Function at 0x18004b870
Capabilities:
Read file on windows

Disassembly:
push rbp
sub rsp, 0x70
mov rax, qword [0x1800f7050]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbp, rcx
mov rcx, qword [rcx + 0x18]
lea r8, [rsp + 0x40]
mov r9d, 2
mov rdx, 0xfffffffffffffff4
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x18004b8c0
call fcn.1800030e0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180062100
add rsp, 0x70
pop rbp
ret
mov rcx, qword [rbp + 0x18]
xor eax, eax
mov qword [rsp + 0x60], r13
lea r9, [rsp + 0x38]
lea rdx, [rsp + 0x48]
lea r8d, [rax + 0xc]
xor r13d, r13d
mov byte [rsp + 0x48], 0
mov qword [rsp + 0x49], rax
mov word [rsp + 0x51], ax
mov byte [rsp + 0x53], al
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x18004b90f
cmp dword [rsp + 0x38], 0xc
jne 0x18004b90f
call fcn.1800030e0
jmp 0x18004ba1a
cmp dword [rsp + 0x48], 0x3552454e
mov qword [rsp + 0x90], rsi
jne 0x18004b975
movzx eax, byte [rsp + 0x53]
mov qword [rsp + 0x30], r13
mov byte [rsp + 0x30], al
movzx eax, byte [rsp + 0x52]
mov byte [rsp + 0x31], al
movzx eax, byte [rsp + 0x51]
mov byte [rsp + 0x32], al
movzx eax, byte [rsp + 0x50]
mov byte [rsp + 0x33], al
movzx eax, byte [rsp + 0x4f]
mov byte [rsp + 0x34], al
movzx eax, byte [rsp + 0x4e]
mov byte [rsp + 0x35], al
movzx eax, byte [rsp + 0x4d]
mov byte [rsp + 0x36], al
movzx eax, byte [rsp + 0x4c]
mov byte [rsp + 0x37], al
mov rsi, qword [rsp + 0x30]
jmp 0x18004b9b0
cmp dword [rsp + 0x4c], 0x4f52454e
jne 0x18004bb23
movzx eax, byte [rsp + 0x53]
mov dword [rsp + 0x30], r13d
mov byte [rsp + 0x30], al
movzx eax, byte [rsp + 0x52]
mov byte [rsp + 0x31], al
movzx eax, byte [rsp + 0x51]
mov byte [rsp + 0x32], al
movzx eax, byte [rsp + 0x50]
mov byte [rsp + 0x33], al
mov esi, dword [rsp + 0x30]
mov qword [rsp + 0x98], rdi
mov rdi, qword [rsp + 0x40]
cmp rdi, rsi
jae 0x18004b9c9
mov eax, 0x80004005
jmp 0x18004ba0a
sub edi, esi
lea rdx, [0x1800fee28]
mov qword [rsp + 0x88], rbx
mov ecx, edi
mov qword [rsp + 0x68], r12
mov qword [rbp + 0x368], rsi
mov r12d, edi
call fcn.1800626b4
mov rbx, rax
test rax, rax
jne 0x18004ba32
mov eax, 0x8007000e
mov r12, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x98]
mov rsi, qword [rsp + 0x90]
mov r13, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180062100
add rsp, 0x70
pop rbp
ret
mov r8, r12
xor edx, edx
mov rcx, rax
call fcn.1800644c0
mov rcx, qword [rbp + 0x18]
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x18004ba7a
mov rcx, qword [rbp + 0x18]
lea r9, [rsp + 0x38]
mov r8d, edi
mov rdx, rbx
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x18004ba90
cmp dword [rsp + 0x38], edi
jne 0x18004ba90
call fcn.1800030e0
mov rcx, rbx
mov edi, eax
call fcn.1800626bc
mov eax, edi
jmp 0x18004b9fd
mov ecx, r13d
test edi, edi
je 0x18004baed
nop word [rax + rax]
mov edx, ecx
add rdx, rbx
mov eax, dword [rdx]
cmp eax, 0x21444e45
je 0x18004baed
cmp eax, 0x494f4144
je 0x18004bb0a
cmp eax, 0x584f4144
je 0x18004bb0a
movzx eax, byte [rdx + 7]
mov dword [rsp + 0x30], r13d
mov byte [rsp + 0x30], al
movzx eax, byte [rdx + 6]
mov byte [rsp + 0x31], al
movzx eax, byte [rdx + 5]
mov byte [rsp + 0x32], al
movzx eax, byte [rdx + 4]
mov byte [rsp + 0x33], al
mov eax, dword [rsp + 0x30]
lea ecx, [rcx + rax + 8]
cmp ecx, edi
jb 0x18004baa0
mov rdx, qword [rbp + 0x18]
mov rcx, rbp
call fcn.18004ce80
mov rcx, rbx
mov edi, eax
call fcn.1800626bc
mov eax, edi
jmp 0x18004b9fd
mov rcx, rbp
call fcn.18004bb30
mov rcx, rbx
mov edi, eax
call fcn.1800626bc
mov eax, edi
jmp 0x18004b9fd
mov eax, 0xe0032009
jmp 0x18004ba12