Function at 0x140053420
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r12d, dword [rsp + 0xb0]
xor r13d, r13d
mov r15, rcx
mov qword [rsp + 0x40], r13
xor ecx, ecx
mov ebx, r13d
mov edi, r13d
mov esi, r9d
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
lea r8, [rsp + 0x40]
xor edx, edx
mov rcx, r15
call fcn.1400579e8
mov r14, rax
test rax, rax
jne 0x140053491
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
lea eax, [r13 + 0xe]
test edi, edi
cmove edi, eax
jmp 0x1400539b7
mov ebp, esi
and ebp, 0x1000
jne 0x1400534bb
cmp word [rax], r13w
je 0x1400534b1
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x1400534b1
cmp word [rax], r13w
jne 0x1400534bb
mov edi, 0x57
jmp 0x1400539d8
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov edx, 8
mov r8d, 0x258
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x1400534f1
lea edi, [rax + 0xe]
jmp 0x1400539d5
xor edx, edx
mov r8d, 0x258
mov rcx, rbx
call sub.msvcrt.dll_memset
mov dword [rbx], 0xfeedf001
mov dword [rbx + 0x1b4], 3
test esi, 0xdfffcfbd
je 0x140053523
mov edi, 0x57
jmp 0x1400539bb
test sil, 2
je 0x14005353b
mov rcx, rbx
call fcn.140059480
or eax, 2
mov edx, eax
call fcn.1400594bc
test sil, 0x40
je 0x140053553
mov rcx, rbx
call fcn.140059480
or eax, 0x40
mov edx, eax
call fcn.1400594bc
mov r8d, 0x20000000
test r8d, esi
je 0x140053570
mov rcx, rbx
call fcn.140059480
or eax, r8d
mov edx, eax
call fcn.1400594bc
bt esi, 0xd
mov edx, 4
cmovae edx, r12d
mov r12d, 7
cmp edx, 3
jbe 0x1400535b2
cmp edx, 5
jbe 0x14005359c
cmp edx, r12d
je 0x1400535b2
lea edi, [r12 + 0x50]
jmp 0x1400539b7
mov rcx, rbx
call fcn.140059380
test rax, rax
je 0x1400535c5
mov dword [rax + 0x1bc], r12d
jmp 0x1400535c5
mov rcx, rbx
call fcn.140059380
test rax, rax
je 0x1400535c5
mov dword [rax + 0x1bc], edx
test ebp, ebp
je 0x1400535d3
mov rcx, r15
call fcn.14005a378
jmp 0x1400535e0
xor r8d, r8d
xor edx, edx
mov rcx, r14
call fcn.1400579e8
mov rcx, rbx
mov rdx, rax
call fcn.140059380
test rax, rax
je 0x1400535f7
mov qword [rax + 0x210], rdx
call fcn.1400593e8
test rax, rax
je 0x1400539a9
or rdx, 0xffffffffffffffff
call fcn.140059774
mov rdx, qword [0x1400c99f8]
call fcn.14005ae78
test eax, eax
je 0x1400539a9
mov rcx, rbx
call fcn.140059734
cmp rax, 0xffffffffffffffff
je 0x1400539a9
mov ebp, 3
mov dword [rbx + 0x1b4], ebp
call fcn.140055098
test eax, eax
je 0x1400539a9
call fcn.14005c4dc
mov rcx, rbx
mov qword [rbx + 0x1d0], rax
call fcn.140059380
test rax, rax
je 0x140053673
mov rcx, qword [0x1400c99f8]
mov qword [rax + 0x230], rcx
mov edx, 1
mov qword [rsp + 0x40], r13
mov rcx, rbx
call fcn.140059600
mov rcx, rbx
call fcn.140059734
cmp dword [0x1400c99e8], r13d
lea rdx, [rsp + 0x40]
mov rcx, rax
je 0x1400536a5
call fcn.1400531e8
jmp 0x1400536b1
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
nop dword [rax + rax]
mov esi, 0xd
test eax, eax
jne 0x1400536d5
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
mov edi, eax
cmove edi, esi
test edi, edi
jne 0x1400539bb
xor edx, edx
mov rcx, rbx
call fcn.14005a79c
test eax, eax
jne 0x14005373f
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx r9d, ax
mov rcx, rbx
or r9d, 0x80070000
mov edi, eax
test eax, eax
cmovle r9d, eax
call fcn.1400593e8
mov r8, rax
mov dword [rsp + 0x30], 0x1a5
xor edx, edx
lea rax, str.WIMCreateFile
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r9d
lea r9, str.Fail_to_read_WIM_header
lea ecx, [rdx + 1]
call fcn.140052bb0
test edi, edi
jne 0x1400539bb
mov rcx, rbx
call fcn.14005c9ac
test eax, eax
je 0x140053990
mov rcx, rbx
call fcn.14005d12c
test eax, eax
je 0x140053990
cmp dword [rbx + 0x1ac], r13d
jge 0x14005377b
mov rcx, rbx
call fcn.14005b1b0
test eax, eax
jne 0x14005377b
mov edi, esi
jmp 0x1400539bb
mov rcx, rbx
call fcn.14005b520
test eax, eax
je 0x140053774
mov rcx, rbx
call fcn.140059f4c
mov rcx, rbx
mov rdx, qword [rax + 0x48]
call fcn.140059f4c
mov rcx, rbx
add rdx, qword [rax + 0x40]
call fcn.140059e30
mov r8, qword [0x1400c99f8]
xor edx, edx
call fcn.140059dd4
mov rcx, rbx
mov rdx, rax
call fcn.140059f4c
cmp qword [rax + 0x80], rdx
jl 0x140053800
mov rcx, rbx
call fcn.140059f4c
cmp qword [rax + 0x88], r13
je 0x140053800
mov rcx, rbx
call fcn.140059f4c
mov rcx, rbx
mov rdx, qword [rax + 0x88]
call fcn.140059f4c
mov rcx, rbx
add rdx, qword [rax + 0x80]
call fcn.140059e30
mov r8, qword [0x1400c99f8]
xor edx, edx
mov rcx, rbx
call fcn.140059dd4
mov rcx, rbx
mov rdx, rax
call fcn.140059f4c
cmp qword [rax + 0x108], rdx
jl 0x14005385c
mov rcx, rbx
call fcn.140059f4c
cmp qword [rax + 0x110], r13
je 0x14005385c
mov rcx, rbx
call fcn.140059f4c
mov rcx, rbx
mov rdx, qword [rax + 0x110]
call fcn.140059f4c
mov rcx, rbx
add rdx, qword [rax + 0x108]
call fcn.140059e30
mov r8, qword [0x1400c99f8]
xor edx, edx
mov rcx, rbx
call fcn.140059dd4
mov rcx, rbx
mov rdx, rax
call fcn.140059380
test rax, rax
je 0x140053884
mov qword [rax + 0x230], rdx
call fcn.1400595b4
bt eax, 8
jae 0x1400538a3
mov rcx, rbx
call fcn.140059f4c
mov rcx, rbx
mov rdx, qword [rax + 0x40]
call fcn.140059e30
mov rcx, rbx
call fcn.140059f4c
mov rcx, rbx
test dword [rax + 0x10], 0x40000
je 0x1400538d1
call fcn.140059380
test rax, rax
je 0x140053950
mov dword [rax + 0x1bc], 2
jmp 0x140053950
call fcn.140059f4c
mov rcx, rbx
test dword [rax + 0x10], 0x20000
je 0x1400538f8
call fcn.140059380
test rax, rax
je 0x140053950
mov dword [rax + 0x1bc], 1
jmp 0x140053950
call fcn.140059f4c
mov rcx, rbx
test dword [rax + 0x10], 0x200000
je 0x14005391c
call fcn.140059380
test rax, rax
je 0x140053950
mov dword [rax + 0x1bc], r12d
jmp 0x140053950
call fcn.140059f4c
mov rcx, rbx
test dword [rax + 0x10], 0x80000
je 0x14005393f
call fcn.140059380
test rax, rax
je 0x140053950
mov dword [rax + 0x1bc], ebp
jmp 0x140053950
call fcn.140059380
test rax, rax
je 0x140053950
mov dword [rax + 0x1bc], r13d
mov rcx, rbx
call fcn.140059f4c
mov edx, 0xfeedf001
movzx ecx, word [rax + 0x28]
cmp dword [rbx], edx
jne 0x14005396c
mov word [rbx + 0x1c8], cx
mov rcx, rbx
call fcn.140059f4c
movzx ecx, word [rax + 0x2a]
cmp dword [rbx], edx
jne 0x140053983
mov word [rbx + 0x1ca], cx
mov rdx, rbx
mov rcx, rbx
call fcn.140059ccc
jmp 0x1400539d8
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x1400539bb
mov edi, 0x570
jmp 0x1400539bb
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
test edi, edi
je 0x1400539d8
test rbx, rbx
je 0x1400539d8
mov edx, 1
mov rcx, rbx
call fcn.140059600
mov rcx, rbx
call fcn.140053a38
mov rbx, r13
mov edx, edi
mov rcx, r14
call fcn.140052dc4
test r14, r14
je 0x140053a07
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov rax, rbx
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret