Function at 0x140291010
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rdi
push r12
push r13
push r14
push r15
mov eax, 0xc460
call sub.ntdll.dll___chkstk
sub rsp, rax
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + 0xc450], rax
mov rbx, rcx
mov r13, r8
mov r12, rdx
lea rcx, [rsp + 0x52]
xor edx, edx
mov r8d, reloc.MFC80U.DLL_Ordinal_1022
mov word [rsp + 0x50], 0
call sub.ntdll.dll_memset
lea rdx, [0x140375d2c]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_wcsstr]
test rax, rax
jne 0x1402910f4
cmp word [rbx], 0x5c
je 0x1402910f4
cmp word [rbx + 2], 0x5c
je 0x1402910f4
lea rdx, [rsp + 0x50]
mov r8d, 0x400
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x50]
mov dx, 0x5c
call qword [sym.imp.ntdll.dll_wcsrchr]
test rax, rax
je 0x1402910af
mov word [rax], 0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x50]
repne scasw ax, word [rdi]
mov eax, dword [0x140375d84]
or rcx, 0xffffffffffffffff
mov dword [rdi - 2], eax
xor eax, eax
lea rdi, [rsp + 0x50]
repne scasw ax, word [rdi]
xor ecx, ecx
nop
nop
nop
movzx eax, word [rbx + rcx]
add rcx, 2
test ax, ax
mov word [rdi + rcx - 4], ax
jne 0x1402910e0
jmp 0x140291111
lea rcx, [rsp + 0x50]
sub rcx, rbx
nop
movzx eax, word [rbx]
add rbx, 2
test ax, ax
mov word [rcx + rbx - 2], ax
jne 0x140291100
xor r14d, r14d
lea rcx, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x30], r14
lea r8d, [r14 + 3]
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov ebx, r14d
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea r15d, [r14 + 1]
cmp rax, 0xffffffffffffffff
mov rdi, rax
je 0x1402911a1
lea rcx, [rsp + 0x451]
xor edx, edx
mov r8d, 0x1fff
mov byte [rsp + 0x450], bl
call sub.ntdll.dll_memset
lea rdx, [rsp + 0x450]
mov r8d, 0x2000
mov rcx, rdi
call fcn.140290ae0
cmp byte [rsp + 0x450], 0xff
jne 0x140291198
cmp byte [rsp + 0x451], 0xfe
cmove ebx, r15d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
mov qword [rsp + 0x30], r14
lea rcx, [rsp + 0x50]
lea r8d, [r9 + 3]
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbp, rax
jne 0x1402911dd
xor eax, eax
jmp 0x1402915b1
lea rcx, [rsp + 0x2452]
xor edx, edx
mov r8d, 0x1ffe
mov word [rsp + 0x2450], r14w
call sub.ntdll.dll_memset
lea rcx, [rsp + 0x2450]
sub rcx, r12
mov rdx, r12
nop
nop
movzx eax, word [rdx]
add rdx, 2
test ax, ax
mov word [rcx + rdx - 2], ax
jne 0x140291210
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x2450]
repne scasw ax, word [rdi]
mov eax, dword [0x140375d9c]
lea rcx, [rsp + 0x8452]
xor edx, edx
mov r8d, 0x3ffe
mov qword [rsp + 0xc4b8], rsi
mov dword [rdi - 2], eax
mov word [rsp + 0x8450], r14w
call sub.ntdll.dll_memset
test ebx, ebx
je 0x1402913f9
nop
nop
lea rcx, [rsp + 0x8450]
xor edx, edx
mov r8d, 0x2000
call sub.ntdll.dll_memset
lea rdi, [rsp + 0x8450]
mov ebx, r14d
mov rsi, r14
nop
nop
nop
nop
lea r9, [rsp + 0x40]
mov r8d, 2
mov rdx, rdi
mov rcx, rbp
mov dword [rsp + 0x40], r14d
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140291389
cmp dword [rsp + 0x40], r14d
je 0x140291389
movzx eax, word [rdi]
add ebx, r15d
add rsi, r15
add rdi, 2
cmp ax, 0xa
je 0x1402912ef
cmp ebx, 0x1000
jb 0x1402912a0
mov word [rdi], r14w
cmp byte [rsp + 0x8450], 0xff
jne 0x140291340
cmp byte [rsp + 0x8451], 0xfe
jne 0x140291340
movzx ecx, word [rsp + 0x8452]
mov rax, r14
lea rdx, [rsp + 0x8452]
test cx, cx
je 0x140291337
nop
add rdx, 2
mov word [rsp + rax*2 + 0x8450], cx
add rax, r15
mov cx, word [rdx]
test cx, cx
jne 0x140291320
mov word [rsp + rax*2 + 0x8450], r14w
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x8450]
repne scasw ax, word [rdi]
not rcx
sub rcx, r15
cmp ecx, 2
jl 0x140291390
movsxd rax, ecx
cmp word [rsp + rax*2 + 0x844c], 0xd
jne 0x140291390
cmp word [rsp + rax*2 + 0x844e], 0xa
jne 0x140291390
mov word [rsp + rax*2 + 0x844c], r14w
mov word [rsp + rax*2 + 0x844e], r14w
jmp 0x140291390
mov word [rdi + rsi*2], r14w
mov ecx, ebx
test ecx, ecx
je 0x140291565
lea rdx, [rsp + 0x2450]
lea rcx, [rsp + 0x8450]
call qword [sym.imp.ntdll.dll_wcsstr]
test rax, rax
mov r11, rax
je 0x140291270
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
sub rcx, r15
movsxd rdx, ecx
lea rcx, [r11 + rdx*2 + 2]
mov rdx, r13
nop
nop
nop
movzx eax, word [rcx]
add rdx, 2
add rcx, 2
test ax, ax
mov word [rdx - 2], ax
jne 0x1402913e0
jmp 0x140291565
lea rcx, [rsp + 0x451]
xor edx, edx
mov r8d, 0x1fff
mov byte [rsp + 0x450], r14b
call sub.ntdll.dll_memset
lea rcx, [rsp + 0x6451]
xor edx, edx
mov r8d, 0x1fff
mov byte [rsp + 0x6450], r14b
call sub.ntdll.dll_memset
lea rcx, [rsp + 0x4451]
xor edx, edx
mov r8d, 0x1fff
mov byte [rsp + 0x4450], r14b
call sub.ntdll.dll_memset
lea rcx, [rsp + 0x6450]
mov r8d, 0x2000
mov rdx, r12
call qword [sym.imp.ntdll.dll_wcstombs]
nop
nop
nop
lea rcx, [rsp + 0x450]
xor edx, edx
mov r8d, 0x2000
call sub.ntdll.dll_memset
lea rdi, [rsp + 0x450]
mov ebx, r14d
mov rsi, r14
nop
nop
nop
nop
lea r9, [rsp + 0x40]
mov r8d, r15d
mov rdx, rdi
mov rcx, rbp
mov dword [rsp + 0x40], r14d
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1402914e6
cmp dword [rsp + 0x40], r14d
je 0x1402914e6
movzx eax, byte [rdi]
add ebx, r15d
add rsi, r15
add rdi, r15
cmp al, 0xa
je 0x1402914e1
cmp ebx, 0x2000
jb 0x1402914a0
mov byte [rdi], r14b
jmp 0x1402914ea
mov byte [rsi + rdi], r14b
test ebx, ebx
je 0x14029154e
lea rdx, [rsp + 0x6450]
lea rcx, [rsp + 0x450]
call qword [sym.imp.ntdll.dll_strstr]
test rax, rax
mov r11, rax
je 0x140291470
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x6450]
repne scasb al, byte [rdi]
lea rdi, [rsp + 0x4450]
not rcx
sub rcx, r15
movsxd rdx, ecx
sub rdi, rdx
sub rdi, r11
lea rcx, [rdx + r11 + 1]
nop
movzx eax, byte [rcx]
mov byte [rdi + rcx - 1], al
add rcx, r15
test al, al
jne 0x140291540
lea rdx, [rsp + 0x4450]
mov r8d, 0x2000
mov rcx, r13
call qword [sym.imp.ntdll.dll_mbstowcs]
mov rsi, qword [rsp + 0xc4b8]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
sub rcx, r15
cmp ecx, 2
jl 0x1402915a5
movsxd rcx, ecx
cmp word [r13 + rcx*2 - 4], 0xd
jne 0x1402915a5
cmp word [r13 + rcx*2 - 2], 0xa
jne 0x1402915a5
mov word [r13 + rcx*2 - 4], ax
mov word [r13 + rcx*2 - 2], ax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r15d
mov rcx, qword [rsp + 0xc450]
xor rcx, rsp
call fcn.140161080
add rsp, 0xc460
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbp
pop rbx
ret