Function at 0x10003514c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x280
mov rax, qword [0x1000da5c8]
xor rax, rsp
mov qword [rsp + 0x270], rax
xor r15d, r15d
mov rdi, rcx
mov rbx, rdx
lea rcx, [rsp + 0x44]
lea r8d, [r15 + 0x12]
xor edx, edx
mov dword [rsp + 0x40], r15d
call sub.msvcrt.dll_memset
cmp rbx, r15
jne 0x1000351a2
mov ebx, 0x80070057
jmp 0x100035462
xor r9d, r9d
mov qword [rsp + 0x30], r15
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, rbx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rdi + 8], rax
cmp rax, 0xffffffffffffffff
jne 0x1000351f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, r15d
je 0x10003548f
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r15d
cmovle ebx, eax
jmp 0x100035462
mov r9d, 2
xor r8d, r8d
mov rcx, rax
lea edx, [r9 - 0x18]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x58]
lea rdx, [rsp + 0x40]
mov r8d, 0x16
mov ebx, eax
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, r15d
je 0x1000351d6
cmp dword [rsp + 0x40], 0x6054b50
jne 0x100035496
sub ebx, dword [rsp + 0x4c]
mov rcx, qword [rdi + 8]
xor r9d, r9d
mov edx, ebx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
movzx r11d, word [rsp + 0x48]
mov edx, 0xffffffff
shl r11, 3
mov r8d, 0x80070216
cmp r11, rdx
ja 0x100035278
mov ebx, r15d
jmp 0x10003527e
mov r11d, edx
mov ebx, r8d
cmp ebx, r15d
jl 0x100035462
mov eax, dword [rsp + 0x4c]
lea ecx, [r11 + rax]
cmp ecx, r11d
jb 0x100035299
mov ebx, r15d
jmp 0x10003529e
mov ecx, edx
mov ebx, r8d
cmp ebx, r15d
jl 0x100035462
cmp ecx, r15d
jbe 0x100035496
mov esi, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
mov rcx, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdx, rax
mov qword [rdi + 0x10], rax
cmp rax, r15
jne 0x1000352df
mov ebx, 0x8007000e
jmp 0x100035462
mov r8d, dword [rsp + 0x4c]
lea r12, [rsi + rax]
add rax, r8
cmp rax, r12
ja 0x100035496
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, r15d
je 0x1000351d6
mov rsi, qword [rdi + 0x10]
mov eax, dword [rsp + 0x4c]
mov r14d, r15d
add rax, rsi
mov qword [rdi + 0x18], rax
movzx eax, word [rsp + 0x48]
cmp r15w, ax
jae 0x10003545c
mov r13, r15
mov r11d, 0x5c
lea edx, [r11 - 0x2e]
cmp rsi, r12
ja 0x100035496
mov rbp, rsi
add rsi, rdx
cmp rsi, r12
ja 0x100035496
cmp dword [rbp], 0x2014b50
jne 0x100035496
mov rax, qword [rdi + 0x18]
mov qword [r13 + rax], rbp
movzx eax, word [rbp + 0x1c]
add rsi, rax
cmp rsi, r12
ja 0x100035496
mov r9, qword [rdi + 0x18]
mov ecx, 0x103
mov rax, qword [r13 + r9]
cmp word [rax + 0x1c], cx
jae 0x100035496
movzx r8d, r15w
cmp r15w, word [rax + 0x1c]
jae 0x1000353d5
lea ebx, [rdx - 0x2d]
mov rax, qword [r13 + r9]
movzx edx, r8w
cmp byte [rdx + rax + 0x2e], 0x2f
movsx ecx, byte [rdx + rax + 0x2e]
cmove cx, r11w
add r8w, bx
mov word [rsp + rdx*2 + 0x60], cx
mov rax, qword [r13 + r9]
cmp r8w, word [rax + 0x1c]
jb 0x1000353a3
mov edx, 0x2e
movzx eax, r8w
mov word [rsp + rax*2 + 0x60], r15w
movzx ecx, word [rsp + 0x60]
lea rax, [rsp + 0x60]
cmp cx, r15w
je 0x10003541a
cmp cx, 0x3a
je 0x100035414
cmp cx, dx
jne 0x100035407
cmp word [rax + 2], dx
jne 0x100035407
cmp word [rax + 4], r11w
je 0x100035414
add rax, 2
mov cx, word [rax]
cmp cx, r15w
jne 0x1000353ef
cmp word [rax], r15w
jne 0x100035496
lea rcx, [rdi + 0x28]
lea rdx, [rsp + 0x60]
mov r8d, r14d
call fcn.1000360b4
cmp eax, r15d
mov ebx, eax
jl 0x100035462
movzx ecx, word [rbp + 0x1e]
movzx edx, word [rbp + 0x20]
mov eax, 1
add r14d, eax
movzx eax, word [rsp + 0x48]
add edx, ecx
movsxd rcx, edx
add r13, 8
add rsi, rcx
cmp r14d, eax
jl 0x100035335
movzx eax, ax
mov dword [rdi + 0x20], eax
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1000031d0
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x280
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ebx, 0x80004005
jmp 0x100035462
mov ebx, 0x80070570
jmp 0x100035462