Function at 0x140098fb0
Capabilities:
Get file attributes
Get file size
Get session user name
Print debug messages

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x100a0]
mov eax, 0x101a0
call fcn.1400e2af0
sub rsp, rax
mov qword [rbp + 0x88], 0xfffffffffffffffe
mov qword [rsp + 0x101f8], rbx
mov rax, qword [0x14017c430]
xor rax, rsp
mov qword [rbp + 0x10090], rax
mov esi, r9d
mov rdi, r8
mov r13, rdx
mov qword [rsp + 0x50], rdx
mov r12, rcx
mov qword [rsp + 0x78], rcx
mov r15, qword [rbp + 0x10100]
xor ebx, ebx
test r8, r8
je 0x14009928e
lea rcx, [rbp + 0x30]
call fcn.1400308a0
nop
mov dword [rsp + 0x48], ebx
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [rsp + 0x48], ebx
jne 0x140099043
mov eax, ebx
jmp 0x14009905c
lea rcx, [r12 + 0x178]
lea r9, [rsp + 0x48]
lea r8, [rbp + 0x30]
mov rdx, rdi
call fcn.140097b60
mov ecx, ebx
test eax, eax
setne cl
test ecx, ecx
jne 0x140099077
lea rcx, [rbp + 0x30]
call fcn.140031290
xor al, al
jmp 0x140099a4c
mov eax, dword [rbp + 0x30]
mov dword [r13 + 0x60], eax
lea r12, [r13 + 0x68]
mov rdx, qword [rbp + 0x38]
lea rcx, [rdx - 0x18]
mov rdi, qword [r12]
sub rdi, 0x18
or r14, 0xffffffffffffffff
cmp rcx, rdi
je 0x1400990e6
cmp dword [rdi + 0x10], 0
jl 0x1400990da
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x1400990da
call fcn.140001d80
mov r13, rax
mov ecx, r14d
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1400990cb
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + VariantCopy]
lea rax, [r13 + 0x18]
mov qword [r12], rax
mov r13, qword [rsp + 0x50]
jmp 0x1400990e6
mov r8d, dword [rdx - 0x10]
mov rcx, r12
call fcn.140002120
lea r12, [r13 + 0x78]
mov rdx, qword [rbp + 0x40]
lea rcx, [rdx - 0x18]
mov rdi, qword [r12]
sub rdi, 0x18
cmp rcx, rdi
je 0x14009914a
cmp dword [rdi + 0x10], 0
jl 0x14009913e
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14009913e
call fcn.140001d80
mov r13, rax
mov ecx, r14d
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14009912f
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + VariantCopy]
lea rax, [r13 + 0x18]
mov qword [r12], rax
mov r13, qword [rsp + 0x50]
jmp 0x14009914a
mov r8d, dword [rdx - 0x10]
mov rcx, r12
call fcn.140002120
lea r12, [r13 + 0x80]
mov rdx, qword [rbp + 0x58]
lea rcx, [rdx - 0x18]
mov rdi, qword [r12]
sub rdi, 0x18
cmp rcx, rdi
je 0x1400991b1
cmp dword [rdi + 0x10], 0
jl 0x1400991a5
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x1400991a5
call fcn.140001d80
mov r13, rax
mov ecx, r14d
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140099196
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + VariantCopy]
lea rax, [r13 + 0x18]
mov qword [r12], rax
mov r13, qword [rsp + 0x50]
jmp 0x1400991b1
mov r8d, dword [rdx - 0x10]
mov rcx, r12
call fcn.140002120
lea r12, [r13 + 0x70]
mov rdx, qword [rbp + 0x50]
lea rcx, [rdx - 0x18]
mov rdi, qword [r12]
sub rdi, 0x18
cmp rcx, rdi
je 0x140099215
cmp dword [rdi + 0x10], 0
jl 0x140099209
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140099209
call fcn.140001d80
mov r13, rax
mov ecx, r14d
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1400991fa
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + VariantCopy]
lea rax, [r13 + 0x18]
mov qword [r12], rax
mov r13, qword [rsp + 0x50]
jmp 0x140099215
mov r8d, dword [rdx - 0x10]
mov rcx, r12
call fcn.140002120
mov rax, qword [r13]
movsxd rcx, dword [rax + 4]
lea r12, [rcx + r13 + 0x78]
mov rdx, qword [rbp + 0x60]
lea rcx, [rdx - 0x18]
mov rdi, qword [r12]
sub rdi, 0x18
cmp rcx, rdi
je 0x140099283
cmp dword [rdi + 0x10], 0
jl 0x140099276
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140099276
call fcn.140001d80
mov r13, rax
mov ecx, r14d
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140099267
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + VariantCopy]
lea rax, [r13 + 0x18]
mov qword [r12], rax
mov r13, qword [rsp + 0x50]
jmp 0x140099283
mov r8d, dword [rdx - 0x10]
mov rcx, r12
call fcn.140002120
nop
lea rcx, [rbp + 0x30]
call fcn.140031290
jmp 0x1400992dc
mov dword [rbp - 0x78], 0x7fff
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0x90]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov rdx, qword [r13]
movsxd rax, dword [rdx + 4]
lea r9, [rax + r13 + 0x78]
xor eax, eax
or r14, 0xffffffffffffffff
mov rcx, r14
lea rdi, [rbp + 0x90]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rbp + 0x90]
mov rcx, r9
call fcn.140002120
mov dword [r13 + 0x148], esi
dec esi
je 0x140099a25
cmp esi, 2
jne 0x140099a4a
lea rcx, [rbp - 0x50]
call fcn.140024710
nop
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbx
mov dword [rsp + 0x70], ebx
mov r12d, ebx
mov rcx, qword [r15 + 8]
mov rsi, rbx
test rcx, rcx
je 0x14009944b
cmp rsi, rcx
jae 0x140099440
mov rax, qword [r15]
mov r9, qword [rax + rsi*8]
lea rdx, [r9 - 0x18]
mov rcx, qword [rbp - 0x38]
lea rdi, [rcx - 0x18]
cmp rdx, rdi
je 0x140099396
cmp dword [rdi + 0x10], 0
jl 0x140099382
mov rax, qword [rdi]
cmp qword [rdx], rax
jne 0x140099382
mov rcx, rdx
call fcn.140001d80
mov r13, rax
mov ecx, r14d
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140099378
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + VariantCopy]
lea rcx, [r13 + 0x18]
mov qword [rbp - 0x38], rcx
jmp 0x140099396
mov r8d, dword [r9 - 0x10]
mov rdx, r9
lea rcx, [rbp - 0x38]
call fcn.140002120
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x1400993d0
mov r8d, 2
lea rdx, [0x14012ffc4]
lea rcx, [rbp - 0x38]
call fcn.14003bd50
lea r8, [rsp + 0x58]
mov rdx, qword [rbp - 0x38]
mov rcx, qword [rsp + 0x78]
call fcn.140099dc0
mov rdx, qword [rsp + 0x60]
jmp 0x14009941e
mov r13, qword [rbp - 0x38]
mov rdi, qword [rsp + 0x60]
mov qword [rbp - 0x80], rdi
cmp rdi, qword [rsp + 0x68]
jb 0x1400993f6
lea rdx, [rdi + 1]
lea rcx, [rsp + 0x58]
call fcn.14009b070
test al, al
je 0x140099435
mov rax, qword [rsp + 0x58]
lea rcx, [rax + rdi*8]
mov qword [rbp - 0x60], rcx
test rcx, rcx
je 0x140099411
mov rdx, r13
call fcn.140002ad0
nop
mov rdx, qword [rsp + 0x60]
inc rdx
mov qword [rsp + 0x60], rdx
inc r12d
inc rsi
mov rcx, qword [r15 + 8]
mov eax, r12d
cmp rax, rcx
jae 0x140099450
jmp 0x140099324
mov ecx, 0x8007000e
call fcn.1400022b0
int3
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov rdx, qword [rsp + 0x60]
mov dword [rbp - 0x80], ebx
mov r15, rbx
mov qword [rsp + 0x78], rbx
lea r12, vtable.SecC::CSerialObject.0
test rdx, rdx
je 0x14009996c
nop dword [rax + rax]
cmp r15, rdx
jae 0x140099961
mov rax, qword [rsp + 0x58]
mov r13, qword [rax + r15*8]
lea rcx, [r13 - 0x18]
mov r10, qword [rbp - 0x38]
lea rdi, [r10 - 0x18]
cmp rcx, rdi
je 0x1400995be
cmp dword [rdi + 0x10], 0
jl 0x1400994d4
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x1400994d4
call fcn.140001d80
mov rsi, rax
mov ecx, r14d
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1400994c7
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + VariantCopy]
lea rax, [rsi + 0x18]
mov qword [rbp - 0x38], rax
jmp 0x1400995be
movsxd rsi, dword [r13 - 0x10]
test esi, esi
jne 0x14009953a
mov rsi, qword [rdi]
cmp dword [rdi + 8], 0
je 0x1400995be
cmp dword [rdi + 0x10], 0
jge 0x14009950a
cmp dword [r10 - 0xc], 0
jl 0x1400997d6
mov dword [r10 - 0x10], ebx
mov rax, qword [rbp - 0x38]
mov word [rax], bx
jmp 0x1400995be
mov eax, r14d
lock xadd dword [rdi + 0x10], eax
dec eax
test eax, eax
jg 0x140099524
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + VariantCopy]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x38], rax
jmp 0x1400995be
test r13, r13
je 0x1400997f7
mov r15d, dword [r10 - 0x10]
mov r12, r13
sub r12, r10
sar r12, 1
test esi, esi
js 0x1400997ec
mov ecx, 1
sub ecx, dword [rdi + 0x10]
mov eax, dword [rdi + 0xc]
sub eax, esi
or eax, ecx
jge 0x140099578
mov edx, esi
lea rcx, [rbp - 0x38]
call fcn.1400020c0
mov r10, qword [rbp - 0x38]
lea rdi, [rsi + rsi]
movsxd rdx, dword [r10 - 0xc]
mov rcx, r10
mov r9, rdi
add rdx, rdx
cmp r12, r15
ja 0x140099599
lea r8, [r10 + r12*2]
call fcn.1400d4ebc
jmp 0x1400995a1
mov r8, r13
call fcn.1400d4e34
mov rax, qword [rbp - 0x38]
cmp esi, dword [rax - 0xc]
jg 0x1400997e1
mov dword [rax - 0x10], esi
mov rax, qword [rbp - 0x38]
mov word [rdi + rax], bx
mov r15, qword [rsp + 0x78]
mov rsi, rbx
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x140099618
call fcn.1400163c0
mov edx, eax
cmp eax, 0x80070020
je 0x14009960f
cmp eax, 0x80070005
jne 0x140099621
mov qword [rbp - 0x28], rbx
jmp 0x1400996d0
mov rsi, rax
mov qword [rbp - 0x70], rax
mov edx, ebx
mov eax, ebx
test edx, edx
sete al
test eax, eax
je 0x14009988a
lea rdx, [rbp - 0x54]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rbp - 0x58], eax
cmp eax, 0xffffffff
jne 0x140099650
call fcn.1400163c0
mov edi, eax
test eax, eax
js 0x14009965a
mov rax, qword [rbp - 0x58]
mov qword [rbp - 0x28], rax
mov edi, ebx
mov rax, qword [0x140183810]
test rax, rax
jne 0x14009968d
mov ecx, 0x220
call fcn.1400d5224
mov qword [rbp - 0x60], rax
test rax, rax
je 0x140099683
mov rcx, rax
call fcn.140097f80
jmp 0x140099686
mov rax, rbx
mov qword [0x140183810], rax
mov eax, dword [rax + 0x21c]
cmp qword [rbp - 0x28], rax
jb 0x1400996ac
lea rcx, str.File_dwFileSize___pCLMon__m_dwMaxFileSize
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
jmp 0x1400997a3
mov eax, ebx
test edi, edi
sete al
test eax, eax
je 0x140099819
test rsi, rsi
je 0x1400996d0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, rbx
mov qword [rbp - 0x70], rbx
mov r13, qword [rsp + 0x50]
add r13, 0xe0
mov qword [rbp - 0x60], r13
mov r12, qword [r13 + 8]
mov qword [rsp + 0x78], r12
cmp r12, qword [r13 + 0x10]
jb 0x140099704
lea rdx, [r12 + 1]
mov rcx, r13
call fcn.140033a80
test al, al
je 0x140099802
imul r12, r12, 0x78
add r12, qword [r13]
mov qword [rbp + 0x80], r12
je 0x14009979f
lea rax, vtable.SecC::CSerialObject.0
mov qword [r12], rax
lea rax, vtable.CLogFileInfo.0
mov qword [r12], rax
mov eax, dword [rbp - 0x48]
mov dword [r12 + 8], eax
mov eax, dword [rbp - 0x44]
mov dword [r12 + 0xc], eax
mov eax, dword [rbp - 0x40]
mov dword [r12 + 0x10], eax
mov eax, dword [rbp - 0x3c]
mov dword [r12 + 0x14], eax
lea rdi, [r12 + 0x18]
mov qword [rsp + 0x40], rdi
mov rcx, qword [rbp - 0x38]
add rcx, 0xffffffffffffffe8
call fcn.140001d80
add rax, 0x18
mov qword [rdi], rax
lea rdi, [r12 + 0x20]
mov qword [rsp + 0x40], rdi
mov rcx, qword [rbp - 0x30]
add rcx, 0xffffffffffffffe8
call fcn.140001d80
add rax, 0x18
mov qword [rdi], rax
mov rax, qword [rbp - 0x28]
mov qword [r12 + 0x28], rax
lea rcx, [r12 + 0x30]
call fcn.14002d2b0
nop
inc qword [r13 + 8]
test rsi, rsi
je 0x1400997b5
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x70], rbx
mov ecx, dword [rbp - 0x80]
inc ecx
mov dword [rbp - 0x80], ecx
inc r15
mov qword [rsp + 0x78], r15
mov eax, ecx
mov rdx, qword [rsp + 0x60]
cmp rax, rdx
jae 0x14009980d
jmp 0x140099470
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov ecx, 0x80070057
call fcn.1400022b0
nop
mov ecx, 0x8007000e
call fcn.1400022b0
nop
lea r12, vtable.SecC::CSerialObject.0
jmp 0x14009996c
test rsi, rsi
je 0x14009982b
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x70], rbx
mov rdi, qword [rsp + 0x58]
test rdi, rdi
je 0x14009987a
mov rbx, qword [rsp + 0x60]
test rbx, rbx
je 0x140099871
nop
mov qword [rsp + 0x40], rdi
mov rdx, qword [rdi]
sub rdx, 0x18
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140099863
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
add rdi, 8
dec rbx
jne 0x140099840
mov rdi, qword [rsp + 0x58]
mov rcx, rdi
call fcn.1400d6134
nop
lea rcx, [rbp - 0x50]
call fcn.140025290
xor al, al
jmp 0x140099a4c
test rsi, rsi
je 0x14009989c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x70], rbx
mov rdi, qword [rsp + 0x58]
test rdi, rdi
je 0x1400998ea
mov rbx, qword [rsp + 0x60]
test rbx, rbx
je 0x1400998e1
mov qword [rsp + 0x40], rdi
mov rdx, qword [rdi]
sub rdx, 0x18
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400998d3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
add rdi, 8
dec rbx
jne 0x1400998b0
mov rdi, qword [rsp + 0x58]
mov rcx, rdi
call fcn.1400d6134
nop
lea rax, [rbp - 0x20]
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 0x20]
call fcn.140032aa0
nop
lea rax, [rbp - 0x30]
mov qword [rsp + 0x40], rax
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140099926
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
lea rax, [rbp - 0x38]
mov qword [rsp + 0x40], rax
mov rdx, qword [rbp - 0x38]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r14d
dec r14d
test r14d, r14d
jg 0x14009994f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
lea rax, vtable.SecC::CSerialObject.0
mov qword [rbp - 0x50], rax
xor al, al
jmp 0x140099a4c
mov ecx, 0x80070057
call fcn.1400022b0
nop
mov rdi, qword [rsp + 0x58]
test rdi, rdi
je 0x1400999ba
mov rbx, qword [rsp + 0x60]
test rbx, rbx
je 0x1400999b1
mov qword [rsp + 0x40], rdi
mov rdx, qword [rdi]
sub rdx, 0x18
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400999a3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
add rdi, 8
dec rbx
jne 0x140099980
mov rdi, qword [rsp + 0x58]
mov rcx, rdi
call fcn.1400d6134
nop
lea rax, [rbp - 0x20]
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 0x20]
call fcn.140032aa0
nop
lea rax, [rbp - 0x30]
mov qword [rsp + 0x40], rax
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400999f6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
lea rax, [rbp - 0x38]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp - 0x38]
lea rdx, [rax - 0x18]
lock xadd dword [rdx + 0x10], r14d
dec r14d
test r14d, r14d
jg 0x140099a1f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov qword [rbp - 0x50], r12
jmp 0x140099a4a
mov rdx, qword [r15]
test rdx, rdx
je 0x140099a3e
xor eax, eax
mov rcx, r14
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea ebx, [rcx - 1]
mov r8d, ebx
lea rcx, [r13 + 8]
call fcn.140002120
mov al, 1
mov rcx, qword [rbp + 0x10090]
xor rcx, rsp
call fcn.1400d4d90
mov rbx, qword [rsp + 0x101f8]
add rsp, 0x101a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret