Function at 0x402ad0
Capabilities:
Read file on windows

Disassembly:
push r15
mov eax, 0x1698
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.004051f0
sub rsp, rax
lea r8, [0x00408140]
mov rdi, rcx
mov rsi, rdx
lea rcx, [rsp + 0x68]
lea rdx, [0x0044c1c0]
call qword [sym.imp.msvcrt.dll__wfopen_s]
test eax, eax
je 0x402b20
add rsp, 0x1698
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r9, qword [rsp + 0x68]
mov r8d, 0x800
mov edx, 1
lea rbp, [rsp + 0xe90]
mov rcx, rbp
call sub.msvcrt.dll_fread
lea rcx, str.maybe_handle_shebang:_read__zd_bytes_n
mov rdx, rax
mov rbx, rax
call fcn.004015a0
mov rcx, qword [rsp + 0x68]
call sub.msvcrt.dll_fclose
cmp rbx, 3
jbe 0x402b70
cmp byte [rsp + 0xe93], 0xa
je 0x402f00
movsxd r8, dword [0x00406120]
lea rbx, [0x00406120]
test r8d, r8d
jne 0x402ba1
jmp 0x403070
movsxd r8, dword [rbx + 0xc]
add rbx, 0xc
test r8d, r8d
je 0x403070
lea rcx, [rbx + 4]
mov rdx, rbp
call sub.msvcrt.dll_strncmp
test eax, eax
jne 0x402b90
mov edx, dword [rbx + 8]
lea rcx, str.maybe_handle_shebang:_BOM_found__code_page__u_n
call fcn.004015a0
movsxd rdx, dword [rbx]
add rdx, rbp
lea r8, [rdx + 0x800]
mov rax, rdx
jmp 0x402bea
cmp cl, 0xa
je 0x402bf2
add rax, 1
cmp rax, r8
jae 0x403058
movzx ecx, byte [rax]
cmp cl, 0xd
jne 0x402bd8
mov ecx, dword [rbx + 8]
cmp ecx, 0x4b0
je 0x402ed0
cmp ecx, 0x2ee0
je 0x403098
add rax, 1
sub rax, rdx
mov r8d, eax
cmp ecx, 0x2ee0
jbe 0x402ff0
cmp ecx, 0x2ee1
je 0x403288
cmp ecx, 0xfde9
jne 0x402b0c
lea rcx, [rsp + 0x670]
mov r8, rdx
mov dword [rsp + 0x28], 0x100
xor edx, edx
mov qword [rsp + 0x20], rcx
mov r9d, eax
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jle 0x402b0c
sub eax, 1
mov rbp, qword [rdi]
mov ecx, 0xbe
xor r10d, r10d
movsxd rbx, eax
xor eax, eax
lea rdi, [rsp + 0x890]
xor r11d, r11d
rep stosq qword [rdi], rax
mov word [rsp + rbx*2 + 0x670], r10w
cmp word [rsp + 0x670], 0x23
lea r12, [rsp + 0x670]
mov qword [rsp + 0x880], 0
mov qword [rsp + 0x888], 0
mov dword [rdi], 0
mov word [rdi + 4], r11w
jne 0x402fa0
cmp word [rsp + 0x672], 0x21
jne 0x402fa0
mov rdi, r12
movzx ecx, word [rdi + 4]
test cx, cx
je 0x402b0c
mov rbp, qword [sym.imp.msvcrt.dll_isspace]
add rdi, 4
jmp 0x402d11
movzx ecx, word [rdi + 2]
add rdi, 2
test cx, cx
je 0x402b0c
call rbp
mov r14d, eax
test eax, eax
jne 0x402d00
mov rcx, qword [str._usr_bin_env_python]
lea r12, [r12 + rbx*2 - 2]
test rcx, rcx
je 0x403437
lea r15, str._usr_bin_env_python
jmp 0x402d51
mov rcx, qword [r15 + 0x10]
add r15, 0x10
test rcx, rcx
je 0x403437
call sub.msvcrt.dll_wcslen
mov rdx, qword [r15]
mov rcx, rdi
mov r8, rax
call sub.msvcrt.dll_wcsncmp
test eax, eax
jne 0x402d40
lea rdx, str.python
mov rcx, rdi
mov ebx, dword [r15 + 8]
mov r14d, 1
call sub.msvcrt.dll_wcsstr
mov rdx, qword [r15]
lea rcx, str.found_in_builtin_virtual_paths:__s__command:__s_n
mov r8, rax
mov r13, rax
call fcn.004015a0
cmp qword [r15], 0
je 0x40343c
xor r15d, r15d
cmp r12, rdi
ja 0x402db9
jmp 0x402dd1
sub r12, 2
cmp r12, rdi
jbe 0x402dd1
movzx ecx, word [r12]
call rbp
test eax, eax
jne 0x402db0
cmp rdi, r12
jae 0x402dd1
xor ecx, ecx
mov word [r12 + 2], cx
test r13, r13
je 0x402b0c
mov rdx, r13
lea rcx, str.parse_shebang:_found_command:__ls_n
call fcn.004015a0
test r14d, r14d
je 0x4035e0
mov edx, 0x20
mov rcx, r13
xor r12d, r12d
call sub.msvcrt.dll_wcschr
test rax, rax
je 0x402e35
movzx ecx, word [rax + 2]
xor edx, edx
lea r12, [rax + 2]
mov word [rax], dx
test cx, cx
jne 0x402e2f
jmp 0x402e35
movzx ecx, word [r12 + 2]
add r12, 2
test cx, cx
je 0x402e35
call rbp
test eax, eax
jne 0x402e20
mov r8d, 6
lea rdx, str.python
mov rcx, r13
call sub.msvcrt.dll_wcsncmp
test eax, eax
jne 0x4035ee
movzx eax, word [r13 + 0xc]
lea rdi, [r13 + 0xc]
test ebx, ebx
je 0x403306
test ax, ax
je 0x402e75
movzx ecx, ax
call rbp
test eax, eax
je 0x40333f
lea rcx, str.searching_PATH_for_python_executable_n
call fcn.004015a0
lea rcx, str.python.exe
call fcn.00402720
test rax, rax
je 0x4032ee
lea r13, [rax + 0x208]
lea rcx, str.Python_on_path:__ls_n
mov rdx, r13
call fcn.004015a0
mov rdx, r13
lea rcx, str.located_python_on_PATH:__ls_n
call fcn.004015a0
mov r8, rsi
mov rdx, r12
mov rcx, r13
call fcn.00402100
nop dword [rax]
add rax, 2
sub rax, rdx
mov r8d, eax
test al, 1
je 0x403107
mov edx, r8d
lea rcx, str.UTF_16LE__but_an_odd_number_of_bytes:__d_n
call fcn.004015a0
jmp 0x402b0c
cmp byte [rsp + 0xe92], 0xd
jne 0x402b70
movzx r12d, byte [rsp + 0xe91]
mov eax, r12d
movzx r12d, byte [rsp + 0xe90]
shl eax, 8
or r12d, eax
movzx eax, word [0x00406040]
test ax, ax
je 0x402b70
lea rbx, [0x00406040]
jmp 0x402f59
movzx eax, word [rbx + 0xc]
add rbx, 0xc
test ax, ax
je 0x402b70
cmp r12w, ax
jb 0x402f48
cmp r12w, word [rbx + 2]
ja 0x402f48
xor edx, edx
lea rcx, [rbx + 4]
call fcn.00402480
test rax, rax
je 0x402f48
mov rdx, rax
lea rcx, str.script_file_is_compiled_against_Python__ls_n
mov qword [rsp + 0x50], rax
call fcn.004015a0
mov rax, qword [rsp + 0x50]
mov r8, rsi
xor edx, edx
lea rcx, [rax + 0xc]
call fcn.00402100
nop dword [rax]
mov r8, rbp
mov rdx, r12
lea rcx, str.parse_shebang_called_without_a_valid_shebang__s__for_argv0__s__n
mov rdi, r12
call fcn.004015a0
mov rcx, rbp
call sub.msvcrt.dll_wcslen
sub rax, 1
cmp rax, 0x302
jbe 0x403125
cmp word [rdi], 0x23
jne 0x402b0c
cmp word [rdi + 2], 0x21
jne 0x402b0c
jmp 0x402ce1
cmp ecx, 0x4b0
je 0x402eda
cmp ecx, 0x4b1
jne 0x402b0c
test al, 1
jne 0x403270
movsxd r9, eax
test eax, eax
jle 0x40304a
mov rax, r9
lea r10, [rsp + 0x66f]
lea r8, [rsp + 0x66e]
nop word [rax + rax]
movzx ecx, byte [rdx + rax - 2]
mov byte [r10 + rax], cl
movzx ecx, byte [rdx + rax - 1]
mov byte [r8 + rax], cl
sub rax, 2
test eax, eax
jg 0x403030
mov rax, r9
shr rax, 1
jmp 0x402c63
lea rcx, str.maybe_handle_shebang:_No_line_terminator_found_n
call fcn.004015a0
jmp 0x402b0c
lea rcx, str.maybe_handle_shebang:_BOM_not_found__using_UTF_8_n
lea rbx, [0x00406120]
call fcn.004015a0
lea r8, [rsp + 0x1690]
mov rdx, rbp
jmp 0x402bcd
add rax, 4
sub rax, rdx
mov r8d, eax
test al, 3
jne 0x40325d
mov ecx, eax
movsxd r9, eax
shr ecx, 0x1f
add ecx, eax
sar ecx, 1
test eax, eax
jle 0x40304a
movsxd rcx, ecx
lea rdx, [rdx + r9 - 4]
lea r10, [rsp + rcx + 0x66e]
lea rax, [rsp + rcx + 0x670]
lea ecx, [r8 - 1]
shr ecx, 2
add rcx, rcx
sub r10, rcx
mov r8, r10
nop word [rax + rax]
movzx ecx, byte [rdx + 1]
sub rax, 2
sub rdx, 4
mov byte [rax + 1], cl
movzx ecx, byte [rdx + 4]
mov byte [rax], cl
cmp r8, rax
jne 0x4030e8
jmp 0x40304a
movsxd rbx, r8d
lea rcx, [rsp + 0x670]
mov r8, rbx
call sub.msvcrt.dll_memcpy
mov rax, rbx
shr rax, 1
jmp 0x402c63
lea rdi, [rsp + 0x880]
mov edx, 0x303
mov r9, 0xffffffffffffffff
mov r8, rbp
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_wcsncpy_s]
movzx edx, word [rsp + 0x880]
lea rax, [rsp + 0x882]
test dx, dx
je 0x40317d
nop word [rax + rax]
cmp dx, 0x2f
jne 0x403171
mov r9d, 0x5c
mov word [rax - 2], r9w
movzx edx, word [rax]
add rax, 2
test dx, dx
jne 0x403160
lea rax, [rsp + 0x470]
lea rbp, [rsp + 0x70]
mov r8d, 3
mov rcx, rdi
mov qword [rsp + 0x38], rax
lea r13, [rsp + 0x62]
mov r9, rbp
lea rax, [rsp + 0x270]
mov rdx, r13
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x40], 0x100
mov qword [rsp + 0x30], 0x100
mov qword [rsp + 0x20], 0x100
call qword [sym.imp.msvcrt.dll__wsplitpath_s]
mov rcx, rbp
call sub.msvcrt.dll_wcslen
lea rax, [rbp + rax*2 - 2]
movzx edx, word [rax]
cmp dx, 0x5c
jne 0x4031ef
movzx edx, word [rax - 2]
sub rax, 2
cmp rax, rbp
jb 0x403217
cmp dx, 0x5c
jne 0x403205
jmp 0x403217
cmp rax, rbp
jb 0x403217
sub rax, 2
xor r8d, r8d
cmp word [rax], 0x5c
mov word [rax + 2], r8w
jne 0x403200
lea rax, str.python.exe
mov rcx, rdi
mov qword [rsp + 0x28], rbp
lea r9, str.__s_s_s
mov qword [rsp + 0x30], rax
mov r8, 0xffffffffffffffff
mov edx, 0x303
mov qword [rsp + 0x20], r13
call qword [sym.imp.msvcrt.dll__snwprintf_s]
mov rdx, rdi
lea rcx, str.invented_shebang:__s_n
call fcn.004015a0
jmp 0x402fcd
mov edx, eax
lea rcx, str.UTF_32LE__but_not_divisible_by_4:__d_n
call fcn.004015a0
jmp 0x402b0c
mov edx, eax
lea rcx, str.maybe_handle_shebang:_UTF_16BE__but_an_odd_number_of_bytes:__d_n
call fcn.004015a0
jmp 0x402b0c
test al, 3
jne 0x40332c
mov ecx, eax
movsxd r9, eax
shr ecx, 0x1f
add ecx, eax
sar ecx, 1
test eax, eax
jle 0x40304a
sub r8d, 1
movsxd rcx, ecx
lea rdx, [rdx + r9 - 2]
shr r8d, 2
lea rax, [rsp + rcx + 0x670]
lea rcx, [rsp + rcx + 0x66e]
add r8, r8
sub rcx, r8
mov r8, rcx
nop dword [rax]
movzx ecx, byte [rdx]
sub rax, 2
sub rdx, 4
mov byte [rax + 1], cl
movzx ecx, byte [rdx + 5]
mov byte [rax], cl
cmp r8, rax
jne 0x4032d0
jmp 0x40304a
lea rdx, str._not_found_
lea rcx, str.Python_on_path:__ls_n
call fcn.004015a0
movzx eax, word [r13 + 0xc]
test ax, ax
jne 0x40333f
mov edx, 1
mov rcx, rdi
call fcn.00402480
test rax, rax
je 0x403373
lea rcx, [rax + 0xc]
mov r8, rsi
mov rdx, r12
call fcn.00402100
mov edx, eax
lea rcx, str.UTF_32BE__but_not_divisible_by_4:__d_n
call fcn.004015a0
jmp 0x402b0c
mov rdx, rdi
lea rcx, str.validate_version:_in:__ls_n
mov rbx, rdi
call fcn.004015a0
movzx eax, word [r13 + 0xc]
cmp ax, 0x5f
je 0x4033e2
test ax, ax
jne 0x403387
lea rcx, str.validate_version:_No_version_number_provided_n
call fcn.004015a0
jmp 0x40330b
mov r8, rdi
lea rdx, str.Requested_Python_version___ls__is_not_installed
mov ecx, 0x67
call fcn.00401ca0
movzx ecx, ax
mov edx, 4
call sub.msvcrt.dll_iswctype
test eax, eax
jne 0x4033b4
mov r8, rdi
lea rdx, str.Invalid_version_specification:__ls._nIn_the_first_line_of_the_script__python_needs_to_be_followed_by_a_valid_version_specifier._nPlease_check_the_documentation.
mov ecx, 0x66
call fcn.00401ca0
nop dword [rax]
add rbx, 2
movzx ecx, word [rbx]
mov edx, 4
call sub.msvcrt.dll_iswctype
test eax, eax
jne 0x4033b0
movzx eax, word [rbx]
cmp ax, 0x2e
je 0x403560
cmp ax, 0x2d
je 0x403404
test ax, ax
jne 0x403398
jmp 0x40330b
cmp word [r13 + 0xe], 0x64
jne 0x403387
lea rcx, str.validate_version:_Windows__d_shebang_n
lea rbx, [r13 + 0x10]
call fcn.004015a0
movzx eax, word [r13 + 0x10]
jmp 0x403360
movzx eax, word [rbx + 2]
cmp ax, 0x33
je 0x4035a2
cmp ax, 0x36
jne 0x403398
cmp word [rbx + 4], 0x34
jne 0x403398
cmp word [rbx + 6], 0
je 0x40330b
jmp 0x403398
mov r13, rdi
xor ebx, ebx
mov r15, qword [0x00406180]
test r15, r15
je 0x4035b2
lea r9, [0x00406180]
jmp 0x403466
mov r15, qword [r9 + 8]
add r9, 8
test r15, r15
je 0x4035b2
mov rcx, r15
mov qword [rsp + 0x58], r9
call sub.msvcrt.dll_wcslen
mov rdx, rdi
mov rcx, r15
mov r8, rax
mov qword [rsp + 0x50], rax
call qword [sym.imp.msvcrt.dll__wcsnicmp]
mov r8, qword [rsp + 0x50]
mov r9, qword [rsp + 0x58]
test eax, eax
jne 0x403455
lea rax, [r8 + r8]
cmp word [r15 + rax - 2], 0x20
lea r8, [rdi + rax]
je 0x403548
mov rcx, r8
lea rdx, str.__t_r_n
mov qword [rsp + 0x50], r8
call sub.msvcrt.dll_wcspbrk
mov r8, qword [rsp + 0x50]
test rax, rax
mov r15, rax
je 0x4035ba
movzx edx, word [rax]
mov word [rax], 0
mov rcx, r8
mov dword [rsp + 0x50], edx
call fcn.00402860
mov edx, dword [rsp + 0x50]
mov word [r15], dx
test rax, rax
je 0x402da0
lea r13, [rax + 0x208]
test dx, dx
jne 0x403516
jmp 0x40351f
movzx edx, word [r15 + 2]
add r15, 2
test dx, dx
je 0x40351f
movzx ecx, dx
call rbp
test eax, eax
jne 0x403508
cmp r12, rdi
ja 0x402db9
jmp 0x402dda
mov qword [rsp + 0x50], r8
movzx ecx, ax
call rbp
mov r8, qword [rsp + 0x50]
test eax, eax
je 0x4034aa
add r8, 2
movzx eax, word [r8]
test ax, ax
jne 0x40352d
jmp 0x4034aa
movzx ecx, word [rbx + 2]
mov edx, 4
lea rbp, [rbx + 2]
call sub.msvcrt.dll_iswctype
mov r13d, eax
jmp 0x40357a
mov rbp, rbx
test r13d, r13d
je 0x403398
movzx ecx, word [rbp + 2]
mov edx, 4
lea rbx, [rbp + 2]
call sub.msvcrt.dll_iswctype
test eax, eax
jne 0x403577
movzx eax, word [rbp + 2]
jmp 0x4033d2
cmp word [rbx + 4], 0x32
jne 0x403398
jmp 0x403427
mov r8, rdi
jmp 0x4034aa
mov rcx, r8
call fcn.00402860
test rax, rax
je 0x402da0
lea r13, [rax + 0x208]
cmp r12, rdi
ja 0x402db9
jmp 0x402dda
mov r8, rsi
mov rdx, r15
mov rcx, r13
call fcn.00402100
mov r8, r13
lea rdx, str.Unknown_virtual_path__ls
mov ecx, 0x66
call fcn.00401ca0
nop
nop word cs:[rax + rax]
nop