Function at 0x1400f05b8
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xe0
mov rax, qword [0x14017d140]
xor rax, rsp
mov qword [rbp + 0x17], rax
xor r15d, r15d
mov rbx, rdx
mov r14, rcx
and dword [rbp - 0x45], r15d
mov rcx, qword [0x14017d3a8]
lea rdi, [0x14017d3a8]
lea r13d, [r15 + 4]
cmp rcx, rdi
je 0x1400f0627
test byte [rcx + 0x1c], r13b
je 0x1400f0627
cmp byte [rcx + 0x19], r13b
jb 0x1400f0627
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000d538]
mov edx, 0xe3
call fcn.14001dd24
mov rcx, qword [r14]
and qword [rbp - 0x19], r15
lea rdx, [rbp - 0x39]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x1400f068a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
mov rcx, qword [0x14017d3a8]
cmp rcx, rdi
je 0x1400f067f
test byte [rcx + 0x1c], r13b
je 0x1400f067f
cmp byte [rcx + 0x19], 2
jb 0x1400f067f
mov r9, qword [r14]
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000d538]
mov edx, 0xe4
mov dword [rsp + 0x20], eax
call fcn.14001de60
mov rcx, qword [0x14017d3a8]
mov r15d, 8
jmp 0x1400f0910
mov esi, 0x10000
xor ecx, ecx
mov edx, esi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r12, rax
test rax, rax
jne 0x1400f06b3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r15d, [r12 + 3]
mov dword [rbx], eax
jmp 0x1400f0909
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbp - 0x19], rax
test rax, rax
jne 0x1400f06e1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, 8
mov dword [rbx], eax
jmp 0x1400f0900
and dword [rbp - 0x21], r15d
and dword [rbp - 0x1d], r15d
mov rcx, qword [0x14017d3a8]
cmp rcx, rdi
je 0x1400f0716
test byte [rcx + 0x1c], r13b
je 0x1400f0716
cmp byte [rcx + 0x19], 5
jb 0x1400f0716
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000d538]
mov edx, 0xe5
call fcn.14001dd24
mov rcx, qword [r14]
lea r9, [rbp - 0x31]
mov r8d, esi
mov rdx, r12
call fcn.1400e156c
mov rcx, qword [r14]
lea r8, [rbp - 0x45]
lea rdx, [rbp - 0x31]
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x1400f078c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
mov rcx, qword [0x14017d3a8]
cmp rcx, rdi
je 0x1400f09c4
test byte [rcx + 0x1c], r13b
je 0x1400f09c4
cmp byte [rcx + 0x19], 2
jb 0x1400f09c4
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000d538]
mov edx, 0xe6
mov r9d, eax
call fcn.14001de24
jmp 0x1400f09c4
mov r9d, dword [rbp - 0x45]
cmp r9d, esi
je 0x1400f07c7
mov rcx, qword [0x14017d3a8]
cmp rcx, rdi
je 0x1400f09be
test byte [rcx + 0x1c], r13b
je 0x1400f09be
cmp byte [rcx + 0x19], 2
jb 0x1400f09be
mov edx, 0xe7
mov dword [rsp + 0x20], esi
jmp 0x1400f09ae
lea rdx, [0x14000d0f8]
mov r8d, CoRevokeClassObject
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_RtlCompareMemory]
cmp rax, 0x10
je 0x1400f0900
lea r9, [rbp - 0x49]
lea r8, [rbp + 7]
lea rdx, [rbp - 0x11]
mov rcx, r12
call fcn.1400f33b4
test al, al
jne 0x1400f082d
mov rcx, qword [0x14017d3a8]
cmp rcx, rdi
je 0x1400f0dc3
test byte [rcx + 0x1c], r13b
je 0x1400f0dc3
cmp byte [rcx + 0x19], 2
jb 0x1400f0dc3
mov edx, pe_nt_image_headers64
jmp 0x1400f0aa2
mov sil, byte [rbp - 0x49]
mov r8, qword [rbp - 0x39]
mov al, sil
neg al
sbb edi, edi
and edi, 0xfffffe00
add edi, 0x400
mov ecx, edi
cmp r8, rcx
jl 0x1400f0dd4
mov r9d, 0x1ff
mov rax, r8
cqo
and rdx, r9
add rax, rdx
and rax, r9
cmp rax, rdx
jne 0x1400f0dd4
sub r8, rcx
mov rax, r8
mov dword [rbp - 0x21], r8d
shr rax, 0x20
mov dword [rbp - 0x1d], eax
mov rcx, qword [0x14017d3a8]
lea rdx, [0x14017d3a8]
cmp rcx, rdx
je 0x1400f08bd
test byte [rcx + 0x1c], r13b
je 0x1400f08bd
cmp byte [rcx + 0x19], 5
jb 0x1400f08bd
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x20], r8d
lea r8, [0x14000d538]
mov edx, 0xea
mov r9d, eax
call fcn.1400285b4
mov rcx, qword [r14]
lea r9, [rbp - 0x31]
mov r8d, edi
mov rdx, r12
call fcn.1400e156c
mov rcx, qword [r14]
lea r8, [rbp - 0x45]
lea rdx, [rbp - 0x31]
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x1400f0979
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, r13d
mov dword [rbx], eax
lea rdi, [0x14017d3a8]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [0x14017d3a8]
mov rax, qword [rbp - 0x19]
test rax, rax
je 0x1400f0929
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14017d3a8]
cmp rcx, rdi
je 0x1400f094f
test byte [rcx + 0x1c], r13b
je 0x1400f094f
cmp byte [rcx + 0x19], r13b
jb 0x1400f094f
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000d538]
mov edx, 0xf8
call fcn.14001dd24
mov eax, r15d
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.140168920
mov rbx, qword [rsp + 0x130]
add rsp, 0xe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r9d, dword [rbp - 0x45]
cmp r9d, edi
je 0x1400f09cc
mov rcx, qword [0x14017d3a8]
lea rdi, [0x14017d3a8]
cmp rcx, rdi
je 0x1400f09be
test byte [rcx + 0x1c], r13b
je 0x1400f09be
cmp byte [rcx + 0x19], 2
jb 0x1400f09be
mov edx, 0xeb
mov dword [rsp + 0x20], reloc.ADVAPI32.dll_TraceEvent
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000d538]
call fcn.1400285b4
mov dword [rbx], reloc.ADVAPI32.dll_TraceEvent
mov r15d, r13d
jmp 0x1400f0900
lea r9, [rbp - 0x49]
lea r8, [rbp - 9]
lea rdx, [rbp - 0x41]
mov rcx, r12
call fcn.1400f33b4
test al, al
jne 0x1400f0a50
test sil, sil
je 0x1400f0a1e
mov rcx, qword [0x14017d3a8]
lea rdi, [0x14017d3a8]
cmp rcx, rdi
je 0x1400f0dc3
test byte [rcx + 0x1c], r13b
je 0x1400f0dc3
cmp byte [rcx + 0x19], 2
jb 0x1400f0dc3
mov edx, 0xec
jmp 0x1400f0aa2
mov rcx, qword [0x14017d3a8]
lea rdi, [0x14017d3a8]
cmp rcx, rdi
je 0x1400f0dc3
test byte [rcx + 0x1c], r13b
je 0x1400f0dc3
cmp byte [rcx + 0x19], 2
jb 0x1400f0dc3
mov edx, 0xed
jmp 0x1400f0aa2
test sil, sil
jne 0x1400f0ab7
lea rcx, [r12 + 0x200]
lea r9, [rbp - 0x49]
lea r8, [rbp - 9]
lea rdx, [rbp - 0x41]
call fcn.1400f33b4
test al, al
jne 0x1400f0ab7
mov rcx, qword [0x14017d3a8]
lea rdi, [0x14017d3a8]
cmp rcx, rdi
je 0x1400f0dc3
test byte [rcx + 0x1c], r13b
je 0x1400f0dc3
cmp byte [rcx + 0x19], 2
jb 0x1400f0dc3
mov edx, 0xee
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000d538]
call fcn.14001dd24
jmp 0x1400f0dc3
lea rax, [rbp - 9]
lea rcx, [rbp + 7]
mov rdx, qword [rax]
cmp rdx, qword [rcx]
jne 0x1400f0ad5
mov rdx, qword [rax + 8]
cmp rdx, qword [rcx + 8]
jne 0x1400f0ad5
xor eax, eax
jmp 0x1400f0ada
sbb eax, eax
sbb eax, reloc.ADVAPI32.dll_TraceEvent
test eax, eax
je 0x1400f0c66
mov rcx, qword [0x14017d3a8]
lea rdi, [0x14017d3a8]
cmp rcx, rdi
je 0x1400f0b16
test byte [rcx + 0x1c], r13b
je 0x1400f0b16
cmp byte [rcx + 0x19], 2
jb 0x1400f0b16
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000d538]
mov edx, 0xef
call fcn.14001dd24
mov dword [rbx], reloc.ADVAPI32.dll_TraceEvent
mov r15d, 9
mov r13, qword [0x14017d3a8]
cmp r13, rdi
je 0x1400f0e13
test byte [r13 + 0x1c], 4
je 0x1400f0bc9
cmp byte [r13 + 0x19], 2
jb 0x1400f0bc9
movzx r9d, byte [rbp + 4]
movzx eax, byte [rbp + 6]
movzx r8d, byte [rbp + 5]
movzx r10d, byte [rbp + 3]
movzx r11d, byte [rbp + 2]
movzx ecx, byte [rbp + 1]
movzx ebx, byte [rbp]
movzx edi, byte [rbp - 1]
movzx esi, word [rbp - 3]
movzx r14d, word [rbp - 5]
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], r8d
mov dword [rsp + 0x58], r9d
mov r9d, dword [rbp - 9]
mov dword [rsp + 0x50], r10d
mov dword [rsp + 0x48], r11d
mov dword [rsp + 0x40], ecx
mov rcx, qword [r13 + 0x10]
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
lea r8, [0x14000d538]
mov edx, 0xf0
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r14d
call fcn.1400285fc
mov r13, qword [0x14017d3a8]
lea rdi, [0x14017d3a8]
cmp r13, rdi
je 0x1400f0e13
test byte [r13 + 0x1c], 4
je 0x1400f0e13
cmp byte [r13 + 0x19], 2
jb 0x1400f0e13
movzx r9d, byte [rbp + 0x13]
movzx eax, byte [rbp + 0x16]
movzx ecx, byte [rbp + 0x15]
movzx r8d, byte [rbp + 0x14]
movzx r10d, byte [rbp + 0x12]
movzx r11d, byte [rbp + 0x11]
movzx ebx, byte [rbp + 0x10]
movzx edi, byte [rbp + 0xf]
movzx esi, word [rbp + 0xd]
movzx r14d, word [rbp + 0xb]
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], ecx
mov rcx, qword [r13 + 0x10]
mov dword [rsp + 0x58], r8d
mov dword [rsp + 0x50], r9d
mov r9d, dword [rbp + 7]
mov dword [rsp + 0x48], r10d
mov dword [rsp + 0x40], r11d
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
lea r8, [0x14000d538]
mov edx, 0xf1
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r14d
call fcn.1400285fc
mov r13d, 4
jmp 0x1400f08f9
mov rdi, qword [rbp - 0x11]
cmp rdi, qword [rbp - 0x41]
je 0x1400f0d1e
mov rcx, qword [0x14017d3a8]
lea rsi, [0x14017d3a8]
cmp rcx, rsi
je 0x1400f0d0d
test byte [rcx + 0x1c], r13b
je 0x1400f0cb3
cmp byte [rcx + 0x19], 2
jb 0x1400f0cb3
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000d538]
mov edx, 0xf2
call fcn.14001dd24
mov rcx, qword [0x14017d3a8]
cmp rcx, rsi
je 0x1400f0d0d
test byte [rcx + 0x1c], r13b
je 0x1400f0ce4
cmp byte [rcx + 0x19], 2
jb 0x1400f0ce4
mov r9, qword [rbp - 0x41]
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000d538]
mov edx, 0xf3
call fcn.1400d3ca0
mov rcx, qword [0x14017d3a8]
cmp rcx, rsi
je 0x1400f0d0d
test byte [rcx + 0x1c], r13b
je 0x1400f0d0d
cmp byte [rcx + 0x19], 2
jb 0x1400f0d0d
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000d538]
mov edx, 0xf4
mov r9, rdi
call fcn.1400d3ca0
mov dword [rbx], reloc.ADVAPI32.dll_TraceEvent
mov r15d, 9
jmp 0x1400f08f9
cmp sil, byte [rbp - 0x49]
je 0x1400f08f9
mov rcx, qword [0x14017d3a8]
lea rdi, [0x14017d3a8]
cmp rcx, rdi
je 0x1400f0dc3
test byte [rcx + 0x1c], r13b
je 0x1400f0d67
cmp byte [rcx + 0x19], 2
jb 0x1400f0d67
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000d538]
mov edx, 0xf5
call fcn.14001dd24
mov rcx, qword [0x14017d3a8]
cmp rcx, rdi
je 0x1400f0dc3
test byte [rcx + 0x1c], r13b
je 0x1400f0d99
cmp byte [rcx + 0x19], 2
jb 0x1400f0d99
movzx r9d, byte [rbp - 0x49]
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000d538]
mov edx, 0xf6
call fcn.1400d3ca0
mov rcx, qword [0x14017d3a8]
cmp rcx, rdi
je 0x1400f0dc3
test byte [rcx + 0x1c], r13b
je 0x1400f0dc3
cmp byte [rcx + 0x19], 2
jb 0x1400f0dc3
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000d538]
movzx r9d, sil
mov edx, 0xf7
call fcn.1400d3ca0
mov dword [rbx], reloc.ADVAPI32.dll_TraceEvent
mov r15d, 9
jmp 0x1400f0900
mov rcx, qword [0x14017d3a8]
lea rdi, [0x14017d3a8]
cmp rcx, rdi
je 0x1400f0dc3
test byte [rcx + 0x1c], r13b
je 0x1400f0dc3
cmp byte [rcx + 0x19], 2
jb 0x1400f0dc3
mov r9d, dword [rbp - 0x35]
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x20], r8d
lea r8, [0x14000d538]
mov edx, 0xe9
call fcn.1400285b4
jmp 0x1400f0dc3
mov r13d, 4
jmp 0x1400f0900