Function at 0x14002f160
Capabilities:
Get file size

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x14028cab8]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea eax, [rdx - 0x10]
mov qword [rsp + 0x48], r8
mov byte [rsp + 0x40], 0
movzx ebx, r9b
mov byte [rsp + 0x41], bl
mov esi, edx
mov rdi, rcx
cmp eax, 0x30
ja 0x14002f1ad
movabs rcx, 0x1000100000001
bt rcx, rax
jb 0x14002f48d
cmp esi, 0x60
je 0x14002f48d
cmp esi, 0x70
je 0x14002f48d
mov qword [rsp + 0x88], rbp
lea rcx, [rdi - 8]
mov qword [rsp + 0x68], r15
call fcn.14002e3c0
cmp byte [rdi + 0x150], 0
mov r15d, eax
jne 0x14002f1ec
inc dword [rdi + 0x148]
jmp 0x14002f279
mov qword [rsp + 0x80], r12
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x78], r13
mov ecx, esi
mov qword [rsp + 0x70], r14
call fcn.1400328e0
movzx r12d, byte [rsp + 0x40]
movzx eax, bl
add r12d, 4
lea r13d, [rax + rax]
add r12d, r13d
add r12d, r15d
mov ecx, r12d
call fcn.1401987c4
mov r14, rax
test rax, rax
jne 0x14002f29e
mov rcx, qword [0x14028d9b0]
lea rax, [0x14028d9b0]
cmp rcx, rax
je 0x14002f267
test dword [rcx + 0x44], 0x200
je 0x14002f267
cmp byte [rcx + 0x41], 2
jb 0x14002f267
mov rcx, qword [rcx + 0x38]
lea edx, [r14 + 0x2d]
lea r8, [0x140238430]
call fcn.14001d350
mov r14, qword [rsp + 0x70]
mov r13, qword [rsp + 0x78]
mov r12, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x88]
mov r15, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140189c60
add rsp, 0x90
pop rdi
pop rsi
pop rbx
ret
lea rcx, [rdi - 8]
call fcn.14002e340
mov r8, rax
mov edx, r12d
mov r9, r15
mov rcx, r14
call fcn.14006c9e0
mov r8, qword [rsp + 0x48]
sub r12d, r15d
mov eax, 1
shr r15d, 1
mov r9d, r13d
cmove r15d, eax
mov eax, 0x3a
lea edx, [r15 - 1]
mov word [r14 + rdx*2], ax
lea rcx, [r14 + r15*2]
mov edx, r12d
call fcn.14006c9e0
movzx ecx, byte [rsp + 0x41]
lea rdx, [rsp + 0x40]
movzx ebx, byte [rsp + 0x40]
add r15d, ecx
mov ecx, esi
call fcn.1400328e0
sub r12d, r13d
lea rcx, [r14 + r15*2]
mov edx, r12d
mov r8, rax
mov r9d, ebx
call fcn.14006c9e0
movzx eax, byte [rsp + 0x40]
xor ecx, ecx
shr eax, 1
mov rdx, r14
add eax, r15d
mov word [r14 + rax*2], cx
lea rcx, [rdi - 8]
mov r8d, dword [rdi + 0x14c]
call fcn.14002e690
test al, al
jne 0x14002f392
mov rcx, qword [0x14028d9b0]
lea rax, [0x14028d9b0]
cmp rcx, rax
je 0x14002f480
test dword [rcx + 0x44], 0x200
je 0x14002f480
cmp byte [rcx + 0x41], 2
jb 0x14002f480
mov rcx, qword [rcx + 0x38]
lea r8, [0x140238430]
mov edx, 0x2e
mov r9, r14
call fcn.14002c9a0
mov rcx, r14
call fcn.1401987b0
jmp 0x14002f267
mov eax, dword [rdi + 0x14c]
lea rdx, [rsp + 0x48]
mov rcx, qword [rdi + 0x158]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileSizeEx]
test eax, eax
je 0x14002f437
mov rax, qword [rsp + 0x48]
add qword [rdi + 8], rax
inc dword [rdi + 0x14c]
mov r8d, dword [rdi + 0x14c]
mov rdx, qword [rdi + 8]
mov rcx, qword [0x14028d9b0]
lea rax, [0x14028d9b0]
cmp rcx, rax
je 0x14002f480
test dword [rcx + 0x44], 0x200
je 0x14002f480
cmp byte [rcx + 0x41], 4
jb 0x14002f480
movzx eax, word [rsp + 0xd0]
mov r9, r14
mov rcx, qword [rcx + 0x38]
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov eax, dword [rdi + 0x148]
mov dword [rsp + 0x28], r8d
mov dword [rsp + 0x20], eax
call fcn.14002db00
mov rcx, r14
call fcn.1401987b0
jmp 0x14002f267
mov rcx, qword [0x14028d9b0]
lea rax, [0x14028d9b0]
cmp rcx, rax
je 0x14002f471
test dword [rcx + 0x44], 0x200
je 0x14002f471
cmp byte [rcx + 0x41], 2
jb 0x14002f471
mov rcx, qword [rcx + 0x38]
lea r8, [0x140238430]
mov edx, 0x30
mov r9, r14
call fcn.14002c9a0
mov edx, dword [rdi + 0x14c]
lea rcx, [rdi - 8]
call fcn.14002fa90
mov rcx, r14
call fcn.1401987b0
jmp 0x14002f267
mov rcx, qword [0x14028d9b0]
lea rax, [0x14028d9b0]
cmp rcx, rax
je 0x14002f286
mov edx, dword [rcx + 0x44]
bt edx, 9
jae 0x14002f286
movzx eax, byte [rcx + 0x41]
cmp al, 5
jb 0x14002f286
cmp esi, 0x101
jae 0x14002f4d7
shr esi, 4
lea r9, str.:_STANDARD_INFORMATION
dec esi
mov r9, qword [r9 + rsi*8]
jmp 0x14002f504
bt edx, 0xb
jae 0x14002f4fd
cmp al, 3
jb 0x14002f4fd
mov rcx, qword [rcx + 0x38]
lea r8, [0x140238848]
mov edx, 0xa
call fcn.14001d350
mov rcx, qword [0x14028d9b0]
lea r9, [0x140231acc]
mov rcx, qword [rcx + 0x38]
lea r8, [0x140238430]
mov edx, 0x2c
call fcn.14002c9a0
jmp 0x14002f286