Function at 0x1400ddcf0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push r12
push r13
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xb0
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rbp - 1], rax
xor r15d, r15d
mov qword [rbp - 0x19], r9
mov r12, r8
mov qword [rbp - 0x21], r8
mov qword [rbp - 0x29], rdx
mov r13d, r15d
mov dword [rbp - 0x55], r15d
mov dword [rbp - 0x2d], r15d
mov dword [rbp - 0x3d], r15d
mov dword [rbp - 0x45], r15d
mov dword [rbp - 0x39], r15d
mov dword [rbp - 0x31], r15d
mov dword [rbp - 0x51], r15d
mov dword [rbp - 0x41], r15d
test r8, r8
je 0x1400ddd50
mov dword [r8], r15d
test r9, r9
je 0x1400ddd58
mov dword [r9], r15d
lea rdx, [0x140183378]
call fcn.1400fafe4
mov rdi, rax
test rax, rax
je 0x1400de409
cmp dword [rbp + 0x7f], 0x73
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0x98], r14
mov ebx, 1
jne 0x1400dde6d
xor r8d, r8d
xor edx, edx
mov rcx, rax
mov esi, r15d
call fcn.1400fad50
mov edx, ebx
mov ecx, 0x4010
call fcn.1400f97a4
mov rbx, rax
test rax, rax
je 0x1400dde45
mov r14d, r15d
mov eax, r15d
test eax, eax
jne 0x1400dde38
lea edx, [rax + 1]
mov r9, rdi
mov r8d, 0x4000
mov rcx, rbx
call fcn.1400fabdc
mov edx, r15d
mov rax, r15
cmp byte [rax + rbx], 0x45
jne 0x1400dde19
cmp byte [rax + rbx + 1], 0x78
jne 0x1400dde19
cmp byte [rax + rbx + 2], 0x69
jne 0x1400dde19
cmp byte [rax + rbx + 3], 0x66
jne 0x1400dde19
movzx ecx, byte [rax + rbx + 6]
cmp cl, 0x49
jne 0x1400dde0e
cmp byte [rax + rbx + 7], cl
je 0x1400dde54
cmp cl, 0x4d
jne 0x1400dde19
cmp byte [rax + rbx + 7], cl
je 0x1400dde54
inc rax
inc edx
cmp rax, 0x3ff8
jl 0x1400ddde3
mov eax, dword [rbp - 0x55]
inc r14d
add esi, 0x4000
cmp r14d, 3
jl 0x1400dddc5
mov rcx, rbx
call fcn.1400f97e8
test r13d, r13d
jne 0x1400dde64
mov rcx, rdi
call fcn.1400fa904
xor eax, eax
jmp 0x1400de3f1
lea eax, [rsi + 6]
mov r13d, 1
add eax, edx
mov dword [rbp - 0x55], eax
jmp 0x1400dde29
mov r13d, dword [rbp - 0x55]
mov ebx, 1
xor r8d, r8d
mov edx, r13d
mov rcx, rdi
call fcn.1400fad50
lea rcx, [rbp - 0x49]
mov r9, rdi
mov r8d, 2
mov rdx, rbx
call fcn.1400fabdc
mov eax, 0x4d4d
lea rcx, [rbp - 0x49]
cmp word [rbp - 0x49], ax
mov esi, r15d
mov r9, rdi
mov r8, rbx
mov edx, 2
cmove esi, ebx
call fcn.1400fabdc
lea rcx, [rbp - 0x35]
mov r9, rdi
mov r8, rbx
mov edx, 4
call fcn.1400fabdc
test esi, esi
je 0x1400ddef7
mov ecx, dword [rbp - 0x35]
mov edx, ecx
mov eax, ecx
shr eax, 0x10
and edx, 0xff0000
or edx, eax
mov eax, ecx
and ecx, 0xff00
shl eax, 0x10
shr edx, 8
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp - 0x35], edx
jmp 0x1400ddefa
mov edx, dword [rbp - 0x35]
mov r14d, dword [rbp + 0x77]
test edx, edx
je 0x1400de15c
mov rcx, rdi
cmp edx, 0xffff
jae 0x1400dde48
add edx, r13d
xor r8d, r8d
call fcn.1400fad50
test eax, eax
jne 0x1400de15c
lea edx, [rax + 2]
lea rcx, [rbp - 0x59]
mov r9, rdi
mov r8, rbx
call fcn.1400fabdc
movzx eax, word [rbp - 0x59]
test esi, esi
je 0x1400ddf4a
rol ax, 8
mov word [rbp - 0x59], ax
mov ebx, r15d
mov r13d, 0x200
mov r12d, 1
mov r14d, ebx
nop dword [rax]
movzx ecx, ax
cmp ax, r13w
jb 0x1400ddf6c
mov ecx, r13d
mov r9, rdi
cmp ebx, ecx
jae 0x1400de04b
xor eax, eax
lea rcx, [rbp - 0x11]
mov rdx, r12
lea r8d, [rax + 0xc]
mov qword [rbp - 0x11], rax
mov dword [rbp - 9], eax
call fcn.1400fabdc
movzx r8d, word [rbp - 0x11]
test esi, esi
je 0x1400ddffe
rol word [rbp - 0xf], 8
mov ecx, dword [rbp - 0xd]
mov edx, ecx
rol r8w, 8
mov eax, ecx
shr eax, 0x10
and edx, 0xff0000
mov word [rbp - 0x11], r8w
or edx, eax
mov eax, ecx
and ecx, 0xff00
shl eax, 0x10
shr edx, 8
or eax, ecx
mov ecx, dword [rbp - 9]
shl eax, 8
or edx, eax
mov eax, ecx
shr eax, 0x10
mov dword [rbp - 0xd], edx
mov edx, ecx
and edx, 0xff0000
or edx, eax
mov eax, ecx
and ecx, 0xff00
shl eax, 0x10
shr edx, 8
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp - 9], edx
jmp 0x1400de001
mov edx, dword [rbp - 9]
mov ecx, 0x8769
cmp r8w, cx
jne 0x1400de01a
movzx eax, word [rbp - 0x59]
mov dword [rbp - 0x2d], edx
inc ebx
jmp 0x1400ddf60
mov ecx, 0x8825
cmp r8w, cx
jne 0x1400de033
movzx eax, word [rbp - 0x59]
mov dword [rbp - 0x51], edx
inc ebx
jmp 0x1400ddf60
movzx eax, word [rbp - 0x59]
mov ecx, 0x111
cmp r8w, cx
cmove r14d, edx
inc ebx
jmp 0x1400ddf60
mov rbx, r12
lea rcx, [rbp - 0x45]
mov edx, 4
mov r8, rbx
mov dword [rbp - 0x31], r14d
call fcn.1400fabdc
mov r12, qword [rbp - 0x21]
mov r14d, dword [rbp + 0x77]
mov r13d, dword [rbp - 0x55]
test esi, esi
je 0x1400de09c
mov ecx, dword [rbp - 0x45]
mov edx, ecx
mov eax, ecx
shr eax, 0x10
and edx, 0xff0000
or edx, eax
mov eax, ecx
shl ecx, 0x10
and eax, 0xff00
shr edx, 8
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp - 0x45], edx
mov eax, dword [rbp - 0x2d]
test eax, eax
je 0x1400de0ec
lea edx, [rax + r13]
xor r8d, r8d
mov rcx, rdi
call fcn.1400fad50
test eax, eax
jne 0x1400de0ec
lea edx, [rax + 2]
lea rcx, [rbp - 0x59]
mov r9, rdi
mov r8, rbx
call fcn.1400fabdc
movzx eax, word [rbp - 0x59]
test esi, esi
je 0x1400de0d8
rol ax, 8
mov word [rbp - 0x59], ax
movzx eax, ax
mov r8d, ebx
mov rcx, rdi
lea edx, [rax + rax*2]
shl edx, 2
call fcn.1400fad50
mov eax, dword [rbp - 0x51]
test eax, eax
je 0x1400de15c
test r14d, r14d
jne 0x1400de15c
lea edx, [rax + r13]
xor r8d, r8d
mov rcx, rdi
mov dword [rbp - 0x41], eax
mov dword [rbp - 0x51], eax
call fcn.1400fad50
test eax, eax
jne 0x1400de15c
lea edx, [rax + 2]
lea rcx, [rbp - 0x59]
mov r9, rdi
mov r8, rbx
call fcn.1400fabdc
movzx eax, word [rbp - 0x59]
test esi, esi
je 0x1400de133
rol ax, 8
mov word [rbp - 0x59], ax
movzx edx, ax
lea rax, [rbp - 0x51]
lea r9, [rbp - 0x11]
mov r8d, esi
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.1400dbc90
mov ebx, dword [rbp - 0x51]
add ebx, r13d
mov dword [rbp - 0x41], ebx
mov ebx, 1
mov eax, dword [rbp - 0x45]
test eax, eax
je 0x1400de294
lea edx, [rax + r13]
xor r8d, r8d
mov rcx, rdi
call fcn.1400fad50
test eax, eax
jne 0x1400de294
lea edx, [rax + 2]
lea rcx, [rbp - 0x59]
mov r9, rdi
mov r8, rbx
call fcn.1400fabdc
movzx eax, word [rbp - 0x59]
test esi, esi
je 0x1400de1a0
rol ax, 8
mov word [rbp - 0x59], ax
mov ebx, r15d
mov r13d, 0x200
mov r12d, 1
mov r14d, ebx
movzx ecx, ax
cmp ax, r13w
jb 0x1400de1be
mov ecx, r13d
cmp ebx, ecx
jae 0x1400de284
xor eax, eax
lea rcx, [rbp - 0x11]
mov r9, rdi
lea r8d, [rax + 0xc]
mov rdx, r12
mov qword [rbp - 0x11], rax
mov dword [rbp - 9], eax
call fcn.1400fabdc
movzx r8d, word [rbp - 0x11]
test esi, esi
je 0x1400de250
rol word [rbp - 0xf], 8
mov ecx, dword [rbp - 0xd]
mov edx, ecx
rol r8w, 8
mov eax, ecx
shr eax, 0x10
and edx, 0xff0000
mov word [rbp - 0x11], r8w
or edx, eax
mov eax, ecx
and ecx, 0xff00
shl eax, 0x10
shr edx, 8
or eax, ecx
mov ecx, dword [rbp - 9]
shl eax, 8
or edx, eax
mov eax, ecx
shr eax, 0x10
mov dword [rbp - 0xd], edx
mov edx, ecx
and edx, 0xff0000
or edx, eax
mov eax, ecx
and ecx, 0xff00
shl eax, 0x10
shr edx, 8
or eax, ecx
shl eax, 8
or edx, eax
mov dword [rbp - 9], edx
jmp 0x1400de253
mov edx, dword [rbp - 9]
mov ecx, 0x201
cmp r8w, cx
jne 0x1400de26c
movzx eax, word [rbp - 0x59]
mov dword [rbp - 0x3d], edx
inc ebx
jmp 0x1400de1b2
movzx eax, word [rbp - 0x59]
mov ecx, 0x202
cmp r8w, cx
cmove r14d, edx
inc ebx
jmp 0x1400de1b2
mov r12, qword [rbp - 0x21]
mov r13d, dword [rbp - 0x55]
mov dword [rbp - 0x39], r14d
mov r14d, dword [rbp + 0x77]
cmp r14d, 1
jne 0x1400de2ba
mov rcx, rdi
call fcn.1400fa904
mov rdx, qword [rbp - 0x19]
test rdx, rdx
je 0x1400de2b0
mov ecx, dword [rbp - 0x3d]
mov dword [rdx], ecx
mov eax, 1
jmp 0x1400de3f1
mov ecx, dword [rbp - 0x3d]
lea eax, [rcx - 1]
cmp eax, 0xfffd
ja 0x1400de2f0
lea edx, [rcx + r13]
xor r8d, r8d
mov rcx, rdi
call fcn.1400fad50
mov r14d, 1
test eax, eax
jne 0x1400de2f6
mov edx, dword [rbp - 0x39]
mov r8d, r14d
mov rcx, rdi
call fcn.1400fad50
jmp 0x1400de2f6
mov r14d, 1
mov rcx, rdi
call fcn.1400fe108
mov ecx, dword [rbp - 0x31]
cmp dword [rbp - 0x41], eax
cmova eax, dword [rbp - 0x41]
sub eax, r13d
add eax, 8
mov dword [r12], eax
cmp eax, ecx
jae 0x1400de320
lea eax, [rcx + 0x200]
mov dword [r12], eax
mov ecx, dword [r12]
cmp ecx, 0xffff
jbe 0x1400de336
mov dword [r12], 0xffff
jmp 0x1400de34e
test ecx, ecx
je 0x1400de3db
mov edx, 0x800
mov eax, ecx
cmp ecx, edx
cmovb eax, edx
mov dword [r12], eax
xor r8d, r8d
mov edx, r13d
mov rcx, rdi
call fcn.1400fad50
test eax, eax
jne 0x1400de3db
mov ecx, dword [r12]
call fcn.1400fa250
mov rbx, qword [rbp - 0x29]
mov qword [rbx], rax
test rax, rax
je 0x1400de3df
mov r8d, dword [r12]
xor edx, edx
mov rcx, rax
call fcn.1400f9ab0
xor eax, eax
mov qword [rbp - 0x51], rax
mov dword [rbp - 0x4f], 0x66697845
test esi, esi
je 0x1400de3a4
movzx eax, byte [r12]
mov byte [rbp - 0x51], al
movzx eax, byte [r12 + 1]
jmp 0x1400de3b2
movzx eax, byte [r12 + 1]
mov byte [rbp - 0x51], al
movzx eax, byte [r12]
mov rcx, qword [rbx]
mov byte [rbp - 0x50], al
mov rax, qword [rbp - 0x51]
mov qword [rcx], rax
mov r8d, dword [r12]
mov rcx, qword [rbx]
sub r8d, 8
add rcx, 8
mov r9, rdi
mov rdx, r14
call fcn.1400fabdc
jmp 0x1400de3df
mov rbx, qword [rbp - 0x29]
mov rcx, rdi
call fcn.1400fa904
cmp qword [rbx], r15
setne r15b
mov eax, r15d
mov rsi, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0xa8]
mov r14, qword [rsp + 0x98]
mov rcx, qword [rbp - 1]
xor rcx, rsp
call fcn.1400f9a80
add rsp, 0xb0
pop r15
pop r13
pop r12
pop rdi
pop rbp
ret