Function at 0x140091450
Capabilities:
Get file size
Get session user name

Disassembly:
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x10280]
mov eax, 0x10380
call fcn.1400e2af0
sub rsp, rax
mov qword [rbp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x103b0], rbx
mov qword [rsp + 0x103b8], rsi
mov qword [rsp + 0x103c0], rdi
mov rax, qword [0x14017c430]
xor rax, rsp
mov qword [rbp + 0x10270], rax
mov r14, qword [0x140183798]
lea rcx, [0x140183358]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, r14
call fcn.140092390
mov rdi, rax
movsxd rcx, eax
mov eax, 0xc50
mul rcx
mov r13, 0xffffffffffffffff
cmovo rax, r13
mov rcx, rax
call fcn.1400aefbc
mov rsi, rax
mov qword [rbp - 0x78], rax
mov dword [rsp + 0x50], edi
lea r8, [rsp + 0x50]
mov rdx, rax
mov rcx, r14
call fcn.140092450
xor ebx, ebx
mov r15, qword [0x1401835d8]
test r15, r15
jne 0x14009152f
lea ecx, [rbx + 0x70]
call fcn.1400d5224
mov qword [rsp + 0x60], rax
test rax, rax
je 0x140091525
mov rcx, rax
call fcn.140038350
mov r15, rax
jmp 0x140091528
mov r15, rbx
mov qword [0x1401835d8], r15
mov r12d, ebx
cmp dword [rsp + 0x50], ebx
jle 0x140091a0d
lea r13, [rsi + 0x830]
cmp dword [r13], 0
jbe 0x140091a09
lea rcx, [rbp + 0x50]
call fcn.140025ab0
nop
movsxd rbx, r12d
imul rbx, rbx, 0xc50
add rbx, rsi
jne 0x14009156d
xor edi, edi
mov ecx, edi
jmp 0x140091581
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
xor edi, edi
mov r8d, ecx
mov rdx, rbx
lea rcx, [rbp + 0xc0]
call fcn.140002120
lea rdx, [rbx + 0x618]
test rdx, rdx
jne 0x1400915a3
mov ecx, edi
jmp 0x1400915b7
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
dec rcx
xor edi, edi
mov r8d, ecx
lea rcx, [rbp + 0xc8]
call fcn.140002120
lea rdx, [rbx + 0x208]
mov rax, qword [rbp + 0x50]
movsxd rcx, dword [rax + 4]
lea r9, [rbp + rcx + 0xc0]
test rdx, rdx
jne 0x1400915e6
mov ecx, edi
jmp 0x1400915f8
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
mov rcx, r9
call fcn.140002120
mov edx, dword [r13]
mov dword [rbp + 0xd0], edx
lea rcx, [rbx + 0x820]
lea rdx, [rbp + 0xd4]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov dword [rsp + 0x68], 0x7fff
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x270]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov rdx, qword [rbp + 0x50]
movsxd rax, dword [rdx + 4]
lea r9, [rbp + rax + 0xc8]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0x270]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rbp + 0x270]
mov rcx, r9
call fcn.140002120
cmp word [r13 + 0x210], 0x2f
je 0x14009198e
xor edi, edi
mov esi, edi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], rdi
lea rax, vtable.SecC::CSerialObject.0
mov qword [rbp - 0x70], rax
lea rax, vtable.CLogFileInfo.0
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rdi
mov qword [rbp - 0x60], rdi
lea rax, [rbp - 0x58]
mov qword [rbp - 0x80], rax
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x58], rax
lea rax, [rbp - 0x50]
mov qword [rbp - 0x80], rax
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rdi
lea rcx, [rbp - 0x40]
call fcn.14002d2b0
nop
lea rdx, [rbx + 0xa40]
test rdx, rdx
jne 0x14009170c
mov ecx, edi
jmp 0x14009171e
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
lea rcx, [rbp - 0x58]
call fcn.140002120
lea rdx, [rbp + 0x58]
mov qword [rbp - 0x80], rdx
mov rbx, qword [rbp + 0x60]
mov qword [rbp + 0x38], rbx
cmp rbx, qword [rbp + 0x68]
jb 0x140091755
lea rdx, [rbx + 1]
lea rcx, [rbp + 0x58]
call fcn.140033a80
test al, al
je 0x1400919d2
imul rbx, rbx, 0x78
add rbx, qword [rbp + 0x58]
mov qword [rbp + 0x10], rbx
je 0x1400917db
lea rax, vtable.SecC::CSerialObject.0
mov qword [rbx], rax
lea rax, vtable.CLogFileInfo.0
mov qword [rbx], rax
mov eax, dword [rbp - 0x68]
mov dword [rbx + 8], eax
mov eax, dword [rbp - 0x64]
mov dword [rbx + 0xc], eax
mov eax, dword [rbp - 0x60]
mov dword [rbx + 0x10], eax
mov eax, dword [rbp - 0x5c]
mov dword [rbx + 0x14], eax
lea rdi, [rbx + 0x18]
mov qword [rsp + 0x58], rdi
mov rcx, qword [rbp - 0x58]
add rcx, 0xffffffffffffffe8
call fcn.140001d80
add rax, 0x18
mov qword [rdi], rax
lea rdi, [rbx + 0x20]
mov qword [rsp + 0x58], rdi
mov rcx, qword [rbp - 0x50]
add rcx, 0xffffffffffffffe8
call fcn.140001d80
add rax, 0x18
mov qword [rdi], rax
mov rax, qword [rbp - 0x48]
mov qword [rbx + 0x28], rax
lea rcx, [rbx + 0x30]
call fcn.14002d2b0
nop
inc qword [rbp + 0x60]
je 0x1400919fe
mov rax, qword [rbp + 0x58]
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rbx + 1]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x14009182b
call fcn.1400163c0
test eax, eax
jne 0x140091905
jmp 0x140091833
mov rsi, rax
mov qword [rsp + 0x70], rax
cmp qword [rbp + 0x60], rbx
jbe 0x1400919f3
mov rdi, qword [rbp + 0x58]
lea rdx, [rsp + 0x64]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x60], eax
cmp eax, 0xffffffff
jne 0x14009187f
call fcn.1400163c0
test eax, eax
jns 0x14009187f
je 0x140091888
test rsi, rsi
je 0x140091905
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x70], rbx
jmp 0x140091905
mov rax, qword [rsp + 0x60]
mov qword [rdi + 0x28], rax
test rsi, rsi
je 0x14009189b
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbx
lea rcx, [rsp + 0x40]
call fcn.140094220
movaps xmm5, xmmword [rsp + 0x40]
movdqa xmmword [rbp + 0x20], xmm5
cmp qword [rbp + 0x60], rbx
jbe 0x1400919e8
mov rax, qword [rbp + 0x58]
lea r8, [rbp + 0x20]
mov rdx, qword [rax + 0x18]
mov rcx, r14
call fcn.140038530
test eax, eax
js 0x140091905
cmp qword [rbp + 0x60], rbx
jbe 0x1400919dd
mov rcx, qword [rbp + 0x58]
mov eax, dword [rsp + 0x40]
mov dword [rcx + 8], eax
mov eax, dword [rsp + 0x44]
mov dword [rcx + 0xc], eax
mov eax, dword [rsp + 0x48]
mov dword [rcx + 0x10], eax
mov eax, dword [rsp + 0x4c]
mov dword [rcx + 0x14], eax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x58], rax
lea rcx, [rbp - 0x40]
call fcn.140032aa0
nop
lea rax, [rbp - 0x50]
mov qword [rsp + 0x58], rax
mov rdx, qword [rbp - 0x50]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140091941
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
lea rax, [rbp - 0x58]
mov qword [rsp + 0x58], rax
mov rdx, qword [rbp - 0x58]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14009196a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
lea rax, vtable.SecC::CSerialObject.0
mov qword [rbp - 0x70], rax
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14009198a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x70], rbx
mov rsi, qword [rbp - 0x78]
mov rax, qword [rbp + 0x50]
movsxd rcx, dword [rax + 4]
lea rdx, [rbp + rcx + 0x50]
mov rcx, r15
call fcn.140037b70
nop
lea rcx, [rbp + 0x130]
call fcn.1400266e0
lea rcx, [rbp + 0x130]
call fcn.14001f9e0
inc r12d
add r13, 0xc50
cmp r12d, dword [rsp + 0x50]
jge 0x140091a09
jmp 0x140091543
mov ecx, 0x8007000e
call fcn.1400022b0
int3
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov ecx, 0x80070057
call fcn.1400022b0
nop
or r13, 0xffffffffffffffff
mov rcx, rsi
call fcn.1400d7c88
mov rax, qword [r14 + 0x80]
mov rbx, qword [rax]
cmp rbx, rax
je 0x140091b53
nop dword [rax + rax]
mov eax, dword [rbx + 0x864]
bt eax, 8
jb 0x140091acf
test al, al
js 0x140091acf
lea rdi, [rbx + 0x30]
xor eax, eax
mov rcx, r13
repne scasw ax, word [rdi]
not rcx
dec rcx
je 0x140091acf
cmp byte [rbx + 0xe91], al
jne 0x140091b46
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0xe91], 0
jne 0x140091aa4
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0xe91], 0
jne 0x140091b46
nop dword [rax + rax]
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0xe91], 0
je 0x140091a90
jmp 0x140091b46
mov rax, qword [rbx + 8]
cmp byte [rax + 0xe91], 0
jne 0x140091ac7
cmp rbx, qword [rax + 0x10]
jne 0x140091ac7
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0xe91], 0
je 0x140091ab1
mov rbx, rax
jmp 0x140091b46
mov r8, rbx
cmp byte [rbx + 0xe91], 0
jne 0x140091b39
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0xe91], 0
jne 0x140091b11
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0xe91], 0
jne 0x140091b39
nop word [rax + rax]
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0xe91], 0
je 0x140091b00
jmp 0x140091b39
mov rax, qword [rbx + 8]
cmp byte [rax + 0xe91], 0
jne 0x140091b36
nop
cmp rbx, qword [rax + 0x10]
jne 0x140091b36
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0xe91], 0
je 0x140091b20
mov rbx, rax
lea rcx, [r14 + 0x78]
lea rdx, [rbp + 0x30]
call fcn.140092d80
cmp rbx, qword [r14 + 0x80]
jne 0x140091a30
lea rcx, [0x140183358]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rbp + 0x10270]
xor rcx, rsp
call fcn.1400d4d90
lea r11, [rsp + 0x10380]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret