Function at 0x6e8f8f30
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5c
test byte [0x6e927878], 8
mov edi, dword [ebp + 0x10]
jne 0x6e8f9140
test edi, edi
je 0x6e8f9238
mov eax, dword [ebp + 0xc]
and eax, 0x18000
cmp eax, 0x18000
je 0x6e8f9220
mov dword [ebp - 0x2c], 1
mov eax, dword [ebp + 0xc]
and eax, 0x10000
cmp eax, 1
sbb ebx, ebx
and ebx, 0xc0000000
sub ebx, 0x40000000
test dword [ebp + 0xc], 0x2000
je 0x6e8f90a8
xor eax, eax
mov ecx, dword [sym.imp.kernel32.dll_CreateFileW]
mov edx, 1
mov dword [esp + 0x18], eax
mov eax, pe_nt_image_headers32
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 8], edx
mov dword [esp + 4], ebx
mov dword [esp], edi
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [ebp - 0x30], ecx
call ecx
sub esp, 0x1c
cmp eax, 0xffffffff
mov esi, eax
je 0x6e8f9188
mov dword [esp], esi
xor eax, eax
mov dword [esp + 4], eax
mov dword [ebp - 0x20], 0
call dword [sym.imp.kernel32.dll_GetFileSize]
sub esp, 8
test eax, eax
je 0x6e8f90c0
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_CloseHandle]
xor eax, eax
xor edx, edx
mov ecx, 0xe
sub esp, 4
mov dword [esp + 0x28], eax
xor eax, eax
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x20]
mov dword [esp + 0x20], eax
xor eax, eax
mov dword [esp + 0x1c], eax
lea eax, [ebp - 0x1c]
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x14], eax
mov eax, 0x112
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], 1
call sym.crypt32.dll_CryptQueryObject
xor ecx, ecx
sub esp, 0x2c
test eax, eax
jne 0x6e8f9198
mov edx, dword [ebp - 0x20]
test edx, edx
je 0x6e8f909b
mov dword [esp], ecx
mov eax, dword [ebp + 0xc]
mov ecx, esi
call fcn.6e8f80e0
mov ecx, dword [ebp + 8]
test ecx, ecx
mov edx, eax
je 0x6e8f909b
test byte [ebp + 0xc], 1
jne 0x6e8f909b
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.advapi32.dll_CryptReleaseContext
mov edx, dword [ebp - 0x2c]
sub esp, 8
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
test dword [ebp + 0xc], 0x4000
sete al
add eax, 3
mov dword [ebp - 0x2c], eax
jmp 0x6e8f8f91
mov dword [esp], edi
mov eax, 0x2e
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbase.dll_wcsrchr]
test eax, eax
je 0x6e8f9210
lea ebx, [eax + 2]
mov eax, 0x6e92fc80
mov edi, dword [sym.imp.kernel32.dll_lstrcmpiW]
mov dword [esp + 4], eax
mov dword [esp], ebx
call edi
sub esp, 8
test eax, eax
jne 0x6e8f91f0
mov ecx, 2
xor eax, eax
xor ebx, ebx
mov dword [esp + 8], eax
mov edi, 0x2000
xor eax, eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], edi
mov dword [esp + 4], eax
mov dword [esp], 2
mov dword [ebp - 0x2c], ecx
call sym.crypt32.dll_CertOpenStore
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x20], eax
sub esp, 0x14
mov edx, eax
jmp 0x6e8f9061
mov eax, edi
mov ebx, str.CRYPT_FileNameOpenStoreW
call fcn.6e8f8b10
mov esi, 0x6e927878
mov ecx, 0x6e92fc6f
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], 3
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
call fcn.6e8f8170
jmp 0x6e8f8f49
lea esp, [ebp - 0xc]
xor edx, edx
pop ebx
mov eax, edx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], ebx
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x1c], 0x100
mov dword [esp], edi
mov dword [esp + 0x10], eax
sete cl
mov eax, 1
inc ecx
xor edx, edx
mov dword [ebp - 0x34], ecx
xor esi, esi
mov ecx, pe_nt_image_headers32
mov dword [esp + 0x14], ecx
mov ecx, dword [ebp - 0x30]
mov dword [esp + 0xc], esi
mov dword [esp + 0x18], edx
mov dword [esp + 8], eax
call ecx
mov ecx, dword [ebp - 0x34]
sub esp, 0x1c
mov esi, eax
jmp 0x6e8f905e
mov dword [esp], ebx
mov eax, 0x6e92fc88
mov dword [esp + 4], eax
call edi
sub esp, 8
test eax, eax
je 0x6e8f90fc
lea esi, [esi]
mov ecx, 1
jmp 0x6e8f9101
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x80070057
xor edx, edx
jmp 0x6e8f909b
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 3
xor edx, edx
jmp 0x6e8f909b