Function at 0x14002f150
Capabilities:
Get file size

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x14027ef78]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea eax, [rdx - 0x10]
mov qword [rsp + 0x48], r8
mov byte [rsp + 0x40], 0
movzx ebx, r9b
mov byte [rsp + 0x41], bl
mov esi, edx
mov rdi, rcx
cmp eax, 0x30
ja 0x14002f19d
movabs rcx, 0x1000100000001
bt rcx, rax
jb 0x14002f47d
cmp esi, 0x60
je 0x14002f47d
cmp esi, 0x70
je 0x14002f47d
mov qword [rsp + 0x88], rbp
lea rcx, [rdi - 8]
mov qword [rsp + 0x68], r15
call fcn.14002e3b0
cmp byte [rdi + 0x150], 0
mov r15d, eax
jne 0x14002f1dc
inc dword [rdi + 0x148]
jmp 0x14002f269
mov qword [rsp + 0x80], r12
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x78], r13
mov ecx, esi
mov qword [rsp + 0x70], r14
call fcn.1400328d0
movzx r12d, byte [rsp + 0x40]
movzx eax, bl
add r12d, 4
lea r13d, [rax + rax]
add r12d, r13d
add r12d, r15d
mov ecx, r12d
call fcn.14018cb64
mov r14, rax
test rax, rax
jne 0x14002f28e
mov rcx, qword [0x14027fe70]
lea rax, [0x14027fe70]
cmp rcx, rax
je 0x14002f257
test dword [rcx + 0x44], 0x200
je 0x14002f257
cmp byte [rcx + 0x41], 2
jb 0x14002f257
mov rcx, qword [rcx + 0x38]
lea edx, [r14 + 0x2d]
lea r8, [0x14022a0e0]
call fcn.14001d350
mov r14, qword [rsp + 0x70]
mov r13, qword [rsp + 0x78]
mov r12, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x88]
mov r15, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14017e000
add rsp, 0x90
pop rdi
pop rsi
pop rbx
ret
lea rcx, [rdi - 8]
call fcn.14002e330
mov r8, rax
mov edx, r12d
mov r9, r15
mov rcx, r14
call fcn.14006c9d0
mov r8, qword [rsp + 0x48]
sub r12d, r15d
mov eax, 1
shr r15d, 1
mov r9d, r13d
cmove r15d, eax
mov eax, 0x3a
lea edx, [r15 - 1]
mov word [r14 + rdx*2], ax
lea rcx, [r14 + r15*2]
mov edx, r12d
call fcn.14006c9d0
movzx ecx, byte [rsp + 0x41]
lea rdx, [rsp + 0x40]
movzx ebx, byte [rsp + 0x40]
add r15d, ecx
mov ecx, esi
call fcn.1400328d0
sub r12d, r13d
lea rcx, [r14 + r15*2]
mov edx, r12d
mov r8, rax
mov r9d, ebx
call fcn.14006c9d0
movzx eax, byte [rsp + 0x40]
xor ecx, ecx
shr eax, 1
mov rdx, r14
add eax, r15d
mov word [r14 + rax*2], cx
lea rcx, [rdi - 8]
mov r8d, dword [rdi + 0x14c]
call fcn.14002e680
test al, al
jne 0x14002f382
mov rcx, qword [0x14027fe70]
lea rax, [0x14027fe70]
cmp rcx, rax
je 0x14002f470
test dword [rcx + 0x44], 0x200
je 0x14002f470
cmp byte [rcx + 0x41], 2
jb 0x14002f470
mov rcx, qword [rcx + 0x38]
lea r8, [0x14022a0e0]
mov edx, 0x2e
mov r9, r14
call fcn.14002c990
mov rcx, r14
call fcn.14018cb50
jmp 0x14002f257
mov eax, dword [rdi + 0x14c]
lea rdx, [rsp + 0x48]
mov rcx, qword [rdi + 0x158]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileSizeEx]
test eax, eax
je 0x14002f427
mov rax, qword [rsp + 0x48]
add qword [rdi + 8], rax
inc dword [rdi + 0x14c]
mov r8d, dword [rdi + 0x14c]
mov rdx, qword [rdi + 8]
mov rcx, qword [0x14027fe70]
lea rax, [0x14027fe70]
cmp rcx, rax
je 0x14002f470
test dword [rcx + 0x44], 0x200
je 0x14002f470
cmp byte [rcx + 0x41], 4
jb 0x14002f470
movzx eax, word [rsp + 0xd0]
mov r9, r14
mov rcx, qword [rcx + 0x38]
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov eax, dword [rdi + 0x148]
mov dword [rsp + 0x28], r8d
mov dword [rsp + 0x20], eax
call fcn.14002daf0
mov rcx, r14
call fcn.14018cb50
jmp 0x14002f257
mov rcx, qword [0x14027fe70]
lea rax, [0x14027fe70]
cmp rcx, rax
je 0x14002f461
test dword [rcx + 0x44], 0x200
je 0x14002f461
cmp byte [rcx + 0x41], 2
jb 0x14002f461
mov rcx, qword [rcx + 0x38]
lea r8, [0x14022a0e0]
mov edx, 0x30
mov r9, r14
call fcn.14002c990
mov edx, dword [rdi + 0x14c]
lea rcx, [rdi - 8]
call fcn.14002fa80
mov rcx, r14
call fcn.14018cb50
jmp 0x14002f257
mov rcx, qword [0x14027fe70]
lea rax, [0x14027fe70]
cmp rcx, rax
je 0x14002f276
mov edx, dword [rcx + 0x44]
bt edx, 9
jae 0x14002f276
movzx eax, byte [rcx + 0x41]
cmp al, 5
jb 0x14002f276
cmp esi, 0x101
jae 0x14002f4c7
shr esi, 4
lea r9, str.:_STANDARD_INFORMATION
dec esi
mov r9, qword [r9 + rsi*8]
jmp 0x14002f4f4
bt edx, 0xb
jae 0x14002f4ed
cmp al, 3
jb 0x14002f4ed
mov rcx, qword [rcx + 0x38]
lea r8, [0x14022a4f8]
mov edx, 0xa
call fcn.14001d350
mov rcx, qword [0x14027fe70]
lea r9, [0x14022377c]
mov rcx, qword [rcx + 0x38]
lea r8, [0x14022a0e0]
mov edx, 0x2c
call fcn.14002c990
jmp 0x14002f276