Function at 0x1400b8bd0
Capabilities:
Read file on windows

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov rcx, rdx
mov edx, 0xae
call fcn.140041910
mov rdx, qword [rax]
cmp byte [rdx], 0
je 0x1400ad9ba
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp 0x1400b8bd0
nop
add rsp, 0x20
pop rsi
ret
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x14012b050]
xor rax, rsp
mov qword [rsp + 0xb0], rax
cmp byte [rcx], 0
je 0x1400b8c04
xor ebx, ebx
jmp 0x1400b8c0f
mov rcx, qword [rsi + 0x20]
call fcn.14003f260
mov ebx, eax
lea rdx, [0x14010e835]
mov rcx, rdi
call fcn.1400ce168
test rax, rax
je 0x1400b903b
mov rbp, rax
mov qword [rsp + 0x28], rsi
call fcn.140040b10
mov r14, rax
mov esi, ebx
xor ebx, ebx
mov ecx, 0x8000c
mov edx, 1
xor r8d, r8d
call fcn.1400434f0
mov rdi, rax
mov edx, 1
mov r8d, 0x8000c
mov rcx, rax
mov qword [rsp + 0x40], rbp
mov r9, rbp
call fcn.1400ce2f0
mov rbp, rax
movsxd rax, ebp
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x88], 0
mov dword [rsp + 0x98], 0
lea rax, [rsp + 0x80]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x38], r14
test r14, r14
setne al
and al, sil
mov byte [rsp + 0x27], al
xor sil, 1
mov dword [rsp + 0x34], esi
xor eax, eax
mov qword [rsp + 0x48], rax
cmp rbx, 0x40005
jbe 0x1400b8d50
nop word cs:[rax + rax]
nop dword [rax]
sub ebp, ebx
add rbx, rdi
movsxd rbp, ebp
mov rcx, rdi
mov rdx, rbx
mov r8, rbp
call fcn.1400bbc60
mov r8d, 0x8000c
sub r8, rbp
lea rcx, [rdi + rbp]
mov edx, 1
mov r9, qword [rsp + 0x40]
call fcn.1400ce2f0
add ebp, eax
movsxd rax, ebp
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x88], 0
mov dword [rsp + 0x98], 0
lea rcx, [rsp + 0x80]
mov qword [rsp + 0xa0], rcx
jmp 0x1400b8d58
mov rcx, qword [rsp + 0xa0]
call fcn.1400430f0
mov ebx, eax
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsi + 0x20]
call fcn.1400430f0
mov r8d, eax
mov rdx, qword [rsi + 0x20]
lea rcx, [rsp + 0x70]
call fcn.140043030
mov r13, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsi + 0x20]
call fcn.1400430f0
mov r8d, eax
mov rdx, qword [rsi + 0x20]
lea rsi, [rsp + 0x50]
mov rcx, rsi
call fcn.140043030
mov rcx, rsi
call fcn.140043940
mov rsi, rax
cmp byte [rax], 0
je 0x1400b8dd0
mov rcx, rsi
call fcn.1400ccb74
mov r12d, eax
jmp 0x1400b8dd6
mov r12d, 0xffffffff
mov rcx, rsi
call fcn.140043590
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsi + 0x20]
call fcn.1400430f0
mov r8d, eax
mov rdx, qword [rsi + 0x20]
lea rcx, [rsp + 0x60]
call fcn.140043030
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsi + 0x20]
call fcn.1400430f0
mov r8d, eax
mov rdx, qword [rsi + 0x20]
lea rcx, [rsp + 0x70]
call fcn.140043030
mov rax, qword [rsp + 0xa0]
cmp dword [rax + 0x18], 0
jne 0x1400b9012
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x10]
test eax, eax
js 0x1400b8e54
mov rsi, qword [rsp + 0x70]
mov r15, qword [rsp + 0x78]
test r12d, r12d
js 0x1400b8e80
cmp eax, r12d
je 0x1400b8e80
test byte [rsp + 0x48], 1
jne 0x1400b9012
mov rbx, qword [rsp + 0x88]
cmp rbx, 0x40005
jbe 0x1400b8d50
jmp 0x1400b8ce0
movdqu xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x70], xmm0
lea rcx, [rsp + 0x70]
mov rdx, qword [str.MIT_MAGIC_COOKIE_1]
call fcn.140043770
mov r12d, 1
test al, al
jne 0x1400b8ece
movdqu xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x70], xmm0
lea rcx, [rsp + 0x70]
mov rdx, qword [str.XDM_AUTHORIZATION_1]
call fcn.140043770
mov r12d, 2
test al, al
je 0x1400b8e54
cmp ebx, 0x100
je 0x1400b8f2b
cmp ebx, 6
je 0x1400b8f42
test ebx, ebx
jne 0x1400b8e54
mov rbx, qword [rsp + 0x28]
cmp byte [rbx], 0
jne 0x1400b8e54
mov rcx, qword [rbx + 0x20]
call fcn.14003f680
cmp eax, 1
jne 0x1400b8e54
mov rcx, qword [rbx + 0x20]
lea rdx, [rsp + 0x70]
call fcn.14003f6c0
cmp r14, 4
jne 0x1400b8e54
mov eax, dword [r13]
cmp eax, dword [rsp + 0x70]
jne 0x1400b8e54
jmp 0x1400b8f95
mov rax, qword [rsp + 0x28]
cmp byte [rax], 0
je 0x1400b8f9e
cmp qword [rsp + 0x38], 0
jne 0x1400b8fa9
jmp 0x1400b8e54
mov rbx, qword [rsp + 0x28]
cmp byte [rbx], 0
jne 0x1400b8e54
mov rcx, qword [rbx + 0x20]
call fcn.14003f680
cmp eax, 2
jne 0x1400b8e54
mov rcx, qword [rbx + 0x20]
lea rdx, [rsp + 0x70]
call fcn.14003f6c0
cmp r14, 0x10
jne 0x1400b8e54
movdqu xmm0, xmmword [r13]
pcmpeqb xmm0, xmmword [rsp + 0x70]
pmovmskb eax, xmm0
cmp eax, 0xffff
jne 0x1400b8e54
mov eax, dword [rsp + 0x34]
mov r14d, eax
jmp 0x1400b8fcd
cmp byte [rsp + 0x27], 0
je 0x1400b8e54
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], r14
lea rcx, [rsp + 0x70]
mov rdx, qword [rsp + 0x38]
call fcn.140043770
mov r14b, 1
test al, al
je 0x1400b8e54
mov rbx, qword [rsp + 0x28]
mov dword [rbx + 0x38], r12d
mov rcx, qword [rbx + 0x40]
call fcn.140043590
mov edx, 1
mov rcx, r15
xor r8d, r8d
call fcn.1400434f0
mov qword [rbx + 0x40], rax
mov rcx, rax
mov rdx, rsi
mov r8, r15
call fcn.1400bbc60
mov dword [rbx + 0x48], r15d
mov eax, r14d
mov qword [rsp + 0x48], rax
jmp 0x1400b8e54
mov rcx, qword [rsp + 0x40]
call fcn.1400cd968
mov edx, 0x8000c
mov rcx, rdi
call fcn.140078e50
mov rcx, rdi
call fcn.140043590
mov rcx, qword [rsp + 0x38]
call fcn.140043590
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1400ba9f0
nop
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret