Function at 0x140050930
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0xc460
call sub.ntdll.dll___chkstk
sub rsp, rax
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + 0xc450], rax
mov rbx, rcx
mov r14, r8
mov r13, rdx
lea rcx, [rsp + 0x52]
xor edx, edx
mov r8d, reloc.MFC80U.DLL_Ordinal_1022
mov word [rsp + 0x50], 0
call sub.ntdll.dll_memset
lea rdx, [0x1402e0f18]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_wcsstr]
test rax, rax
jne 0x140050a14
cmp word [rbx], 0x5c
je 0x140050a14
cmp word [rbx + 2], 0x5c
je 0x140050a14
lea rdx, [rsp + 0x50]
mov r8d, 0x400
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x50]
mov dx, 0x5c
call qword [sym.imp.ntdll.dll_wcsrchr]
test rax, rax
je 0x1400509cf
mov word [rax], 0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x50]
repne scasw ax, word [rdi]
mov eax, dword [0x1403b5bbc]
or rcx, 0xffffffffffffffff
mov dword [rdi - 2], eax
xor eax, eax
lea rdi, [rsp + 0x50]
repne scasw ax, word [rdi]
xor ecx, ecx
nop
nop
nop
movzx eax, word [rbx + rcx]
add rcx, 2
test ax, ax
mov word [rdi + rcx - 4], ax
jne 0x140050a00
jmp 0x140050a31
lea rcx, [rsp + 0x50]
sub rcx, rbx
nop
movzx eax, word [rbx]
add rbx, 2
test ax, ax
mov word [rcx + rbx - 2], ax
jne 0x140050a20
xor r15d, r15d
lea rcx, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x30], r15
lea r8d, [r15 + 3]
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov ebp, r15d
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea r12d, [r15 + 1]
cmp rax, 0xffffffffffffffff
mov rsi, rax
je 0x140050baf
lea rcx, [rsp + 0x450]
xor edx, edx
mov r8d, 0x2000
call sub.ntdll.dll_memset
lea rdi, [rsp + 0x450]
mov ebx, r15d
nop
nop
nop
lea r9, [rsp + 0x40]
mov r8d, 2
mov rdx, rdi
mov rcx, rsi
mov dword [rsp + 0x40], r15d
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140050b8a
cmp dword [rsp + 0x40], ebp
je 0x140050b8a
movzx eax, word [rdi]
add ebx, r12d
add rdi, 2
cmp ax, 0xa
je 0x140050aeb
cmp ebx, 0x1000
jb 0x140050aa0
mov word [rdi], bp
cmp byte [rsp + 0x450], 0xff
jne 0x140050b43
cmp byte [rsp + 0x451], 0xfe
jne 0x140050b43
movzx edx, word [rsp + 0x452]
mov edi, r15d
lea rcx, [rsp + 0x452]
test dx, dx
je 0x140050b38
lea rax, [rsp + 0x450]
add rcx, 2
mov word [rax], dx
add edi, r12d
mov dx, word [rcx]
add rax, 2
test dx, dx
jne 0x140050b22
movsxd rax, edi
mov word [rsp + rax*2 + 0x450], bp
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x450]
repne scasw ax, word [rdi]
not rcx
sub rcx, r12
cmp ecx, 2
jl 0x140050b90
movsxd rax, ecx
cmp word [rsp + rax*2 + 0x44c], 0xd
jne 0x140050b90
cmp word [rsp + rax*2 + reloc.MFC80U.DLL_Ordinal_1102], 0xa
jne 0x140050b90
mov word [rsp + rax*2 + Ordinal_1102], bp
mov word [rsp + rax*2 + reloc.MFC80U.DLL_Ordinal_1102], bp
jmp 0x140050b90
mov eax, ebx
mov word [rdi + rax*2], bp
cmp byte [rsp + 0x450], 0xff
jne 0x140050ba6
cmp byte [rsp + 0x451], 0xfe
cmove ebp, r12d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
mov qword [rsp + 0x30], r15
lea rcx, [rsp + 0x50]
lea r8d, [r9 + 3]
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov r12, rax
jne 0x140050beb
xor eax, eax
jmp 0x140050fcd
lea rcx, [rsp + 0x2452]
xor edx, edx
mov r8d, 0x1ffe
mov word [rsp + 0x2450], r15w
call sub.ntdll.dll_memset
lea rcx, [rsp + 0x2450]
sub rcx, r13
mov rdx, r13
nop
nop
nop
movzx eax, word [rdx]
add rdx, 2
test ax, ax
mov word [rcx + rdx - 2], ax
jne 0x140050c20
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x2450]
repne scasw ax, word [rdi]
mov eax, dword [0x1402e0f14]
lea rcx, [rsp + 0x8452]
xor edx, edx
mov r8d, 0x3ffe
mov word [rsp + 0x8450], r15w
mov dword [rdi - 2], eax
call sub.ntdll.dll_memset
test ebp, ebp
je 0x140050e09
nop
nop
nop
nop
lea rcx, [rsp + 0x8450]
xor edx, edx
mov r8d, 0x2000
call sub.ntdll.dll_memset
lea rdi, [rsp + 0x8450]
mov ebx, r15d
mov rsi, r15
nop
nop
nop
nop
lea r9, [rsp + 0x40]
mov r8d, 2
mov rdx, rdi
mov rcx, r12
mov dword [rsp + 0x40], r15d
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140050d9b
cmp dword [rsp + 0x40], r15d
je 0x140050d9b
movzx eax, word [rdi]
add ebx, 1
add rsi, 1
add rdi, 2
cmp ax, 0xa
je 0x140050d00
cmp ebx, 0x1000
jb 0x140050cb0
mov word [rdi], r15w
cmp byte [rsp + 0x8450], 0xff
jne 0x140050d51
cmp byte [rsp + 0x8451], 0xfe
jne 0x140050d51
movzx ecx, word [rsp + 0x8452]
mov rax, r15
lea rdx, [rsp + 0x8452]
test cx, cx
je 0x140050d48
add rdx, 2
mov word [rsp + rax*2 + 0x8450], cx
add rax, 1
mov cx, word [rdx]
test cx, cx
jne 0x140050d30
mov word [rsp + rax*2 + 0x8450], r15w
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x8450]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
cmp ecx, 2
jl 0x140050da2
movsxd rax, ecx
cmp word [rsp + rax*2 + 0x844c], 0xd
jne 0x140050da2
cmp word [rsp + rax*2 + 0x844e], 0xa
jne 0x140050da2
mov word [rsp + rax*2 + 0x844c], r15w
mov word [rsp + rax*2 + 0x844e], r15w
jmp 0x140050da2
mov word [rdi + rsi*2], r15w
mov ecx, ebx
test ecx, ecx
je 0x140050f86
lea rdx, [rsp + 0x2450]
lea rcx, [rsp + 0x8450]
call qword [sym.imp.ntdll.dll_wcsstr]
test rax, rax
mov r11, rax
je 0x140050c80
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
movsxd rdx, ecx
lea rcx, [r11 + rdx*2 + 2]
mov rdx, r14
nop
nop
movzx eax, word [rcx]
add rdx, 2
add rcx, 2
test ax, ax
mov word [rdx - 2], ax
jne 0x140050df0
jmp 0x140050f86
lea rcx, [rsp + 0x451]
xor edx, edx
mov r8d, 0x1fff
mov byte [rsp + 0x450], r15b
call sub.ntdll.dll_memset
lea rcx, [rsp + 0x6451]
xor edx, edx
mov r8d, 0x1fff
mov byte [rsp + 0x6450], r15b
call sub.ntdll.dll_memset
lea rcx, [rsp + 0x4451]
xor edx, edx
mov r8d, 0x1fff
mov byte [rsp + 0x4450], r15b
call sub.ntdll.dll_memset
lea rcx, [rsp + 0x6450]
mov r8d, 0x2000
mov rdx, r13
call qword [sym.imp.ntdll.dll_wcstombs]
nop
nop
nop
lea rcx, [rsp + 0x450]
xor edx, edx
mov r8d, 0x2000
call sub.ntdll.dll_memset
lea rdi, [rsp + 0x450]
mov ebx, r15d
mov rsi, r15
nop
nop
nop
nop
lea r9, [rsp + 0x40]
mov r8d, 1
mov rdx, rdi
mov rcx, r12
mov dword [rsp + 0x40], r15d
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140050efb
cmp dword [rsp + 0x40], r15d
je 0x140050efb
movzx eax, byte [rdi]
add ebx, 1
add rsi, 1
add rdi, 1
cmp al, 0xa
je 0x140050ef6
cmp ebx, 0x2000
jb 0x140050eb0
mov byte [rdi], r15b
jmp 0x140050eff
mov byte [rsi + rdi], r15b
test ebx, ebx
je 0x140050f6f
lea rdx, [rsp + 0x6450]
lea rcx, [rsp + 0x450]
call qword [sym.imp.ntdll.dll_strstr]
test rax, rax
mov r11, rax
je 0x140050e80
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x6450]
repne scasb al, byte [rdi]
lea rdi, [rsp + 0x4450]
not rcx
sub rcx, 1
movsxd rdx, ecx
sub rdi, rdx
sub rdi, r11
lea rcx, [rdx + r11 + 1]
nop
nop
nop
nop
movzx eax, byte [rcx]
add rcx, 1
test al, al
mov byte [rcx + rdi - 2], al
jne 0x140050f60
lea rdx, [rsp + 0x4450]
mov r8d, 0x2000
mov rcx, r14
call qword [sym.imp.ntdll.dll_mbstowcs]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r14
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
cmp ecx, 2
jl 0x140050fbf
movsxd rcx, ecx
cmp word [r14 + rcx*2 - 4], 0xd
jne 0x140050fbf
cmp word [r14 + rcx*2 - 2], 0xa
jne 0x140050fbf
mov word [r14 + rcx*2 - 4], ax
mov word [r14 + rcx*2 - 2], ax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0xc450]
xor rcx, rsp
call fcn.140161080
mov rbx, qword [rsp + 0xc4b8]
add rsp, 0xc460
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret