Function at 0x1400c8540
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rdi
push r13
mov eax, 0x2368
call sub.ntdll.dll___chkstk
sub rsp, rax
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + 0x2350], rax
mov r13, rcx
mov rbx, rdx
lea rcx, [rsp + reloc.MFC80U.DLL_Ordinal_338]
xor edx, edx
mov r8d, Ordinal_512
mov word [rsp + reloc.MFC80U.DLL_Ordinal_336], 0
call sub.ntdll.dll_memset
call fcn.140049400
mov rcx, qword [rbx + 8]
mov rdi, qword [rax]
mov r9d, dword [rbx]
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + reloc.MFC80U.DLL_Ordinal_336]
mov r8d, 0x100
mov rcx, rax
call qword [rdi + 0xa0]
test eax, eax
jne 0x1400c868a
call fcn.140049470
lea rbp, [0x1404343d0]
xor edx, edx
mov rcx, rbp
mov r8d, 0x80
mov rbx, rax
call sub.ntdll.dll_memset
lea rcx, str..._boot.cpp
mov edx, 0x5c
call qword [sym.imp.ntdll.dll_strrchr]
test rax, rax
mov rdi, rax
jne 0x1400c85fa
xor ebp, ebp
jmp 0x1400c8670
xor eax, eax
lea rdx, [0x1402dfd08]
lea rcx, [rsp + 0x38]
mov r8d, 0x31e
mov byte [rsp + 0x38], 0
mov qword [rsp + 0x39], rax
mov word [rsp + 0x41], ax
mov byte [rsp + 0x43], al
call qword [sym.imp.ntdll.dll_sprintf]
lea rdx, [rdi + 1]
mov rcx, rbp
sub rcx, rdx
movzx eax, byte [rdx]
add rdx, 1
test al, al
mov byte [rcx + rdx - 1], al
jne 0x1400c8631
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbp
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x38]
nop
nop
nop
nop
movzx eax, byte [rdx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x1400c8660
mov rax, qword [rbx]
lea rdx, str._s:_Failed_to_IVol.GetPartArcName_in_IsExistArcItem.
mov r8, rbp
mov rcx, rbx
call qword [rax + 0x10]
xor eax, eax
jmp 0x1400c892e
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + reloc.MFC80U.DLL_Ordinal_336]
repne scasw ax, word [rdi]
mov eax, dword [0x1403b5bbc]
lea r8, [rsp + reloc.MFC80U.DLL_Ordinal_336]
lea rdx, [rsp + 0x38]
mov rcx, r13
mov dword [rdi - 2], eax
call fcn.1400c7eb0
test eax, eax
jne 0x1400c86f0
call fcn.140049470
lea rcx, str..._boot.cpp
mov edx, 0x326
mov rbx, qword [rax]
mov rdi, rax
call fcn.1400c6f30
lea rdx, str._s:_Failed_to_AnalyseArcInfo_in_IsExistArcItem.
mov rcx, rdi
mov r8, rax
call qword [rbx + 0x10]
xor eax, eax
jmp 0x1400c892e
lea rcx, [rsp + 0x51]
xor edx, edx
mov r8d, 0xff
mov byte [rsp + 0x50], 0
call sub.ntdll.dll_memset
mov edx, dword [rsp + 0x38]
cmp edx, 3
jne 0x1400c8743
call fcn.140049470
lea rcx, str..._boot.cpp
mov edx, 0x32d
mov rbx, qword [rax]
mov rdi, rax
call fcn.1400c6f30
lea rdx, str._s:_Arc_type_invalid.
mov rcx, rdi
mov r8, rax
call qword [rbx + 0x10]
xor eax, eax
jmp 0x1400c892e
cmp edx, 2
mov qword [rsp + 0x2360], r12
je 0x1400c8777
cmp edx, 1
je 0x1400c8777
test edx, edx
jne 0x1400c87ae
movsx r8d, byte [rsp + 0x45]
mov r9d, dword [rbx + 0x10]
lea rdx, str.multi_0_disk_0_rdisk__d_partition__d_
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntdll.dll_sprintf]
jmp 0x1400c87ae
mov rcx, qword [r13]
mov rax, qword [rcx]
call qword [rax + 0x40]
movsx edi, byte [rsp + 0x44]
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x28]
lea rdx, str.signature__08x_disk__d_rdisk_0_partition__d_
lea rcx, [rsp + 0x50]
mov r8d, eax
mov eax, dword [rbx + 0x10]
mov r9d, edi
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntdll.dll_sprintf]
mov edx, 0x80
mov rcx, r13
call fcn.1400c7970
xor edx, edx
mov rcx, r13
call fcn.1400c7780
cmp rax, 0xffffffffffffffff
mov r12, rax
je 0x1400c88f8
test rax, rax
je 0x1400c88f8
mov qword [rsp + 0x23a0], rsi
xor ebp, ebp
nop
nop
nop
lea rcx, [rsp + 0x1350]
xor edx, edx
mov r8d, 0x1000
call sub.ntdll.dll_memset
lea rdi, [rsp + 0x1350]
mov ebx, ebp
mov rsi, rbp
lea r9, [rsp + 0x30]
mov r8d, 1
mov rdx, rdi
mov rcx, r12
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400c885b
cmp dword [rsp + 0x30], ebp
je 0x1400c885b
movzx eax, byte [rdi]
add ebx, 1
add rsi, 1
add rdi, 1
cmp al, 0xa
je 0x1400c8856
cmp ebx, 0x1000
jb 0x1400c8812
mov byte [rdi], bpl
jmp 0x1400c885f
mov byte [rsi + rdi], bpl
test ebx, ebx
je 0x1400c88d6
lea rcx, [rsp + 0x351]
xor edx, edx
mov r8d, 0xfff
mov byte [rsp + 0x350], bpl
call sub.ntdll.dll_memset
mov rdx, rbp
nop
nop
nop
nop
movzx eax, byte [rsp + rdx + 0x1350]
add rdx, 1
test al, al
mov byte [rsp + rdx + 0x34f], al
jne 0x1400c8890
lea rcx, [rsp + 0x350]
call qword [sym.imp.ntdll.dll__strlwr]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x350]
call qword [sym.imp.ntdll.dll_strstr]
test rax, rax
je 0x1400c87f0
mov ebp, 1
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 3
mov rcx, r13
call fcn.1400c7970
mov rsi, qword [rsp + 0x23a0]
mov eax, ebp
jmp 0x1400c8926
call fcn.140049470
lea rcx, str..._boot.cpp
mov edx, 0x344
mov rbx, qword [rax]
mov rdi, rax
call fcn.1400c6f30
lea rdx, str._s:_Failed_to_GetBootIniHandle.
mov rcx, rdi
mov r8, rax
call qword [rbx + 0x10]
xor eax, eax
mov r12, qword [rsp + 0x2360]
mov rcx, qword [rsp + 0x2350]
xor rcx, rsp
call fcn.140161080
add rsp, 0x2368
pop r13
pop rdi
pop rbp
pop rbx
ret