Function at 0x140029d20
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xbd0]
sub rsp, 0xcd0
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov qword [rsp + 0xd20], rbx
mov rax, qword [0x1401b5e90]
xor rax, rsp
mov qword [rbp + 0xbc0], rax
mov r14, rdx
mov r13, rcx
mov qword [rbp - 0x48], rcx
xor r12d, r12d
mov dword [rsp + 0x44], r12d
lea rcx, [0x1401b59a8]
mov rax, qword [0x1401b59a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [r13], rax
mov r9d, 1
mov dword [rsp + 0x44], r9d
or rsi, 0xffffffffffffffff
mov qword [rsp + 0x78], rsi
mov eax, dword [0x1401bdd80]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 0x8000000f
jge 0x140029db6
dec ecx
or ecx, 0xfffffff0
inc ecx
cmp ecx, 9
jne 0x140029de3
mov r8d, r9d
mov eax, r9d
mov edx, 0xce
nop word [rax + rax]
lea ecx, [rax + r8]
lea r8d, [rax]
mov eax, ecx
dec edx
jns 0x140029dd0
mov dword [0x1401bdd80], ecx
mov rax, qword [r14]
mov ebx, 3
cmp dword [rax - 0x10], 0
je 0x140029e65
movzx eax, word [rax]
cmp ax, word [0x140146fd8]
jne 0x140029e02
mov eax, r12d
jmp 0x140029e07
sbb eax, eax
or eax, r9d
test eax, eax
je 0x140029e65
lea rcx, [rbp - 0x78]
call fcn.140028330
nop
mov r9d, ebx
mov dword [rsp + 0x44], ebx
mov rdx, qword [rax]
mov eax, r12d
test rdx, rdx
setne al
test eax, eax
jne 0x140029e37
mov ecx, 0x80004005
call fcn.140001920
int3
mov rax, qword [r14]
sub rdx, rax
nop dword [rax]
movzx ecx, word [rax]
cmp cx, word [rax + rdx]
jne 0x140029e57
add rax, 2
test cx, cx
jne 0x140029e40
mov eax, r12d
jmp 0x140029e5c
sbb eax, eax
or eax, 1
test eax, eax
je 0x140029e65
xor dil, dil
jmp 0x140029e68
mov dil, 1
test r9b, 2
je 0x140029e8f
and r9d, 0xfffffffd
mov dword [rsp + 0x44], r9d
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140029e8f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test dil, dil
je 0x140029f13
lea rcx, [rbp - 0x60]
call fcn.140028330
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [r13]
sub rbx, 0x18
cmp rcx, rbx
je 0x140029ef2
cmp dword [rbx + 0x10], 0
jl 0x140029ee5
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140029ee5
call fcn.1400024f0
mov rdi, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x140029edb
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rdi + 0x18]
mov qword [r13], rax
jmp 0x140029ef2
mov r8d, dword [rdx - 0x10]
mov rcx, r13
call fcn.1400023a0
nop
mov rdx, qword [rbp - 0x60]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14002a422
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14002a422
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x78], rax
cmp rax, 0xffffffffffffffff
jne 0x140029fa8
lea rcx, [rbp - 0x58]
call fcn.140028330
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [r13]
sub rbx, 0x18
cmp rcx, rbx
je 0x140029f9f
cmp dword [rbx + 0x10], 0
jl 0x140029f92
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140029f92
call fcn.1400024f0
mov rdi, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x140029f88
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [r13], rax
jmp 0x140029f9f
mov r8d, dword [rdx - 0x10]
mov rcx, r13
call fcn.1400023a0
nop
mov rdx, qword [rbp - 0x58]
jmp 0x140029ef6
xor ecx, ecx
mov qword [rsp + 0x60], rcx
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x140029fe0
lea rcx, [rbp - 0x70]
call fcn.140028330
nop
mov rdx, rax
mov rcx, r13
call fcn.140002310
nop
mov rdx, qword [rbp - 0x70]
jmp 0x140029ef6
cmp dword [rsp + 0x64], 0
je 0x14002a006
lea rcx, [rbp - 0x68]
call fcn.140028330
nop
mov rdx, rax
mov rcx, r13
call fcn.140002310
nop
mov rdx, qword [rbp - 0x68]
jmp 0x140029ef6
cmp dword [rsp + 0x60], 0
je 0x14002a422
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
mov edx, dword [rsp + 0x60]
lea rcx, [rsp + 0x48]
call fcn.14002a720
mov dword [rbp - 0x80], r12d
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x80]
mov r8d, dword [rsp + 0x60]
mov rdi, qword [rsp + 0x48]
mov rdx, rdi
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14002a068
test rdi, rdi
je 0x14002a422
mov rcx, rdi
jmp 0x14002a40e
xor cl, cl
mov byte [rsp + 0x40], cl
xor r15b, r15b
movzx eax, byte [rdi]
cmp al, 0xff
jne 0x14002a08a
cmp byte [rdi + 1], 0xfe
jne 0x14002a08a
mov byte [rsp + 0x40], 1
mov ebx, 2
jmp 0x14002a0bf
cmp al, 0xfe
jne 0x14002a0a3
cmp byte [rdi + 1], 0xff
jne 0x14002a0a3
mov byte [rsp + 0x40], 1
mov r15b, 1
mov ebx, 2
jmp 0x14002a0bf
cmp al, 0xef
jne 0x14002a1d6
cmp byte [rdi + 1], 0xbb
jne 0x14002a1d6
cmp byte [rdi + 2], 0xbf
jne 0x14002a1d6
movsxd rdx, ebx
add rdx, rdi
mov r14, qword [rsp + 0x50]
cmp rdx, r14
jne 0x14002a0d9
mov r14, rdi
mov qword [rsp + 0x50], rdi
jmp 0x14002a0f4
cmp rdi, rdx
je 0x14002a0f4
sub r14, rdx
mov r8, r14
mov rcx, rdi
call fcn.1400cbb10
add r14, rdi
mov qword [rsp + 0x50], r14
test r15b, r15b
je 0x14002a1dd
mov rcx, rdi
cmp rdi, r14
je 0x14002a127
nop word [rax + rax]
movzx r8d, byte [rcx + 1]
movzx edx, byte [rcx]
mov byte [rcx + 1], dl
mov byte [rcx], r8b
add rcx, 2
cmp rcx, r14
jne 0x14002a110
mov r9d, dword [0x1401bdd80]
lea eax, [r9 + 1]
imul eax, r9d
and eax, 0x8000000f
jge 0x14002a144
dec eax
or eax, 0xfffffff0
inc eax
cmp eax, 0xb
jne 0x14002a1dd
mov r15d, r12d
lea r12, [rbp - 0x40]
nop word [rax + rax]
xor r10d, r10d
nop word [rax + rax]
lea ebx, [r10 + 1]
lea ecx, [r15 + 1]
mov eax, r9d
cdq
idiv ecx
mov r8d, edx
mov ecx, r9d
sub ecx, r15d
imul r8d, ecx
mov eax, r9d
cdq
idiv ebx
add r8d, eax
sub r8d, r10d
mov dword [r12], r8d
mov edx, r8d
lea rcx, [0x140146c08]
call fcn.1400cc3f4
mov r10d, ebx
add r12, 4
cmp ebx, 0x18
jge 0x14002a1bf
mov r9d, dword [0x1401bdd80]
jmp 0x14002a170
inc r15d
cmp r15d, 0x20
jge 0x14002a1d1
mov r9d, dword [0x1401bdd80]
jmp 0x14002a160
xor r12d, r12d
jmp 0x14002a1dd
mov r14, qword [rsp + 0x50]
jmp 0x14002a1e2
movzx ecx, byte [rsp + 0x40]
sub r14, rdi
cmp byte [rdi + r14 - 1], 0
je 0x14002a2dd
lea rdx, [r14 + 1]
lea rcx, [rsp + 0x48]
call fcn.14002a720
mov eax, dword [0x1401bdd80]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 0x8000000f
jge 0x14002a21a
dec ecx
or ecx, 0xfffffff0
inc ecx
cmp ecx, 9
jne 0x14002a241
mov ecx, 4
call fcn.1400cc2a0
mov rbx, rax
call fcn.1400cc4a0
mov dword [rbx], eax
mov dword [0x1401bdd80], eax
mov rcx, rbx
call fcn.1400cbac0
mov rdi, qword [rsp + 0x48]
mov byte [rdi + r14], 0
movzx ebx, byte [rsp + 0x40]
test bl, bl
je 0x14002a26d
lea rdx, [r14 + 2]
lea rcx, [rsp + 0x48]
call fcn.14002a720
mov rdi, qword [rsp + 0x48]
mov byte [rdi + r14 + 1], 0
mov r8d, dword [0x1401bdd80]
lea ecx, [r8 + 2]
lea eax, [r8 + 1]
imul ecx, eax
imul ecx, r8d
mov eax, 0xb21642c9
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x17
sub ecx, edx
cmp ecx, 0xa
jne 0x14002a304
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x7b
movsxd rcx, r8d
mov eax, 4
mul rcx
cmovo rax, rsi
mov rcx, rax
call fcn.1400cb128
mov rcx, rax
call fcn.1400cc208
jmp 0x14002a304
test cl, cl
je 0x14002a3a9
lea rdx, [r14 + 2]
lea rcx, [rsp + 0x48]
call fcn.14002a720
mov rdi, qword [rsp + 0x48]
mov word [rdi + r14], 0
movzx ebx, byte [rsp + 0x40]
test bl, bl
je 0x14002a3a9
lea rcx, [0x1401b59a8]
mov rax, qword [0x1401b59a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
test rdi, rdi
je 0x14002a36c
test rdi, 0xffffffffffff0000
jne 0x14002a355
movzx ebx, di
mov ecx, ebx
call fcn.1400019e0
test rax, rax
je 0x14002a380
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140002690
jmp 0x14002a380
mov rax, rsi
nop dword [rax + rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x14002a360
jmp 0x14002a36f
mov eax, r12d
mov r8d, eax
mov rdx, rdi
lea rcx, [rsp + 0x68]
call fcn.1400023a0
nop
lea rdx, [rsp + 0x68]
mov rcx, r13
call fcn.140002310
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14002a404
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14002a404
lea rcx, [0x1401b59a8]
mov rax, qword [0x1401b59a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x70], rax
mov rdx, rdi
lea rcx, [rsp + 0x70]
call fcn.140003600
nop
lea rdx, [rsp + 0x70]
mov rcx, r13
call fcn.140002310
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14002a3f8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, r13
mov rcx, r13
call fcn.1400276c0
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14002a422
call fcn.1400cbac0
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r12
mov r8d, dword [0x1401bdd80]
imul r8d, r8d
mov eax, 0x78787879
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x11
sub r8d, edx
mov ecx, dword [0x1401be7fc]
mov eax, 0x2038071b
cmp r8d, 3
cmove ecx, eax
mov dword [0x1401be7fc], ecx
mov rax, qword [rsp + 0x78]
cmp rax, 0xffffffffffffffff
je 0x14002a471
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, r13
mov rcx, qword [rbp + 0xbc0]
xor rcx, rsp
call fcn.1400cbae0
mov rbx, qword [rsp + 0xd20]
add rsp, 0xcd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret