Function at 0x1400c8bf0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x22c8
call sub.ntdll.dll___chkstk
sub rsp, rax
mov qword [rsp + 0x90], 0xfffffffffffffffe
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + 0x22b0], rax
mov ebp, r9d
mov esi, r8d
mov rbx, rdx
mov r12, rcx
mov qword [rsp + 0x60], rcx
mov byte [rsp + 0x130], 0
xor edx, edx
lea r8d, [rdx + 0x7f]
lea rcx, [rsp + 0x131]
call sub.ntdll.dll_memset
mov byte [rsp + 0xb0], 0
xor edx, edx
lea r8d, [rdx + 0x7f]
lea rcx, [rsp + 0xb1]
call sub.ntdll.dll_memset
mov edx, dword [rbx]
cmp edx, 3
jne 0x1400c8d5a
call fcn.140049470
mov rsi, rax
xor edx, edx
mov r8d, 0x80
lea rbx, [0x1404343d0]
mov rcx, rbx
call sub.ntdll.dll_memset
mov edx, 0x5c
lea rcx, str..._boot.cpp
call qword [sym.imp.ntdll.dll_strrchr]
mov rdi, rax
test rax, rax
jne 0x1400c8cba
xor ebx, ebx
jmp 0x1400c8d40
mov byte [rsp + 0x98], 0
xor eax, eax
mov qword [rsp + 0x99], rax
mov word [rsp + 0xa1], ax
mov byte [rsp + 0xa3], al
mov r8d, Ordinal_670
lea rdx, [0x1402dfd08]
lea rcx, [rsp + 0x98]
call qword [sym.imp.ntdll.dll_sprintf]
lea rdx, [rdi + 1]
mov rcx, rbx
sub rcx, rdx
movzx eax, byte [rdx]
mov byte [rdx + rcx], al
add rdx, 1
test al, al
jne 0x1400c8d00
mov rdi, rbx
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x98]
xor ecx, ecx
nop
nop
nop
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
add rcx, 1
test al, al
jne 0x1400c8d30
mov rax, qword [rsi]
mov r8, rbx
lea rdx, str._s:_Arc_type_invalid.
mov rcx, rsi
call qword [rax + 0x10]
xor eax, eax
jmp 0x1400c9455
cmp edx, 2
je 0x1400c8da8
cmp edx, 1
je 0x1400c8da8
test edx, edx
jne 0x1400c8e15
movsx r8d, byte [rbx + 0xd]
mov r9d, esi
lea rdx, str.multi_0_disk_0_rdisk__d_partition__d_
lea rcx, [rsp + 0x130]
call qword [sym.imp.ntdll.dll_sprintf]
movsx r8d, byte [rbx + 0xd]
mov r9d, ebp
lea rdx, str.multi_0_disk_0_rdisk__d_partition__d_
lea rcx, [rsp + 0xb0]
call qword [sym.imp.ntdll.dll_sprintf]
jmp 0x1400c8e15
mov rcx, qword [r12]
mov rax, qword [rcx]
call qword [rax + 0x40]
movsx edi, byte [rbx + 0xc]
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x28]
mov r8d, eax
mov dword [rsp + 0x20], esi
mov r9d, edi
lea rdx, str.signature__08x_disk__d_rdisk_0_partition__d_
lea rcx, [rsp + 0x130]
call qword [sym.imp.ntdll.dll_sprintf]
mov rcx, qword [r12 + 8]
mov rax, qword [rcx]
call qword [rax + 0x40]
mov rcx, rax
movsx edi, byte [rbx + 0xc]
mov rax, qword [rax]
call qword [rax + 0x28]
mov r8d, eax
mov dword [rsp + 0x20], ebp
mov r9d, edi
lea rdx, str.signature__08x_disk__d_rdisk_0_partition__d_
lea rcx, [rsp + 0xb0]
call qword [sym.imp.ntdll.dll_sprintf]
mov edx, 0x80
mov rcx, r12
call fcn.1400c7970
xor edx, edx
mov rcx, r12
call fcn.1400c7780
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x1400c9379
test rax, rax
je 0x1400c9379
xor ebx, ebx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbx
mov r12d, ebx
mov dword [rsp + 0x34], ebx
mov r13d, ebx
mov dword [rsp + 0x30], ebx
lea r14d, [rbx + 1]
nop
nop
nop
xor edx, edx
mov r8d, 0x1000
lea rcx, [rsp + 0x12b0]
call sub.ntdll.dll_memset
lea rdi, [rsp + 0x12b0]
mov esi, ebx
mov rbp, rbx
mov dword [rsp + 0x58], ebx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x58]
mov r8d, r14d
mov rdx, rdi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400c8ed8
cmp dword [rsp + 0x58], 0
je 0x1400c8ed8
add esi, r14d
add rbp, 1
movzx eax, byte [rdi]
add rdi, r14
cmp al, 0xa
je 0x1400c8ed3
cmp esi, 0x1000
jb 0x1400c8e92
mov byte [rdi], 0
jmp 0x1400c8edc
mov byte [rdi + rbp], 0
test esi, esi
je 0x1400c91bb
lea eax, [rsi + 8]
movsxd rdi, eax
mov rcx, rdi
call sub.MFC80U.DLL_Ordinal_265
mov rbp, rax
mov qword [rsp + 0x58], rax
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.ntdll.dll_memset
movsxd r8, esi
lea rdx, [rsp + 0x12b0]
mov rcx, rbp
call sub.ntdll.dll_memcpy
mov r11, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
test rdi, rdi
je 0x1400c8f55
mov rcx, r11
sub rcx, rdi
sar rcx, 3
mov rax, qword [rsp + 0x50]
sub rax, rdi
sar rax, 3
cmp rcx, rax
jae 0x1400c8f55
mov qword [r11], rbp
lea rax, [r11 + 8]
mov qword [rsp + 0x48], rax
jmp 0x1400c9002
mov rsi, r11
cmp rdi, r11
jbe 0x1400c8f6d
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov r11, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rsi
test rdi, rdi
je 0x1400c8fa1
mov rax, r11
sub rax, rdi
sar rax, 3
je 0x1400c8fa1
cmp rdi, r11
jbe 0x1400c8f98
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
sub rsi, rdi
sar rsi, 3
jmp 0x1400c8fa4
mov rsi, rbx
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x80], xmm0
lea r9, [rsp + 0x58]
mov r8, r14
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x38]
call fcn.140061590
mov rdx, qword [rsp + 0x40]
mov rdi, rdx
mov rax, qword [rsp + 0x48]
cmp rdx, rax
jbe 0x1400c8fee
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov rax, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
lea rcx, [rdi + rsi*8]
cmp rcx, rax
ja 0x1400c8ffc
cmp rcx, rdx
jae 0x1400c9002
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov r12d, ebx
mov rdi, rbx
mov rsi, qword [rsp + 0x60]
nop
mov rax, qword [rsi + 0x18]
test rax, rax
jne 0x1400c901e
mov rcx, rbx
jmp 0x1400c9029
mov rcx, qword [rsi + 0x20]
sub rcx, rax
sar rcx, 2
movsxd rax, r12d
cmp rax, rcx
jae 0x1400c9074
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x1400c904a
mov rax, qword [rsi + 0x20]
sub rax, rcx
sar rax, 2
cmp rdi, rax
jb 0x1400c9050
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov rax, qword [rsi + 0x18]
cmp r13d, dword [rax + rdi*4]
je 0x1400c9062
add r12d, r14d
add rdi, r14
jmp 0x1400c9010
add r13d, r14d
mov dword [rsp + 0x30], r13d
mov r12d, dword [rsp + 0x34]
jmp 0x1400c8e70
mov byte [rsp + 0x2b0], 0
xor edx, edx
mov r8d, 0xfff
lea rcx, [rsp + reloc.MFC80U.DLL_Ordinal_689]
call sub.ntdll.dll_memset
mov rdx, rbx
nop
nop
nop
movzx eax, byte [rsp + rdx + 0x12b0]
mov byte [rsp + rdx + 0x2b0], al
add rdx, r14
test al, al
jne 0x1400c90a0
lea rcx, [rsp + 0x2b0]
call qword [sym.imp.ntdll.dll__strlwr]
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x2b0]
call qword [sym.imp.ntdll.dll_strstr]
mov r12, rax
test rax, rax
je 0x1400c91a9
lea rax, [rsp + 0x2b0]
mov rdi, r12
sub rdi, rax
mov r8, rdi
lea rdx, [rsp + 0x12b0]
mov rcx, rbp
call qword [sym.imp.ntdll.dll_strncpy]
add rbp, rdi
lea rcx, [rsp + 0xb0]
lea rax, [rsp + 0xb0]
mov rdx, rbp
sub rdx, rax
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
add rcx, r14
test al, al
jne 0x1400c9121
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0xb0]
repne scasb al, byte [rdi]
not rcx
sub rcx, r14
add rbp, rcx
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x130]
repne scasb al, byte [rdi]
not rcx
lea rax, [rsp + 0x2b0]
sub r12d, eax
lea eax, [r12 + rcx - 1]
cdqe
lea rcx, [rsp + rax + 0x12b0]
nop
nop
nop
nop
movzx eax, byte [rcx]
mov byte [rbp], al
add rcx, r14
add rbp, 1
test al, al
jne 0x1400c9180
mov r12d, r14d
mov dword [rsp + 0x34], r14d
lea rdx, [rsp + 0x30]
lea rcx, [rsi + 0x10]
call fcn.140001a70
jmp 0x1400c91ae
mov r12d, dword [rsp + 0x34]
add r13d, r14d
mov dword [rsp + 0x30], r13d
jmp 0x1400c8e70
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r12d, r12d
je 0x1400c92ef
mov edx, r14d
mov r13, qword [rsp + 0x60]
mov rcx, r13
call fcn.1400c7780
mov r12, rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebp, ebx
mov rsi, rbx
nop
nop
nop
mov rdi, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
test rdx, rdx
jne 0x1400c9214
mov rcx, rbx
jmp 0x1400c921e
mov rcx, rdi
sub rcx, rdx
sar rcx, 3
movsxd rax, ebp
cmp rax, rcx
jae 0x1400c926f
test rdx, rdx
je 0x1400c9237
sub rdi, rdx
sar rdi, 3
cmp rsi, rdi
jb 0x1400c9242
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov rdx, qword [rsp + 0x40]
mov rdx, qword [rdx + rsi*8]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r12
call fcn.1400c7020
test eax, eax
je 0x1400c926c
add ebp, r14d
add rsi, r14
jmp 0x1400c9200
mov r14d, ebx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov word [rsp + 0x1b0], 0
xor edx, edx
mov r8d, 0xfe
lea rcx, [rsp + 0x1b2]
call sub.ntdll.dll_memset
call fcn.140049400
mov rdi, qword [rax]
mov r8d, 0x80
lea rdx, [rsp + 0x1b0]
mov rcx, rax
call qword [rdi + 0x48]
mov rdx, qword [r13 + 0x58]
test rdx, rdx
je 0x1400c92e0
lea rcx, [rsp + 0x1b0]
sub rcx, rdx
movzx eax, word [rdx]
mov word [rcx + rdx], ax
add rdx, 2
test ax, ax
jne 0x1400c92d0
lea rcx, [rsp + 0x1b0]
call fcn.1400555e0
jmp 0x1400c92f4
mov r13, qword [rsp + 0x60]
mov ebp, ebx
mov rsi, rbx
nop
nop
mov rdi, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
jne 0x1400c9314
mov rdx, rbx
jmp 0x1400c931e
mov rdx, rdi
sub rdx, rcx
sar rdx, 3
movsxd rax, ebp
cmp rax, rdx
jae 0x1400c9354
test rcx, rcx
je 0x1400c9337
sub rdi, rcx
sar rdi, 3
cmp rsi, rdi
jb 0x1400c9342
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + rsi*8]
call sub.MFC80U.DLL_Ordinal_266
add ebp, 1
add rsi, 1
jmp 0x1400c9300
mov edx, 3
mov rcx, r13
call fcn.1400c7970
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400c9371
call sub.MFC80U.DLL_Ordinal_776
mov eax, r14d
jmp 0x1400c9455
call fcn.140049470
mov rsi, rax
xor edx, edx
mov r8d, 0x80
lea rbx, [0x1404343d0]
mov rcx, rbx
call sub.ntdll.dll_memset
mov edx, 0x5c
lea rcx, str..._boot.cpp
call qword [sym.imp.ntdll.dll_strrchr]
mov rdi, rax
test rax, rax
jne 0x1400c93b9
xor ebx, ebx
jmp 0x1400c9440
mov byte [rsp + 0x98], 0
xor eax, eax
mov qword [rsp + 0x99], rax
mov word [rsp + 0xa1], ax
mov byte [rsp + 0xa3], al
mov r8d, 0x2b6
lea rdx, [0x1402dfd08]
lea rcx, [rsp + 0x98]
call qword [sym.imp.ntdll.dll_sprintf]
lea rdx, [rdi + 1]
mov rcx, rbx
sub rcx, rdx
nop
movzx eax, byte [rdx]
mov byte [rcx + rdx], al
add rdx, 1
test al, al
jne 0x1400c9400
mov rdi, rbx
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x98]
xor ecx, ecx
nop
nop
nop
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
add rcx, 1
test al, al
jne 0x1400c9430
mov rax, qword [rsi]
mov r8, rbx
lea rdx, str._s:_Failed_to_GetBootIniHandle.
mov rcx, rsi
call qword [rax + 0x10]
xor eax, eax
mov rcx, qword [rsp + 0x22b0]
xor rcx, rsp
call fcn.140161080
add rsp, 0x22c8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret