Function at 0x1402f1f40
Capabilities:
Read file on windows

Disassembly:
jmp 0x1402f1f40
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa8
lea rbp, [rsp + 0x30]
mov rsi, rcx
mov dword [r8], 0
lea rdi, [0x140000000]
mov ecx, dword [rsi]
lea eax, [rcx - 1]
cmp eax, 0x31
jbe 0x1402f1f99
movabs rax, 0x5551455344414552
mov dword [0x140898f1c], 1
mov dword [0x140761844], ecx
mov qword [0x140761848], rax
jmp 0x1402f2026
movsxd rcx, ecx
imul r12, rcx, 0x138
mov r10, qword [rdi + r12 + 0x75da18]
cmp r10, 0xffffffffffffffff
je 0x1402f1fbe
mov r13, qword [rdi + r12 + 0x75da30]
test r13, r13
jne 0x1402f1fe1
movabs rax, 0x5551455344414552
mov dword [0x140898f1c], 0x2710
mov dword [0x140761844], ecx
mov qword [0x140761848], rax
jmp 0x1402f2026
mov r15d, dword [rdi + r12 + 0x75da28]
xor al, al
mov r11d, dword [rdi + r12 + 0x75da24]
mov ebx, dword [rdi + r12 + 0x75da20]
mov r12d, dword [rdi + r12 + 0x75da38]
test r15d, r15d
je 0x1402f2037
movabs rax, 0x5551455344414552
mov dword [0x140761844], ecx
mov qword [0x140761848], rax
mov dword [0x140898f1c], r15d
lea rsp, [rbp + 0x78]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov dword [rbp + 0x60], r11d
lea ecx, [r12 + 1]
mov dword [0x140898f1c], 0
xor r14d, r14d
mov dword [rbp + 0x18], ecx
mov byte [rbp + 0x68], al
mov dword [rbp + 0x38], r9d
mov qword [rbp + 0x28], r10
mov qword [rbp + 0x20], rdx
mov qword [rbp + 0x30], r8
test ebx, ebx
jle 0x1402f2070
cmp ebx, r11d
jle 0x1402f21f8
mov rax, rsp
mov rdx, r13
mov r8d, r12d
lea r9, [rbp + 0x60]
mov dword [r9], 0
mov qword [rax + 0x20], 0
mov rcx, qword [rbp + 0x28]
call sub.KERNEL32.dll_ReadFile
mov ebx, eax
test r13, r13
jne 0x1402f2108
mov r11, rsp
mov ecx, 0x10100009
lea rdx, [0x140513c60]
mov r8d, 3
mov r9d, 9
lea rax, [0x140513cc8]
lea r10, [0x140513cd4]
mov qword [r11 + 0x20], rax
mov qword [r11 + 0x28], r10
call fcn.140002199
mov r11, rsp
mov ecx, 0x10100009
lea rdx, [0x140513c60]
mov r8d, 3
mov r9d, 9
lea rax, [0x140513ce0]
lea r10, [0x140513cec]
mov qword [r11 + 0x20], rax
mov qword [r11 + 0x28], r10
call fcn.140002199
movsxd rax, dword [rsi]
imul rcx, rax, 0x138
inc qword [rdi + rcx + 0x75da40]
test ebx, ebx
je 0x1402f26f6
mov eax, dword [rbp + 0x60]
xor r15d, r15d
mov ecx, 0xffffffff
test eax, eax
setne r15b
cmove r14d, ecx
dec r15d
mov ebx, 1
test r13, r13
jne 0x1402f217a
mov r11, rsp
mov ecx, 0x10100009
lea rdx, [0x140513c60]
mov r8d, 3
mov r9d, 9
lea rax, [0x140513cf8]
lea r10, [0x140513d04]
mov qword [r11 + 0x20], rax
mov qword [r11 + 0x28], r10
call fcn.140002199
movzx r9d, byte [r13]
movzx eax, byte [r13 + 1]
shl r9d, 0x10
shl eax, 8
or r9d, eax
movzx ecx, byte [r13 + 2]
or r9d, ecx
cmp r9d, 0xefbbbf
jne 0x1402f21f4
test r13, r13
jne 0x1402f21da
mov r10, rsp
mov ecx, 0x10100009
lea rdx, [0x140513c60]
mov r8d, 3
mov r9d, 9
lea rax, [0x140513d10]
lea rbx, [0x140513d1c]
mov qword [r10 + 0x20], rax
mov qword [r10 + 0x28], rbx
call fcn.140002199
mov byte [r13 + 2], 0x78
mov eax, 0x7878
mov word [r13], ax
mov ebx, 4
mov r11d, dword [rbp + 0x60]
jmp 0x1402f21f8
mov r11d, dword [rbp + 0x60]
mov eax, r14d
and eax, 1
cmp ebx, r11d
jg 0x1402f265f
mov dword [rbp + 0x48], r15d
mov dword [rbp + 0x70], r14d
mov r14d, eax
mov dword [rbp + 0x40], r12d
mov qword [rbp + 0x50], rsi
mov esi, r11d
test r14d, r14d
jne 0x1402f26d4
test r13, r13
jne 0x1402f2263
mov r12, rsp
mov ecx, 0x10100009
lea rdx, [0x140513c60]
mov r8d, 3
mov r9d, 9
lea rdi, [0x140513d28]
lea r10, [0x140513d34]
mov qword [r12 + 0x20], rdi
mov qword [r12 + 0x28], r10
call fcn.140002199
movsxd rbx, ebx
movsxd r12, esi
mov qword [rbp + 0x58], rbx
lea r15, [rbx - 1]
sub r12, r15
jg 0x1402f2279
xor r12d, r12d
mov rdi, rsp
add r15, r13
mov rcx, r15
mov edx, r12d
lea r8, [0x140513db8]
mov r9d, 1
mov dword [rdi + 0x20], 0
call fcn.140006019
mov edi, eax
test r13, r13
jne 0x1402f22db
mov r8, rsp
lea r10, [0x140513d40]
mov ecx, 0x10100009
lea rdx, [0x140513c60]
mov r9d, 9
mov qword [r8 + 0x20], r10
lea r10, [0x140513d4c]
mov qword [r8 + 0x28], r10
mov r8d, 3
call fcn.140002199
mov r10, rsp
mov rcx, r15
mov edx, r12d
lea r8, [0x140513dbc]
mov r9d, 1
mov dword [r10 + 0x20], 0
call fcn.140006019
mov r12d, eax
test r12d, r12d
jne 0x1402f23b4
test edi, edi
jne 0x1402f23b0
cmp esi, ebx
jl 0x1402f2386
mov rcx, qword [rbp + 0x30]
mov r8d, dword [rcx]
cmp r8d, dword [rbp + 0x38]
jge 0x1402f2386
sub esi, ebx
lea r10, [0x140000000]
mov rbx, qword [rbp + 0x50]
inc esi
mov edi, dword [rbp + 0x38]
lea rdx, [rbp + 8]
sub edi, r8d
movsxd r9, dword [rbx]
cmp edi, esi
mov rcx, qword [rbp + 0x58]
movsxd r8, r8d
cmovl esi, edi
imul r12, r9, 0x138
mov r15, qword [r10 + r12 + 0x75da30]
add r8, qword [rbp + 0x20]
mov qword [rdx], r8
lea r8, [rbp + 0x10]
movsxd rsi, esi
lea rcx, [r15 + rcx - 1]
mov qword [rbp], rcx
lea rcx, [rbp]
mov qword [r8], rsi
call fcn.140005312
mov rcx, qword [rbp + 0x30]
add dword [rcx], esi
mov esi, dword [rbp + 0x60]
lea ebx, [rsi + 1]
cmp ebx, esi
jle 0x1402f221d
mov r15d, dword [rbp + 0x48]
mov r11d, esi
mov r14d, dword [rbp + 0x70]
lea rdi, [0x140000000]
mov r12d, dword [rbp + 0x40]
mov rsi, qword [rbp + 0x50]
jmp 0x1402f2063
mov ecx, edi
jmp 0x1402f23df
test edi, edi
jne 0x1402f23bd
mov ecx, r12d
jmp 0x1402f23df
cmp r12d, edi
lea eax, [rdi + 1]
mov ecx, edi
cmovl ecx, r12d
cmp r12d, eax
je 0x1402f2591
lea eax, [r12 + 1]
cmp eax, edi
je 0x1402f2591
mov r14d, 1
lea r15d, [rbx + rcx - 2]
cmp r15d, ebx
jl 0x1402f23fe
mov rax, qword [rbp + 0x30]
mov eax, dword [rax]
cmp eax, dword [rbp + 0x38]
jl 0x1402f25b0
lea ebx, [r15 + 2]
cmp ebx, dword [rbp + 0x18]
jne 0x1402f2629
cmp dword [0x140898f1c], 0
jne 0x1402f2629
cmp dword [rbp + 0x48], 0
jne 0x1402f2629
mov rax, rsp
mov rdx, r13
mov dword [rbp + 0x60], 0
lea r9, [rbp + 0x60]
mov qword [rax + 0x20], 0
mov rcx, qword [rbp + 0x28]
mov r8d, dword [rbp + 0x40]
call sub.KERNEL32.dll_ReadFile
mov ebx, eax
test r13, r13
jne 0x1402f24bb
mov r10, rsp
mov ecx, 0x10100009
lea rdx, [0x140513c60]
mov r8d, 3
mov r9d, 9
lea rax, [0x140513d58]
lea rsi, [0x140513d64]
mov qword [r10 + 0x20], rax
mov qword [r10 + 0x28], rsi
call fcn.140002199
mov r10, rsp
mov ecx, 0x10100009
lea rdx, [0x140513c60]
mov r8d, 3
mov r9d, 9
lea rax, str.LOCALWORK
lea rsi, str.PLOCALWORK
mov qword [r10 + 0x20], rax
mov qword [r10 + 0x28], rsi
call fcn.140002199
mov rax, qword [rbp + 0x50]
lea rsi, [0x140000000]
movsxd rcx, dword [rax]
imul r8, rcx, 0x138
inc qword [rsi + r8 + 0x75da40]
test ebx, ebx
je 0x1402f26c2
mov esi, dword [rbp + 0x60]
test esi, esi
jne 0x1402f24f5
mov dword [rbp + 0x48], 0xffffffff
xor ebx, ebx
jmp 0x1402f2629
test r13, r13
jne 0x1402f2566
mov r10, rsp
mov ecx, 0x10100009
lea rdx, [0x140513c60]
mov r8d, 3
mov r9d, 9
lea rax, [0x140513d88]
lea rbx, [0x140513d94]
mov qword [r10 + 0x20], rax
mov qword [r10 + 0x28], rbx
call fcn.140002199
mov r10, rsp
mov ecx, 0x10100009
lea rdx, [0x140513c60]
mov r8d, 3
mov r9d, 9
lea rax, [0x140513da0]
lea rbx, [0x140513dac]
mov qword [r10 + 0x20], rax
mov qword [r10 + 0x28], rbx
call fcn.140002199
mov al, byte [r13]
cmp al, 0xa
jne 0x1402f2575
test r12d, r12d
je 0x1402f257d
jmp 0x1402f2587
cmp al, 0xd
jne 0x1402f2587
test edi, edi
jne 0x1402f2587
mov ebx, 2
jmp 0x1402f2629
mov ebx, 1
jmp 0x1402f2629
mov r14d, 2
lea r15d, [rbx + rcx - 2]
cmp r15d, ebx
jl 0x1402f2625
mov rax, qword [rbp + 0x30]
mov eax, dword [rax]
cmp eax, dword [rbp + 0x38]
jge 0x1402f2625
mov r9, qword [rbp + 0x50]
neg ebx
add ebx, r15d
lea r11, [0x140000000]
mov esi, dword [rbp + 0x38]
inc ebx
movsxd r10, dword [r9]
sub esi, eax
imul rcx, r10, 0x138
cmp esi, ebx
lea rdx, [rbp + 8]
mov r8, qword [rbp + 0x58]
cmovl ebx, esi
mov rsi, qword [r11 + rcx + 0x75da30]
lea rcx, [rbp]
movsxd rax, eax
add rax, qword [rbp + 0x20]
movsxd rbx, ebx
lea r9, [rsi + r8 - 1]
mov qword [rcx], r9
lea r8, [rbp + 0x10]
mov qword [rdx], rax
mov qword [r8], rbx
call fcn.140005312
mov rax, qword [rbp + 0x30]
mov esi, dword [rbp + 0x60]
add dword [rax], ebx
lea ebx, [r14 + r15 + 1]
cmp r14d, 1
je 0x1402f2402
jmp 0x1402f2629
lea ebx, [r15 + 3]
mov byte [rbp + 0x68], 0xff
mov r14d, 1
mov dword [rbp + 0x70], 0xffffffff
cmp ebx, esi
jle 0x1402f221d
mov r15d, dword [rbp + 0x48]
mov r11d, esi
mov r12d, dword [rbp + 0x40]
mov eax, r14d
mov r14d, dword [rbp + 0x70]
lea rdi, [0x140000000]
mov rsi, qword [rbp + 0x50]
test eax, eax
je 0x1402f2063
mov al, byte [rbp + 0x68]
mov rdx, qword [rbp + 0x20]
mov r8, qword [rbp + 0x30]
test al, 1
jne 0x1402f269c
mov ecx, dword [r8]
test ecx, ecx
jle 0x1402f2691
movsxd rax, ecx
cmp byte [rax + rdx - 1], 0x1a
jne 0x1402f269c
dec ecx
mov byte [rax + rdx - 1], 0x20
mov dword [r8], ecx
test ecx, ecx
jne 0x1402f269c
mov dword [0x140898f1c], r15d
movsxd rax, dword [rsi]
imul rdx, rax, 0x138
mov dword [rdi + rdx + 0x75da24], r11d
mov dword [rdi + rdx + 0x75da20], ebx
mov dword [rdi + rdx + 0x75da28], r15d
jmp 0x1402f2026
call sub.KERNEL32.dll_GetLastError
mov dword [rbp + 0x48], eax
mov esi, dword [rbp + 0x60]
xor ebx, ebx
jmp 0x1402f2629
mov r15d, dword [rbp + 0x48]
mov r11d, esi
mov al, byte [rbp + 0x68]
lea rdi, [0x140000000]
mov rsi, qword [rbp + 0x50]
mov rdx, qword [rbp + 0x20]
mov r8, qword [rbp + 0x30]
jmp 0x1402f2672
call sub.KERNEL32.dll_GetLastError
mov r15d, eax
mov r14d, 0xffffffff
jmp 0x1402f213a