Function at 0x140021e60
Capabilities:
Get file size

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x140225e48]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea eax, [rdx - 0x10]
mov qword [rsp + 0x48], r8
mov byte [rsp + 0x40], 0
movzx ebx, r9b
mov byte [rsp + 0x41], bl
mov esi, edx
mov rdi, rcx
cmp eax, 0x30
ja 0x140021ead
movabs rcx, 0x1000100000001
bt rcx, rax
jb 0x14002218d
cmp esi, 0x60
je 0x14002218d
cmp esi, 0x70
je 0x14002218d
mov qword [rsp + 0x88], rbp
lea rcx, [rdi - 8]
mov qword [rsp + 0x68], r15
call fcn.1400211e0
cmp byte [rdi + 0x150], 0
mov r15d, eax
jne 0x140021eec
inc dword [rdi + 0x148]
jmp 0x140021f79
mov qword [rsp + 0x80], r12
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x78], r13
mov ecx, esi
mov qword [rsp + 0x70], r14
call fcn.140023090
movzx r12d, byte [rsp + 0x40]
movzx eax, bl
add r12d, 4
lea r13d, [rax + rax]
add r12d, r13d
add r12d, r15d
mov ecx, r12d
call fcn.14014317c
mov r14, rax
test rax, rax
jne 0x140021f9e
mov rcx, qword [0x140226b10]
lea rax, [0x140226b10]
cmp rcx, rax
je 0x140021f67
test dword [rcx + 0x1c], 0x100
je 0x140021f67
cmp byte [rcx + 0x19], 2
jb 0x140021f67
mov rcx, qword [rcx + 0x10]
lea edx, [r14 + 0x2d]
lea r8, [0x1401e0550]
call fcn.14001f000
mov r14, qword [rsp + 0x70]
mov r13, qword [rsp + 0x78]
mov r12, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x88]
mov r15, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400eb3e0
add rsp, 0x90
pop rdi
pop rsi
pop rbx
ret
lea rcx, [rdi - 8]
call fcn.140021160
mov r8, rax
mov edx, r12d
mov r9, r15
mov rcx, r14
call fcn.14003c1a0
mov r8, qword [rsp + 0x48]
sub r12d, r15d
mov eax, 1
shr r15d, 1
mov r9d, r13d
cmove r15d, eax
mov eax, 0x3a
lea edx, [r15 - 1]
mov word [r14 + rdx*2], ax
lea rcx, [r14 + r15*2]
mov edx, r12d
call fcn.14003c1a0
movzx ecx, byte [rsp + 0x41]
lea rdx, [rsp + 0x40]
movzx ebx, byte [rsp + 0x40]
add r15d, ecx
mov ecx, esi
call fcn.140023090
sub r12d, r13d
lea rcx, [r14 + r15*2]
mov edx, r12d
mov r8, rax
mov r9d, ebx
call fcn.14003c1a0
movzx eax, byte [rsp + 0x40]
xor ecx, ecx
shr eax, 1
mov rdx, r14
add eax, r15d
mov word [r14 + rax*2], cx
lea rcx, [rdi - 8]
mov r8d, dword [rdi + 0x14c]
call fcn.1400214b0
test al, al
jne 0x140022092
mov rcx, qword [0x140226b10]
lea rax, [0x140226b10]
cmp rcx, rax
je 0x140022180
test dword [rcx + 0x1c], 0x100
je 0x140022180
cmp byte [rcx + 0x19], 2
jb 0x140022180
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401e0550]
mov edx, 0x2e
mov r9, r14
call fcn.14001f090
mov rcx, r14
call fcn.14011f0ac
jmp 0x140021f67
mov eax, dword [rdi + 0x14c]
lea rdx, [rsp + 0x48]
mov rcx, qword [rdi + 0x158]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileSizeEx]
test eax, eax
je 0x140022137
mov rax, qword [rsp + 0x48]
add qword [rdi + 8], rax
inc dword [rdi + 0x14c]
mov r8d, dword [rdi + 0x14c]
mov rdx, qword [rdi + 8]
mov rcx, qword [0x140226b10]
lea rax, [0x140226b10]
cmp rcx, rax
je 0x140022180
test dword [rcx + 0x1c], 0x100
je 0x140022180
cmp byte [rcx + 0x19], 4
jb 0x140022180
movzx eax, word [rsp + 0xd0]
mov r9, r14
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov eax, dword [rdi + 0x148]
mov dword [rsp + 0x28], r8d
mov dword [rsp + 0x20], eax
call fcn.1400208c0
mov rcx, r14
call fcn.14011f0ac
jmp 0x140021f67
mov rcx, qword [0x140226b10]
lea rax, [0x140226b10]
cmp rcx, rax
je 0x140022171
test dword [rcx + 0x1c], 0x100
je 0x140022171
cmp byte [rcx + 0x19], 2
jb 0x140022171
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401e0550]
mov edx, 0x30
mov r9, r14
call fcn.14001f090
mov edx, dword [rdi + 0x14c]
lea rcx, [rdi - 8]
call fcn.1400227a0
mov rcx, r14
call fcn.14011f0ac
jmp 0x140021f67
mov rcx, qword [0x140226b10]
lea rax, [0x140226b10]
cmp rcx, rax
je 0x140021f86
mov edx, dword [rcx + 0x1c]
bt edx, 8
jae 0x140021f86
movzx eax, byte [rcx + 0x19]
cmp al, 5
jb 0x140021f86
cmp esi, 0x101
jae 0x1400221d7
shr esi, 4
lea r9, str.:_STANDARD_INFORMATION
dec esi
mov r9, qword [r9 + rsi*8]
jmp 0x140022204
bt edx, 0xa
jae 0x1400221fd
cmp al, 3
jb 0x1400221fd
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401e0a38]
mov edx, 0xa
call fcn.14001f000
mov rcx, qword [0x140226b10]
lea r9, [0x1401df018]
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401e0550]
mov edx, 0x2c
call fcn.14001f090
jmp 0x140021f86