Function at 0x1400be7a0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x30
xor ebp, ebp
cmp r8d, 0x50
mov esi, r8d
mov rdi, rdx
mov r12, rcx
jb 0x1400be9f2
mov rcx, rsi
mov qword [rsp + 0x50], rbx
call fcn.1400be730
test rax, rax
mov rbx, rax
je 0x1400be9e2
xor r8d, r8d
xor edx, edx
mov rcx, r12
call fcn.1400ca3d0
test eax, eax
je 0x1400be9b1
lea r9, [rsp + 0x60]
mov r8d, esi
mov rdx, rbx
mov rcx, r12
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400be99b
mov edx, dword [rsp + 0x60]
cmp edx, esi
jne 0x1400be98d
lea r10, [rbx + 3]
lea r9, str.NTFS
lea r8d, [rbp + 8]
mov rdx, r10
sub r9, r10
nop
nop
nop
nop
movzx eax, byte [r9 + rdx]
movzx ecx, byte [rdx]
sub ecx, eax
jne 0x1400be976
add rdx, 1
sub r8d, 1
jne 0x1400be840
movzx edx, byte [rbx + 0xd]
lea rcx, str.sectors_per_cluster__d_n
call fcn.1400b1c70
movzx r11d, byte [rbx + 0xd]
cmp r11b, 0x80
ja 0x1400be885
movzx ecx, word [rbx + 0xb]
movzx eax, r11b
imul ecx, eax
mov dword [rdi + 0x10], ecx
jmp 0x1400be8a0
mov al, r11b
mov ecx, 0x100
mov edx, 1
sub ecx, eax
movzx eax, word [rbx + 0xb]
shl edx, cl
imul edx, eax
mov dword [rdi + 0x10], edx
mov edx, dword [rdi + 0x10]
lea rcx, str.bytes_per_cluster__d_n
call fcn.1400b1c70
mov r11d, dword [rdi + 0x10]
test r11d, r11d
je 0x1400be966
movzx eax, word [rbx + 0xb]
test eax, eax
mov dword [rdi + 0x18], eax
je 0x1400be956
movzx eax, byte [rbx + 0x40]
test al, al
jle 0x1400be8df
movsx eax, al
imul eax, r11d
mov dword [rdi + 0x14], eax
jmp 0x1400be8ee
neg eax
mov edx, 1
movzx ecx, al
shl edx, cl
mov dword [rdi + 0x14], edx
cmp dword [rdi + 0x14], ebp
je 0x1400be946
mov rdx, qword [rbx + 0x30]
lea rcx, str.mft_lcn__I64u_n
mov qword [rdi], rdx
mov rax, qword [rbx + 0x48]
mov qword [rdi + 8], rax
call fcn.1400b1c70
mov rdx, qword [rdi + 8]
lea rcx, str.serial_number__I64u_n
call fcn.1400b1c70
mov edx, dword [rdi + 0x10]
lea rcx, str.bytes_per_cluster__u_n
call fcn.1400b1c70
mov edx, dword [rdi + 0x14]
lea rcx, str.bytes_per_file_record__u_n
call fcn.1400b1c70
mov ebp, 1
jmp 0x1400be9c5
lea rcx, str.invalid_bytes_per_file_record__u_n
xor edx, edx
call fcn.1400b1c70
jmp 0x1400be9c5
lea rcx, str.invalid_bytes_per_sector__u_n
xor edx, edx
call fcn.1400b1c70
jmp 0x1400be9c5
lea rcx, str.invalid_bytes_per_cluster__u_n
xor edx, edx
call fcn.1400b1c70
jmp 0x1400be9c5
lea rcx, str.bad_NTFS_signature:__t_n
mov r8d, 8
mov rdx, r10
call fcn.1400b1c70
jmp 0x1400be9c5
lea rcx, str.unable_to_read_all_of_NTFS_boot_sector:__u_n
call fcn.1400b1c70
jmp 0x1400be9c5
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.failed_to_read_NTFS_boot_sector:__u_n
mov edx, eax
call fcn.1400b1c70
jmp 0x1400be9c5
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.failed_to_set_file_pointer_to_boot_sector__u_n
mov edx, eax
call fcn.1400b1c70
mov rcx, rbx
call fcn.1400be790
mov eax, ebp
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
lea rcx, str.failed_to_alloc_sector_buf
call fcn.1400b1c70
mov eax, ebp
jmp 0x1400be9cf
lea rcx, str.bad_sector_size__u_n
mov edx, esi
call fcn.1400b1c70
mov eax, ebp
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret