Function at 0x1000dc5c0
Capabilities:
Get file size

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe8
mov rax, qword [0x100165138]
xor rax, rsp
mov qword [rsp + 0xd0], rax
xor r13d, r13d
mov rbx, r9
mov rdi, r8
and dword [rsp + 0x74], r13d
mov r12, rdx
mov rbp, rcx
mov rcx, qword [0x1001653b8]
lea rsi, [0x1001653b8]
lea r15d, [r13 + 4]
cmp rcx, rsi
je 0x1000dc632
test byte [rcx + 0x1c], r15b
je 0x1000dc632
cmp byte [rcx + 0x19], r15b
jb 0x1000dc632
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003148]
mov edx, 0xe5
call fcn.10001c854
and qword [rsp + 0xa0], r13
test rdi, rdi
je 0x1000dc642
mov byte [rdi], r13b
test r12, r12
je 0x1000dc657
xor edx, edx
mov r8d, 0x200
mov rcx, r12
call sub.msvcrt.dll_memset
mov rcx, qword [rbp]
lea rdx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x1000dc6b9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
mov r12, qword [0x1001653b8]
cmp r12, rsi
je 0x1000dc6ae
test byte [r12 + 0x1c], r15b
je 0x1000dc6ae
cmp byte [r12 + 0x19], 2
jb 0x1000dc6ae
mov r9, qword [rbp]
mov rcx, qword [r12 + 0x10]
lea r8, [0x100003148]
mov edx, 0xe6
mov dword [rsp + 0x20], eax
call fcn.1000c2c40
mov r13d, 8
jmp 0x1000dc98f
mov edx, 0x10000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r14, rax
test rax, rax
jne 0x1000dc6df
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r13d, [r14 + 3]
mov dword [rbx], eax
jmp 0x1000dc981
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0xa0], rax
test rax, rax
jne 0x1000dc711
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13d, 8
mov dword [rbx], eax
jmp 0x1000dc981
and dword [rsp + 0x98], r13d
and dword [rsp + 0x9c], r13d
mov rcx, qword [0x1001653b8]
cmp rcx, rsi
je 0x1000dc74e
test byte [rcx + 0x1c], r15b
je 0x1000dc74e
cmp byte [rcx + 0x19], 5
jb 0x1000dc74e
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003148]
mov edx, 0xe7
call fcn.10001c854
mov rcx, qword [rbp]
lea r9, [rsp + 0x88]
mov r8d, 0x10000
mov rdx, r14
call fcn.1000d3528
mov rcx, qword [rbp]
lea r8, [rsp + 0x74]
lea rdx, [rsp + 0x88]
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x1000dc7d6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
mov r12, qword [0x1001653b8]
cmp r12, rsi
je 0x1000dca45
test byte [r12 + 0x1c], r15b
je 0x1000dca45
cmp byte [r12 + 0x19], 2
jb 0x1000dca45
mov rcx, qword [r12 + 0x10]
lea r8, [0x100003148]
mov edx, 0xe8
mov r9d, eax
call fcn.10001c878
jmp 0x1000dca45
mov r9d, dword [rsp + 0x74]
cmp r9d, 0x10000
je 0x1000dc81a
mov rcx, qword [0x1001653b8]
cmp rcx, rsi
je 0x1000dca3f
test byte [rcx + 0x1c], r15b
je 0x1000dca3f
cmp byte [rcx + 0x19], 2
jb 0x1000dca3f
mov edx, 0xe9
mov dword [rsp + 0x20], 0x10000
jmp 0x1000dca2f
lea rdx, [0x10000cfd0]
mov r8d, 0x10
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_RtlCompareMemory]
cmp rax, 0x10
je 0x1000dcf4c
and qword [rsp + 0x28], r13
lea rax, [rsp + 0x70]
lea r9, [rsp + 0xc0]
lea r8, [rsp + 0xa8]
mov rdx, r14
mov rcx, rbp
mov qword [rsp + 0x20], rax
call fcn.1000df638
test al, al
jne 0x1000dc896
mov rcx, qword [0x1001653b8]
cmp rcx, rsi
je 0x1000dce13
test byte [rcx + 0x1c], r15b
je 0x1000dce13
cmp byte [rcx + 0x19], 2
jb 0x1000dce13
mov edx, 0xea
jmp 0x1000dcb48
mov sil, byte [rsp + 0x70]
mov rcx, qword [rsp + 0x80]
mov al, sil
neg al
sbb edi, edi
and edi, 0xfffffe00
add edi, 0x400
mov r8d, edi
cmp rcx, r8
jl 0x1000dcefb
mov r9d, 0x1ff
mov rax, rcx
cqo
and rdx, r9
add rax, rdx
and rax, r9
cmp rax, rdx
jne 0x1000dcefb
sub rcx, r8
mov r8, rcx
mov dword [rsp + 0x98], ecx
shr r8, 0x20
mov dword [rsp + 0x9c], r8d
mov rax, qword [0x1001653b8]
lea rdx, [0x1001653b8]
cmp rax, rdx
je 0x1000dc933
test byte [rax + 0x1c], r15b
je 0x1000dc933
cmp byte [rax + 0x19], 5
jb 0x1000dc933
mov dword [rsp + 0x20], ecx
mov rcx, qword [rax + 0x10]
mov r9d, r8d
lea r8, [0x100003148]
mov edx, 0xec
call fcn.10001d914
mov rcx, qword [rbp]
lea r9, [rsp + 0x88]
mov r8d, edi
mov rdx, r14
call fcn.1000d3528
mov rcx, qword [rbp]
lea r8, [rsp + 0x74]
lea rdx, [rsp + 0x88]
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x1000dc9f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13d, r15d
mov dword [rbx], eax
lea rsi, [0x1001653b8]
test r14, r14
je 0x1000dc98f
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x1000dc9a2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r12, qword [0x1001653b8]
cmp r12, rsi
je 0x1000dc9d2
test byte [r12 + 0x1c], r15b
je 0x1000dc9d2
cmp byte [r12 + 0x19], r15b
jb 0x1000dc9d2
mov rcx, qword [r12 + 0x10]
lea r8, [0x100003148]
mov edx, 0xfa
call fcn.10001c854
mov eax, r13d
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.10014e600
add rsp, 0xe8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov r9d, dword [rsp + 0x74]
cmp r9d, edi
je 0x1000dca4d
mov rcx, qword [0x1001653b8]
lea rsi, [0x1001653b8]
cmp rcx, rsi
je 0x1000dca3f
test byte [rcx + 0x1c], r15b
je 0x1000dca3f
cmp byte [rcx + 0x19], 2
jb 0x1000dca3f
mov edx, 0xed
mov dword [rsp + 0x20], 0x400
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003148]
call fcn.10001d914
mov dword [rbx], 0x45d
mov r13d, r15d
jmp 0x1000dc981
and qword [rsp + 0x28], r13
lea rax, [rsp + 0x70]
lea r9, [rsp + 0xb0]
lea r8, [rsp + 0x78]
mov rdx, r14
mov rcx, rbp
mov qword [rsp + 0x20], rax
call fcn.1000df638
test al, al
jne 0x1000dcae4
test sil, sil
je 0x1000dcab2
mov rcx, qword [0x1001653b8]
lea rsi, [0x1001653b8]
cmp rcx, rsi
je 0x1000dce13
test byte [rcx + 0x1c], r15b
je 0x1000dce13
cmp byte [rcx + 0x19], 2
jb 0x1000dce13
mov edx, 0xee
jmp 0x1000dcb48
mov rcx, qword [0x1001653b8]
lea rsi, [0x1001653b8]
cmp rcx, rsi
je 0x1000dce13
test byte [rcx + 0x1c], r15b
je 0x1000dce13
cmp byte [rcx + 0x19], 2
jb 0x1000dce13
mov edx, 0xef
jmp 0x1000dcb48
test sil, sil
jne 0x1000dcb5d
and qword [rsp + 0x28], r13
lea rax, [rsp + 0x70]
lea rdx, [r14 + 0x200]
lea r9, [rsp + 0xb0]
lea r8, [rsp + 0x78]
mov rcx, rbp
mov qword [rsp + 0x20], rax
call fcn.1000df638
test al, al
jne 0x1000dcb5d
mov rcx, qword [0x1001653b8]
lea rsi, [0x1001653b8]
cmp rcx, rsi
je 0x1000dce13
test byte [rcx + 0x1c], r15b
je 0x1000dce13
cmp byte [rcx + 0x19], 2
jb 0x1000dce13
mov edx, 0xf0
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003148]
call fcn.10001c854
jmp 0x1000dce13
lea rax, [rsp + 0xb0]
lea rcx, [rsp + 0xc0]
mov rdx, qword [rax]
cmp rdx, qword [rcx]
jne 0x1000dcb83
mov rdx, qword [rax + 8]
cmp rdx, qword [rcx + 8]
jne 0x1000dcb83
xor eax, eax
jmp 0x1000dcb88
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000dcd66
mov rcx, qword [0x1001653b8]
lea rsi, [0x1001653b8]
cmp rcx, rsi
je 0x1000dcbc4
test byte [rcx + 0x1c], r15b
je 0x1000dcbc4
cmp byte [rcx + 0x19], 2
jb 0x1000dcbc4
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003148]
mov edx, 0xf1
call fcn.10001c854
mov dword [rbx], 0x570
mov r13d, 9
mov r12, qword [0x1001653b8]
cmp r12, rsi
je 0x1000dc981
test byte [r12 + 0x1c], r15b
je 0x1000dcc9c
cmp byte [r12 + 0x19], 2
jb 0x1000dcc9c
movzx r9d, byte [rsp + 0xbc]
movzx eax, byte [rsp + 0xbf]
movzx ecx, byte [rsp + 0xbe]
movzx r8d, byte [rsp + 0xbd]
movzx r10d, byte [rsp + 0xbb]
movzx r11d, byte [rsp + 0xba]
movzx ebx, byte [rsp + 0xb9]
movzx edi, byte [rsp + 0xb8]
movzx esi, word [rsp + 0xb6]
movzx ebp, word [rsp + 0xb4]
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], ecx
mov rcx, qword [r12 + 0x10]
mov dword [rsp + 0x58], r8d
mov dword [rsp + 0x50], r9d
mov r9d, dword [rsp + 0xb0]
mov dword [rsp + 0x48], r10d
mov dword [rsp + 0x40], r11d
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
lea r8, [0x100003148]
mov edx, 0xf2
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], ebp
call fcn.10005c9cc
lea rsi, [0x1001653b8]
mov r12, qword [0x1001653b8]
cmp r12, rsi
je 0x1000dc981
test byte [r12 + 0x1c], r15b
je 0x1000dc981
cmp byte [r12 + 0x19], 2
jb 0x1000dc981
movzx r9d, byte [rsp + 0xcc]
movzx eax, byte [rsp + 0xcf]
movzx ecx, byte [rsp + 0xce]
movzx r8d, byte [rsp + 0xcd]
movzx r10d, byte [rsp + 0xcb]
movzx r11d, byte [rsp + 0xca]
movzx ebx, byte [rsp + 0xc9]
movzx edi, byte [rsp + 0xc8]
movzx esi, word [rsp + 0xc6]
movzx ebp, word [rsp + 0xc4]
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], ecx
mov rcx, qword [r12 + 0x10]
mov dword [rsp + 0x58], r8d
mov dword [rsp + 0x50], r9d
mov r9d, dword [rsp + 0xc0]
mov dword [rsp + 0x48], r10d
mov dword [rsp + 0x40], r11d
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
lea r8, [0x100003148]
mov edx, 0xf3
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], ebp
call fcn.10005c9cc
jmp 0x1000dc97a
mov rdi, qword [rsp + 0xa8]
cmp rdi, qword [rsp + 0x78]
je 0x1000dce24
mov rcx, qword [0x1001653b8]
lea rsi, [0x1001653b8]
cmp rcx, rsi
je 0x1000dce13
test byte [rcx + 0x1c], r15b
je 0x1000dcdb8
cmp byte [rcx + 0x19], 2
jb 0x1000dcdb8
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003148]
mov edx, 0xf4
call fcn.10001c854
mov rcx, qword [0x1001653b8]
cmp rcx, rsi
je 0x1000dce13
test byte [rcx + 0x1c], r15b
je 0x1000dcdea
cmp byte [rcx + 0x19], 2
jb 0x1000dcdea
mov r9, qword [rsp + 0x78]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003148]
mov edx, 0xf5
call fcn.10001d71c
mov rcx, qword [0x1001653b8]
cmp rcx, rsi
je 0x1000dce13
test byte [rcx + 0x1c], r15b
je 0x1000dce13
cmp byte [rcx + 0x19], 2
jb 0x1000dce13
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003148]
mov edx, 0xf6
mov r9, rdi
call fcn.10001d71c
mov dword [rbx], 0x570
mov r13d, 9
jmp 0x1000dc981
cmp sil, byte [rsp + 0x70]
je 0x1000dcedc
mov rcx, qword [0x1001653b8]
lea rdi, [0x1001653b8]
cmp rcx, rdi
je 0x1000dcecb
test byte [rcx + 0x1c], r15b
je 0x1000dce6e
cmp byte [rcx + 0x19], 2
jb 0x1000dce6e
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003148]
mov edx, 0xf7
call fcn.10001c854
mov rcx, qword [0x1001653b8]
cmp rcx, rdi
je 0x1000dcecb
test byte [rcx + 0x1c], r15b
je 0x1000dcea1
cmp byte [rcx + 0x19], 2
jb 0x1000dcea1
movzx r9d, byte [rsp + 0x70]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003148]
mov edx, pe_nt_image_headers64
call fcn.10001d71c
mov rcx, qword [0x1001653b8]
cmp rcx, rdi
je 0x1000dcecb
test byte [rcx + 0x1c], r15b
je 0x1000dcecb
cmp byte [rcx + 0x19], 2
jb 0x1000dcecb
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003148]
movzx r9d, sil
mov edx, 0xf9
call fcn.10001d71c
mov dword [rbx], 0x570
mov r13d, 9
jmp 0x1000dc97a
test r12, r12
je 0x1000dc97a
mov rcx, r12
mov rdx, r14
mov r8d, 0x200
call sub.msvcrt.dll_memcpy
jmp 0x1000dc97a
mov rax, qword [0x1001653b8]
lea rsi, [0x1001653b8]
cmp rax, rsi
je 0x1000dce13
test byte [rax + 0x1c], r15b
je 0x1000dce13
cmp byte [rax + 0x19], 2
jb 0x1000dce13
mov r9d, dword [rsp + 0x84]
mov dword [rsp + 0x20], ecx
mov rcx, qword [rax + 0x10]
lea r8, [0x100003148]
mov edx, 0xeb
call fcn.10001d914
jmp 0x1000dce13
test rdi, rdi
je 0x1000dc981
mov byte [rdi], 1
jmp 0x1000dc981