Function at 0x18001c770
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov dword [rsp + 0x20], r9d
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rsi, qword [rbp + 0x2f]
lea r14d, [r9 + 0xb]
xor edi, edi
lea rdx, [0x180000000]
mov eax, r9d
mov r15, r8
mov r13, rcx
cmp r9d, r14d
jae 0x18001ca9c
mov r12, qword [rbp + 0x2f]
lea ebx, [r9 - 0x121]
mov r9, qword [rbp + 0x2f]
mov r8d, 0x800
mov qword [rbp + 0x1f], r9
cmp ebx, 0x22
ja case.0x18001c7f0.11
movzx eax, byte [rdx + rbx + 0x1cd34]
mov ecx, dword [rdx + rax*4 + 0x1cd04]
add rcx, rdx
jmp rcx
mov rax, qword [r13]
cmp qword [rax + 0x158], rdi
je 0x18001ca53
cmp byte [rsi + 0x1d8], dil
jne 0x18001ca16
cmp byte [rsi + 0x250], dil
jne 0x18001ca16
lea rdx, [rbp + 0x17]
mov qword [rbp + 0x17], rsi
mov ecx, reloc.SHELL32.dll_PathYetAnotherMakeUniqueName
call fcn.180029080
lea rdx, [0x180000000]
mov byte [rsi + 0x1d8], 1
mov r8d, 0x800
mov byte [rsi + 0x250], 1
jmp case.0x18001c7f0.11
mov rax, qword [r13]
mov ecx, dword [rax + 0x30]
inc ecx
imul ecx, dword [rax + 0x28]
mov r12d, ecx
mov qword [rbp + 0x2f], r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rbp + 0x1f], rax
test rax, rax
je 0x18001ca90
mov ecx, dword [r15]
mov r8d, r12d
mov rdx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
movsxd r12, eax
lea rdx, [0x180000000]
mov r8d, 0x800
jmp case.0x18001c7f0.11
cmp r12, qword [rbp + 0x2f]
je case.0x18001c7f0.11
mov ebx, dword [rbp + 0x7f]
mov r15d, 0x7f2bb724
mov r14d, 0x137
jmp case.0x18001ca14.306
cmp r12, 0xffffffffffffffff
jne case.0x18001c7f0.11
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ebx, dword [rbp + 0x7f]
mov r14d, 0x137
mov r15d, dword [rax]
jmp case.0x18001ca14.306
test word [r13 + 0x18], r8w
je 0x18001c901
xor r8d, r8d
mov edx, 0xdc
mov rcx, r13
call fcn.18001b6e0
mov r13, rax
test rax, rax
jne 0x18001c922
mov dword [r15], ILRemoveLastID
jmp 0x18001c922
xor r9d, r9d
mov r8, r13
xor edx, edx
mov ecx, 0xe9
call fcn.18001b840
mov r13, rax
test rax, rax
jne 0x18001c922
mov dword [r15], 6
mov qword [rbp + 0x27], r13
lea rdx, [0x180000000]
mov r8d, 0x800
jmp case.0x18001c7f0.11
mov rcx, qword [r13]
mov eax, dword [r15]
mov dword [rcx + 0x80], eax
jmp case.0x18001c7f0.11
mov rax, qword [r13]
test rax, rax
je 0x18001c95b
cmp dword [rax], 0x52530a0a
je case.0x18001c7f0.11
mov dword [rbp + 0x27], 2
jmp case.0x18001ca14.323
mov rax, qword [r13]
cmp qword [rax + 0x148], rdi
je 0x18001ca53
cmp qword [rax + 0x150], rdi
jmp 0x18001c9c6
mov rsi, qword [r13]
test rsi, rsi
je 0x18001c95b
cmp dword [rsi], 0x52530a0a
jne 0x18001c95b
jmp case.0x18001c7f0.11
mov rax, qword [r13]
cmp qword [rax + 0xa8], rdi
je 0x18001ca53
cmp qword [rax + 0xb0], rdi
je 0x18001ca53
cmp qword [rax + 0xd0], rdi
je 0x18001ca53
cmp qword [rax + 0x130], rdi
je 0x18001ca53
inc ebx
lea eax, [rbx + 0x121]
cmp eax, r14d
jb 0x18001c7d5
mov eax, dword [rbp + 0x7f]
mov r9, qword [rbp + 0x1f]
mov r15d, dword [rbp + 0x7f]
mov r14d, eax
mov ebx, dword [rbp + 0x7f]
add eax, 0xa
cmp r14d, eax
jae case.0x18001ca14.323
lea eax, [r14 - 0x12c]
cmp eax, 0x17
ja case.0x18001ca14.306
mov ecx, dword [rdx + rax*4 + 0x1cd58]
add rcx, rdx
jmp rcx
lea rax, [rbp + 0x7f]
mov dword [rbp + 0x7f], edi
mov r9d, 0x75
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x2f]
mov dword [rbp + 0x17], edi
lea rdx, [rbp + 0x17]
mov dword [rbp + 0x1f], ILRemoveLastID
lea rcx, [rbp + 0x1f]
mov qword [rbp + 0x2f], rsi
call fcn.180063bc0
mov dword [rbp + 0x27], ILRemoveLastID
jmp case.0x18001ca14.323
mov qword [rbp + 0x2f], rax
lea r8, [rbp + 0x2f]
lea rax, [rbp + 0x7f]
mov dword [rbp + 0x7f], edi
mov r9d, 0x75
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x1f]
mov dword [rbp + 0x1f], edi
lea rcx, [rbp + 0x17]
mov dword [rbp + 0x17], 3
call fcn.180063bc0
mov dword [rbp + 0x27], 3
jmp case.0x18001ca14.323
mov dword [rbp + 0x27], ILRemoveLastID
jmp case.0x18001ca14.323
mov r9, qword [rbp + 0x2f]
mov qword [rbp + 0x1f], r9
jmp 0x18001c9e4
mov dword [rsi + 0x278], edi
mov byte [rsi + 0x27c], dil
mov dword [rsi + 0x280], edi
mov rcx, qword [r13]
call qword [rsi + 0x150]
mov dword [rsi + reloc.SHELL32.dll_SHChangeNotification_Lock], eax
jmp case.0x18001ca14.306
mov eax, dword [rsi + reloc.SHELL32.dll_SHChangeNotification_Lock]
mov dword [rsi + 0x288], eax
mov dword [rsi + 0x1f8], edi
jmp case.0x18001ca14.306
mov dword [rsi + 0x25c], edi
mov qword [rsi + 0x270], rdi
jmp case.0x18001ca14.306
mov byte [rsi + 0x290], 1
mov qword [rsi + 0x254], rdi
jmp case.0x18001ca14.306
mov rax, qword [rsi + 0xc0]
mov dword [rsi + 0x28c], edi
test rax, rax
je 0x18001cb30
mov rcx, qword [r13]
call rax
test al, al
jne 0x18001cb30
mov ebx, 0x385
jmp 0x18001cb4b
xor r9d, r9d
mov qword [rbp + 0x2f], rsi
xor edx, edx
lea rcx, [rbp + 0x2f]
mov r8d, 0x102
call fcn.1800ac6f0
mov rbx, rax
movzx eax, byte [rsi + 0x1da]
cmp al, 1
jne 0x18001cba6
lea rax, [rbp + 0x2f]
mov byte [rsi + 0x1d8], dil
mov qword [rsp + 0x60], rax
xor r9d, r9d
mov qword [rsp + 0x58], rdi
xor r8d, r8d
mov qword [rsp + 0x50], rdi
xor edx, edx
mov qword [rsp + 0x48], rdi
xor ecx, ecx
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ILRemoveLastID
mov qword [rbp + 0x2f], rsi
call fcn.18007bae0
jmp 0x18001cbae
test al, al
jne 0x18001ccc7
test ebx, ebx
jne case.0x18001ca14.305
cmp byte [rsi + 0x1fc], dil
je 0x18001cbd8
mov rcx, rsi
mov ebx, ILRemoveLastID
call qword [rsi + 0x150]
mov dword [rsi + 0x1f8], eax
jmp case.0x18001ca14.306
cmp byte [rsi + 0x291], dil
je 0x18001cbeb
mov ebx, ILRemoveLastID
jmp case.0x18001ca14.306
cmp byte [rsi + 0x293], dil
je 0x18001cbfe
mov ebx, reloc.SHELL32.dll_ILFindLastID
jmp case.0x18001ca14.306
mov byte [rsi + 0x290], dil
cmp byte [rsi + 0x294], dil
je case.0x18001ca14.306
mov byte [rsi + 0x294], dil
jmp case.0x18001ca14.306
mov rax, qword [r13]
mov edx, 8
mov rcx, qword [rax + 0x20]
mov rax, r9
nop
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm1, xmmword [rax - 0x70]
movups xmmword [rcx - 0x70], xmm1
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x60], xmm0
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x50], xmm1
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x40], xmm0
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x30], xmm1
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x20], xmm0
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x18001cc30
mov rcx, qword [r13]
mov edx, dword [rcx + 0x28]
mov r8d, dword [rcx + 0x30]
mov rcx, qword [rcx + 0x38]
imul r8d, edx
add rdx, r9
call sub.VCRUNTIME140.dll_memcpy
mov r15d, edi
mov r14d, 0x137
jmp case.0x18001ca14.306
mov dword [rbp + 0x27], edi
mov eax, dword [rbp + 0x7f]
lea rdx, [0x180000000]
mov r9, qword [rbp + 0x1f]
inc r14d
jmp 0x18001c9ee
mov dword [rbp + 0x27], ebx
jmp case.0x18001ca14.323
mov dword [rbp + 0x27], 4
jmp case.0x18001ca14.323
mov rcx, r9
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov dword [rbp + 0x27], r15d
mov rax, qword [rbp + 0x27]
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret