Function at 0x18001ea60
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xb8
mov r12, qword [rbp + 0x87]
mov r11, r9
mov ebx, dword [rbp + 0x57]
mov r10, rcx
mov r13, qword [rbp - 0x11]
mov r9, r8
mov edi, dword [rbp + 0x57]
mov ecx, 0x120
mov r14, qword [rbp + 0x6f]
mov eax, edx
mov r15d, edx
imul eax, eax, 0xb8b
mov dword [rbp - 0x25], r15d
cmp r15d, eax
ja 0x18001ef10
cmp r15d, 0x5e5c
ja 0x18001edc5
je 0x18001ee70
cmp r15d, 0xd8
ja 0x18001ed54
je 0x18001eb91
cmp r15d, 0x32
je 0x18001eb68
cmp r15d, 0x5f
je 0x18001eb47
cmp r15d, 0x7a
jne 0x18001efd8
mov rax, qword [rbp + 0x77]
mov rcx, qword [rax]
mov rax, qword [rbp + 0x7f]
mov eax, dword [rax]
lea r8d, [rax + rax]
test rcx, rcx
je 0x18001eb27
mov eax, dword [r11]
inc eax
cdq
sub eax, edx
sar eax, 1
cmp dword [r14], eax
jge 0x18001eb37
mov rdx, qword [r10]
mov rcx, qword [r9]
call sub.VCRUNTIME140.dll_memcpy
jmp 0x18001efc7
mov rdx, rcx
mov rcx, qword [r9]
call sub.VCRUNTIME140.dll_memcpy
jmp 0x18001efc7
imul eax, dword [rbp + 0x57], 0xc5
mov dword [rbp - 0x39], 0
mov qword [rbp - 0x19], 0
add r15d, eax
mov eax, dword [rbp + 0x57]
jmp 0x18001eab3
mov rax, qword [0x1801edf20]
lea rcx, [0x180001920]
mov qword [rbp - 0x11], rax
mov rax, qword [r12]
test rax, rax
cmovne rcx, rax
mov qword [0x1801edf20], rcx
jmp 0x18001efd3
mov rax, qword [r12]
mov ecx, dword [rax + 0x28]
shl ecx, 5
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r13, rax
test rax, rax
je 0x18001efea
mov rcx, qword [r12]
xor eax, eax
mov dword [rbp - 0x29], eax
cmp dword [rcx + 0x30], eax
jbe 0x18001efc7
nop
mov qword [rbp - 0x21], rcx
lea r8, [rbp - 0x31]
lea rcx, [rbp - 0x21]
mov dword [rbp - 0x31], eax
xor r9d, r9d
mov edx, 0xa7
call fcn.18004c090
mov r15, rax
test rax, rax
je 0x18001ed4d
mov rcx, qword [r12]
mov esi, dword [rcx + 0x40]
test esi, esi
je 0x18001ecf9
nop word [rax + rax]
mov r14d, 0x87
nop word [rax + rax]
mov eax, r14d
sub eax, 0x85
je 0x18001ecd6
sub eax, 1
je 0x18001ec40
cmp eax, 1
jne 0x18001ece1
mov edi, 0x20
cmp esi, edi
jae 0x18001ece1
mov edi, esi
jmp 0x18001ece1
mov rax, qword [r12]
mov rdx, r13
mov r8d, dword [rax + 0x28]
mov rax, qword [rbp + 0x6f]
imul r8d, edi
mov ecx, dword [rax]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
movsxd rdx, eax
cmp rdx, 0xffffffffffffffff
je 0x18001ed43
mov rcx, qword [r12]
mov eax, dword [rcx + 0x28]
imul eax, edi
cmp rdx, rax
jne 0x18001ed1b
mov rax, qword [rcx + 8]
lea r8, [rbp - 0x21]
xor ecx, ecx
mov qword [rbp - 9], rax
mov qword [rsp + 0x60], rcx
lea rax, [rbp - 0x31]
mov qword [rsp + 0x58], r13
xor r9d, r9d
mov qword [rsp + 0x50], rax
xor edx, edx
mov dword [rsp + 0x48], SHSetFolderPathW
lea rax, [rbp - 9]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov dword [rbp - 0x31], edi
mov qword [rbp - 0x21], r15
call fcn.18006a6a0
mov ebx, eax
jmp 0x18001ece1
test ebx, ebx
jne 0x18001ed20
mov eax, edi
add r15, rax
sub esi, edi
dec r14d
cmp r14d, 0x84
ja 0x18001ec10
test esi, esi
jne 0x18001ec00
mov eax, dword [rbp - 0x29]
mov rcx, qword [r12]
inc eax
mov dword [rbp - 0x29], eax
cmp eax, dword [rcx + 0x30]
jb 0x18001ebc0
mov r14, qword [rbp + 0x6f]
mov r15d, dword [rbp - 0x25]
jmp 0x18001efc7
mov ebx, 0x7f2bb724
mov r14, qword [rbp + 0x6f]
mov rcx, r13
mov esi, 8
mov r15d, 0xa710
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esi, 0x4d0
jmp 0x18001ee12
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ebx, dword [rax]
jmp 0x18001ed20
mov ebx, 0x7f2bb73b
jmp 0x18001ed20
cmp r15d, 0x26ac
je 0x18001edab
cmp r15d, 0x497a
je 0x18001ed85
cmp r15d, 0x4d26
je 0x18001ef10
imul eax, dword [rbp + 0x57], 0xc5
add r15d, eax
mov eax, dword [rbp + 0x57]
jmp 0x18001eab3
mov r9d, 0xf9
mov r8, r12
xor edx, edx
xor ecx, ecx
call fcn.180066890
test eax, eax
jns 0x18001efc7
mov dword [rbp - 0x41], 0xffffffff
jmp 0x18001ef10
mov rax, qword [rbp - 0x11]
mov qword [rbp - 0x41], rax
imul eax, dword [rbp + 0x57], 0xc5
add r15d, eax
mov eax, dword [rbp + 0x57]
jmp 0x18001eab3
cmp r15d, 0xdbb0
ja 0x18001ef28
je 0x18001eed2
cmp r15d, 0x9295
je 0x18001ee89
cmp r15d, 0xa710
je 0x18001ee0d
cmp r15d, 0xbc3e
je 0x18001ef10
imul eax, dword [rbp + 0x57], 0xc5
add r15d, eax
mov eax, dword [rbp + 0x57]
jmp 0x18001eab3
mov esi, 8
cmp esi, 0x9a0
ja 0x18001ee5f
cmp esi, 8
je 0x18001ee33
cmp esi, 0x4d8
jne 0x18001ed38
mov dword [rbp - 0x41], ebx
jmp 0x18001ef10
mov rax, qword [r12]
lea r8, [rbp - 0x21]
xor r9d, r9d
mov qword [rbp - 0x21], rax
xor edx, edx
mov qword [rsp + 0x20], 0
mov ecx, 0x85
call fcn.18000c4a0
mov rbx, rax
jmp 0x18001ed24
mov r9, qword [rbp + 0x5f]
mov ecx, 0x120
mov r10, qword [rbp + 0x4f]
mov r11, qword [rbp + 0x67]
imul eax, dword [rbp + 0x57], 0xc5
mov dword [rbp - 0x41], 0
add r15d, eax
mov eax, dword [rbp + 0x57]
jmp 0x18001eab3
cmp word [r12 + 0x14], cx
jne 0x18001efd8
mov r9d, 0x121
lea r8, [rbp - 0x39]
xor edx, edx
mov rcx, r12
call fcn.18001c770
mov qword [rbp - 0x19], rax
test rax, rax
jne 0x18001efc7
mov eax, dword [rbp - 0x39]
lea r8, [rbp + 0x57]
mov rdx, r12
mov dword [rbp + 0x57], eax
mov ecx, 0xc0
call fcn.180017ee0
mov dword [rbp - 0x41], eax
jmp 0x18001ef10
xor r8d, r8d
mov rdx, r12
lea ecx, [r8 + 0x2a]
call fcn.180028530
test eax, eax
jg 0x18001ef09
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x18001efc7
xor r8d, r8d
mov rdx, rcx
lea ecx, [r8 + 0x2a]
call fcn.180028530
test eax, eax
je 0x18001efc7
mov dword [rbp - 0x41], 0
mov rax, qword [rbp - 0x41]
add rsp, 0xb8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
cmp r15d, 0x124cb
je 0x18001ef6d
cmp r15d, 0x16de6
je 0x18001ef55
cmp r15d, 0x1b701
je 0x18001ef10
imul eax, dword [rbp + 0x57], 0xc5
add r15d, eax
mov eax, dword [rbp + 0x57]
jmp 0x18001eab3
mov eax, dword [rbp - 0x39]
mov dword [rbp - 0x41], eax
imul eax, dword [rbp + 0x57], 0xc5
add r15d, eax
mov eax, dword [rbp + 0x57]
jmp 0x18001eab3
mov rcx, qword [rbp - 0x19]
mov edx, 0xce
mov r14, qword [rbp + 0x6f]
test rcx, rcx
mov rax, rcx
mov r8, r14
cmove rax, r12
lea rcx, [rbp - 0x31]
mov rsi, rax
mov r12, rax
mov eax, dword [r11]
mov r9, rsi
mov dword [rbp - 0x31], eax
call fcn.1800b9450
mov dword [rbp - 0x39], eax
mov ecx, eax
test eax, eax
jle 0x18001efc7
mov edx, 0x123
cmp word [rsi + 0x14], dx
jne 0x18001efc7
dec ecx
lea rdx, [r14 + 1]
mov dword [rbp - 0x39], ecx
movsxd r8, ecx
mov rcx, r14
call sub.VCRUNTIME140.dll_memmove
mov r11, qword [rbp + 0x67]
mov r10, qword [rbp + 0x4f]
mov r9, qword [rbp + 0x5f]
mov ecx, 0x120
imul eax, dword [rbp + 0x57], 0xc5
add r15d, eax
mov eax, dword [rbp + 0x57]
jmp 0x18001eab3
mov dword [rbp - 0x41], ILRemoveLastID
jmp 0x18001ef10