Function at 0x140035100
Capabilities:
Get file size

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x1402b8d08]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea eax, [rdx - 0x10]
mov qword [rsp + 0x48], r8
mov byte [rsp + 0x40], 0
movzx ebx, r9b
mov byte [rsp + 0x41], bl
mov esi, edx
mov rdi, rcx
cmp eax, 0x30
ja 0x14003514d
movabs rcx, 0x1000100000001
bt rcx, rax
jb 0x14003542d
cmp esi, 0x60
je 0x14003542d
cmp esi, 0x70
je 0x14003542d
mov qword [rsp + 0x88], rbp
lea rcx, [rdi - 8]
mov qword [rsp + 0x68], r15
call fcn.140034330
cmp byte [rdi + 0x150], 0
mov r15d, eax
jne 0x14003518c
inc dword [rdi + 0x148]
jmp 0x140035219
mov qword [rsp + 0x80], r12
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x78], r13
mov ecx, esi
mov qword [rsp + 0x70], r14
call fcn.140038860
movzx r12d, byte [rsp + 0x40]
movzx eax, bl
add r12d, 4
lea r13d, [rax + rax]
add r12d, r13d
add r12d, r15d
mov ecx, r12d
call fcn.1401c0494
mov r14, rax
test rax, rax
jne 0x14003523e
mov rcx, qword [0x1402b9860]
lea rax, [0x1402b9860]
cmp rcx, rax
je 0x140035207
test dword [rcx + 0x44], 0x200
je 0x140035207
cmp byte [rcx + 0x41], 2
jb 0x140035207
mov rcx, qword [rcx + 0x38]
lea edx, [r14 + 0x2d]
lea r8, [0x140261820]
call fcn.140022ad0
mov r14, qword [rsp + 0x70]
mov r13, qword [rsp + 0x78]
mov r12, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x88]
mov r15, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401b1920
add rsp, 0x90
pop rdi
pop rsi
pop rbx
ret
lea rcx, [rdi - 8]
call fcn.1400342b0
mov r8, rax
mov edx, r12d
mov r9, r15
mov rcx, r14
call fcn.140072d70
mov r8, qword [rsp + 0x48]
sub r12d, r15d
mov eax, 1
shr r15d, 1
mov r9d, r13d
cmove r15d, eax
mov eax, 0x3a
lea edx, [r15 - 1]
mov word [r14 + rdx*2], ax
lea rcx, [r14 + r15*2]
mov edx, r12d
call fcn.140072d70
movzx ecx, byte [rsp + 0x41]
lea rdx, [rsp + 0x40]
movzx ebx, byte [rsp + 0x40]
add r15d, ecx
mov ecx, esi
call fcn.140038860
sub r12d, r13d
lea rcx, [r14 + r15*2]
mov edx, r12d
mov r8, rax
mov r9d, ebx
call fcn.140072d70
movzx eax, byte [rsp + 0x40]
xor ecx, ecx
shr eax, 1
mov rdx, r14
add eax, r15d
mov word [r14 + rax*2], cx
lea rcx, [rdi - 8]
mov r8d, dword [rdi + 0x14c]
call fcn.140034600
test al, al
jne 0x140035332
mov rcx, qword [0x1402b9860]
lea rax, [0x1402b9860]
cmp rcx, rax
je 0x140035420
test dword [rcx + 0x44], 0x200
je 0x140035420
cmp byte [rcx + 0x41], 2
jb 0x140035420
mov rcx, qword [rcx + 0x38]
lea r8, [0x140261820]
mov edx, 0x2e
mov r9, r14
call fcn.1400328a0
mov rcx, r14
call fcn.1401c0480
jmp 0x140035207
mov eax, dword [rdi + 0x14c]
lea rdx, [rsp + 0x48]
mov rcx, qword [rdi + 0x158]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileSizeEx]
test eax, eax
je 0x1400353d7
mov rax, qword [rsp + 0x48]
add qword [rdi + 8], rax
inc dword [rdi + 0x14c]
mov r8d, dword [rdi + 0x14c]
mov rdx, qword [rdi + 8]
mov rcx, qword [0x1402b9860]
lea rax, [0x1402b9860]
cmp rcx, rax
je 0x140035420
test dword [rcx + 0x44], 0x200
je 0x140035420
cmp byte [rcx + 0x41], 4
jb 0x140035420
movzx eax, word [rsp + 0xd0]
mov r9, r14
mov rcx, qword [rcx + 0x38]
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov eax, dword [rdi + 0x148]
mov dword [rsp + 0x28], r8d
mov dword [rsp + 0x20], eax
call fcn.140033a70
mov rcx, r14
call fcn.1401c0480
jmp 0x140035207
mov rcx, qword [0x1402b9860]
lea rax, [0x1402b9860]
cmp rcx, rax
je 0x140035411
test dword [rcx + 0x44], 0x200
je 0x140035411
cmp byte [rcx + 0x41], 2
jb 0x140035411
mov rcx, qword [rcx + 0x38]
lea r8, [0x140261820]
mov edx, 0x30
mov r9, r14
call fcn.1400328a0
mov edx, dword [rdi + 0x14c]
lea rcx, [rdi - 8]
call fcn.140035a30
mov rcx, r14
call fcn.1401c0480
jmp 0x140035207
mov rcx, qword [0x1402b9860]
lea rax, [0x1402b9860]
cmp rcx, rax
je 0x140035226
mov edx, dword [rcx + 0x44]
bt edx, 9
jae 0x140035226
movzx eax, byte [rcx + 0x41]
cmp al, 5
jb 0x140035226
cmp esi, 0x101
jae 0x140035477
shr esi, 4
lea r9, [0x140261b00]
dec esi
mov r9, qword [r9 + rsi*8]
jmp 0x1400354a4
bt edx, 0xb
jae 0x14003549d
cmp al, 3
jb 0x14003549d
mov rcx, qword [rcx + 0x38]
lea r8, [0x140261af0]
mov edx, 0xa
call fcn.140022ad0
mov rcx, qword [0x1402b9860]
lea r9, [0x14025b71c]
mov rcx, qword [rcx + 0x38]
lea r8, [0x140261820]
mov edx, 0x2c
call fcn.1400328a0
jmp 0x140035226