Function at 0x1400025c4
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov rax, qword [0x1400cabe8]
xor rax, rsp
mov qword [rbp + 0xb0], rax
mov rbx, rcx
mov dword [rbp - 0x70], 0x11c
xor eax, eax
lea rcx, [rbp - 0x70]
mov qword [rsp + 0x40], rax
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
nop dword [rax + rax]
test eax, eax
jne 0x140002638
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edx, eax
lea rcx, str.Warning_failed_to_get_OS_version_Info_GetLastError____0x_08X_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov rax, qword [rbx + 0x108]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
nop dword [rax + rax]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
nop dword [rax + rax]
mov rax, qword [rbx + 0x10]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
nop dword [rax + rax]
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
nop dword [rax + rax]
mov eax, dword [rbp - 0x64]
lea rcx, str._tOS_version___t_t_d._d._d___Currently_running_on__d._d._d__n
movzx r8d, byte [rbx + 5]
movzx edx, byte [rbx + 4]
mov r9d, dword [rbx + 8]
mov dword [rsp + 0x30], eax
mov eax, dword [rbp - 0x68]
mov dword [rsp + 0x28], eax
mov eax, dword [rbp - 0x6c]
mov dword [rsp + 0x20], eax
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
movzx ecx, word [rsp + 0x74]
movzx eax, word [rsp + 0x76]
movzx r10d, word [rsp + 0x72]
movzx r11d, word [rsp + 0x70]
movzx r9d, word [rsp + 0x6e]
movzx r8d, word [rsp + 0x6a]
movzx edx, word [rsp + 0x68]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
lea rcx, str._tStart_Time___t_t_04d__02d__02d__02d:_02d:_02d._03d_n
mov dword [rsp + 0x28], r10d
mov dword [rsp + 0x20], r11d
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
cmp qword [rbx + 0x10], 0
jne 0x140002742
lea rcx, str._tEnd_Time_t_tNot_set__Logger_may_not_have_been_stopped_._n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
jmp 0x14000278a
movzx ecx, word [rbp - 0x7c]
movzx eax, word [rbp - 0x7a]
movzx r10d, word [rbp - 0x7e]
movzx r11d, word [rbp - 0x80]
movzx r9d, word [rsp + 0x7e]
movzx r8d, word [rsp + 0x7a]
movzx edx, word [rsp + 0x78]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
lea rcx, str._tEnd_Time_____t_t_04d__02d__02d__02d:_02d:_02d._03d_n
mov dword [rsp + 0x28], r10d
mov dword [rsp + 0x20], r11d
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov r8d, dword [rbx + 0x48]
lea rdx, [rbx + 0x4c]
lea rcx, str._tTimezone_is__t_t_s__Bias_is__dmins__n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov edx, dword [rbx]
lea rcx, str._tBufferSize____________t_d_B_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov edx, dword [rbx + 0x1c]
lea rcx, str._tMaximum_File_Size_____t_d_MB_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov edx, dword [rbx + 0x24]
cmp edx, 1
ja 0x1400027ed
lea rcx, str._tBuffers__Written______tNot_set__No_events_matched_filter_._n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
jmp 0x140002800
lea rcx, str._tBuffers__Written______t_d_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov edx, dword [rbx + 0x20]
lea rcx, str._tLogger_Mode_Settings_t__X_
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
cmp dword [rbx + 0x20], 0
jne 0x140002828
lea rcx, str.Logfile_Mode_is_not_set
jmp 0x140002986
lea rcx, [0x140028d18]
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov eax, dword [rbx + 0x20]
test al, 1
je 0x140002858
lea rcx, str._sequential
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov eax, dword [rbx + 0x20]
test al, 2
je 0x140002872
lea rcx, str._circular
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov eax, dword [rbx + 0x20]
test al, 4
je 0x14000288c
lea rcx, str._append
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov eax, dword [rbx + 0x20]
test al, 8
je 0x1400028a6
lea rcx, str._newfile
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov eax, dword [rbx + 0x20]
test al, 0x20
je 0x1400028c0
lea rcx, str._preallocate
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov eax, dword [rbx + 0x20]
test al, 0x40
je 0x1400028da
lea rcx, str._nonstoppable
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov eax, dword [rbx + 0x20]
bt eax, 8
jae 0x1400028f6
lea rcx, str._real_time
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov eax, dword [rbx + 0x20]
bt eax, 0xb
jae 0x140002912
lea rcx, str._private
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov eax, dword [rbx + 0x20]
bt eax, 0xe
jae 0x14000292e
lea rcx, str._global_sequence
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov eax, dword [rbx + 0x20]
bt eax, 0xf
jae 0x14000294a
lea rcx, str._local_sequence
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov eax, dword [rbx + 0x20]
bt eax, 0x10
jae 0x140002966
lea rcx, str._relog
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov eax, dword [rbx + 0x20]
bt eax, 0x18
jae 0x14000297f
lea rcx, str._paged
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
lea rcx, [0x140028e50]
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov edx, dword [rbx + 0xc]
lea rcx, str._n_tProcessorCount_________t_d_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
test rdi, rdi
je 0x140002a0e
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
nop dword [rax + rax]
test eax, eax
jne 0x1400029da
lea rcx, str.WARNING:_Could_not_get_file_size__continuing_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
jmp 0x140002a0e
mov rax, qword [rsp + 0x40]
mov ecx, dword [rbx + 0x1c]
cqo
and edx, 0xfffff
add rax, rdx
sar rax, 0x14
cmp rax, rcx
jle 0x140002a0e
mov edx, ecx
mov r8, rax
lea rcx, str.WARNING:_File_size_given_as__dMB__should_be__I64dMB_continuing_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
cmp dword [rbx + 0x20], 2
jne 0x140002a2d
cmp dword [rbx + 0x24], 0
jne 0x140002a2d
lea rcx, str.WARNING:_Circular_Trace_File_did_not_have_wrap_address_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.140023980
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret