test edx, edx
je 0x41750e
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x4171c4
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x4c], eax
mov eax, r9d
mov ecx, ebx
and ecx, 0xc000000
cmp ecx, 0x4000000
je 0x417710
cmp ecx, 0x8000000
je 0x417710
test ecx, ecx
jne 0x4171c4
or eax, 0x2000000
xor r9d, r9d
mov rcx, qword [rsi + 0x150]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x7c]
mov qword [rsp + 0x30], 0
mov r8d, dword [rsp + 0x64]
mov edx, dword [rsp + 0x4c]
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbp, rax
je 0x417ae0
mov edx, ebx
mov rcx, rax
call qword [sym.imp.msvcrt.dll__open_osfhandle]
test eax, eax
mov edi, eax
js 0x417b20
and ebx, 0x20000000
jne 0x417770
movsxd rdi, edi
mov qword [rsi + 0x88], rdi
jmp 0x4171d9
mov dword [rsp + 0x50], 0x120112
mov dword [rsp + 0x58], 0x130112
mov dword [rsp + 0x60], 2
mov dword [rsp + 0x5c], 4
mov dword [rsp + 0x54], 0x130116
mov dword [rsp + 0x4c], 0x120116
jmp 0x4172e0
mov r9d, 0x20000080
mov edi, 0x28000080
mov r11d, 0x30000080
mov r10d, 0x10000080
mov ecx, 0x8000080
mov edx, 0x20000180
mov r15d, 0x28000180
mov r14d, 0x30000180
mov r13d, 0x10000180
mov r12d, 0x8000180
mov ebp, 0x180
mov dword [rsp + 0x78], 0x24000180
mov dword [rsp + 0x74], 0x2c000180
mov dword [rsp + 0x70], 0x34000180
mov r8d, 0x4000180
mov dword [rsp + 0x6c], 0x14000180
mov dword [rsp + 0x68], 0xc000180
mov eax, pe_nt_image_headers64
jmp 0x417472
cmp eax, 0x500
je 0x417683
jle 0x417750
cmp eax, 0x600
je 0x417740
cmp eax, 0x700
jne 0x4171c4
mov dword [rsp + 0x7c], 1
jmp 0x417331
mov eax, ebx
mov r10d, 0x120112
mov r9d, 0x130112
and eax, 8
mov dword [rsp + 0x60], 2
mov dword [rsp + 0x5c], 4
mov r8d, 0x130116
mov dword [rsp + 0x50], 0x120110
mov dword [rsp + 0x58], 0x130110
mov dword [rsp + 0x54], 0x130114
mov dword [rsp + 0x4c], 0x120114
mov ecx, 0x120116
jmp 0x4172cc
mov eax, ebx
and eax, 8
jmp 0x417220
mov r9d, edi
mov eax, ecx
jmp 0x4174ea
mov r9d, r11d
mov eax, r10d
jmp 0x4174ea
or eax, 0x80000000
jmp 0x417539
mov dword [rsp + 0x7c], 2
jmp 0x417331
mov dword [rsp + 0x7c], 4
jmp 0x417331
mov dword [rsp + 0x7c], 5
jmp 0x417331
cmp eax, 0x400
je 0x417329
jmp 0x4171c4
xor eax, eax
jmp 0x417285
mov r9d, 0x18
lea r8, [rsp + 0x80]
mov edx, 1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandleEx]
test eax, eax
je 0x417ab0
movzx eax, byte [rsp + 0x95]
test al, al
mov byte [rsp + 0xa4], al
je 0x417c60
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0xa8], 0xffffffffffffffff
lea rcx, [0x006e2400]
movzx ebx, dil
lea rbp, [0x00459400]
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, rbx
shl rax, 4
add rax, rbp
mov r9, qword [rax]
test r9, r9
mov rdx, r9
setne r10b
and edx, 0xf
jne 0x417b42
test r10b, r10b
je 0x417b42
mov rax, qword [rax + 8]
cmp edi, dword [rax]
je 0x417d60
mov edx, 0x10
cmp edi, dword [rax + 0x28]
je 0x417e01
cmp rdx, 2
je 0x41792f
cmp edi, dword [rax + 0x50]
je 0x417dca
cmp rdx, 3
je 0x41792f
cmp edi, dword [rax + 0x78]
je 0x417dc3
cmp rdx, 4
je 0x41792f
cmp edi, dword [rax + 0xa0]
je 0x417dbc
cmp rdx, 5
je 0x41792f
cmp edi, dword [rax + 0xc8]
je 0x417db5
cmp rdx, 6
je 0x41792f
cmp edi, dword [rax + 0xf0]
je 0x417dae
cmp rdx, 7
je 0x41792f
cmp edi, dword [rax + 0x118]
je 0x417da7
cmp rdx, 8
je 0x41792f
cmp edi, dword [rax + 0x140]
je 0x417da0
cmp rdx, 9
je 0x41792f
cmp edi, dword [rax + 0x168]
je 0x417d68
cmp rdx, 0xa
je 0x41792f
cmp edi, dword [rax + 0x190]
je 0x417de6
cmp rdx, 0xb
je 0x41792f
cmp edi, dword [rax + 0x1b8]
je 0x417ddf
cmp rdx, 0xc
je 0x41792f
cmp edi, dword [rax + 0x1e0]
je 0x417dd8
cmp rdx, 0xd
je 0x41792f
cmp edi, dword [rax + 0x208]
je 0x417dd1
cmp rdx, 0xe
je 0x41792f
cmp edi, dword [rax + 0x230]
je 0x417df7
cmp rdx, 0x10
jne 0x41792f
cmp edi, dword [rax + 0x258]
je 0x417ded
mov rdx, qword [rax + 0x280]
test rdx, rdx
jne 0x417949
jmp 0x417be0
test r8b, r8b
je 0x417a14
cmp edi, dword [rdx]
je 0x417b70
cmp edi, dword [rdx + 0x28]
je 0x417b80
cmp edi, dword [rdx + 0x50]
je 0x417b90
cmp edi, dword [rdx + 0x78]
je 0x417bd0
cmp edi, dword [rdx + 0xa0]
je 0x417c11
cmp edi, dword [rdx + 0xc8]
je 0x417c20
cmp edi, dword [rdx + 0xf0]
je 0x417c30
cmp edi, dword [rdx + 0x118]
je 0x417c40
cmp edi, dword [rdx + 0x140]
je 0x417c50
cmp edi, dword [rdx + 0x168]
je 0x417ca0
cmp edi, dword [rdx + 0x190]
je 0x417cb0
cmp edi, dword [rdx + 0x1b8]
je 0x417cc0
cmp edi, dword [rdx + 0x1e0]
je 0x417cd0
cmp edi, dword [rdx + 0x208]
je 0x417ce0
cmp edi, dword [rdx + 0x230]
je 0x417cea
cmp edi, dword [rdx + 0x258]
je 0x417cf4
mov r8d, 1
xor ecx, ecx
mov rdx, qword [rdx + 0x280]
test rdx, rdx
jne 0x417940
test rcx, rcx
je 0x417be0
mov rax, qword [rsp + 0xa0]
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0xa8]
mov qword [rcx + 0x10], rax
mov rax, qword [rsp + 0xb0]
mov qword [rcx + 0x18], rax
mov rax, qword [rsp + 0xb8]
mov qword [rcx + 0x20], rax
lea rcx, [0x006e2400]
call sub.KERNEL32.dll_LeaveCriticalSection
jmp 0x41759a
mov eax, dword [rsp + 0xa0]
mov edx, dword [rsp + 0xb0]
mov rcx, rbp
mov qword [rsp + 0x28], 0
mov r9d, dword [rsp + 0xb4]
and eax, 3
mov dword [rsp + 0x20], edx
cmp eax, 1
sbb eax, eax
xor edx, edx
and eax, 0xfffffffe
lea r8d, [rax + 4]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test rax, rax
mov qword [rsp + 0xa8], rax
jne 0x4177c3
nop dword [rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi + 0x14c], eax
mov ecx, eax
call fcn.00416500
cdqe
mov qword [rsi + 0x88], rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4171d9
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rdi
cmp eax, 0x50
jne 0x417b00
and ebx, 0x500
cmp ebx, 0x100
je 0x417d12
call rdi
mov dword [rsi + 0x14c], eax
mov ecx, eax
call fcn.00416500
cdqe
mov qword [rsi + 0x88], rax
jmp 0x4171d9
call qword [sym.imp.msvcrt.dll__errno]
cmp dword [rax], 0x18
jne 0x417ba0
mov qword [rsi + 0x88], 0xfffffffffffff01e
mov dword [rsi + 0x14c], 4
jmp 0x417acc
mov rax, rbx
shl rax, 4
test rdx, rdx
mov rax, qword [rbp + rax + 8]
je 0x41792f
cmp edi, dword [rax]
je 0x417d60
cmp rdx, 1
jne 0x417814
jmp 0x41792f
xor ecx, ecx
add rcx, rdx
sete r8b
jmp 0x417a04
mov ecx, 0x28
jmp 0x417b72
mov ecx, 0x50
jmp 0x417b72
mov rbx, qword [sym.imp.KERNEL32.dll_GetLastError]
call rbx
test eax, eax
je 0x417cfe
call rbx
mov dword [rsi + 0x14c], eax
mov ecx, eax
call fcn.00416500
cdqe
mov qword [rsi + 0x88], rax
jmp 0x417acc
mov ecx, 0x78
jmp 0x417b72
mov r12d, r9d
and r12d, 0xf
jne 0x417bf2
test r10b, r10b
jne 0x417d2c
mov edx, r12d
shl rbx, 4
add r9, 1
lea rdx, [rdx + rdx*4]
mov qword [rbp + rbx], r9
lea rcx, [rax + rdx*8]
mov dword [rcx], edi
jmp 0x417a1d
mov ecx, 0xa0
jmp 0x417b72
mov ecx, 0xc8
jmp 0x417b72
mov ecx, 0xf0
jmp 0x417b72
mov ecx, 0x118
jmp 0x417b72
mov ecx, 0x140
jmp 0x417b72
lea rdx, [rsp + 0xb0]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x417ab0
cmp qword [rsp + 0xb0], 0
jne 0x417a5e
mov qword [rsp + 0xa8], 0xffffffffffffffff
jmp 0x4177c3
mov ecx, 0x168
jmp 0x417b72
mov ecx, 0x190
jmp 0x417b72
mov ecx, 0x1b8
jmp 0x417b72
mov ecx, 0x1e0
jmp 0x417b72
mov ecx, 0x208
jmp 0x417b72
mov ecx, 0x230
jmp 0x417b72
mov ecx, 0x258
jmp 0x417b72
mov dword [rsi + 0x14c], 0xfffff002
mov ecx, 0xfffff002
jmp 0x417abe
mov qword [rsi + 0x88], 0xfffffffffffff01c
mov dword [rsi + 0x14c], 0x50
jmp 0x4171d9
mov ecx, 0x288
call fcn.004109f0
test rax, rax
je 0x417e0b
mov rdx, rbx
shl rdx, 4
add rdx, rbp
mov rcx, qword [rdx + 8]
mov qword [rax + 0x280], rcx
mov qword [rdx + 8], rax
mov r9, qword [rdx]
jmp 0x417bf2
mov rcx, rax
jmp 0x417a14
mov edx, 9
nop dword [rax]
lea rdx, [rdx + rdx*4]
lea rcx, [rax + rdx*8]
mov rdx, qword [rax + 0x280]
test rdx, rdx
je 0x417a14
test rcx, rcx
je 0x417949
jmp 0x417a14
mov edx, 8
jmp 0x417d70
mov edx, 7
jmp 0x417d70
mov edx, 6
jmp 0x417d70
mov edx, 5
jmp 0x417d70
mov edx, 4
jmp 0x417d70
mov edx, 3
jmp 0x417d70
mov edx, 2
jmp 0x417d70
mov edx, 0xd
jmp 0x417d70
mov edx, 0xc
jmp 0x417d70
mov edx, 0xb
jmp 0x417d70
mov edx, 0xa
jmp 0x417d70
mov edx, 0xf
jmp 0x417d70
mov edx, 0xe
jmp 0x417d70
mov edx, 1
jmp 0x417d70
lea rdx, [0x0044e470]
mov ecx, 0xe
call fcn.00416440
nop
nop dword [rax]