Function at 0x1400d1568
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xe0
mov rax, qword [0x14017a608]
xor rax, rsp
mov qword [rbp + 0x1f], rax
xor r13d, r13d
mov rbx, r9
and dword [rbp - 0x45], r13d
mov rsi, rcx
mov rcx, qword [0x14017a048]
lea r12, [0x14017a048]
lea r14d, [r13 + 4]
cmp rcx, r12
je 0x1400d15d7
test byte [rcx + 0x1c], r14b
je 0x1400d15d7
cmp byte [rcx + 0x19], r14b
jb 0x1400d15d7
mov rcx, qword [rcx + 0x10]
lea r8, [0x14015c6b0]
mov edx, 0xe3
call fcn.140004b70
mov rcx, qword [rsi]
lea rdx, [rbp - 0x31]
and qword [rbp - 0x11], r13
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
nop dword [rax + rax]
test eax, eax
jne 0x1400d1646
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov dword [rbx], eax
mov rcx, qword [0x14017a048]
cmp rcx, r12
je 0x1400d163b
test byte [rcx + 0x1c], r14b
je 0x1400d163b
cmp byte [rcx + 0x19], 2
jb 0x1400d163b
mov r9, qword [rsi]
lea r8, [0x14015c6b0]
mov rcx, qword [rcx + 0x10]
mov edx, 0xe4
mov dword [rsp + 0x20], eax
call fcn.140004cc4
mov rcx, qword [0x14017a048]
mov r13d, 8
jmp 0x1400d1d7b
mov edi, 0x10000
xor ecx, ecx
mov edx, edi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
nop dword [rax + rax]
mov qword [rbp - 9], rax
mov r15, rax
test rax, rax
jne 0x1400d167e
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov dword [rbx], eax
lea r13d, [r15 + 3]
jmp 0x1400d1d74
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
nop dword [rax + rax]
mov qword [rbp - 0x11], rax
test rax, rax
jne 0x1400d16b8
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov dword [rbx], eax
mov r13d, 8
jmp 0x1400d1d5f
and dword [rbp - 0x19], r13d
and dword [rbp - 0x15], r13d
mov rcx, qword [0x14017a048]
cmp rcx, r12
je 0x1400d16ed
test byte [rcx + 0x1c], r14b
je 0x1400d16ed
cmp byte [rcx + 0x19], 5
jb 0x1400d16ed
mov rcx, qword [rcx + 0x10]
lea r8, [0x14015c6b0]
mov edx, 0xe5
call fcn.140004b70
mov rcx, qword [rsi]
lea r9, [rbp - 0x29]
mov r8d, edi
mov rdx, r15
call fcn.1400c1af8
mov rcx, qword [rsi]
lea r8, [rbp - 0x45]
mov r9d, 1
lea rdx, [rbp - 0x29]
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
nop dword [rax + rax]
test eax, eax
jne 0x1400d1766
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov dword [rbx], eax
mov rcx, qword [0x14017a048]
cmp rcx, r12
je 0x1400d175e
test byte [rcx + 0x1c], r14b
je 0x1400d175e
cmp byte [rcx + 0x19], 2
jb 0x1400d175e
mov rcx, qword [rcx + 0x10]
lea r8, [0x14015c6b0]
mov edx, 0xe6
mov r9d, eax
call fcn.140004b9c
mov r13d, r14d
jmp 0x1400d1d5f
mov r9d, dword [rbp - 0x45]
cmp r9d, edi
je 0x1400d17a8
mov rcx, qword [0x14017a048]
cmp rcx, r12
je 0x1400d17a0
test byte [rcx + 0x1c], r14b
je 0x1400d17a0
cmp byte [rcx + 0x19], 2
jb 0x1400d17a0
mov edx, 0xe7
mov dword [rsp + 0x20], edi
mov rcx, qword [rcx + 0x10]
lea r8, [0x14015c6b0]
call fcn.1400101b0
mov dword [rbx], 0x45d
jmp 0x1400d175e
mov r8d, 0x10
lea rdx, [0x14015c298]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_RtlCompareMemory]
nop dword [rax + rax]
cmp rax, 0x10
je 0x1400d1d5f
and qword [rsp + 0x28], r13
lea rax, [rbp - 0x49]
lea r9, [rbp + 0xf]
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x39]
mov rdx, r15
mov rcx, rsi
call fcn.1400d4584
test al, al
jne 0x1400d1831
mov rcx, qword [0x14017a048]
cmp rcx, r12
je 0x1400d1d53
test byte [rcx + 0x1c], r14b
je 0x1400d1d53
cmp byte [rcx + 0x19], 2
jb 0x1400d1d53
mov edx, pe_nt_image_headers64
mov rcx, qword [rcx + 0x10]
lea r8, [0x14015c6b0]
call fcn.140004b70
jmp 0x1400d1d53
mov al, byte [rbp - 0x49]
mov r8, qword [rbp - 0x31]
neg al
sbb edi, edi
and edi, 0xfffffe00
add edi, 0x400
mov ecx, edi
cmp r8, rcx
jl 0x1400d1d1d
mov r9d, 0x1ff
mov rax, r8
cqo
and rdx, r9
add rax, rdx
and rax, r9
cmp rax, rdx
jne 0x1400d1d1d
sub r8, rcx
mov rax, r8
mov dword [rbp - 0x19], r8d
shr rax, 0x20
mov dword [rbp - 0x15], eax
mov rcx, qword [0x14017a048]
cmp rcx, r12
je 0x1400d18b6
test byte [rcx + 0x1c], r14b
je 0x1400d18b6
cmp byte [rcx + 0x19], 5
jb 0x1400d18b6
mov rcx, qword [rcx + 0x10]
mov edx, 0xea
mov dword [rsp + 0x20], r8d
mov r9d, eax
lea r8, [0x14015c6b0]
call fcn.1400101b0
mov rcx, qword [rsi]
lea r9, [rbp - 0x29]
mov r8d, edi
mov rdx, r15
call fcn.1400c1af8
mov rcx, qword [rsi]
lea r8, [rbp - 0x45]
mov r9d, 1
lea rdx, [rbp - 0x29]
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
nop dword [rax + rax]
test eax, eax
jne 0x1400d18fc
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov dword [rbx], eax
jmp 0x1400d175e
mov r9d, dword [rbp - 0x45]
cmp r9d, edi
je 0x1400d193b
mov rcx, qword [0x14017a048]
cmp rcx, r12
je 0x1400d17a0
test byte [rcx + 0x1c], r14b
je 0x1400d17a0
cmp byte [rcx + 0x19], 2
jb 0x1400d17a0
mov edx, 0xeb
mov dword [rsp + 0x20], 0x400
jmp 0x1400d1790
and qword [rsp + 0x28], r13
lea rax, [rbp - 0x48]
lea r9, [rbp - 1]
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x41]
mov rdx, r15
mov rcx, rsi
call fcn.1400d4584
test al, al
jne 0x1400d19c2
cmp byte [rbp - 0x49], r13b
je 0x1400d1994
mov rcx, qword [0x14017a048]
cmp rcx, r12
je 0x1400d1d53
test byte [rcx + 0x1c], r14b
je 0x1400d1d53
cmp byte [rcx + 0x19], 2
jb 0x1400d1d53
mov edx, 0xec
jmp 0x1400d181c
mov rcx, qword [0x14017a048]
cmp rcx, r12
je 0x1400d1d53
test byte [rcx + 0x1c], r14b
je 0x1400d1d53
cmp byte [rcx + 0x19], 2
jb 0x1400d1d53
mov edx, 0xed
jmp 0x1400d181c
cmp byte [rbp - 0x49], r13b
jne 0x1400d1a1f
and qword [rsp + 0x28], r13
lea rax, [rbp - 0x48]
lea rdx, [r15 + 0x200]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 1]
mov rcx, rsi
lea r8, [rbp - 0x41]
call fcn.1400d4584
test al, al
jne 0x1400d1a1f
mov rcx, qword [0x14017a048]
cmp rcx, r12
je 0x1400d1d53
test byte [rcx + 0x1c], r14b
je 0x1400d1d53
cmp byte [rcx + 0x19], 2
jb 0x1400d1d53
mov edx, 0xee
jmp 0x1400d181c
mov r9, qword [rbp - 1]
mov rdx, qword [rbp + 7]
cmp r9, qword [rbp + 0xf]
jne 0x1400d1b99
cmp rdx, qword [rbp + 0x17]
jne 0x1400d1b99
mov r9, qword [rbp - 0x41]
cmp qword [rbp - 0x39], r9
je 0x1400d1af1
mov rcx, qword [0x14017a048]
cmp rcx, r12
je 0x1400d1d53
test byte [rcx + 0x1c], r14b
je 0x1400d1a85
cmp byte [rcx + 0x19], 2
jb 0x1400d1a85
mov rcx, qword [rcx + 0x10]
lea r8, [0x14015c6b0]
mov edx, 0xf2
call fcn.140004b70
mov r9, qword [rbp - 0x41]
mov rcx, qword [0x14017a048]
cmp rcx, r12
je 0x1400d1d53
test byte [rcx + 0x1c], r14b
je 0x1400d1ab6
cmp byte [rcx + 0x19], 2
jb 0x1400d1ab6
mov rcx, qword [rcx + 0x10]
lea r8, [0x14015c6b0]
mov edx, 0xf3
call fcn.140010438
mov rcx, qword [0x14017a048]
cmp rcx, r12
je 0x1400d1d53
test byte [rcx + 0x1c], r14b
je 0x1400d1d53
cmp byte [rcx + 0x19], 2
jb 0x1400d1d53
mov r9, qword [rbp - 0x39]
mov edx, 0xf4
mov rcx, qword [rcx + 0x10]
lea r8, [0x14015c6b0]
call fcn.140010438
jmp 0x1400d1d53
mov al, byte [rbp - 0x48]
cmp byte [rbp - 0x49], al
je 0x1400d1d5f
mov rcx, qword [0x14017a048]
cmp rcx, r12
je 0x1400d1d53
test byte [rcx + 0x1c], r14b
je 0x1400d1b38
cmp byte [rcx + 0x19], 2
jb 0x1400d1b38
mov rcx, qword [rcx + 0x10]
lea r8, [0x14015c6b0]
mov edx, 0xf5
call fcn.140004b70
mov al, byte [rbp - 0x48]
mov rcx, qword [0x14017a048]
cmp rcx, r12
je 0x1400d1d53
test byte [rcx + 0x1c], r14b
je 0x1400d1b6d
cmp byte [rcx + 0x19], 2
jb 0x1400d1b6d
mov rcx, qword [rcx + 0x10]
lea r8, [0x14015c6b0]
movzx r9d, al
mov edx, 0xf6
call fcn.140010438
mov rcx, qword [0x14017a048]
cmp rcx, r12
je 0x1400d1d53
test byte [rcx + 0x1c], r14b
je 0x1400d1d53
cmp byte [rcx + 0x19], 2
jb 0x1400d1d53
movzx r9d, byte [rbp - 0x49]
mov edx, 0xf7
jmp 0x1400d1adc
mov rcx, qword [0x14017a048]
cmp rcx, r12
je 0x1400d1bce
test byte [rcx + 0x1c], r14b
je 0x1400d1bce
cmp byte [rcx + 0x19], 2
jb 0x1400d1bce
mov rcx, qword [rcx + 0x10]
lea r8, [0x14015c6b0]
mov edx, 0xef
call fcn.140004b70
mov rdx, qword [rbp + 7]
mov r9, qword [rbp - 1]
mov dword [rbx], 0x570
mov r13d, 9
mov rcx, qword [0x14017a048]
cmp rcx, r12
je 0x1400d1d5f
test byte [rcx + 0x1c], r14b
je 0x1400d1c84
cmp byte [rcx + 0x19], 2
jb 0x1400d1c84
movzx r8d, byte [rbp + 0xd]
movzx eax, byte [rbp + 0xe]
movzx r10d, byte [rbp + 0xc]
movzx r11d, byte [rbp + 0xb]
movzx ebx, byte [rbp + 0xa]
movzx edi, byte [rbp + 9]
movzx esi, byte [rbp + 8]
movzx r15d, word [rbp + 5]
movzx r12d, word [rbp + 3]
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], r8d
lea r8, [0x14015c6b0]
mov dword [rsp + 0x58], r10d
mov dword [rsp + 0x50], r11d
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], edi
movzx r14d, dl
mov edx, 0xf0
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r12d
call fcn.140010200
mov rcx, qword [0x14017a048]
lea r14d, [r13 - 5]
mov r15, qword [rbp - 9]
lea r12, [0x14017a048]
cmp rcx, r12
je 0x1400d1d5f
test byte [rcx + 0x1c], r14b
je 0x1400d1d5f
cmp byte [rcx + 0x19], 2
jb 0x1400d1d5f
movzx ecx, byte [rbp + 0x1d]
mov edx, 0xf1
movzx r8d, byte [rbp + 0x1c]
movzx r9d, byte [rbp + 0x1b]
movzx eax, byte [rbp + 0x1e]
movzx r10d, byte [rbp + 0x1a]
movzx r11d, byte [rbp + 0x19]
movzx ebx, byte [rbp + 0x18]
movzx edi, byte [rbp + 0x17]
movzx esi, word [rbp + 0x15]
movzx r14d, word [rbp + 0x13]
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], ecx
mov rcx, qword [0x14017a048]
mov dword [rsp + 0x58], r8d
lea r8, [0x14015c6b0]
mov dword [rsp + 0x50], r9d
mov r9d, dword [rbp + 0xf]
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x48], r10d
mov dword [rsp + 0x40], r11d
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r14d
call fcn.140010200
jmp 0x1400d1d5f
mov rcx, qword [0x14017a048]
cmp rcx, r12
je 0x1400d1d53
test byte [rcx + 0x1c], r14b
je 0x1400d1d53
cmp byte [rcx + 0x19], 2
jb 0x1400d1d53
mov r9d, dword [rbp - 0x2d]
mov edx, 0xe9
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x20], r8d
lea r8, [0x14015c6b0]
call fcn.1400101b0
mov r13d, 9
mov dword [rbx], 0x570
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop dword [rax + rax]
mov r14d, 4
mov rcx, qword [0x14017a048]
mov rax, qword [rbp - 0x11]
test rax, rax
je 0x1400d1d9a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, qword [0x14017a048]
cmp rcx, r12
je 0x1400d1dc0
test byte [rcx + 0x1c], r14b
je 0x1400d1dc0
cmp byte [rcx + 0x19], r14b
jb 0x1400d1dc0
mov rcx, qword [rcx + 0x10]
lea r8, [0x14015c6b0]
mov edx, 0xf8
call fcn.140004b70
mov eax, r13d
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.14014b700
mov rbx, qword [rsp + 0x128]
add rsp, 0xe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret