Function at 0x14000a451
Capabilities:
Get file size

Disassembly:
push r15
mov eax, 0x12b8
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.140077930
sub rsp, rax
xor eax, eax
lea rsi, str._vFAT
mov dword [rsp + 0x1300], ecx
test rdx, rdx
mov ecx, 0x400
lea rdi, [rsp + 0x2b0]
rep stosd dword [rdi], eax
mov dword [rsp + 0x68], 0x5c3a53
mov ecx, 9
mov r12, rdx
lea rdi, [rsp + 0x8c]
rep movsd dword [rdi], dword [rsi]
lea rsi, [rsp + 0x2b0]
jne 0x14000a4cd
mov rax, qword [0x1400b5fc0]
cmp dword [rax], 0x9f
ja 0x14000a4cd
lea rcx, str.ESP_toggling_is_only_available_for_Windows_10_or_later
call fcn.140038472
jmp 0x14000a4f1
mov ecx, dword [rsp + 0x1300]
xor edx, edx
mov r9d, 1
mov r8d, 1
call fcn.1400077b5
mov qword [rsp + 0x40], rax
inc rax
jne 0x14000a4f8
xor ebx, ebx
jmp 0x14000ab55
xor ebx, ebx
lea rax, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x38], rbx
mov rcx, qword [rsp + 0x40]
mov edx, 0x70050
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x1000
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.DLL_GetFileSizeEx]
test eax, eax
je 0x14000a537
cmp dword [rsp + 0x60], 0
jne 0x14000a557
call fcn.14003893c
mov edx, dword [rsp + 0x1300]
lea rcx, str.Could_not_get_layout_for_drive_0x_02x:__s
mov r8, rax
call fcn.140038472
jmp 0x14000a684
test r12, r12
je 0x14000a56d
mov edx, dword [rsp + 0x2b4]
mov rax, rsi
xor ebx, ebx
jmp 0x14000a7c9
lea rdi, [rsp + 0x300]
xor ebx, ebx
lea r13, [0x1400bee90]
cmp dword [rsp + 0x2b4], ebx
jle 0x14000a5b7
mov eax, dword [rsp + 0x2b0]
test eax, eax
jne 0x14000a5a2
cmp byte [rdi], 0xef
je 0x14000a5d6
inc ebx
add rdi, 0x90
jmp 0x14000a57e
dec eax
jne 0x14000a597
mov rdx, r13
mov rcx, rdi
call fcn.1400378e4
test eax, eax
je 0x14000a597
jmp 0x14000a5d6
mov rax, qword [sym.imp.msvcrt.dll_clearerr]
xor r13d, r13d
xor r14d, r14d
or ebx, 0xffffffff
mov edi, 1
mov qword [rsp + 0x48], rax
jmp 0x14000a6e4
cmp dword [rsp + 0x2b0], 1
movsxd rdi, ebx
jne 0x14000a998
imul r13, rdi, 0x90
lea rcx, str.ESP_name:__S
lea rdx, [rsi + r13 + 0x78]
lea r13, [rsi + r13 + 0x60]
call fcn.140038472
lea rax, [rsp + 0xb0]
mov r14, qword [sym.imp.msvcrt.dll_clearerr]
mov r15d, 1
mov qword [rsp + 0x48], rax
or r8, 0xffffffffffffffff
mov rcx, qword [rsp + 0x48]
mov edx, 0x10
lea r9, str.ToggleEsp_02u
mov dword [rsp + 0x20], r15d
call r14
mov rcx, qword [rsp + 0x48]
mov byte [rsp + 0xbf], 0
call fcn.1400075bd
cmp byte [rax], 0
jne 0x14000a9c9
mov edx, 1
mov rcx, r13
call fcn.140038c6c
mov rcx, qword [rsp + 0x48]
mov rdx, rax
call fcn.1400072d9
test eax, eax
jne 0x14000a833
lea rcx, str.ESP_toggling_data_could_not_be_stored
call fcn.140038472
xor ebx, ebx
jmp 0x14000a976
test ebx, ebx
jns 0x14000a6d1
mov eax, dword [rsp + 0x2b0]
cmp eax, 1
jne 0x14000a740
mov r13, r8
mov rdx, r13
mov rcx, r15
mov qword [rsp + 0x58], r8
call fcn.1400378e4
mov r8, qword [rsp + 0x58]
test eax, eax
jne 0x14000a76e
inc ebp
add r8, 0x90
cmp dword [rsp + 0x2b4], ebp
jg 0x14000a68b
inc edi
cmp edi, 9
je 0x14000a823
test ebx, ebx
jns 0x14000a871
lea r15, [rsp + 0xb0]
lea r9, str.ToggleEsp_02u
or r8, 0xffffffffffffffff
mov edx, 0x10
mov rcx, r15
mov dword [rsp + 0x20], edi
mov rax, qword [rsp + 0x48]
call rax
mov rcx, r15
mov byte [rsp + 0xbf], 0
call fcn.1400075bd
mov rcx, rax
call fcn.140038d0c
mov r15, rax
test rax, rax
je 0x14000a6d1
lea rax, [rsp + 0x6c]
lea r8, [rsp + 0x310]
xor ebp, ebp
mov qword [rsp + 0x50], rax
jmp 0x14000a6c8
test eax, eax
jne 0x14000a6a2
mov eax, dword [rsp + 0x2b8]
xor r9d, r9d
mov r13, qword [rsp + 0x50]
mov dword [rsp + 0x70], r9d
mov dword [rsp + 0x6c], eax
mov rax, qword [r8 - 0x28]
mov qword [rsp + 0x74], rax
jmp 0x14000a6a2
mov eax, dword [rsp + 0x2b0]
cmp eax, 1
jne 0x14000a7a0
movabs rax, 0x3bc93ec9a0004bba
mov dword [r8 - 0x10], 0xc12a7328
mov word [r8 - 0xc], 0xf81f
mov word [r8 - 0xa], 0x11d2
mov qword [r8 - 8], rax
jmp 0x14000a7a4
test eax, eax
je 0x14000a7b1
mov ebx, ebp
mov r14d, 1
jmp 0x14000a6bf
mov byte [r8 - 0x10], 0xef
jmp 0x14000a7a4
mov rcx, qword [rax + 0x38]
add rax, 0x90
cmp rcx, r12
je 0x14000a7cf
inc ebx
cmp ebx, edx
jl 0x14000a7b8
jmp 0x14000a827
mov edx, dword [rsp + 0x2b0]
movsxd rax, ebx
cmp edx, 1
jne 0x14000a80b
imul rax, rax, 0x90
movabs rdi, 0x11d2f81fc12a7328
mov qword [rsp + rax + 0x300], rdi
movabs rdi, 0x3bc93ec9a0004bba
mov qword [rsp + rax + 0x308], rdi
jmp 0x14000a86e
xor r14d, r14d
test edx, edx
jne 0x14000a871
imul rax, rax, 0x90
mov byte [rsp + rax + 0x300], 0xef
jmp 0x14000a86e
test ebx, ebx
jns 0x14000a871
lea rcx, str.No_partition_to_toggle
jmp 0x14000a67f
mov eax, dword [rsp + 0x2b0]
cmp eax, 1
jne 0x14000aa6c
imul rdi, rdi, 0x90
movabs rax, 0x4433b9e5ebd0a0a2
mov qword [rsp + rdi + 0x300], rax
movabs rax, 0xc79926b7b668c087
mov qword [rsp + rdi + 0x308], rax
xor r14d, r14d
movsxd rbx, ebx
xor eax, eax
xor edx, edx
xor ecx, ecx
imul rbx, rbx, 0x90
mov r9d, dword [rsp + 0x60]
mov r8, rsi
mov byte [rsp + rbx + 0x2fc], 1
mov dword [rsp + 0x28], edx
mov edx, 0x7c054
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.DLL_GetFileSizeEx]
test eax, eax
jne 0x14000a8d1
call fcn.14003893c
lea rcx, str.Could_not_set_drive_layout:__s
mov rdx, rax
call fcn.140038472
jmp 0x14000a684
mov rcx, qword [rsp + 0x40]
call fcn.14000a3ff
test r12, r12
je 0x14000a8ea
mov ebx, 1
jmp 0x14000a976
test r14d, r14d
je 0x14000a92e
lea rbx, [rsp + 0x7c]
movzx ebp, bpl
lea r9, str.ToggleEsp_02u
or r8, 0xffffffffffffffff
mov rcx, rbx
mov dword [rsp + 0x20], ebp
mov edx, 0x10
call qword [sym.imp.msvcrt.dll_clearerr]
lea rdx, [0x140089da0]
mov rcx, rbx
mov byte [rsp + 0x8b], 0
call fcn.1400072d9
jmp 0x14000a8e0
movsx ecx, byte [rsp + 0x68]
call fcn.1400093a0
test eax, eax
jne 0x14000a8e0
mov ecx, dword [rsp + 0x1300]
xor r9d, r9d
mov rdx, qword [rsp + rbx + 0x2e8]
mov r8d, 1
call fcn.140007977
lea rcx, [rsp + 0x68]
mov rbx, rax
mov rdx, rax
call fcn.140009f69
mov rcx, rbx
call fcn.1400796c8
jmp 0x14000a8e0
mov rax, qword [rsp + 0x40]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x14000ab55
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.DLL_CreateDirectorCreateEventACreateFileA]
jmp 0x14000ab55
mov eax, dword [rsp + 0x2b8]
xor r11d, r11d
lea r13, [rsp + 0x6c]
mov dword [rsp + 0x70], r11d
mov dword [rsp + 0x6c], eax
imul rax, rdi, 0x90
mov rax, qword [rsp + rax + 0x2e8]
mov qword [rsp + 0x74], rax
jmp 0x14000a604
inc r15d
cmp r15d, 9
jne 0x14000a61e
lea rax, [rsp + 0xb0]
mov r14, qword [sym.imp.msvcrt.dll_clearerr]
mov r15d, 1
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x20], r15d
inc r15d
or r8, 0xffffffffffffffff
mov rcx, qword [rsp + 0x50]
lea r9, str.ToggleEsp_02u
mov edx, 0x10
call r14
or r8, 0xffffffffffffffff
mov edx, 0x10
mov rcx, qword [rsp + 0x48]
lea r9, str.ToggleEsp_02u
mov byte [rsp + 0xbf], 0
mov dword [rsp + 0x20], r15d
call r14
mov rcx, qword [rsp + 0x48]
mov byte [rsp + 0xcf], 0
call fcn.1400075bd
mov rcx, qword [rsp + 0x50]
mov rdx, rax
call fcn.1400072d9
cmp r15d, 8
jne 0x14000a9fd
jmp 0x14000a656
test eax, eax
jne 0x14000a86e
imul rax, rdi, 0x90
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov byte [rsp + rax + 0x300], 0xb
mov rdx, qword [rsp + rax + 0x2e8]
call qword [0x14011c720]
mov r14d, eax
test eax, eax
je 0x14000a871
xor r10d, r10d
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x64]
lea rdx, [rsp + 0xb0]
mov qword [rsp + 0x20], r10
mov r8d, 0x200
call qword [0x14011c6d8]
test eax, eax
je 0x14000a86e
cmp dword [rsp + 0x64], 0x200
jne 0x14000a86e
lea rcx, [rsp + 0xe6]
lea r15, [rsp + 0x11e]
lea r14, [rsp + 0x8d]
xor r13d, r13d
mov r8d, 8
mov rdx, r14
mov qword [rsp + 0x48], rcx
call fcn.140079740
mov rcx, qword [rsp + 0x48]
test eax, eax
jne 0x14000ab3a
movsxd r13, r13d
imul rax, rdi, 0x90
lea r13, [r13 + r13*8]
mov dl, byte [rsp + r13 + 0x8c]
mov byte [rsp + rax + 0x300], dl
jmp 0x14000ab47
inc r13d
add r14, 9
cmp r13d, 4
jne 0x14000aafe
add rcx, 0x1c
cmp rcx, r15
jne 0x14000aaf3
jmp 0x14000a86e
mov eax, ebx
add rsp, 0x12b8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret