Function at 0x100024734
Capabilities:
Get file size

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], r9
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4f8
mov rbx, rcx
xor ecx, ecx
xor edi, edi
and qword [rsp + 0x70], rcx
and dword [rsp + 0x48], ecx
and dword [rsp + 0x68], ecx
and dword [rsp + 0x58], ecx
and dword [rsp + 0x40], ecx
and qword [r11 - 0x4a8], rcx
and qword [r11 - 0x490], rcx
and dword [rsp + 0x30], ecx
and qword [r11 - 0x470], rcx
and qword [rsp + 0xc0], rcx
and qword [rsp + 0xa0], rcx
and dword [rsp + 0xb0], edi
xor r15d, r15d
xor r13d, r13d
xor r14d, r14d
xor r12d, r12d
xor esi, esi
mov qword [rsp + 0x78], rcx
xor ebp, ebp
mov rax, r9
mov qword [rsp + 0xb8], r15
mov dword [rsp + 0xb4], ecx
mov dword [rsp + 0x60], r13d
mov dword [rsp + 0x64], r14d
mov dword [rsp + 0x4c], ecx
mov dword [rsp + 0x6c], ecx
mov dword [rsp + 0x5c], ecx
mov dword [rsp + 0x44], ecx
mov dword [rsp + 0x34], r12d
mov dword [rsp + 0x50], 4
mov dword [rsp + 0x38], esi
mov qword [r11 - 0x468], rcx
mov qword [r11 - 0x460], rcx
mov qword [r11 - 0x458], rcx
mov qword [r11 - 0x4b8], rcx
mov qword [r11 - 0x4b0], rcx
test rbx, rbx
je 0x100024a5e
cmp r8, 0xffffffffffffffff
je 0x100024a5e
cmp rax, 0xffffffffffffffff
je 0x100024a5e
lea rdx, [rsp + 0x58]
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x100024a5e
cmp qword [rsp + 0x58], rsi
je 0x100024a5e
mov rax, qword [rbx + 0xd8]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0xa8]
mov qword [rsp + 0xc0], rax
mov rax, qword [rbx + 0xe0]
lea rdx, [rsp + 0x34]
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0xa0], rax
call fcn.1000199ec
test eax, eax
jne 0x1000248ab
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [rsp + 0x38], eax
mov r12d, dword [rsp + 0x34]
cmp qword [rsp + 0x90], rdi
je 0x100024a5e
cmp qword [rsp + 0xa8], rdi
je 0x100024a5e
mov r9d, 0x8000
cmp r12d, r9d
jb 0x100024a5e
cmp dword [rsp + 0x30], r9d
jb 0x100024a5e
mov rcx, rbx
mov edi, 1
call fcn.1000198fc
mov rcx, qword [rsp + 0x58]
cmp eax, edi
lea rax, [rcx + 0x7fff]
cmove r12d, r9d
mov r9d, dword [rsp + 0x50]
cqo
and edx, 0x7fff
add rdx, rax
lea eax, [rdi + 7]
sar rdx, 0xf
cmp dword [rsp + 0x5c], ebp
cmovne r9d, eax
sub edx, edi
mov dword [rsp + 0x50], r9d
je 0x100024a59
mov r15d, r9d
mov eax, edx
mov ecx, 0xffffffff
xor edi, edi
imul r15, rax
mov qword [rsp + 0xb8], r15
cmp r15, rcx
ja 0x100024952
xor ebx, ebx
jmp 0x100024962
mov r15d, ecx
mov ebx, 0x80070216
mov qword [rsp + 0xb8], r15
test ebx, ebx
jns 0x1000249b6
bt ebx, 0x1c
mov ecx, ebx
jae 0x100024999
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
cmp eax, 0x13d
jne 0x100024986
mov esi, ebx
mov dword [rsp + 0x38], ebx
jmp 0x100024a5e
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov esi, eax
mov dword [rsp + 0x38], eax
jmp 0x100024a5e
and ecx, 0x1fff0000
movzx eax, bx
mov esi, ebx
cmp ecx, 0x70000
cmove esi, eax
mov dword [rsp + 0x38], esi
jmp 0x100024a5e
cmp r15d, edx
jbe 0x100024a5e
cmp r15d, 0x400
ja 0x1000249d2
lea rbp, [rsp + 0xf0]
jmp 0x1000249ee
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, r15d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x100024a5e
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x558]
and qword [rsp + 0x70], rdi
and qword [rsp + 0x78], rdi
and dword [rsp + 0x80], edi
and dword [rsp + 0x84], edi
lea r9, [rsp + 0x70]
mov r8d, r15d
mov rdx, rbp
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x20], 1
call fcn.100024dec
test eax, eax
je 0x100024a5e
mov rcx, qword [rsp + 0x58]
mov eax, r15d
mov edi, 1
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x40], rcx
and qword [rsp + 0x98], r13
test edi, edi
je 0x100024d9c
mov rbx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x100024d20
mov ecx, r12d
cmp rcx, rax
cmovg r12d, dword [rsp + 0x40]
mov dword [rsp + 0x34], r12d
test rbx, rbx
je 0x100024af3
movabs rax, 0x6666666666666667
imul rbx
sar rdx, 0x16
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rcx, [rdx + rdx*4]
shl rcx, 0x15
cmp rbx, rcx
jne 0x100024af3
mov rcx, qword [rsp + 0x540]
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x948e
call fcn.1000185d8
mov ecx, 0xffffffff
cmp eax, ecx
jne 0x100024af3
mov ecx, 0x4d3
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
test edi, edi
je 0x100024d16
mov rax, qword [rsp + 0xc0]
mov rdx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x550]
and qword [rsp + 0xc8], 0
and qword [rsp + 0xd0], 0
and dword [rsp + 0x20], 0
lea r9, [rsp + 0xc8]
mov r8d, r12d
mov qword [rsp + 0xe0], rax
mov dword [rsp + 0xd8], r13d
mov dword [rsp + 0xdc], r14d
call fcn.100024dec
test eax, eax
je 0x100024d16
and dword [rsp + 0x30], 0
mov eax, r12d
xor r14d, r14d
sub qword [rsp + 0x40], rax
add rbx, rax
mov edi, r12d
mov qword [rsp + 0x60], rbx
test r12d, r12d
je 0x100024c7a
mov ebx, dword [rsp + 0x30]
mov r15, qword [rsp + 0x98]
mov rsi, qword [rsp + 0xa8]
mov r12, qword [rsp + 0x90]
mov eax, 0x8000
lea rdx, [rsp + 0x30]
mov ecx, r14d
mov r13d, eax
cmp edi, eax
mov qword [rsp + 0x28], rdx
cmovb r13d, edi
and dword [rsp + 0x30], 0
add rcx, rsi
mov qword [rsp + 0xe8], rcx
mov r9, rcx
mov eax, ebx
add rax, r12
mov r8d, r13d
mov dword [rsp + 0x20], r13d
mov qword [rsp + 0x98], rax
mov rdx, rax
mov rax, qword [rsp + 0x548]
mov rcx, rax
call qword [rax + 0x18]
test eax, eax
jne 0x100024c0f
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0xe8]
mov r8d, r13d
call fcn.100039734
mov r11d, r13d
jmp 0x100024c14
mov r11d, dword [rsp + 0x30]
mov eax, r11d
add ebx, r13d
add r14d, r11d
add qword [rsp + 0x68], rax
sub edi, r13d
cmp qword [rsp + 0x40], 0
jne 0x100024c31
test edi, edi
je 0x100024c5c
mov rax, qword [rsp + 0x68]
sub rax, qword [rsp + 0xb0]
cmp dword [rsp + 0x50], 4
jne 0x100024c4c
mov dword [rbp + r15*4], eax
jmp 0x100024c51
mov qword [rbp + r15*8], rax
inc r15
test edi, edi
jne 0x100024b9a
mov rbx, qword [rsp + 0x60]
mov esi, dword [rsp + 0x38]
mov r12d, dword [rsp + 0x34]
mov qword [rsp + 0x98], r15
mov r15, qword [rsp + 0xb8]
mov eax, dword [rsp + 0x48]
and qword [rsp + 0x70], 0
and qword [rsp + 0x78], 0
mov dword [rsp + 0x80], eax
mov eax, dword [rsp + 0x4c]
mov ecx, r14d
mov dword [rsp + 0x84], eax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x48]
add rax, rcx
cmp rax, qword [rsp + 0x58]
mov qword [rsp + 0x48], rax
jg 0x100024d0a
mov rdx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x558]
lea r9, [rsp + 0x70]
mov r8d, r14d
mov dword [rsp + 0x20], 1
call fcn.100024dec
mov edi, eax
test eax, eax
je 0x100024cfd
mov r14d, dword [rsp + 0x64]
mov r13d, dword [rsp + 0x60]
jmp 0x100024a73
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x100024d9c
mov esi, 0xdf
xor edi, edi
jmp 0x100024d9c
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edi, edi
mov esi, eax
test edi, edi
je 0x100024d9c
test rbp, rbp
je 0x100024d83
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x558]
and qword [rsp + 0x70], 0
and qword [rsp + 0x78], 0
and dword [rsp + 0x80], 0
and dword [rsp + 0x84], 0
lea r9, [rsp + 0x70]
mov r8d, r15d
mov rdx, rbp
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x20], 1
call fcn.100024dec
mov edi, eax
test eax, eax
jne 0x100024d87
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test edi, edi
je 0x100024d9c
mov rcx, qword [rsp + 0x560]
test rcx, rcx
je 0x100024d9c
mov rax, qword [rsp + 0x48]
mov qword [rcx], rax
test rbp, rbp
je 0x100024dc2
lea rax, [rsp + 0xf0]
cmp rbp, rax
je 0x100024dc2
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
je 0x100024dce
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
add rsp, 0x4f8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret