Function at 0x18001a020
Capabilities:
Read file on windows

Disassembly:
mov r11, rsp
push rbp
push rbx
push r12
push r15
lea rbp, [r11 - 0x458]
sub rsp, 0x538
mov rax, qword [0x180079880]
xor rax, rsp
mov qword [rbp + 0x410], rax
lea eax, [r9 + 0x12]
mov qword [rsp + 0x70], rcx
mov r12, r8
mov r15, rdx
mov rbx, rcx
cmp r9d, eax
jae 0x18001a3fe
mov qword [r11 + 0x20], rsi
lea r8, [0x180000000]
mov qword [r11 - 0x28], rdi
lea esi, [r9 - 0x9c]
mov qword [r11 - 0x30], r13
lea rdi, [0x18001a650]
movzx r13d, byte [rsp + 0x50]
xor edx, edx
mov qword [r11 - 0x38], r14
mov r14d, 0x12
cmp esi, 0x16
ja case.0x18001a0aa.13
mov ecx, dword [r8 + rsi*4 + 0x1a5f0]
add rcx, r8
jmp rcx
mov qword [rsp + 0x40], rdx
xor r9d, r9d
mov qword [rsp + 0x38], rdx
xor r8d, r8d
mov dword [rsp + 0x30], 0xe7
xor ecx, ecx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rdx
xor edx, edx
call fcn.18000f700
movzx eax, byte [0x180079011]
lea r8, [rsp + 0x50]
mov byte [rsp + 0x60], al
movzx eax, byte [0x180079010]
mov byte [rsp + 0x50], al
lea rax, [rsp + 0x58]
mov byte [rsp + 0x58], 0
lea r9, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov edx, 0xce
xor ecx, ecx
call fcn.180026890
movzx eax, byte [0x180079013]
lea r9, [rsp + 0x60]
mov byte [rsp + 0x60], al
lea r8, [rsp + 0x58]
movzx eax, byte [0x180079012]
mov edx, 0xce
mov byte [rsp + 0x58], al
xor ecx, ecx
lea rax, [rsp + 0x50]
mov byte [rsp + 0x50], 0
mov qword [rsp + 0x20], rax
call fcn.180026890
jmp 0x18001a3c9
lea rcx, [r12 + 0xa]
cmp rcx, r15
je case.0x18001a0aa.13
cmp qword [r15 + 0x18], 0x10
mov rdx, r15
jb 0x18001a16d
mov rdx, qword [r15]
mov r8, qword [r15 + 0x10]
call fcn.18003e0a0
jmp 0x18001a3c9
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [rbp - 0x40]
lea r9, [rbp - 0x38]
mov rcx, rax
mov dword [rsp + 0x30], 2
xor eax, eax
mov r8, rbx
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rbx, qword [rsp + 0x70]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [r12], rdi
movups xmmword [rbp - 0x20], xmm0
jmp 0x18001a3c9
mov byte [rbp - 0xf], 0
jmp case.0x18001a0aa.13
mov byte [rbp - 4], 0x75
jmp case.0x18001a0aa.13
mov dword [rbp - 8], 0x646e4963
mov byte [rbp - 4], 0
jmp case.0x18001a0aa.13
mov byte [rbp - 0x10], 0x73
jmp case.0x18001a0aa.13
mov qword [rsp + 0x30], rdx
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rdx
xor r8d, r8d
xor edx, edx
mov byte [rsp + 0x50], 0xc0
xor ecx, ecx
mov dword [rsp + 0x20], 0xed
call fcn.180027790
movzx eax, byte [0x180079011]
lea r9, [rsp + 0x60]
mov byte [rsp + 0x60], al
lea r8, [rsp + 0x58]
movzx eax, byte [0x180079010]
mov edx, 0xce
mov byte [rsp + 0x58], al
xor ecx, ecx
lea rax, [rsp + 0x50]
mov byte [rsp + 0x50], 1
mov qword [rsp + 0x20], rax
call fcn.180026890
jmp 0x18001a3c9
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov r13b, 1
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
movzx ecx, word [rbx]
lea r8, [rsp + 0x50]
mov word [rsp + 0x50], cx
mov rdx, r12
mov ecx, 0xa
mov qword [rbp - 0x40], rax
call fcn.1800038f0
jmp 0x18001a3c9
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18001a3c9
mov word [rbp + 8], 0x64
jmp case.0x18001a0aa.13
mov r8d, 5
lea rdx, [0x180071210]
lea rcx, [rbp + 1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov r8d, 2
mov byte [rbp + 6], 0
lea rdx, [0x180071229]
lea rcx, [rbp - 0x10]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x18001a3c9
mov qword [rsp + 0x30], rdx
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rdx
xor r8d, r8d
xor edx, edx
mov byte [rsp + 0x50], 0x80
xor ecx, ecx
mov dword [rsp + 0x20], 0xed
call fcn.180027790
movzx eax, byte [0x180079011]
lea r8, [rsp + 0x58]
mov byte [rsp + 0x60], al
movzx eax, byte [0x180079010]
mov byte [rsp + 0x58], al
lea rax, [rsp + 0x50]
mov byte [rsp + 0x50], 1
jmp 0x18001a0fc
mov r8d, 3
lea rdx, [0x180071279]
lea rcx, [rbp - 0xf]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov dword [rbp - 0xc], 0x69736142
jmp 0x18001a3c9
xor r9d, r9d
lea rax, [rbp - 0x10]
xor edx, edx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], pe_nt_image_headers64
lea r8d, [r9 + 4]
lea rcx, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rcx, qword [rbp - 0x40]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rdi, rdi
je 0x18001a3bf
test r13b, r13b
je 0x18001a3c2
xor eax, eax
lea r9, [rsp + 0x68]
mov r8d, 0x400
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x10]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x18001a41b
cmp dword [rsp + 0x68], eax
ja 0x18001a41b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r13b, r13b
lea rdi, [0x18001a650]
xor edx, edx
lea r8, [0x180000000]
inc esi
sub r14, 1
jne 0x18001a096
mov r14, qword [rsp + 0x520]
mov r13, qword [rsp + 0x528]
mov rdi, qword [rsp + 0x530]
mov rsi, qword [rsp + 0x578]
mov rcx, qword [rbp + 0x410]
xor rcx, rsp
call fcn.180050c90
add rsp, 0x538
pop r15
pop r12
pop rbx
pop rbp
ret
mov ebx, 0x21
cmp ebx, 0x21
je 0x18001a438
cmp ebx, 0x1ad
jne 0x18001a48c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18001a48c
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea rax, [rbp - 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov eax, dword [rsp + 0x68]
mov rcx, rdi
mov dword [rsp + 0x20], eax
lea edx, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov r9d, dword [rsp + 0x68]
lea rax, [rbp - 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
add ebx, 0x18c
cmp ebx, 0x318
jbe 0x18001a420
mov rbx, qword [rsp + 0x70]
jmp 0x18001a3c2
mov rbx, r12
mov edi, 0x10
nop dword [rax]
movzx eax, byte [rbx]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x30], rdx
xor r8d, r8d
mov qword [rsp + 0x28], rdx
xor ecx, ecx
xor edx, edx
mov byte [rsp + 0x50], al
mov dword [rsp + 0x20], 0xed
call fcn.180027790
lea rbx, [rbx + 1]
mov edx, 0
sub rdi, 1
jne 0x18001a4b0
movzx eax, byte [0x180079011]
lea r9, [rbp - 0x80]
mov byte [rbp - 0x80], al
lea r8, [rbp - 0x78]
movzx eax, byte [0x180079010]
xor ecx, ecx
mov byte [rbp - 0x78], al
lea rax, [rsp + 0x78]
mov byte [rsp + 0x78], dl
mov edx, 0xce
mov qword [rsp + 0x20], rax
call fcn.180026890
movzx eax, byte [0x180079013]
lea r9, [rbp - 0x68]
mov byte [rbp - 0x68], al
lea r8, [rbp - 0x60]
movzx eax, byte [0x180079012]
mov edx, 0xce
mov byte [rbp - 0x60], al
xor ecx, ecx
lea rax, [rbp - 0x70]
mov byte [rbp - 0x70], 0
mov qword [rsp + 0x20], rax
call fcn.180026890
mov rbx, qword [rsp + 0x70]
jmp 0x18001a3c2
movzx eax, byte [0x180079013]
lea r9, [rbp - 0x50]
mov byte [rbp - 0x50], al
lea r8, [rbp - 0x48]
movzx eax, byte [0x180079012]
mov edx, 0xce
mov byte [rbp - 0x48], al
xor ecx, ecx
lea rax, [rbp - 0x58]
mov byte [rbp - 0x58], 0
mov qword [rsp + 0x20], rax
call fcn.180026890
lea rbx, [r12 + 0x10]
mov edi, 0x10
nop dword [rax]
movzx eax, byte [rbx]
lea r9, [rsp + 0x50]
mov byte [rsp + 0x50], al
xor r8d, r8d
xor eax, eax
xor edx, edx
mov qword [rsp + 0x30], rax
xor ecx, ecx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xed
call fcn.180027790
lea rbx, [rbx + 1]
sub rdi, 1
jne 0x18001a5a0
mov rbx, qword [rsp + 0x70]
jmp 0x18001a3c2
mov dword [rbp - 3], 0x6f697463
mov byte [rbp + 1], 0
jmp case.0x18001a0aa.13