Function at 0x140009423
Capabilities:
Get file size

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x2f8
movabs rax, 0x726f7475615c3a23
mov qword [rsp + 0x57], rax
mov ebp, ecx
mov ecx, 0x20a
mov r12, rdx
movabs rax, 0x666e692e6e7572
lea rdi, [rsp + 0xe6]
mov rbx, r8
mov r13d, r9d
mov qword [rsp + 0x5e], rax
xor eax, eax
lea r14, [rsp + 0xe6]
rep stosb byte [rdi], al
lea rdi, str.NO_LABEL
mov ecx, ebp
mov dword [rsp + 0x53], 0x5c3a23
mov qword [r8], rdi
call fcn.140009181
test eax, eax
je 0x140009768
mov al, byte [r12]
test al, al
jne 0x14000955e
xor esi, esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], esi
mov ecx, ebp
call fcn.140008b74
mov dword [rsp + 0x38], 0x40
lea r9, [rsp + 0x44]
mov rdx, r14
mov rsi, rax
lea rax, [rsp + 0x66]
mov r8d, 0x40
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x4c]
mov rcx, rsi
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [0x14011c5e8]
test eax, eax
je 0x140009542
xor r11d, r11d
lea rbp, [0x1400cfc40]
or r9d, 0xffffffff
xor edx, edx
mov qword [rsp + 0x38], r11
mov r8, r14
mov ecx, 0xfde9
mov qword [rsp + 0x30], r11
mov dword [rsp + 0x28], 0x105
mov qword [rsp + 0x20], rbp
call qword [0x14011c7d0]
cmp byte [0x1400cfc40], 0
je 0x14000953f
mov rdi, rbp
mov qword [rbx], rdi
lea rax, [rsi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140009740
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_CreateDirectorCreateEventACreateFileA]
jmp 0x140009740
xor r8d, r8d
xor edx, edx
mov r9d, 1
mov ecx, ebp
mov byte [rsp + 0x57], al
mov byte [rsp + 0x53], al
call fcn.1400077b5
xor r8d, r8d
xor r9d, r9d
xor r10d, r10d
mov qword [rsp + 0x38], r8
mov r14, rax
mov edx, 0x2d4800
mov rcx, rax
mov qword [rsp + 0x30], r8
xor r8d, r8d
mov dword [rsp + 0x28], r9d
xor r9d, r9d
mov qword [rsp + 0x20], r10
call qword [sym.imp.KERNEL32.DLL_GetFileSizeEx]
test eax, eax
je 0x1400095cc
lea rdx, [rsp + 0x57]
mov r8d, 1
lea rcx, str.label
call fcn.140023801
mov rsi, rax
jmp 0x1400095fb
call qword [sym.imp.KERNEL32.DLL_PeekNamedPipe]
cmp eax, 0x15
jne 0x1400095dc
test r13d, r13d
je 0x1400095e0
xor esi, esi
jmp 0x1400095fb
movsx ecx, byte [r12]
call qword [0x14011cc00]
lea rcx, str.Ignoring_autorun.inf_label_for_drive__c:_No_media
mov edx, eax
call fcn.140038472
jmp 0x1400095dc
lea rax, [r14 - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000960e
mov rcx, r14
call qword [sym.imp.KERNEL32.DLL_CreateDirectorCreateEventACreateFileA]
test rsi, rsi
je 0x140009664
test r13d, r13d
jne 0x140009634
movsx ecx, byte [r12]
call qword [0x14011cc00]
mov r8, rsi
lea rcx, str.Using_autorun.inf_label_for_drive__c:__s
mov edx, eax
call fcn.140038472
mov rcx, rsi
lea rdi, [0x1400cfc40]
call fcn.1400797e8
mov rcx, rdi
mov r8, rsi
mov edx, 0x105
lea r9, [rax + 1]
call fcn.140006940
mov rcx, rsi
call fcn.1400796c8
jmp 0x140009763
lea rcx, [rsp + 0x53]
call fcn.140006cd5
mov edx, 2
mov ecx, 0x105
mov r14, rax
call sub.msvcrt.dll_vfprintf
xor ecx, ecx
xor edx, edx
xor r9d, r9d
mov dword [rsp + 0x38], edx
mov r8d, 0x105
mov rdx, rax
mov r12, rax
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
mov rcx, r14
call qword [0x14011c5f0]
mov r15, qword [sym.imp.KERNEL32.DLL_PeekNamedPipe]
mov r13d, eax
call r15
mov esi, eax
test r13d, r13d
je 0x140009703
xor eax, eax
or r9d, 0xffffffff
xor edx, edx
mov dword [rsp + 0x28], 0x105
mov qword [rsp + 0x38], rax
mov r8, r12
mov ecx, 0xfde9
mov qword [rsp + 0x30], rax
lea rax, [0x1400cfc40]
mov qword [rsp + 0x20], rax
call qword [0x14011c7d0]
test eax, eax
jne 0x140009703
call r15
xor r13d, r13d
mov esi, eax
test r12, r12
je 0x140009710
mov rcx, r12
call fcn.1400796c8
test r14, r14
je 0x14000971d
mov rcx, r14
call fcn.1400796c8
mov ecx, esi
mov rsi, qword [0x14011c730]
call rsi
test r13d, r13d
je 0x140009747
cmp byte [0x1400cfc40], 0
je 0x140009747
lea rax, [0x1400cfc40]
mov qword [rbx], rax
mov eax, 1
jmp 0x140009768
call r15
xor edx, edx
mov ecx, ebp
mov r12d, eax
call fcn.1400118c9
mov qword [rbx], rax
test rax, rax
jne 0x140009740
mov ecx, r12d
call rsi
mov qword [rbx], rdi
jmp 0x140009740
add rsp, 0x2f8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret