Function at 0x1400033b8
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rcx, qword [0x14002fa0b]
movzx r13d, r9w
mov r14, rdx
call fcn.140004268
xor edi, edi
lea rcx, [0x14002fa28]
mov esi, edi
mov r15, rax
call fcn.140004474
mov r12, rax
test rax, rax
je 0x140003449
mov ebx, edi
mov rdx, rbx
lea rcx, [0x14002fa28]
call fcn.140003008
mov rcx, qword [rax + 8]
shl rcx, 2
cmp r14, rcx
jb 0x140003449
mov rdx, rbx
lea rcx, [0x14002fa28]
call fcn.140003008
inc esi
movsxd rbx, esi
mov rcx, qword [rax + 8]
shl rcx, 2
sub r14, rcx
cmp rbx, r12
jb 0x140003409
lea rcx, [0x14002fa28]
movsxd rbx, esi
call fcn.140004474
cmp rbx, rax
jne 0x140003469
lea rcx, str._MFTParseDirectory___wrong_nMFTEntry
jmp 0x1400038b5
mov rdx, rbx
lea rcx, [0x14002fa28]
call fcn.140003008
movzx ecx, word [0x14002f9e8]
xor r9d, r9d
imul r14, qword [0x14002fa0b]
movzx edx, byte [0x14002f9ea]
xor r8d, r8d
imul rdx, rcx
imul rdx, qword [rax]
add rdx, r14
mov r14, qword [rbp + 0x40]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov r8d, dword [0x14002fa0b]
xor r9d, r9d
mov rdx, r15
mov qword [rsp + 0x20], rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400034e4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str._MFTParseDirectory___Read_MFT_entry_error:__d
call fcn.1400040fc
jmp 0x1400038ba
mov rdx, qword [0x14002fa0b]
mov rcx, r15
call fcn.1400030b0
cmp dword [r15], 0x454c4946
je 0x140003508
lea rcx, str._MFTParseDirectory___RootDirectory_Error
jmp 0x1400038b5
movzx ebx, word [r15 + 0x14]
mov ecx, 0xffffffff
add rbx, r15
mov eax, dword [rbx]
cmp eax, ecx
je 0x1400038ae
mov r12d, 0x90
cmp eax, 0x20
je 0x1400035c0
mov r14, qword [rbp + 0x50]
cmp eax, r12d
jne 0x14000359c
cmp byte [rbx + 8], 1
je 0x140003604
movzx eax, word [rbx + 0x14]
cmp byte [rax + rbx + 0x1c], dil
jne 0x140003590
mov edx, dword [rax + rbx + 0x14]
lea rcx, [rax + 0x20]
add rdx, rax
add rcx, rbx
add rdx, rbx
mov r8, r14
call fcn.140004004
mov ecx, 0xffffffff
mov rsi, rax
cmp rax, rcx
je 0x1400035f8
test rax, rax
je 0x1400035a3
mov edx, 1
mov rcx, r15
call fcn.140007374
mov rax, rsi
jmp 0x1400038bc
cmp r13w, r12w
je 0x1400038ba
jmp 0x1400035a3
cmp eax, 0xa0
je 0x140003610
mov eax, dword [rbx + 4]
add rbx, rax
mov eax, dword [rbx]
cmp eax, ecx
je 0x1400038ae
cmp eax, 0x20
jne 0x140003532
mov r14, qword [rbp + 0x40]
movzx esi, word [rbx + 0x14]
add rsi, rbx
movabs rbx, 0xffffffffffff
cmp dword [rsi], r12d
jne 0x140003875
mov rdx, qword [rsi + 0x10]
mov r9d, r12d
mov r8, qword [rbp + 0x50]
and rdx, rbx
mov rcx, r14
call fcn.1400033b8
mov rdi, rax
jmp 0x14000388e
lea rcx, str._MFTParseDirectory___IndexEntry_parsing_error
jmp 0x1400038b5
lea rcx, str._MFTParseDirectory____INDEX_ROOT_not_resident
jmp 0x1400038b5
cmp byte [rbx + 8], dil
jne 0x140003622
lea rcx, str._MFTParseDirectory____INDEX_ALLOCATE_not_nonresident
jmp 0x1400038b5
lea rcx, [rbp - 0x20]
call fcn.140002ed8
movzx esi, word [rbx + 0x20]
mov r13, rdi
mov rax, qword [rbx + 0x18]
add rsi, rbx
mov r14, rdi
add rax, 1
je 0x140003709
mov eax, dword [rbx + 4]
add rax, rbx
cmp rsi, rax
jae 0x140003709
movzx edx, byte [rsi]
mov r12, qword [rsi + 1]
mov r9d, edx
shr r9d, 4
and edx, 0xf
cmp edx, 8
jae 0x140003682
or rax, 0xffffffffffffffff
lea ecx, [rdx*8]
shr rax, cl
shl rax, cl
not rax
and r12, rax
or r8, 0xffffffffffffffff
lea r10d, [r9*8]
mov ecx, r10d
shr r8, cl
shl r8, cl
not r8
and r8, qword [rdx + rsi + 1]
inc edx
add edx, r9d
add rsi, rdx
test r8, r8
je 0x1400036f9
cmp r9d, 8
jae 0x1400036f6
lea ecx, [r10 - 1]
mov rax, r8
sar rax, cl
cmp rax, 1
jne 0x1400036de
mov ecx, r10d
mov qword [rbp - 0x38], r12
lea rdx, [rbp - 0x40]
shl eax, cl
movsxd rcx, eax
sub r8, rcx
add r14, r8
mov qword [rbp - 0x40], r14
jmp 0x1400036ed
add r14, r8
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x30], r14
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x20]
call fcn.140004450
add r13, r12
mov rax, qword [rbx + 0x18]
inc rax
cmp r13, rax
jb 0x140003646
lea rcx, [rbp - 0x20]
mov rbx, rdi
mov r12d, edi
call fcn.140004474
test rax, rax
je 0x140003823
mov r14, rdi
mov rdx, r14
lea rcx, [rbp - 0x20]
mov r13d, edi
call fcn.140003008
cmp qword [rax + 8], rdi
jbe 0x14000380b
mov rsi, rdi
mov rdx, r14
lea rcx, [rbp - 0x20]
call fcn.140003008
mov rcx, qword [0x14002fa13]
mov rbx, qword [rax]
add rbx, rsi
call fcn.140004268
imul rbx, qword [0x14002fa13]
mov rcx, qword [rbp + 0x40]
xor r9d, r9d
mov rdx, rbx
xor r8d, r8d
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov r8d, dword [0x14002fa13]
xor r9d, r9d
mov rcx, qword [rbp + 0x40]
mov rdx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000385f
mov rdx, qword [0x14002fa13]
mov rcx, rsi
call fcn.1400030b0
cmp dword [rsi], 0x58444e49
jne 0x140003851
mov ecx, dword [rsi + 0x18]
mov edx, dword [rsi + 0x1c]
add rcx, 0x18
mov r8, qword [rbp + 0x50]
add rcx, rsi
add rdx, rsi
call fcn.140004004
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140003848
mov edx, 1
mov rcx, rsi
test rax, rax
jne 0x140003841
call fcn.140007374
inc r13d
lea rcx, [rbp - 0x20]
mov rdx, r14
movsxd rsi, r13d
call fcn.140003008
cmp rsi, qword [rax + 8]
jb 0x140003740
inc r12d
lea rcx, [rbp - 0x20]
movsxd r14, r12d
call fcn.140004474
cmp r14, rax
jb 0x140003724
mov edx, 1
mov rcx, r15
call fcn.140007374
mov rdi, rbx
lea rcx, [rbp - 0x20]
call fcn.140002fd8
mov rax, rdi
jmp 0x1400038bc
call fcn.140007374
jmp 0x140003823
lea rcx, str._MFTParseDirectory___IndexEntry_parsing_error
jmp 0x140003858
lea rcx, str._MFTParseDirectory___Indx_Type_Error
call fcn.1400040fc
jmp 0x140003833
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str._MFTParseDirectory___Read_MFT_entry_error:__d
call fcn.1400040fc
jmp 0x140003833
cmp dword [rsi], 0xa0
jne 0x14000388e
mov rdx, qword [rsi + 0x10]
lea rax, [rdi - 1]
and rdx, rbx
cmp rax, 0xfffffffffffffffd
ja 0x14000389a
movzx eax, word [rsi + 4]
add rsi, rax
jmp 0x1400035d1
mov r8, qword [rbp + 0x50]
mov r9d, 0xa0
mov rcx, r14
call fcn.1400033b8
jmp 0x1400038bc
lea rcx, str._MFTParseDirectory___Something_Went_Wrong_1
call fcn.1400040fc
xor eax, eax
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret