Function at 0x10000fb4c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x180
mov rax, qword [0x10001b110]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor esi, esi
mov r12, rdx
cmp rdx, rsi
je 0x10000fc41
or rcx, 0xffffffffffffffff
xor eax, eax
lea rbx, [0x10001c670]
mov rdi, rbx
lea r13d, [rsi + 1]
lea r15d, [rsi + 5]
repne scasb al, byte [rdi]
not rcx
sub rcx, r13
cmp rcx, r15
jb 0x10000fc41
lea rdx, [rcx + rbx - 4]
lea rcx, [0x100003f6c]
call qword [sym.imp.msvcrt.dll__stricmp]
cmp eax, esi
jne 0x10000fc41
mov edx, 0x8000
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__open]
mov ebx, eax
cmp eax, 0xffffffff
je 0x10000fc41
lea r8d, [rsi + 0xc]
lea rdx, [rsp + 0x48]
mov ecx, eax
call qword [sym.imp.msvcrt.dll__read]
cmp eax, 0xc
jne 0x10000fc39
movzx edx, word [rsp + 0x4c]
mov edi, esi
movzx ecx, dl
shr dx, 8
shl cx, 8
movzx eax, dl
movzx ebp, cx
or ebp, eax
jbe 0x10000fc39
cmp edi, 0x28
jae 0x10000fc39
lea rdx, [rsp + 0x38]
mov r8d, 0x10
mov ecx, ebx
call qword [sym.imp.msvcrt.dll__read]
cmp eax, 0x10
jne 0x10000fc39
cmp dword [rsp + 0x38], 0x656d616e
je 0x10000fc6f
add edi, r13d
cmp edi, ebp
jb 0x10000fc0b
mov ecx, ebx
call qword [sym.imp.msvcrt.dll__close]
xor eax, eax
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.100018d50
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret
mov ecx, dword [rsp + 0x40]
mov ebp, 0xff0000
xor r8d, r8d
mov edi, ecx
mov eax, ecx
shr eax, 0x10
and edi, ebp
or edi, eax
mov eax, ecx
shl ecx, 0x18
and ecx, 0xff000000
and eax, 0xff00
shr edi, 8
shl eax, 8
or edi, eax
or edi, ecx
mov ecx, ebx
mov edx, edi
call qword [sym.imp.msvcrt.dll__lseek]
cmp eax, edi
jne 0x10000fc39
lea rdx, [rsp + 0x30]
mov r8d, 6
mov ecx, ebx
call qword [sym.imp.msvcrt.dll__read]
cmp eax, 6
jne 0x10000fc39
movzx ecx, word [rsp + 0x32]
movzx eax, cl
shr cx, 8
shl ax, 8
movzx edi, ax
movzx eax, cl
or edi, eax
je 0x10000fc39
lea rdx, [rsp + 0x20]
mov r8d, 0xc
mov ecx, ebx
dec edi
call qword [sym.imp.msvcrt.dll__read]
cmp eax, 0xc
jne 0x10000fc39
movzx ecx, word [rsp + 0x20]
movzx eax, byte [rsp + 0x20]
shr cx, 8
shl ax, 8
or cx, ax
cmp cx, r13w
jne 0x10000fd3c
movzx ecx, word [rsp + 0x26]
movzx eax, byte [rsp + 0x26]
shr cx, 8
shl ax, 8
or cx, ax
cmp cx, r15w
je 0x10000fd40
cmp edi, esi
jmp 0x10000fce2
mov ecx, dword [rsp + 0x40]
xor r8d, r8d
mov edi, ecx
mov eax, ecx
shr eax, 0x10
and edi, ebp
or edi, eax
mov eax, ecx
shl ecx, 0x18
and eax, 0xff00
and ecx, 0xff000000
shr edi, 8
shl eax, 8
or edi, eax
or edi, ecx
movzx ecx, word [rsp + 0x34]
movzx eax, cl
shr cx, 8
shl ax, 8
movzx edx, ax
movzx eax, cl
movzx ecx, word [rsp + 0x2a]
or edx, eax
movzx eax, cl
shr cx, 8
shl ax, 8
add edi, edx
movzx edx, ax
movzx eax, cl
movzx ecx, word [rsp + 0x28]
or edx, eax
movzx eax, cl
shr cx, 8
shl ax, 8
add edi, edx
movzx ebp, ax
movzx eax, cl
mov ecx, ebx
mov edx, edi
or ebp, eax
call qword [sym.imp.msvcrt.dll__lseek]
cmp eax, edi
jne 0x10000fc39
cmp ebp, 0xff
ja 0x10000fc39
lea rdx, [rsp + 0x70]
mov r8d, ebp
mov ecx, ebx
call qword [sym.imp.msvcrt.dll__read]
cmp eax, ebp
jne 0x10000fc39
mov ecx, ebx
mov byte [rsp + rbp + 0x70], sil
call qword [sym.imp.msvcrt.dll__close]
lea rdx, [0x100003f60]
lea rcx, [rsp + 0x70]
call qword [sym.imp.msvcrt.dll_strpbrk]
mov rbx, rax
cmp rax, rsi
je 0x10000fe54
mov rcx, rax
call qword [sym.imp.msvcrt.dll_atol]
lea rdx, [0x100003f60]
mov rcx, rbx
mov edi, eax
shl edi, 0x10
and edi, 0xffff0000
call qword [sym.imp.msvcrt.dll_strspn]
movsxd rcx, eax
cmp byte [rbx + rcx], 0x2e
jne 0x10000fe52
lea rcx, [rbx + rcx + 1]
call qword [sym.imp.msvcrt.dll_atol]
movzx ecx, ax
add edi, ecx
mov esi, edi
mov dword [r12], esi
mov eax, r13d
jmp 0x10000fc43