Function at 0x418bc0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov ebx, dword [rcx + 0x150]
mov rsi, rcx
cmp ebx, 0xffffffff
je 0x418ec0
mov rbp, qword [rcx + 0x180]
lea rcx, [0x006e2400]
movzx edi, bl
call sub.KERNEL32.dll_EnterCriticalSection
mov eax, edi
lea r9, [0x00459400]
mov rcx, rax
shl rcx, 4
add rcx, r9
mov r8, qword [rcx]
mov rdx, r8
and edx, 0xf
jne 0x418e90
test r8, r8
je 0x418e90
mov rax, qword [rcx + 8]
cmp ebx, dword [rax]
je 0x41927b
mov edx, 0x10
cmp ebx, dword [rax + 0x28]
je 0x41925d
cmp rdx, 2
je 0x418d4f
cmp ebx, dword [rax + 0x50]
je 0x419267
cmp rdx, 3
je 0x418d4f
cmp ebx, dword [rax + 0x78]
je 0x419241
cmp rdx, 4
je 0x418d4f
cmp ebx, dword [rax + 0xa0]
je 0x419248
cmp rdx, 5
je 0x418d4f
cmp ebx, dword [rax + 0xc8]
je 0x41924f
cmp rdx, 6
je 0x418d4f
cmp ebx, dword [rax + 0xf0]
je 0x419256
cmp rdx, 7
je 0x418d4f
cmp ebx, dword [rax + 0x118]
je 0x4191d8
cmp rdx, 8
je 0x418d4f
cmp ebx, dword [rax + 0x140]
je 0x419210
cmp rdx, 9
je 0x418d4f
cmp ebx, dword [rax + 0x168]
je 0x419217
cmp rdx, 0xa
je 0x418d4f
cmp ebx, dword [rax + 0x190]
je 0x41921e
cmp rdx, 0xb
je 0x418d4f
cmp ebx, dword [rax + 0x1b8]
je 0x419225
cmp rdx, 0xc
je 0x418d4f
cmp ebx, dword [rax + 0x1e0]
je 0x41922c
cmp rdx, 0xd
je 0x418d4f
cmp ebx, dword [rax + 0x208]
je 0x419233
cmp rdx, 0xe
je 0x418d4f
cmp ebx, dword [rax + 0x230]
je 0x41923a
cmp rdx, 0x10
jne 0x418d4f
cmp ebx, dword [rax + 0x258]
je 0x419271
mov rax, qword [rax + 0x280]
test rax, rax
jne 0x418d68
jmp 0x418ee0
test cl, cl
je 0x418e32
cmp ebx, dword [rax]
je 0x419020
cmp ebx, dword [rax + 0x28]
je 0x419030
cmp ebx, dword [rax + 0x50]
je 0x419040
cmp ebx, dword [rax + 0x78]
je 0x419050
cmp ebx, dword [rax + 0xa0]
je 0x4190d0
cmp ebx, dword [rax + 0xc8]
je 0x4190e0
cmp ebx, dword [rax + 0xf0]
je 0x4190f0
cmp ebx, dword [rax + 0x118]
je 0x419100
cmp ebx, dword [rax + 0x140]
je 0x419130
cmp ebx, dword [rax + 0x168]
je 0x419140
cmp ebx, dword [rax + 0x190]
je 0x419150
cmp ebx, dword [rax + 0x1b8]
je 0x419160
cmp ebx, dword [rax + 0x1e0]
je 0x419170
cmp ebx, dword [rax + 0x208]
je 0x419180
cmp ebx, dword [rax + 0x230]
je 0x419190
cmp ebx, dword [rax + 0x258]
je 0x4191a0
mov ecx, 1
xor edx, edx
mov rax, qword [rax + 0x280]
test rax, rax
jne 0x418d60
test rdx, rdx
je 0x418ee0
mov rax, qword [rdx + 8]
lea rcx, [0x006e2400]
mov qword [rsp + 0x50], rax
mov rax, qword [rdx + 0x10]
mov qword [rsp + 0x58], rax
mov rax, qword [rdx + 0x18]
mov qword [rsp + 0x60], rax
mov rax, qword [rdx + 0x20]
mov qword [rsp + 0x68], rax
call sub.KERNEL32.dll_LeaveCriticalSection
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.00418410
nop
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
shl rax, 4
test rdx, rdx
mov rax, qword [r9 + rax + 8]
je 0x418d4f
cmp ebx, dword [rax]
je 0x41927b
cmp rdx, 1
jne 0x418c34
jmp 0x418d4f
mov qword [rcx + 0x88], 0xfffffffffffff00d
mov dword [rcx + 0x14c], 6
jmp 0x418e79
lea rcx, [0x006e2400]
call sub.KERNEL32.dll_LeaveCriticalSection
mov ecx, ebx
call qword [sym.imp.msvcrt.dll__get_osfhandle]
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x419283
cmp rbp, 0xffffffffffffffff
je 0x419060
mov rax, qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov qword [rsp + 0x50], 0
mov r9d, 1
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
lea r8, [rsp + 0x48]
mov qword [rsp + 0x68], 0
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x38], rax
xor r14d, r14d
xor r15d, r15d
call rax
lea r13, [rsp + 0x50]
mov dword [rsp + 0x34], eax
lea r12, [rsp + 0x44]
mov rdi, qword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x418f7d
cmp r14d, dword [rsi + 0x170]
jae 0x419110
mov eax, r15d
mov r9, r12
mov rcx, rbx
add rax, rbp
mov dword [rsp + 0x60], eax
sar rax, 0x20
mov dword [rsp + 0x64], eax
mov eax, r14d
add r14d, 1
shl rax, 4
add rax, qword [rsi + 0x178]
mov rdx, qword [rax + 8]
mov qword [rsp + 0x20], r13
mov r8d, dword [rax]
call rdi
add r15d, dword [rsp + 0x44]
test eax, eax
jne 0x418f70
mov edx, dword [rsp + 0x34]
xor edi, edi
test edx, edx
jne 0x4191af
test r15d, r15d
jne 0x41911c
test dil, dil
jne 0x41911c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x4191c9
cmp eax, 0x26
je 0x4190b7
cmp eax, 0x6d
je 0x4190b7
mov ecx, eax
mov dword [rsi + 0x14c], eax
call fcn.00416500
cdqe
mov qword [rsi + 0x88], rax
jmp 0x418e79
xor edx, edx
add rdx, rax
sete cl
jmp 0x418e22
mov edx, 0x28
jmp 0x419022
mov edx, 0x50
jmp 0x419022
mov edx, 0x78
jmp 0x419022
xor ebp, ebp
xor r15d, r15d
lea r12, [rsp + 0x44]
mov rdi, qword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x41907f
cmp dword [rsi + 0x170], ebp
jbe 0x41911c
mov eax, ebp
mov r9, r12
mov rcx, rbx
shl rax, 4
add rax, qword [rsi + 0x178]
add ebp, 1
mov rdx, qword [rax + 8]
mov qword [rsp + 0x20], 0
mov r8d, dword [rax]
call rdi
add r15d, dword [rsp + 0x44]
test eax, eax
jne 0x419073
xor edi, edi
jmp 0x418fcc
mov qword [rsi + 0x88], 0
jmp 0x418e79
mov edx, 0xa0
jmp 0x419022
mov edx, 0xc8
jmp 0x419022
mov edx, 0xf0
jmp 0x419022
mov edx, 0x118
jmp 0x419022
mov eax, dword [rsp + 0x34]
test eax, eax
jne 0x4191aa
mov eax, r15d
mov qword [rsi + 0x88], rax
jmp 0x418e79
mov edx, 0x140
jmp 0x419022
mov edx, 0x168
jmp 0x419022
mov edx, 0x190
jmp 0x419022
mov edx, 0x1b8
jmp 0x419022
mov edx, 0x1e0
jmp 0x419022
mov edx, 0x208
jmp 0x419022
mov edx, 0x230
jmp 0x419022
mov edx, 0x258
jmp 0x419022
mov edi, 1
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x48]
mov rcx, rbx
mov rax, qword [rsp + 0x38]
call rax
jmp 0x418fcc
mov ecx, 0x3ec
mov eax, 0x3ec
jmp 0x419001
mov edx, 7
nop dword [rax]
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8]
mov rax, qword [rax + 0x280]
test rdx, rdx
jne 0x418e32
test rax, rax
jne 0x418d68
jmp 0x418e32
mov edx, 8
jmp 0x4191e0
mov edx, 9
jmp 0x4191e0
mov edx, 0xa
jmp 0x4191e0
mov edx, 0xb
jmp 0x4191e0
mov edx, 0xc
jmp 0x4191e0
mov edx, 0xd
jmp 0x4191e0
mov edx, 0xe
jmp 0x4191e0
mov edx, 3
jmp 0x4191e0
mov edx, 4
jmp 0x4191e0
mov edx, 5
jmp 0x4191e0
mov edx, 6
jmp 0x4191e0
mov edx, 1
jmp 0x4191e0
mov edx, 2
jmp 0x4191e0
mov edx, 0xf
jmp 0x4191e0
mov rdx, rax
jmp 0x418e32
mov dword [rsi + 0x14c], 6
mov ecx, 6
call fcn.00416500
cdqe
mov qword [rsi + 0x88], rax
jmp 0x418e79