Function at 0x401540
Capabilities:
Read file on windows

Disassembly:
mov r11, rsp
sub rsp, 0x4d8
mov rax, qword [0x0042baf8]
mov qword [rsp + 0x480], rax
mov qword [r11 - 8], rbx
mov qword [r11 - 0x28], r12
mov qword [r11 - 0x30], r13
mov qword [r11 - 0x40], r15
mov r15, qword [rsp + 0x500]
mov r12, rdx
xor edx, edx
mov r13d, r8d
mov rbx, rcx
mov qword [rsp + 0x38], rcx
lea r8, str.____Reading__I64u_bytes_from_offset__I64u
lea ecx, [rdx + 6]
mov r9, r15
mov qword [rsp + 0x20], 0
call qword [rbx + 0x298]
test r12, r12
je 0x4015cd
test r13d, r13d
je 0x4015cd
cmp r15, 0x7fffffff
jb 0x4015d4
xor edx, edx
lea r8, str.____Cannot_read__I64u_bytes__maximum_is__lu.
mov r9, r15
lea ecx, [rdx + 2]
mov dword [rsp + 0x20], 0x7fffffff
call qword [rbx + 0x298]
xor eax, eax
jmp 0x401863
xor edx, edx
mov rax, r15
div qword [rbx + 0x118]
test rdx, rdx
je 0x4015fa
mov rcx, qword [rbx + 0x118]
xor edx, edx
mov rax, r15
div rcx
sub rcx, rdx
add r15, rcx
mov rcx, r15
mov qword [rsp + 0x4c8], rbp
call fcn.00410900
test rax, rax
mov rbp, rax
mov qword [rsp + 0x40], rax
jne 0x401630
lea r8, str.Error:_malloc___returned_NULL.
lea ecx, [rax + 2]
xor edx, edx
call qword [rbx + 0x298]
xor eax, eax
jmp 0x40185b
mov qword [rsp + 0x4c0], rsi
mov r8, r15
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x4b8], rdi
mov qword [rsp + 0x4a0], r14
call fcn.00416230
xor esi, esi
xor r14d, r14d
xor edi, edi
cmp byte [r12], sil
mov qword [rsp + 0x48], rsi
je 0x401840
nop
nop
movzx r8d, byte [rdi + r12]
inc esi
inc rdi
mov eax, r8d
shr r8d, 4
and eax, 0xf
cmp esi, r13d
jae 0x4018d3
xor ebx, ebx
xor ecx, ecx
test eax, eax
mov qword [rsp + 0x30], rbx
movsxd rdx, eax
jle 0x4016c4
nop
movzx eax, byte [rdi + r12]
inc esi
inc rdi
cmp esi, r13d
mov byte [rsp + rcx + 0x30], al
jae 0x4018ec
inc rcx
cmp rcx, rdx
jl 0x4016a0
mov rbx, qword [rsp + 0x30]
xor eax, eax
xor edx, edx
test r8d, r8d
mov qword [rsp + 0x30], rax
mov ecx, r8d
jle 0x401704
nop
nop
nop
movzx eax, byte [rdi + r12]
inc esi
inc rdi
cmp esi, r13d
mov byte [rsp + rdx + 0x30], al
jae 0x4018ec
inc rdx
cmp rdx, rcx
jl 0x4016e0
mov rax, qword [rsp + 0x30]
cmp byte [rsp + rdx + 0x2f], 0x80
jb 0x40172b
cmp rdx, 8
jge 0x40172b
lea rcx, [rsp + rdx + 0x30]
mov r8d, 8
sub r8, rdx
mov dl, 0xff
call fcn.00416230
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
add r14, rbx
add rcx, rax
test rax, rax
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x48], rcx
je 0x4018c9
test rbx, rbx
je 0x4018bf
mov rax, qword [rsp + 0x38]
sub r14, rbx
mov rbp, qword [rax + 0x118]
imul rbp, qword [rax + 0x120]
imul r14, rbp
mov r8, rbp
imul rbp, rbx
imul r8, rcx
mov qword [rsp + 0x50], r8
lea rax, [r14 + rbp]
test rax, rax
je 0x4018b0
cmp r15, r14
jbe 0x4018a4
cmp r15, rax
jae 0x40179e
mov rbp, r15
sub rbp, r14
test rbp, rbp
je 0x401898
mov rbx, qword [rsp + 0x38]
xor edx, edx
mov rax, r8
mov rcx, qword [rbx + 0x118]
lea r8, str.____Reading__I64u_bytes_from_Lcn_I64u_into_offset_I64u
mov r9, rbp
mov qword [rsp + 0x28], r14
imul rcx, qword [rbx + 0x120]
div rcx
xor edx, edx
lea ecx, [rdx + 6]
mov qword [rsp + 0x20], rax
call qword [rbx + 0x298]
mov rax, qword [rsp + 0x40]
mov r11, qword [rsp + 0x50]
mov rcx, qword [rbx + 0x28]
lea rdx, [r14 + rax]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x70], r11d
shr r11, 0x20
lea r9, [rsp + 0x58]
mov r8d, ebp
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x78], 0
mov dword [rsp + 0x74], r11d
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40190a
mov r14, qword [rsp + 0x30]
cmp byte [rdi + r12], 0
jne 0x401670
mov rbp, qword [rsp + 0x40]
mov rax, rbp
mov rdi, qword [rsp + 0x4b8]
mov rsi, qword [rsp + 0x4c0]
mov r14, qword [rsp + 0x4a0]
mov rbp, qword [rsp + 0x4c8]
mov r15, qword [rsp + 0x498]
mov r13, qword [rsp + 0x4a8]
mov r12, qword [rsp + 0x4b0]
mov rbx, qword [rsp + 0x4d0]
mov rcx, qword [rsp + 0x480]
call fcn.0041e010
add rsp, 0x4d8
ret
mov rbx, qword [rsp + 0x38]
mov r14, qword [rsp + 0x30]
jmp 0x401830
mov rbx, qword [rsp + 0x38]
mov r14, qword [rsp + 0x30]
jmp 0x401830
mov rbx, qword [rsp + 0x38]
mov r14, qword [rsp + 0x30]
jmp 0x401830
mov rbx, qword [rsp + 0x38]
jmp 0x401830
mov rbx, qword [rsp + 0x38]
jmp 0x401830
xor edx, edx
lea r8, str.Error:_datarun_is_longer_than_buffer__the_MFT_may_be_corrupt.
lea ecx, [rdx + 2]
call qword [rbx + 0x298]
xor eax, eax
jmp 0x401843
mov rax, qword [rsp + 0x38]
xor edx, edx
lea r8, str.Error:_datarun_is_longer_than_buffer__the_MFT_may_be_corrupt.
lea ecx, [rdx + 2]
call qword [rax + 0x298]
xor eax, eax
jmp 0x401843
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsp + 0x80]
mov ecx, eax
call sym.JkDefragCmd64.exe_SystemErrorStr
xor edx, edx
lea r9, [rsp + 0x80]
lea ecx, [rdx + 2]
lea r8, str.Error_while_reading_disk:__s
call qword [rbx + 0x298]
mov rcx, qword [rsp + 0x40]
call fcn.004109b0
xor eax, eax
jmp 0x401843