Function at 0x140035110
Capabilities:
Get file size

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x14029fbf8]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea eax, [rdx - 0x10]
mov qword [rsp + 0x48], r8
mov byte [rsp + 0x40], 0
movzx ebx, r9b
mov byte [rsp + 0x41], bl
mov esi, edx
mov rdi, rcx
cmp eax, 0x30
ja 0x14003515d
movabs rcx, 0x1000100000001
bt rcx, rax
jb 0x14003543d
cmp esi, 0x60
je 0x14003543d
cmp esi, 0x70
je 0x14003543d
mov qword [rsp + 0x88], rbp
lea rcx, [rdi - 8]
mov qword [rsp + 0x68], r15
call fcn.140034340
cmp byte [rdi + 0x150], 0
mov r15d, eax
jne 0x14003519c
inc dword [rdi + 0x148]
jmp 0x140035229
mov qword [rsp + 0x80], r12
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x78], r13
mov ecx, esi
mov qword [rsp + 0x70], r14
call fcn.140038870
movzx r12d, byte [rsp + 0x40]
movzx eax, bl
add r12d, 4
lea r13d, [rax + rax]
add r12d, r13d
add r12d, r15d
mov ecx, r12d
call fcn.1401a8584
mov r14, rax
test rax, rax
jne 0x14003524e
mov rcx, qword [str.P_a_]
lea rax, str.P_a_
cmp rcx, rax
je 0x140035217
test dword [rcx + 0x44], 0x200
je 0x140035217
cmp byte [rcx + 0x41], 2
jb 0x140035217
mov rcx, qword [rcx + 0x38]
lea edx, [r14 + 0x2d]
lea r8, [0x140249260]
call fcn.140022ad0
mov r14, qword [rsp + 0x70]
mov r13, qword [rsp + 0x78]
mov r12, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x88]
mov r15, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140199a10
add rsp, 0x90
pop rdi
pop rsi
pop rbx
ret
lea rcx, [rdi - 8]
call fcn.1400342c0
mov r8, rax
mov edx, r12d
mov r9, r15
mov rcx, r14
call fcn.140072d80
mov r8, qword [rsp + 0x48]
sub r12d, r15d
mov eax, 1
shr r15d, 1
mov r9d, r13d
cmove r15d, eax
mov eax, 0x3a
lea edx, [r15 - 1]
mov word [r14 + rdx*2], ax
lea rcx, [r14 + r15*2]
mov edx, r12d
call fcn.140072d80
movzx ecx, byte [rsp + 0x41]
lea rdx, [rsp + 0x40]
movzx ebx, byte [rsp + 0x40]
add r15d, ecx
mov ecx, esi
call fcn.140038870
sub r12d, r13d
lea rcx, [r14 + r15*2]
mov edx, r12d
mov r8, rax
mov r9d, ebx
call fcn.140072d80
movzx eax, byte [rsp + 0x40]
xor ecx, ecx
shr eax, 1
mov rdx, r14
add eax, r15d
mov word [r14 + rax*2], cx
lea rcx, [rdi - 8]
mov r8d, dword [rdi + 0x14c]
call fcn.140034610
test al, al
jne 0x140035342
mov rcx, qword [str.P_a_]
lea rax, str.P_a_
cmp rcx, rax
je 0x140035430
test dword [rcx + 0x44], 0x200
je 0x140035430
cmp byte [rcx + 0x41], 2
jb 0x140035430
mov rcx, qword [rcx + 0x38]
lea r8, [0x140249260]
mov edx, 0x2e
mov r9, r14
call fcn.1400328b0
mov rcx, r14
call fcn.1401a8570
jmp 0x140035217
mov eax, dword [rdi + 0x14c]
lea rdx, [rsp + 0x48]
mov rcx, qword [rdi + 0x158]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileSizeEx]
test eax, eax
je 0x1400353e7
mov rax, qword [rsp + 0x48]
add qword [rdi + 8], rax
inc dword [rdi + 0x14c]
mov r8d, dword [rdi + 0x14c]
mov rdx, qword [rdi + 8]
mov rcx, qword [str.P_a_]
lea rax, str.P_a_
cmp rcx, rax
je 0x140035430
test dword [rcx + 0x44], 0x200
je 0x140035430
cmp byte [rcx + 0x41], 4
jb 0x140035430
movzx eax, word [rsp + 0xd0]
mov r9, r14
mov rcx, qword [rcx + 0x38]
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov eax, dword [rdi + 0x148]
mov dword [rsp + 0x28], r8d
mov dword [rsp + 0x20], eax
call fcn.140033a80
mov rcx, r14
call fcn.1401a8570
jmp 0x140035217
mov rcx, qword [str.P_a_]
lea rax, str.P_a_
cmp rcx, rax
je 0x140035421
test dword [rcx + 0x44], 0x200
je 0x140035421
cmp byte [rcx + 0x41], 2
jb 0x140035421
mov rcx, qword [rcx + 0x38]
lea r8, [0x140249260]
mov edx, 0x30
mov r9, r14
call fcn.1400328b0
mov edx, dword [rdi + 0x14c]
lea rcx, [rdi - 8]
call fcn.140035a40
mov rcx, r14
call fcn.1401a8570
jmp 0x140035217
mov rcx, qword [str.P_a_]
lea rax, str.P_a_
cmp rcx, rax
je 0x140035236
mov edx, dword [rcx + 0x44]
bt edx, 9
jae 0x140035236
movzx eax, byte [rcx + 0x41]
cmp al, 5
jb 0x140035236
cmp esi, 0x101
jae 0x140035487
shr esi, 4
lea r9, [0x140249540]
dec esi
mov r9, qword [r9 + rsi*8]
jmp 0x1400354b4
bt edx, 0xb
jae 0x1400354ad
cmp al, 3
jb 0x1400354ad
mov rcx, qword [rcx + 0x38]
lea r8, [0x140249530]
mov edx, 0xa
call fcn.140022ad0
mov rcx, qword [str.P_a_]
lea r9, [0x14024315c]
mov rcx, qword [rcx + 0x38]
lea r8, [0x140249260]
mov edx, 0x2c
call fcn.1400328b0
jmp 0x140035236