Function at 0x1800dee50
Capabilities:
Read file on windows

Disassembly:
mov byte [rsp + 0x20], r9b
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x2aa0
call fcn.1801339d0
sub rsp, rax
mov qword [rsp + 0x2a60], 0xfffffffffffffffe
mov rax, qword [0x180161180]
xor rax, rsp
mov qword [rsp + 0x2a98], rax
mov qword [rsp + 0x29b0], 0
mov dword [rsp + 0x29ac], 0
movzx eax, byte [rsp + 0x2ac8]
test eax, eax
je 0x1800deec0
mov dword [rsp + 0x2a68], 2
jmp 0x1800deecb
mov dword [rsp + 0x2a68], 1
movzx eax, byte [rsp + 0x2a68]
mov byte [rsp + 0x29d0], al
mov byte [rsp + 0x29a8], 0
mov qword [rsp + 0x29c8], 0
mov qword [rsp + 0x29a0], 0
mov qword [rsp + 0x29c0], 0xffffffffffffffff
mov dword [rsp + 0x190], 0x1f
mov dword [rsp + 0x29b8], 0
movzx r9d, byte [rsp + 0x2ac8]
mov r8, qword [rsp + 0x2ac0]
mov rdx, qword [rsp + 0x2ab8]
lea rcx, [0x180035190]
call fcn.1800892c0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
mov rcx, qword [rsp + 0x2ac0]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x29c0], rax
cmp qword [rsp + 0x29c0], 0xffffffffffffffff
jne 0x1800df0e5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x190], eax
mov eax, dword [rsp + 0x190]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x190]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], 0
mov r9d, 1
mov r8d, 0x80000000
mov rdx, qword [rsp + 0x2ac0]
lea rcx, [0x180035110]
call fcn.1800892c0
mov ecx, 0x1020
call fcn.1800eb9ac
mov qword [rsp + 0x29e8], rax
cmp qword [rsp + 0x29e8], 0
je 0x1800df095
mov r8d, dword [rsp + 0x190]
mov eax, dword [rsp + 0x190]
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x190]
mov dword [rsp + 0x58], eax
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x40], 3
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0x80000000
mov rax, qword [rsp + 0x2ac0]
mov qword [rsp + 0x20], rax
lea r9, [0x180035090]
mov edx, 5
mov rcx, qword [rsp + 0x29e8]
call fcn.18008d120
mov qword [rsp + 0x2a70], rax
jmp 0x1800df0a1
mov qword [rsp + 0x2a70], 0
mov rax, qword [rsp + 0x2a70]
mov qword [rsp + 0x29e0], rax
mov rax, qword [rsp + 0x29e0]
mov qword [rsp + 0x29b0], rax
mov rax, qword [rsp + 0x29b0]
mov qword [rsp + 0x29f0], rax
lea rdx, [0x18015a158]
lea rcx, [rsp + 0x29f0]
call fcn.1800ec370
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8000
mov rcx, qword [rsp + 0x29c0]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x1800df232
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x190], eax
mov eax, dword [rsp + 0x190]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x190]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x8000
mov edx, dword [rsp + 0x29c0]
lea rcx, [0x180035020]
call fcn.1800892c0
mov ecx, 0x1020
call fcn.1800eb9ac
mov qword [rsp + 0x2a00], rax
cmp qword [rsp + 0x2a00], 0
je 0x1800df1d4
mov r8d, dword [rsp + 0x190]
mov eax, dword [rsp + 0x190]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x190]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000
mov rax, qword [rsp + 0x29c0]
mov qword [rsp + 0x20], rax
lea r9, [0x180034fb0]
mov edx, 5
mov rcx, qword [rsp + 0x2a00]
call fcn.18008d120
mov qword [rsp + 0x2a78], rax
jmp 0x1800df1e0
mov qword [rsp + 0x2a78], 0
mov rax, qword [rsp + 0x2a78]
mov qword [rsp + 0x29f8], rax
mov rax, qword [rsp + 0x29f8]
mov qword [rsp + 0x29b0], rax
mov rcx, qword [rsp + 0x29c0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x29b0]
mov qword [rsp + 0x2a08], rax
lea rdx, [0x18015a158]
lea rcx, [rsp + 0x2a08]
call fcn.1800ec370
lea rdi, [rsp + 0x1a0]
xor eax, eax
mov ecx, 0x2800
rep stosb byte [rdi], al
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x29b8]
mov r8d, 0x2800
lea rdx, [rsp + 0x1a0]
mov rcx, qword [rsp + 0x29c0]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1800df3c6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x190], eax
mov eax, dword [rsp + 0x190]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x190]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], 0
lea rax, [rsp + 0x29b8]
mov qword [rsp + 0x20], rax
mov r9d, 0x2800
lea r8, [rsp + 0x1a0]
mov edx, dword [rsp + 0x29c0]
lea rcx, [0x180034f40]
call fcn.1800892c0
mov ecx, 0x1020
call fcn.1800eb9ac
mov qword [rsp + 0x2a18], rax
cmp qword [rsp + 0x2a18], 0
je 0x1800df368
mov r8d, dword [rsp + 0x190]
mov eax, dword [rsp + 0x190]
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x190]
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x29b8]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x2800
lea rax, [rsp + 0x1a0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x29c0]
mov qword [rsp + 0x20], rax
lea r9, [0x180034ed0]
mov edx, 5
mov rcx, qword [rsp + 0x2a18]
call fcn.18008d120
mov qword [rsp + 0x2a80], rax
jmp 0x1800df374
mov qword [rsp + 0x2a80], 0
mov rax, qword [rsp + 0x2a80]
mov qword [rsp + 0x2a10], rax
mov rax, qword [rsp + 0x2a10]
mov qword [rsp + 0x29b0], rax
mov rcx, qword [rsp + 0x29c0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x29b0]
mov qword [rsp + 0x2a20], rax
lea rdx, [0x18015a158]
lea rcx, [rsp + 0x2a20]
call fcn.1800ec370
cmp dword [rsp + 0x29b8], 0x2800
je 0x1800df54d
mov dword [rsp + 0x190], 0x3e4
mov eax, dword [rsp + 0x190]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x190]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], 0x2800
mov eax, dword [rsp + 0x29b8]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], 0
lea rax, [rsp + 0x29b8]
mov qword [rsp + 0x20], rax
mov r9d, 0x2800
lea r8, [rsp + 0x1a0]
mov edx, dword [rsp + 0x29c0]
lea rcx, [0x180034e40]
call fcn.1800892c0
mov ecx, 0x1020
call fcn.1800eb9ac
mov qword [rsp + 0x2a30], rax
cmp qword [rsp + 0x2a30], 0
je 0x1800df4ef
mov r8d, dword [rsp + 0x190]
mov eax, dword [rsp + 0x190]
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x190]
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x50], 0x2800
mov eax, dword [rsp + 0x29b8]
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x29b8]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x2800
lea rax, [rsp + 0x1a0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x29c0]
mov qword [rsp + 0x20], rax
lea r9, [0x180034db0]
mov edx, 5
mov rcx, qword [rsp + 0x2a30]
call fcn.18008d120
mov qword [rsp + 0x2a88], rax
jmp 0x1800df4fb
mov qword [rsp + 0x2a88], 0
mov rax, qword [rsp + 0x2a88]
mov qword [rsp + 0x2a28], rax
mov rax, qword [rsp + 0x2a28]
mov qword [rsp + 0x29b0], rax
mov rcx, qword [rsp + 0x29c0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x29b0]
mov qword [rsp + 0x2a38], rax
lea rdx, [0x18015a158]
lea rcx, [rsp + 0x2a38]
call fcn.1800ec370
mov dword [rsp + 0x29ac], 0
jmp 0x1800df56b
mov eax, dword [rsp + 0x29ac]
add eax, 1
mov dword [rsp + 0x29ac], eax
cmp dword [rsp + 0x29ac], 5
jge 0x1800df7aa
movzx ecx, byte [rsp + 0x29d0]
mov eax, dword [rsp + 0x29ac]
imul eax, eax, 0x800
cdqe
movzx eax, byte [rsp + rax + 0x1a0]
cmp eax, ecx
jne 0x1800df69a
mov eax, dword [rsp + 0x29ac]
imul eax, eax, 0x800
add eax, 1
cdqe
movzx eax, byte [rsp + rax + 0x1a0]
cmp eax, 0x43
jne 0x1800df69a
mov eax, dword [rsp + 0x29ac]
imul eax, eax, 0x800
add eax, 2
cdqe
movzx eax, byte [rsp + rax + 0x1a0]
cmp eax, 0x44
jne 0x1800df69a
mov eax, dword [rsp + 0x29ac]
imul eax, eax, 0x800
add eax, 3
cdqe
movzx eax, byte [rsp + rax + 0x1a0]
cmp eax, 0x30
jne 0x1800df69a
mov eax, dword [rsp + 0x29ac]
imul eax, eax, 0x800
add eax, 4
cdqe
movzx eax, byte [rsp + rax + 0x1a0]
cmp eax, 0x30
jne 0x1800df69a
mov eax, dword [rsp + 0x29ac]
imul eax, eax, 0x800
add eax, 5
cdqe
movzx eax, byte [rsp + rax + 0x1a0]
cmp eax, 0x31
jne 0x1800df69a
movzx r8d, byte [rsp + 0x29d0]
mov eax, dword [rsp + 0x29ac]
imul eax, eax, 0x800
cdqe
movzx edx, byte [rsp + rax + 0x1a0]
lea rcx, [0x180034d40]
call fcn.1800892c0
mov byte [rsp + 0x29a8], 1
mov eax, dword [rsp + 0x29ac]
imul eax, eax, 0x800
cdqe
lea rax, [rsp + rax + 0x1a0]
mov qword [rsp + 0x29c8], rax
mov eax, dword [rsp + 0x29ac]
imul eax, eax, 0x800
cdqe
movzx eax, byte [rsp + rax + 0x1a0]
test eax, eax
jne 0x1800df7a5
mov eax, dword [rsp + 0x29ac]
imul eax, eax, 0x800
add eax, 1
cdqe
movzx eax, byte [rsp + rax + 0x1a0]
cmp eax, 0x43
jne 0x1800df7a5
mov eax, dword [rsp + 0x29ac]
imul eax, eax, 0x800
add eax, 2
cdqe
movzx eax, byte [rsp + rax + 0x1a0]
cmp eax, 0x44
jne 0x1800df7a5
mov eax, dword [rsp + 0x29ac]
imul eax, eax, 0x800
add eax, 3
cdqe
movzx eax, byte [rsp + rax + 0x1a0]
cmp eax, 0x30
jne 0x1800df7a5
mov eax, dword [rsp + 0x29ac]
imul eax, eax, 0x800
add eax, 4
cdqe
movzx eax, byte [rsp + rax + 0x1a0]
cmp eax, 0x30
jne 0x1800df7a5
mov eax, dword [rsp + 0x29ac]
imul eax, eax, 0x800
add eax, 5
cdqe
movzx eax, byte [rsp + rax + 0x1a0]
cmp eax, 0x31
jne 0x1800df7a5
mov eax, dword [rsp + 0x29ac]
imul eax, eax, 0x800
cdqe
movzx edx, byte [rsp + rax + 0x1a0]
xor r8d, r8d
lea rcx, [0x180034cd0]
call fcn.1800892c0
mov eax, dword [rsp + 0x29ac]
imul eax, eax, 0x800
cdqe
lea rax, [rsp + rax + 0x1a0]
mov qword [rsp + 0x29a0], rax
jmp 0x1800df55a
movzx eax, byte [rsp + 0x29a8]
test eax, eax
jne 0x1800df867
lea rcx, [0x180034c70]
call fcn.1800892c0
mov ecx, 0x1020
call fcn.1800eb9ac
mov qword [rsp + 0x2a48], rax
cmp qword [rsp + 0x2a48], 0
je 0x1800df809
lea r9, [0x180034c70]
xor r8d, r8d
mov edx, 2
mov rcx, qword [rsp + 0x2a48]
call fcn.18008d120
mov qword [rsp + 0x2a90], rax
jmp 0x1800df815
mov qword [rsp + 0x2a90], 0
mov rax, qword [rsp + 0x2a90]
mov qword [rsp + 0x2a40], rax
mov rax, qword [rsp + 0x2a40]
mov qword [rsp + 0x29b0], rax
mov rcx, qword [rsp + 0x29c0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x29b0]
mov qword [rsp + 0x2a50], rax
lea rdx, [0x18015a158]
lea rcx, [rsp + 0x2a50]
call fcn.1800ec370
mov r8, qword [rsp + 0x2ac0]
lea rdx, [0x180034c58]
lea rcx, [rsp + 0x80]
call fcn.1800eb79c
cmp qword [rsp + 0x29a0], 0
je 0x1800df8a4
mov rdx, qword [rsp + 0x29a0]
mov rcx, qword [rsp + 0x2ab8]
call fcn.18009aa10
nop
mov rax, qword [rsp + 0x29c0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov rax, qword [rsp + 0x29c8]
mov eax, dword [rax + 0xa6]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x29c8]
mov eax, dword [rax + 0x9e]
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x80]
movzx r8d, byte [rsp + 0x2ac8]
mov rdx, qword [rsp + 0x2ab8]
mov rcx, qword [rsp + 0x2ab0]
call fcn.1800de190
nop
mov rcx, qword [rsp + 0x29c0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x2a98]
xor rcx, rsp
call fcn.1800eb430
add rsp, 0x2aa0
pop rdi
ret