Function at 0x14004e980
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xd0
mov rax, qword [0x14039bc30]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov rax, r8
mov rsi, rdx
mov qword [rbp + 0xf], rdx
cmp qword [r8 + 0x18], 8
jb 0x14004e9be
mov rax, qword [r8]
xor r15d, r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r15 + 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rbp + 0x17], rax
cmp rax, 0xffffffffffffffff
jne 0x14004ea24
mov qword [rsi], r15
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], 7
mov word [rsi], r15w
lea r8d, [r15 + 7]
lea rdx, [0x1403304a8]
mov rcx, rsi
call fcn.140032810
nop
mov rcx, rbx
jmp 0x14004ec21
mov ecx, 0x400
call fcn.14013b750
mov rdi, rax
mov qword [rbp + 0xf], rax
xor edx, edx
mov r8d, 0x400
mov rcx, rax
call fcn.14013d7a0
mov dword [rbp - 0x19], r15d
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x19]
mov r8d, 0x3ff
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14004eae5
lea ecx, [rax + 5]
call fcn.1400b2690
test eax, eax
je 0x14004eaaf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x61], eax
lea rax, [rbp - 0x61]
mov qword [rsp + 0x28], rax
lea rax, str.failed_to_read_the_file:__d
mov qword [rsp + 0x20], rax
mov r9d, 0x3d
lea r8, str.McAfee::DAD::CTxtVerSubstitution::Substitute
lea rdx, str.E:BT2b930805_726b_4e13_82a8_9915837eb5a8DynamicAppDownloaderPluginsBSIUpdaterPlugin_srcTxtVerSubstitution.cpp
lea ecx, [r9 - 0x38]
call fcn.14004a110
mov qword [rsi], r15
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], 7
mov word [rsi], r15w
mov r8d, 7
lea rdx, [0x1403304a8]
mov rcx, rsi
call fcn.140032810
nop
mov rcx, rdi
call fcn.14013afa0
jmp 0x14004ec19
mov qword [rbp - 0x11], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], 0xf
mov byte [rbp - 0x11], 0
mov r12, 0xffffffffffffffff
mov r8, r12
inc r8
cmp byte [rdi + r8], 0
jne 0x14004eb03
mov rdx, rdi
lea rcx, [rbp - 0x11]
call fcn.140026990
nop
mov qword [rbp + 0xf], r15
mov rcx, rdi
call fcn.14013afa0
lea r14, [rbp - 0x11]
cmp qword [rbp + 7], 0x10
setae byte [rbp - 0x69]
cmovae r14, qword [rbp - 0x11]
mov r13, qword [rbp - 1]
cmp r13, 0xd
jb 0x14004ebaf
lea r15, [r14 + r13]
lea r8, [r15 - 0xc]
sub r8, r14
mov edx, 0x24
mov rcx, r14
call fcn.14013e650
mov rdi, rax
test rax, rax
je 0x14004ebac
nop dword [rax]
nop word [rax + rax]
mov r8d, 0xd
lea rdx, str._FileVersion
mov rcx, rdi
call fcn.14013e370
test eax, eax
je 0x14004ec51
inc rdi
lea r8, [r15 - 0xc]
sub r8, rdi
mov edx, 0x24
mov rcx, rdi
call fcn.14013e650
mov rdi, rax
test rax, rax
jne 0x14004eb70
xor r15d, r15d
mov ecx, 5
call fcn.1400b2690
test eax, eax
je 0x14004ebe6
lea rax, str.failed_to_find_file_version_key
mov qword [rsp + 0x20], rax
mov r9d, 0x48
lea r8, str.McAfee::DAD::CTxtVerSubstitution::Substitute
lea rdx, str.E:BT2b930805_726b_4e13_82a8_9915837eb5a8DynamicAppDownloaderPluginsBSIUpdaterPlugin_srcTxtVerSubstitution.cpp
lea ecx, [r9 - 0x43]
call fcn.1400297c0
mov qword [rsi], r15
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], 7
mov word [rsi], r15w
mov r8d, 7
lea rdx, [0x1403304a8]
mov rcx, rsi
call fcn.140032810
nop
lea rcx, [rbp - 0x11]
call fcn.1400266d0
nop
test rbx, rbx
je 0x14004ec27
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rsi
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.14013af80
mov rbx, qword [rsp + 0x110]
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
sub rdi, r14
cmp rdi, 0xffffffffffffffff
je 0x14004ebac
add rdi, 0xd
xor eax, eax
mov qword [rbp - 0x39], rax
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x21], 0xf
mov byte [rbp - 0x39], al
cmp r13, rdi
jb 0x14004ee2f
sub r13, rdi
cmp r13, 0xffffffffffffffff
cmovb r12, r13
lea rdx, [rbp - 0x11]
cmp byte [rbp - 0x69], al
cmovne rdx, qword [rbp - 0x11]
add rdx, rdi
mov r8, r12
lea rcx, [rbp - 0x39]
call fcn.140026990
nop
lea rdi, [rbp - 0x39]
cmp qword [rbp - 0x21], 0x10
setae r12b
mov r15, qword [rbp - 0x39]
cmovae rdi, r15
mov r14, qword [rbp - 0x29]
test r14, r14
je 0x14004edc2
mov r8, r14
mov edx, 0x20
mov rcx, rdi
call fcn.14013e650
test rax, rax
je 0x14004edc2
sub rax, rdi
cmp rax, 0xffffffffffffffff
je 0x14004edc2
xor r13d, r13d
mov qword [rbp - 0x59], r13
mov qword [rbp - 0x49], r13
mov qword [rbp - 0x41], 0xf
cmp r14, rax
cmovb rax, r14
lea rdx, [rbp - 0x39]
test r12b, r12b
cmovne rdx, r15
mov r8, rax
lea rcx, [rbp - 0x59]
call fcn.140026990
lea rcx, [rbp - 0x39]
call fcn.1400266d0
movups xmm0, xmmword [rbp - 0x59]
movups xmmword [rbp - 0x39], xmm0
movups xmm1, xmmword [rbp - 0x49]
movups xmmword [rbp - 0x29], xmm1
mov qword [rbp - 0x49], r13
mov qword [rbp - 0x41], 0xf
mov byte [rbp - 0x59], r13b
lea rcx, [rbp - 0x59]
call fcn.1400266d0
lea rcx, [rbp - 0x39]
mov rdi, qword [rbp - 0x29]
cmp qword [rbp - 0x21], 0x10
jb 0x14004ed6a
mov r14, qword [rbp - 0x39]
add rdi, r14
jmp 0x14004ed71
add rdi, rcx
lea r14, [rbp - 0x39]
mov qword [rsi], r13
mov qword [rsi + 0x10], r13
mov qword [rsi + 0x18], 7
mov word [rsi], r13w
mov rdx, rdi
sub rdx, r14
mov rcx, rsi
call fcn.14004ee40
mov qword [rbp - 0x61], rsi
cmp r14, rdi
je 0x14004edb4
nop dword [rax + rax]
movsx edx, byte [r14]
mov rcx, rsi
call fcn.140032180
inc r14
cmp r14, rdi
jne 0x14004eda0
lea rcx, [rbp - 0x39]
call fcn.1400266d0
jmp 0x14004ec0f
mov ecx, 5
call fcn.1400b2690
test eax, eax
je 0x14004edf9
lea rax, str.failed_to_find_the_end_of_the_file_version
mov qword [rsp + 0x20], rax
mov r9d, 0x50
lea r8, str.McAfee::DAD::CTxtVerSubstitution::Substitute
lea rdx, str.E:BT2b930805_726b_4e13_82a8_9915837eb5a8DynamicAppDownloaderPluginsBSIUpdaterPlugin_srcTxtVerSubstitution.cpp
lea ecx, [r9 - 0x4b]
call fcn.1400297c0
xor eax, eax
mov qword [rsi], rax
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], 7
mov word [rsi], ax
lea r8d, [rax + 7]
lea rdx, [0x1403304a8]
mov rcx, rsi
call fcn.140032810
nop
lea rcx, [rbp - 0x39]
call fcn.1400266d0
jmp 0x14004ec0f
call fcn.140032160
int3