Function at 0x14004545c
Capabilities:
Get file attributes
Get file size

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb30
mov qword [rsp + 0xa8], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x140253530]
xor rax, rsp
mov qword [rsp + 0xb20], rax
mov r12d, r8d
mov rbx, rdx
mov rsi, rcx
xor r14d, r14d
cmp dword [rcx + 0x28], r14d
je 0x1400454ac
xor eax, eax
jmp 0x140045acd
mov eax, r14d
cmp rdx, r14
setne al
cmp eax, r14d
jne 0x1400454c0
call fcn.14001501c
int3
add rcx, 0x98
call fcn.1400940bc
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.140008700
nop
mov rdi, qword [rsp + 0x50]
cmp dword [rdi - 0x10], r14d
jl 0x140045514
lea rdx, [0x1401bda10]
mov rcx, rdi
call fcn.140186de0
cmp rax, r14
je 0x14004550f
mov rdi, qword [rsp + 0x50]
sub rax, rdi
sar rax, 1
cmp eax, 0xffffffff
jne 0x14004567a
jmp 0x140045514
mov rdi, qword [rsp + 0x50]
cmp dword [rdi - 0x10], r14d
jl 0x140045549
lea rdx, [0x1401c7a94]
mov rcx, rdi
call fcn.140186de0
cmp rax, r14
je 0x140045544
mov rdi, qword [rsp + 0x50]
sub rax, rdi
sar rax, 1
cmp eax, 0xffffffff
jne 0x14004567a
jmp 0x140045549
mov rdi, qword [rsp + 0x50]
cmp dword [rdi - 0x10], r14d
jl 0x140045577
lea rdx, [0x1401c7a90]
mov rcx, rdi
call fcn.140186de0
cmp rax, r14
je 0x140045577
mov rdi, qword [rsp + 0x50]
sub rax, rdi
sar rax, 1
cmp eax, 0xffffffff
jne 0x14004567a
mov r13d, 0x104
mov r8d, r13d
lea rdx, [rsp + 0x910]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, r14d
jbe 0x140045675
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
lea edi, [r13 - 4]
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x710]
mov r8d, 3
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x910]
call fcn.140187bf4
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x510]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
lea rax, [rsp + 0x310]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.140187bf4
lea r11, [rsp + 0x510]
mov qword [rsp + 0x28], r11
lea rax, [rsp + 0x310]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x710]
lea r8, [rsp + 0xf0]
mov rdx, r13
lea rcx, [rsp + 0x100]
call fcn.140187a90
lea rcx, [rsp + 0x100]
call fcn.140186914
mov r8d, eax
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x50]
call fcn.140008840
mov rdi, qword [rsp + 0x50]
jmp 0x14004567a
mov rdi, qword [rsp + 0x50]
cmp r12d, r14d
jbe 0x1400456f7
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400456f2
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, r12d
jbe 0x1400456f2
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
cmp eax, r14d
jg 0x1400456eb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x140045acd
mov rdi, qword [rsp + 0x50]
mov ebx, 0x2010
mov eax, 0x3010
cmp dword [rsi + 0x34], r14d
cmovne ebx, eax
call fcn.14005b1a4
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rax + 0x10]
call qword [sym.imp.USER32.dll_LoadImageW]
mov qword [rsi + 0x98], rax
cmp rax, r14
jne 0x14004575d
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
cmp eax, r14d
jg 0x140045756
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x140045acd
lea r8, [rsp + 0xd0]
mov r12d, 0x20
mov edx, r12d
mov rcx, rax
call qword [sym.imp.GDI32.dll_GetObjectW]
cmp eax, r14d
jne 0x1400457b8
mov rcx, qword [rsi + 0x98]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov qword [rsi + 0x98], r14
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
cmp eax, r14d
jg 0x1400457b1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x140045acd
mov dword [rsi + 0x18], 1
lea rcx, [rsi + 0xb0]
lea rdx, [rsp + 0x50]
call fcn.1400089c0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
je 0x1400457e6
mov dword [rsi + 0x24], 1
movzx eax, word [rsp + 0xe2]
mov dword [rsi + 0xc], eax
cmp eax, 8
jle 0x140045a5e
cmp eax, r12d
jge 0x140045a5e
cmp qword [rsi + 0x98], r14
je 0x140045a5e
lea rcx, [rsp + 0x58]
call fcn.140029970
nop
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.14002a36c
lea r8, [rsp + 0xb0]
mov edx, r12d
mov rcx, qword [rsi + 0x98]
call qword [sym.imp.GDI32.dll_GetObjectW]
cmp eax, r14d
jne 0x14004585c
lea rcx, [rsp + 0x58]
call fcn.14002a42c
jmp 0x140045a5e
mov rdx, qword [rsi + 0x98]
cmp rdx, r14
je 0x140045878
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.GDI32.dll_SelectObject]
mov rbx, rax
jmp 0x14004587b
mov rbx, r14
cmp rbx, r14
jne 0x14004588f
lea rcx, [rsp + 0x58]
call fcn.14002a42c
jmp 0x140045a5e
mov r15d, dword [rsp + 0xb4]
mov r13d, dword [rsp + 0xb8]
mov r8d, r13d
mov edx, r15d
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov rdi, rax
mov qword [rsp + 0x98], rax
cmp rax, r14
jne 0x1400458de
mov rdx, rbx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.GDI32.dll_SelectObject]
nop
lea rcx, [rsp + 0x58]
call fcn.14002a42c
jmp 0x140045a5e
lea rcx, [rsp + 0x78]
call fcn.140029970
nop
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.14002a36c
mov rdx, rdi
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.GDI32.dll_SelectObject]
mov qword [rsp + 0xa0], rax
cmp rax, r14
jne 0x140045951
mov rdx, rbx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, rdi
call qword [sym.imp.GDI32.dll_DeleteObject]
nop
lea rcx, [rsp + 0x78]
call fcn.14002a42c
nop
lea rcx, [rsp + 0x58]
call fcn.14002a42c
jmp 0x140045a5e
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x30], r14d
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
mov r9d, r15d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.GDI32.dll_BitBlt]
mov r12d, r14d
cmp r15d, r14d
jle 0x140045a0b
mov edi, r14d
cmp r13d, r14d
jle 0x1400459fb
mov r8d, edi
mov edx, r12d
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.GDI32.dll_GetPixel]
mov r14d, eax
cmp word [rsp + 0xc2], 0x18
jne 0x1400459cc
cmp dword [0x14024e69c], 0
jne 0x1400459cc
mov ecx, eax
call fcn.14003efc4
jmp 0x1400459d5
xor edx, edx
mov ecx, eax
call fcn.14003ef14
cmp r14d, eax
je 0x1400459f1
mov r9d, eax
mov r8d, edi
mov edx, r12d
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.GDI32.dll_SetPixel]
inc edi
cmp edi, r13d
jl 0x140045998
xor r14d, r14d
inc r12d
cmp r12d, r15d
jl 0x140045990
mov rdi, qword [rsp + 0x98]
mov rdx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.GDI32.dll_SelectObject]
mov rdx, rbx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, qword [rsi + 0x98]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov qword [rsi + 0x98], rdi
lea rcx, [rsp + 0x78]
call fcn.14002a42c
nop
lea rcx, [rsp + 0x58]
call fcn.14002a42c
mov r12d, 0x20
cmp word [rsp + 0xe2], r12w
jb 0x140045a78
mov edx, dword [rsi + 0x3c]
mov rcx, qword [rsi + 0x98]
call fcn.14003f53c
mov rcx, rsi
call fcn.14003eed4
lea rcx, [rsi + 0xa0]
call fcn.1400940bc
mov qword [rsi + 0xa0], r14
lea rcx, [rsi + 0xa8]
call fcn.1400940bc
mov qword [rsi + 0xa8], r14
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
cmp ecx, r14d
jg 0x140045ac8
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, 1
mov rcx, qword [rsp + 0xb20]
xor rcx, rsp
call fcn.140184d90
mov rbx, qword [rsp + 0xb80]
add rsp, 0xb30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret