Function at 0x18005b070
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x10], edx
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0xc0
mov r10, qword [rbp - 9]
lea r15d, [rdx + 0xa]
mov r12, qword [rbp + 0x7f]
mov r13, r8
xor r8d, r8d
mov qword [rbp - 0x11], r10
mov r14, r9
mov ebx, edx
lea r9, [0x180000000]
mov rdi, rcx
cmp edx, r15d
jae 0x18005b240
mov ebx, dword [rbp + 0x67]
lea esi, [rdx - 0xb3]
nop
cmp esi, 0x28
ja case.0x18005b0ed.10
movzx eax, byte [r9 + rsi + 0x5b794]
mov ecx, dword [r9 + rax*4 + 0x5b768]
add rcx, r9
jmp rcx
mov edx, 0xef
mov rcx, r10
call fcn.18005e8f0
mov r10, qword [rbp - 0x11]
jmp 0x18005b222
mov eax, dword [r14]
lea r8, [rbp - 1]
mov r9, r12
mov dword [rbp - 1], eax
lea rdx, [rbp - 0x21]
mov dword [rbp - 0x21], 1
mov ecx, pe_nt_image_headers64
call fcn.18004e490
mov r10, qword [rbp - 0x11]
jmp 0x18005b222
lea rdx, [rbp + 0xf]
mov ecx, 0x76
call fcn.18003ac40
test eax, eax
jne 0x18005b2ce
lea r9d, [rax + 0x75]
mov rdx, r14
lea r8, [rbp + 0xf]
mov rcx, r12
call fcn.18004fbb0
lea rdx, [rbp + 0xf]
mov ebx, eax
test eax, eax
jne 0x18005b2b9
mov r9, rdi
lea r8d, [rax + 0x24]
mov rcx, r13
call fcn.18005ba20
mov r10, qword [rbp - 0x11]
mov rbx, rax
jmp 0x18005b222
mov dword [rbp - 0x19], ebx
jmp case.0x18005b0ed.10
mov qword [rsp + 0x48], r8
xor r9d, r9d
mov qword [rsp + 0x40], r8
xor edx, edx
mov qword [rsp + 0x38], r8
xor ecx, ecx
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], r8
mov r8d, 0xc3
call fcn.180018250
mov r10, qword [rbp - 0x11]
jmp 0x18005b222
mov r8d, 0xa5
lea rdx, [rbp + 0xf]
xor ecx, ecx
call fcn.180059240
mov r10, qword [rbp - 0x11]
jmp 0x18005b222
mov dword [rbp - 0x21], r8d
lea rcx, [rbp - 0x21]
xor r8d, r8d
mov edx, 0x128
call fcn.1800079b0
xor r8d, r8d
mov dword [rbp - 0x21], 5
mov edx, 0x128
lea rcx, [rbp - 0x21]
call fcn.1800079b0
mov r10, qword [rbp - 0x11]
jmp 0x18005b222
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 0x41]
call fcn.180045c30
mov r10, rax
mov qword [rbp - 0x11], rax
xor r8d, r8d
lea r9, [0x180000000]
inc esi
lea ecx, [rsi + 0xb3]
cmp ecx, r15d
jb 0x18005b0d0
mov ebx, dword [rbp + 0x67]
imul eax, ebx, 0x6ae
mov esi, ebx
mov dword [rbp - 1], eax
cmp ebx, eax
ja case.0x18005b0ed.8
mov ebx, dword [rbp + 0x67]
lea rdx, [0x1800a9369]
mov r15, qword [rbp - 9]
cmp esi, 0x11807
ja 0x18005b5e9
je 0x18005b525
mov eax, esi
sub eax, 0xbd
je 0x18005b503
sub eax, 0x14
je 0x18005b4dd
sub eax, 0x14
je 0x18005b3db
sub eax, 0x8b87
je 0x18005b30f
cmp eax, 0xd70
jne 0x18005b70e
mov eax, dword [r13]
cmp dword [rbp + 7], eax
ja 0x18005b72b
mov ebx, r8d
jmp 0x18005b70e
mov r8d, 0xa5
xor ecx, ecx
call fcn.180059240
mov dword [rbp - 0x19], ebx
jmp case.0x18005b0ed.8
mov dword [rbp - 0x19], eax
jmp case.0x18005b0ed.8
movzx eax, word [r12]
cmp ax, 0x7f
ja 0x18005b2ed
mov dword [rbp - 0x19], 1
jmp case.0x18005b0ed.8
mov ecx, 0x7ff
cmp ax, cx
ja 0x18005b303
mov dword [rbp - 0x19], 2
jmp case.0x18005b0ed.8
mov dword [rbp - 0x19], 3
jmp case.0x18005b0ed.8
xor edx, edx
lea rcx, [rbp - 0x41]
lea r8d, [rdx + 0x45]
call fcn.1800388c0
movzx ecx, byte [rbp - 0x41]
lea rdx, [rbp - 0x29]
mov byte [rbp - 0x39], cl
xor r9d, r9d
xor ecx, ecx
mov qword [rbp - 9], rax
mov qword [rsp + 0x48], rcx
lea rax, [rbp - 0x39]
mov qword [rsp + 0x40], rcx
xor r8d, r8d
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x31]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rcx
mov ecx, 0xbf
mov byte [rbp - 0x31], 4
mov byte [rbp - 0x29], 4
mov qword [rsp + 0x20], rax
call fcn.180042a10
xor ecx, ecx
mov byte [r15], al
movzx eax, byte [rbp - 0x41]
lea rdx, [rbp - 0x39]
mov qword [rsp + 0x48], rcx
xor r9d, r9d
mov qword [rsp + 0x40], rcx
xor r8d, r8d
mov byte [rbp - 0x29], al
lea rax, [rbp - 0x29]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x31]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rcx
mov ecx, 0xbf
mov byte [rbp - 0x31], 4
mov byte [rbp - 0x39], 0
mov qword [rsp + 0x20], rax
call fcn.180042a10
lea rcx, str.staticTargets
mov byte [r15 + 1], al
call fcn.18005fbf0
mov r10, qword [rbp - 0x11]
lea rdx, [0x1800a9369]
jmp 0x18005b70e
test r12, r12
jne 0x18005b423
mov qword [rsp + 0x48], r8
lea rax, [rbp - 0x21]
mov qword [rsp + 0x40], r8
xor r9d, r9d
mov qword [rsp + 0x38], rdx
xor ecx, ecx
mov qword [rsp + 0x30], rax
mov edx, 0xcd
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], r8
mov dword [rbp - 0x21], r8d
lea r8, str.option_167
call fcn.180026490
lea rdx, [0x1800a9369]
test rdi, rdi
jne 0x18005b463
xor ecx, ecx
lea rax, [rbp - 0x21]
mov qword [rsp + 0x48], rcx
lea r8, str.D0_D1_D2_D3
mov qword [rsp + 0x40], rcx
xor r9d, r9d
mov qword [rsp + 0x38], rdx
mov edx, 0xcd
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
mov dword [rbp - 0x21], ecx
call fcn.180026490
test r13, r13
jne 0x18005b4aa
xor ecx, ecx
lea rax, [0x1800a9369]
mov qword [rsp + 0x48], rcx
lea r8, str.mFFForceFields
mov qword [rsp + 0x40], rcx
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov edx, 0xcd
lea rax, [rbp - 0x21]
mov dword [rbp - 0x21], ecx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
call fcn.180026490
mov eax, dword [r14]
lea r9, [rbp + 7]
xor edx, edx
mov dword [rbp - 0x21], eax
mov r8d, 0x99
lea rcx, [rbp - 0x21]
call fcn.18002ab50
test eax, eax
jne 0x18005b2ce
mov r10, qword [rbp - 0x11]
lea rdx, [0x1800a9369]
jmp 0x18005b70e
mov ecx, 0x10
mov qword [rbp - 9], r8
mov byte [rbp - 0x41], 0
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r10, qword [rbp - 0x11]
lea rdx, [0x1800a9369]
mov r15, rax
jmp 0x18005b70e
xor r9d, r9d
xor r8d, r8d
mov rcx, r10
lea edx, [r9 + 0xb]
call fcn.180027ee0
mov r10, qword [rbp - 0x11]
lea rdx, [0x1800a9369]
jmp 0x18005b70e
movzx r8d, byte [r15]
lea rcx, str.Unknown_payload_type:__u
mov edx, r8d
mov r8, qword [r9 + r8*8 + 0xb4240]
call fcn.18005fbf0
movzx r8d, byte [r15 + 1]
lea rax, [0x180000000]
mov edx, r8d
lea rcx, str.DelayTimes_not_correct
mov r8, qword [rax + r8*8 + 0xb4270]
call fcn.18005fbf0
cmp byte [r15 + 1], 7
mov eax, dword [r12 + 4]
jne 0x18005b5a2
sub eax, dword [rbp - 9]
lea r8, [rbp - 0x21]
mov r9d, 0x10c
mov dword [rbp - 0x21], eax
mov rdx, r12
mov rcx, r15
call fcn.180047b40
mov r10, qword [rbp - 0x11]
lea rdx, [0x1800a9369]
mov qword [r15 + 8], rax
mov qword [rbp - 0x19], r15
jmp 0x18005b70e
mov rcx, rax
sub rcx, qword [rbp - 9]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [r15 + 8], rax
mov edx, 1
mov r8d, dword [r12 + 4]
mov rcx, rax
sub r8, qword [rbp - 9]
mov r9, qword [0x1800c9d18]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov r10, qword [rbp - 0x11]
lea rdx, [0x1800a9369]
mov qword [rbp - 9], rax
mov qword [rbp - 0x19], r15
jmp 0x18005b70e
cmp esi, 0x132d3
je 0x18005b706
cmp esi, 0x1a3a2
je case.0x18005b0ed.8
cmp esi, 0x1cbca
je 0x18005b61a
cmp esi, 0x264c1
je case.0x18005b0ed.8
jmp 0x18005b70e
mov ecx, dword [r14]
cmp ecx, 0x80
jae 0x18005b631
mov eax, ebx
inc ebx
mov byte [rax + rdi], cl
jmp 0x18005b6cb
cmp ecx, 0x100
jae 0x18005b64f
mov eax, ebx
inc ebx
mov byte [rax + rdi], 0x81
movzx eax, byte [r14]
mov byte [rbx + rdi], al
inc ebx
jmp 0x18005b6cb
cmp ecx, 0x10000
jae 0x18005b674
mov eax, ebx
inc ebx
mov byte [rax + rdi], 0x82
movzx eax, byte [r14 + 1]
mov byte [rbx + rdi], al
inc ebx
movzx eax, byte [r14]
mov byte [rbx + rdi], al
inc ebx
jmp 0x18005b6cb
cmp ecx, 0x1000000
jae 0x18005b73b
mov edx, 0x114
mov eax, edx
sub eax, 0x114
je 0x18005b6af
sub eax, 1
je 0x18005b6a3
cmp eax, 1
jne 0x18005b6c1
movzx eax, byte [r14]
mov ecx, ebx
mov byte [rcx + rdi], al
jmp 0x18005b6bf
movzx eax, byte [r14 + 1]
mov ecx, ebx
mov byte [rcx + rdi], al
jmp 0x18005b6bf
mov eax, ebx
inc ebx
mov byte [rax + rdi], 0x83
movzx eax, byte [r14 + 2]
mov byte [rbx + rdi], al
inc ebx
inc edx
cmp edx, 0x117
jb 0x18005b685
cmp dword [r14], 0
mov edx, r8d
jbe 0x18005b6f5
nop dword [rax]
nop dword [rax + rax]
mov eax, edx
inc edx
mov ecx, ebx
inc ebx
movzx eax, byte [rax + r12]
mov byte [rcx + rdi], al
cmp edx, dword [r14]
jb 0x18005b6e0
mov dword [r13], ebx
lea rdx, [0x1800a9369]
mov dword [rbp - 0x19], r8d
jmp 0x18005b70e
mov eax, ebx
inc ebx
mov byte [rax + rdi], 4
imul eax, dword [rbp + 0x67], 0xab
add esi, eax
cmp esi, dword [rbp - 1]
ja case.0x18005b0ed.8
xor r8d, r8d
lea r9, [0x180000000]
jmp 0x18005b261
mov eax, dword [rbp + 7]
mov dword [r13], eax
mov dword [rbp - 0x19], 6
jmp case.0x18005b0ed.8
mov dword [rbp - 0x19], 0x10
mov rax, qword [rbp - 0x19]
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret