Function at 0x4bc870
Capabilities:
Get file size

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
add rsp, 0xffffffffffffff80
mov ebx, dword [rcx + 0x168]
mov ebp, ebx
and ebp, 3
mov rsi, rcx
test ebx, 0x20000000
je 0x4bc9e8
mov dword [rsp + 0x60], ebx
mov qword [rsp + 0x78], 0
cmp ebp, 1
je 0x4bcaf8
test bl, 8
je 0x4bcb10
xor ecx, ecx
and ebx, 0xfffffff4
call sub.msvcrt.dll__umask
or ebx, 2
mov ecx, eax
mov edi, eax
call sub.msvcrt.dll__umask
mov r10d, 0x12019f
mov eax, ebx
mov edx, ebx
and eax, 0x10000000
cmp eax, 1
sbb r8d, r8d
and edx, 0x700
and r8d, 7
cmp edx, 0x300
je 0x4bcb60
jg 0x4bc9a8
cmp edx, 0x100
je 0x4bcae8
cmp edx, 0x200
jne 0x4bc993
mov ecx, 5
mov edx, pe_nt_image_headers64
test bh, 1
je 0x4bc937
not edi
and edi, dword [rsi + 0x158]
xor edx, edx
and edi, 0x80
sete dl
sub edx, 0xffffff80
test bl, 0x40
je 0x4bc949
or edx, 0x4000100
or r10d, 0x10000
mov eax, edx
or ah, 1
test bh, 0x10
cmovne edx, eax
mov eax, ebx
and eax, 0x30
cmp eax, 0x10
je 0x4bca28
cmp eax, 0x20
je 0x4bcb40
test eax, eax
je 0x4bca2e
mov qword [rsi + 0x88], 0xfffffffffffff019
mov dword [rsi + 0x14c], 0x57
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
test edx, edx
jne 0x4bc973
mov ecx, 3
jmp 0x4bc917
cmp edx, 0x600
je 0x4bc912
jle 0x4bc9d0
cmp edx, 0x700
jne 0x4bc973
mov ecx, 1
jmp 0x4bc917
cmp edx, 0x400
je 0x4bc997
cmp edx, 0x500
je 0x4bc9be
jmp 0x4bc973
xor ecx, ecx
call sub.msvcrt.dll__umask
mov ecx, eax
mov edi, eax
call sub.msvcrt.dll__umask
cmp ebp, 3
je 0x4bc973
lea rax, [0x0071bcc8]
mov r10d, dword [rax + rbp*4]
mov eax, r10d
and eax, 0xfffffffd
or eax, 4
test bl, 8
cmovne r10d, eax
jmp 0x4bc8cf
or edx, 0x10000000
test ebx, 0x2000000
je 0x4bca50
test r10b, 4
je 0x4bca4a
test r10b, 2
je 0x4bc973
and r10d, 0xfffffffb
or edx, 0x20000000
mov eax, ebx
and eax, 0xc000000
lea r9d, [rax - 0x4000000]
and r9d, 0xf8000000
je 0x4bcb50
test eax, eax
jne 0x4bc973
mov r11, qword [rsi + 0x150]
mov dword [rsp + 0x20], ecx
xor r9d, r9d
or edx, 0x2000000
mov dword [rsp + 0x28], edx
mov edx, r10d
mov qword [rsp + 0x30], 0
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x4bcd40
mov edx, ebx
mov rcx, rax
call qword [sym.imp.msvcrt.dll__open_osfhandle]
mov edi, eax
test eax, eax
js 0x4bcca8
and ebx, 0x20000000
jne 0x4bcb90
movsxd rdi, edi
mov qword [rsi + 0x88], rdi
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov ecx, 4
jmp 0x4bc917
mov ebp, ebx
and ebp, 0xfffffffc
or ebp, 2
and ebx, 8
je 0x4bcb70
mov ebx, ebp
jmp 0x4bc8b3
xor ecx, ecx
call sub.msvcrt.dll__umask
mov ecx, eax
mov edi, eax
call sub.msvcrt.dll__umask
cmp ebp, 3
je 0x4bc973
lea rax, [0x0071bcc8]
mov r10d, dword [rax + rbp*4]
jmp 0x4bc8cf
or edx, 0x8000000
jmp 0x4bca2e
or edx, 0x80000000
jmp 0x4bca73
mov ecx, 2
jmp 0x4bc917
xor ecx, ecx
mov ebx, ebp
mov ebp, 2
call sub.msvcrt.dll__umask
mov ecx, eax
mov edi, eax
call sub.msvcrt.dll__umask
jmp 0x4bcb29
mov r9d, 0x18
lea r8, [rsp + 0x40]
mov edx, 1
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandleEx]
test eax, eax
je 0x4bcd20
movzx eax, byte [rsp + 0x55]
mov byte [rsp + 0x64], al
test al, al
je 0x4bcdf0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x68], 0xffffffffffffffff
lea rcx, [0x00a09e00]
movzx ebx, dil
lea rbp, [0x00780e00]
call sub.KERNEL32.dll_EnterCriticalSection
mov rax, rbx
shl rax, 4
add rax, rbp
mov r8, qword [rax]
test r8, r8
mov rcx, r8
setne r10b
and ecx, 0xf
jne 0x4bcd80
test r10b, r10b
je 0x4bcd80
mov r9, qword [rax + 8]
mov ecx, 0x10
mov rdx, r9
xor eax, eax
jmp 0x4bcc39
add rax, 1
add rdx, 0x28
cmp rax, rcx
jae 0x4bcd98
cmp edi, dword [rdx]
jne 0x4bcc28
lea rax, [rax + rax*4]
lea rax, [r9 + rax*8]
test rax, rax
jne 0x4bcc80
mov r12d, r8d
and r12d, 0xf
jne 0x4bcc5c
test r10b, r10b
jne 0x4bce78
shl rbx, 4
mov eax, r12d
add r8, 1
add rbp, rbx
lea rax, [rax + rax*4]
mov rdx, qword [rbp + 8]
mov qword [rbp], r8
lea rax, [rdx + rax*8]
mov dword [rax], edi
nop dword [rax]
movdqa xmm0, xmmword [rsp + 0x60]
movdqa xmm1, xmmword [rsp + 0x70]
lea rcx, [0x00a09e00]
movups xmmword [rax + 8], xmm0
movups xmmword [rax + 0x18], xmm1
call fcn.004d4240
jmp 0x4bcace
call qword [sym.imp.msvcrt.dll__errno]
cmp dword [rax], 0x18
jne 0x4bce20
mov qword [rsi + 0x88], 0xfffffffffffff01e
mov dword [rsi + 0x14c], 4
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4bc988
mov eax, dword [rsp + 0x60]
mov edx, dword [rsp + 0x70]
mov rcx, r12
mov qword [rsp + 0x28], 0
mov r9d, dword [rsp + 0x74]
and eax, 3
mov dword [rsp + 0x20], edx
cmp eax, 1
sbb eax, eax
xor edx, edx
and eax, 0xfffffffe
lea r8d, [rax + 4]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov qword [rsp + 0x68], rax
test rax, rax
jne 0x4bcbd4
nop dword [rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi + 0x14c], eax
mov ecx, eax
call fcn.004bb150
cdqe
mov qword [rsi + 0x88], rax
jmp 0x4bcccc
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rdi
cmp eax, 0x50
jne 0x4bcd60
and ebx, 0x500
cmp ebx, 0x100
je 0x4bce4a
call rdi
mov dword [rsi + 0x14c], eax
mov ecx, eax
call fcn.004bb150
cdqe
mov qword [rsi + 0x88], rax
jmp 0x4bc988
mov rax, rbx
shl rax, 4
mov r9, qword [rbp + rax + 8]
test rcx, rcx
jne 0x4bcc1d
nop dword [rax]
mov rcx, qword [r9 + 0x280]
test rcx, rcx
je 0x4bcc4a
nop dword [rax + rax]
mov rdx, rcx
xor eax, eax
nop dword [rax]
cmp edi, dword [rdx]
je 0x4bcde0
add eax, 1
add rdx, 0x28
cmp eax, 0x10
jne 0x4bcdb8
mov rcx, qword [rcx + 0x280]
test rcx, rcx
jne 0x4bcdb0
jmp 0x4bcc4a
lea rax, [rax + rax*4]
lea rax, [rcx + rax*8]
jmp 0x4bcc80
lea rdx, [rsp + 0x70]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x4bcd20
cmp qword [rsp + 0x70], 0
jne 0x4bccda
mov qword [rsp + 0x68], 0xffffffffffffffff
jmp 0x4bcbd4
mov rbx, qword [sym.imp.KERNEL32.dll_GetLastError]
call rbx
test eax, eax
je 0x4bce64
call rbx
mov dword [rsi + 0x14c], eax
mov ecx, eax
call fcn.004bb150
cdqe
mov qword [rsi + 0x88], rax
jmp 0x4bcccc
mov qword [rsi + 0x88], 0xfffffffffffff01c
mov dword [rsi + 0x14c], 0x50
jmp 0x4bc988
mov dword [rsi + 0x14c], 0xfffff002
mov ecx, 0xfffff002
jmp 0x4bcd2e
mov ecx, 0x288
call fcn.004b75d0
mov rdx, rax
test rax, rax
je 0x4bceab
mov rax, rbx
shl rax, 4
add rax, rbp
mov rcx, qword [rax + 8]
mov r8, qword [rax]
mov qword [rdx + 0x280], rcx
mov qword [rax + 8], rdx
jmp 0x4bcc5c
lea rdx, [0x0071ba8e]
mov ecx, 0xe
call fcn.004bb090
nop
nop dword [rax]