Function at 0x18000e2e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r15d, dword [rsp + 0xa0]
mov rdi, r9
mov r9, r8
mov r8, rdx
mov rdx, rcx
lea r12d, [r15 + 0x374]
cmp r15d, r12d
jae case.0x18000e380.40
mov r14, qword [rsp + 0xa8]
xor ebx, ebx
mov rbp, qword [rsp + 0x30]
movzx esi, word [rsp + 0xa0]
mov r13, qword [rsp + 0x30]
lea r10, [0x180000000]
cmp r15d, 0x124
ja 0x18000e5fb
je 0x18000e5bf
lea eax, [r15 - 0x20]
cmp eax, 0xf7
ja case.0x18000e380.43
movzx eax, byte [r10 + rax + 0xe6e4]
mov ecx, dword [r10 + rax*4 + 0xe6b4]
add rcx, r10
jmp rcx
mov rcx, qword [rdi]
dec rcx
mov rax, rcx
shr rax, 1
or rax, rcx
mov qword [rdi], rax
jmp case.0x18000e380.43
mov rbp, qword [rdi + 0x70]
mov rax, qword [rbp + 0x40]
test rax, rax
je 0x18000e3bd
mov r8d, 1
lea rdx, [rsp + 0xa0]
mov rcx, rdi
call rax
cdqe
jmp 0x18000e3d6
mov r9, qword [rbp + 0x38]
lea rcx, [rsp + 0xa0]
mov edx, 1
mov r8d, edx
call fcn.180079e64
cmp rax, 1
je case.0x18000e380.43
mov ecx, 0xfa
mov eax, ecx
sub eax, 0xfa
je 0x18000e414
cmp eax, 1
jne 0x18000e41b
mov dword [rsp + 0x30], ebx
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x98]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov dword [rdi + 0x60], 0x66
inc ecx
cmp ecx, 0xfc
jb 0x18000e3e5
jmp case.0x18000e380.43
mov ecx, 0x100
nop
mov eax, ecx
sub eax, 0x100
je 0x18000e440
cmp eax, 1
je case.0x18000e380.40
jmp 0x18000e445
mov word [rsp + 0x30], si
inc ecx
cmp ecx, 0x102
jb 0x18000e430
mov r13, r8
jmp case.0x18000e380.43
cmp byte [rsp + 0xa0], 0
jbe 0x18000e543
mov ebx, 0x11d
nop word [rax + rax]
mov eax, ebx
sub eax, 0x11d
je 0x18000e515
cmp eax, 1
jne 0x18000e526
mov r9, qword [rdi + 0x70]
mov rax, qword [r9 + 0x40]
test rax, rax
je 0x18000e4ab
mov rdx, qword [r14]
mov rcx, rdi
movzx r8d, byte [rsp + 0xa0]
inc rdx
call rax
cdqe
jmp 0x18000e4c8
mov rcx, qword [r14]
mov edx, 1
movzx r8d, byte [rsp + 0xa0]
inc rcx
mov r9, qword [r9 + 0x38]
call fcn.180079e64
movzx ecx, byte [rsp + 0xa0]
cmp rax, rcx
je 0x18000e526
mov ecx, 0x43
nop word [rax + rax]
mov eax, ecx
sub eax, 0x43
je 0x18000e501
sub eax, 0x25
je 0x18000e4f7
cmp eax, 0x25
je case.0x18000e380.40
jmp 0x18000e508
mov dword [rsp + 0x30], 0
jmp 0x18000e508
mov dword [rdi + 0x60], 0x66
add ecx, 0x25
cmp ecx, 0xb2
jb 0x18000e4e0
jmp 0x18000e526
movzx eax, byte [rsp + 0xa0]
lea rcx, [rbp + 0x50]
mov qword [r14], rcx
mov byte [rcx], al
inc ebx
cmp ebx, 0x11f
jb 0x18000e470
xor ebx, ebx
mov dword [rsp + 0x30], 1
jmp case.0x18000e380.43
mov eax, 0x3e
cmp eax, 0x3e
je 0x18000e55b
cmp eax, 0x57
jne 0x18000e55e
mov byte [rbp + 0x50], 0
mov dword [rbp + 0x34], ebx
jmp 0x18000e55e
mov qword [r14], rbx
add eax, 0x19
cmp eax, 0x70
jb 0x18000e548
mov dword [rsp + 0x30], 1
jmp case.0x18000e380.43
lea r9, str.___i__:
jmp 0x18000e59f
lea r9, str._guidName_is_NULL__
jmp 0x18000e59f
mov r8d, dword [r9]
lea rdx, [0x180098df4]
mov rcx, qword [r13 + 0x10]
call fcn.18006bc20
lea r9, [0x180098df8]
mov rdx, qword [r13 + 0x10]
mov r8d, 0x70
mov qword [rsp + 0x28], rbx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.18006a100
jmp case.0x18000e380.43
mov ecx, 0x112
mov eax, ecx
sub eax, 0x112
je 0x18000e5d8
cmp eax, 0x12
je case.0x18000e380.40
jmp 0x18000e5dd
mov byte [rsp + 0x30], 0
add ecx, 0x12
cmp ecx, 0x136
jb 0x18000e5c4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
shr esi, 0x10
xor si, ax
jmp case.0x18000e380.43
mov eax, r15d
sub eax, 0x14b
je 0x18000e680
sub eax, 0x34
je 0x18000e677
sub eax, 0x34
je 0x18000e65e
sub eax, 0x34
je 0x18000e659
cmp eax, 0x34
jne case.0x18000e380.43
mov ecx, 0x9e
nop
mov eax, ecx
sub eax, 0x9d
je case.0x18000e380.40
cmp eax, 1
jne 0x18000e63a
mov rax, qword [rdi]
mov qword [rsp + 0x30], rax
dec ecx
cmp ecx, 0x9c
ja 0x18000e620
mov r8d, dword [rdx]
lea rdx, [0x180098df4]
mov rcx, qword [r13 + 0x10]
call fcn.18006bc20
jmp case.0x18000e380.43
inc qword [rdi]
jmp case.0x18000e380.43
mov rcx, qword [rdi]
shr rcx, 8
or rcx, qword [rdi]
mov rax, rcx
shr rax, 0x10
or rax, rcx
mov qword [rdi], rax
jmp case.0x18000e380.43
mov rcx, qword [rdi]
shr rcx, 4
jmp 0x18000e687
mov rcx, qword [rdi]
shr rcx, 2
or qword [rdi], rcx
add r15d, 0x34
cmp r15d, r12d
jae case.0x18000e380.40
mov rdx, qword [rsp + 0x80]
mov r8, qword [rsp + 0x88]
mov r9, qword [rsp + 0x90]
jmp 0x18000e343