Function at 0x1401fdff0
Capabilities:
Get file size

Disassembly:
mov dword [rsp + 0x18], r8d
mov byte [rsp + 0x10], dl
mov dword [rsp + 8], ecx
sub rsp, 0xb8
mov byte [rsp + 0x30], 0x69
movabs rax, 0x271a55304bb0e8bc
mov qword [rsp + 0x38], rax
movsx eax, byte [rsp + 0x30]
sub eax, 0x41
mov byte [rsp + 0x30], al
movzx eax, byte [rsp + 0x30]
mov byte [rsp + 0x48], al
cmp byte [rsp + 0x48], 0x28
je 0x1401fe139
cmp byte [rsp + 0x48], 0x45
je 0x1401fe044
jmp 0x1401fe227
movabs rax, 0x31042fe0bf66e6fc
cmp qword [rsp + 0x38], rax
jne 0x1401fe0f6
mov dword [rsp + 0xc0], 0x59a4f5a1
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x68], rax
movabs rax, 0x6c4ce4e622edde23
cmp qword [rsp + 0x68], rax
je 0x1401fe081
jmp 0x1401fe0da
call fcn.1401fe730
mov r8d, 0x7c
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.COMCTL32.dll_DrawInsert]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.COMCTL32.dll_MakeDragList]
mov dword [rsp + 0x54], eax
mov r8d, dword [rsp + 0xd0]
movzx edx, byte [rsp + 0xc8]
mov ecx, dword [rsp + 0xc0]
call fcn.1401fdff0
mov dword [rsp + 0xd0], 0xed2ae6fc
jmp 0x1401fe0f4
lea r8, [rsp + 0x40]
lea rdx, [fcn.1401fdff0]
mov rcx, qword [rsp + 0x70]
call sub.COMCTL32.dll_RemoveWindowSubclass
mov dword [rsp + 0x40], eax
jmp 0x1401fe134
movabs rax, 0x7b470108cec2b283
mov rcx, qword [rsp + 0x38]
add rcx, rax
mov rax, rcx
movabs rcx, 0xd6078416713a69a
cmp rax, rcx
jge 0x1401fe134
movabs rax, 0x6563a1fa980e04e8
mov rcx, qword [rsp + 0x38]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
jmp 0x1401fe227
movsx eax, byte [rsp + 0x30]
cmp eax, 0x4f
jg 0x1401fe1ed
mov eax, 0x5eaa
mov word [rsp + 0x34], ax
mov eax, dword [rsp + 0xc0]
mov dword [rsp + 0x50], eax
movzx eax, byte [rsp + 0x30]
mov byte [rsp + 0x4c], al
cmp byte [rsp + 0x4c], 0x48
je 0x1401fe16e
jmp 0x1401fe1eb
movsx eax, byte [rsp + 0x30]
xor eax, 9
mov byte [rsp + 0x30], al
xor r8d, r8d
mov rdx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.COMCTL32.dll_LBItemFromPt]
mov dword [rsp + 0x44], eax
mov ecx, 0x2d
call fcn.1401fe800
movsx eax, word [rsp + 0x34]
or eax, 0x9ea
mov word [rsp + 0x34], ax
mov r8d, dword [rsp + 0xd0]
movzx edx, byte [rsp + 0xc8]
mov ecx, dword [rsp + 0x44]
call fcn.1401fdff0
lea rdx, [rsp + 0x44]
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0xc0], eax
jmp 0x1401fe227
movabs rax, 0x3fb17214da8a9f07
cmp qword [rsp + 0x38], rax
jl 0x1401fe227
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x34
lea r8, [rsp + 0x38]
mov edx, 0xbb
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_QueryInformationJobObject]
mov dword [rsp + 0x54], eax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x58], rax
movabs rax, 0x7d5792120cacbb3
cmp qword [rsp + 0x58], rax
je 0x1401fe28b
movabs rax, 0x722839f8cb552567
cmp qword [rsp + 0x58], rax
je 0x1401fe255
jmp 0x1401fe2af
mov ecx, 0x66
call qword [sym.imp.KERNEL32.dll_IsValidCodePage]
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x38]
shl rax, 0x19
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov dword [rsp + 0x40], eax
jmp 0x1401fe2af
mov r8d, dword [rsp + 0xd0]
movzx edx, byte [rsp + 0xc8]
mov ecx, dword [rsp + 0x44]
call fcn.1401fdff0
mov dword [rsp + 0xd0], 0xadf00226
mov eax, 0xa7
add rsp, 0xb8
ret