Function at 0x1400cf850
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x30
xor ebp, ebp
cmp r8d, 0x50
mov esi, r8d
mov rdi, rdx
mov r12, rcx
jb 0x1400cfaa2
mov rcx, rsi
mov qword [rsp + 0x50], rbx
call fcn.1400cf7e0
test rax, rax
mov rbx, rax
je 0x1400cfa92
xor r8d, r8d
xor edx, edx
mov rcx, r12
call fcn.1400db610
test eax, eax
je 0x1400cfa61
lea r9, [rsp + 0x60]
mov r8d, esi
mov rdx, rbx
mov rcx, r12
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400cfa4b
mov edx, dword [rsp + 0x60]
cmp edx, esi
jne 0x1400cfa3d
lea r10, [rbx + 3]
lea r9, str.NTFS
lea r8d, [rbp + 8]
mov rdx, r10
sub r9, r10
nop
nop
nop
nop
movzx eax, byte [r9 + rdx]
movzx ecx, byte [rdx]
sub ecx, eax
jne 0x1400cfa26
add rdx, 1
sub r8d, 1
jne 0x1400cf8f0
movzx edx, byte [rbx + 0xd]
lea rcx, str.sectors_per_cluster__d_n
call fcn.1400b3fb0
movzx r11d, byte [rbx + 0xd]
cmp r11b, 0x80
ja 0x1400cf935
movzx ecx, word [rbx + 0xb]
movzx eax, r11b
imul ecx, eax
mov dword [rdi + 0x10], ecx
jmp 0x1400cf950
mov al, r11b
mov ecx, 0x100
mov edx, 1
sub ecx, eax
movzx eax, word [rbx + 0xb]
shl edx, cl
imul edx, eax
mov dword [rdi + 0x10], edx
mov edx, dword [rdi + 0x10]
lea rcx, str.bytes_per_cluster__d_n
call fcn.1400b3fb0
mov r11d, dword [rdi + 0x10]
test r11d, r11d
je 0x1400cfa16
movzx eax, word [rbx + 0xb]
test eax, eax
mov dword [rdi + 0x18], eax
je 0x1400cfa06
movzx eax, byte [rbx + 0x40]
test al, al
jle 0x1400cf98f
movsx eax, al
imul eax, r11d
mov dword [rdi + 0x14], eax
jmp 0x1400cf99e
neg eax
mov edx, 1
movzx ecx, al
shl edx, cl
mov dword [rdi + 0x14], edx
cmp dword [rdi + 0x14], ebp
je 0x1400cf9f6
mov rdx, qword [rbx + 0x30]
lea rcx, str.mft_lcn__I64u_n
mov qword [rdi], rdx
mov rax, qword [rbx + 0x48]
mov qword [rdi + 8], rax
call fcn.1400b3fb0
mov rdx, qword [rdi + 8]
lea rcx, str.serial_number__I64u_n
call fcn.1400b3fb0
mov edx, dword [rdi + 0x10]
lea rcx, str.bytes_per_cluster__u_n
call fcn.1400b3fb0
mov edx, dword [rdi + 0x14]
lea rcx, str.bytes_per_file_record__u_n
call fcn.1400b3fb0
mov ebp, 1
jmp 0x1400cfa75
lea rcx, str.invalid_bytes_per_file_record__u_n
xor edx, edx
call fcn.1400b3fb0
jmp 0x1400cfa75
lea rcx, str.invalid_bytes_per_sector__u_n
xor edx, edx
call fcn.1400b3fb0
jmp 0x1400cfa75
lea rcx, str.invalid_bytes_per_cluster__u_n
xor edx, edx
call fcn.1400b3fb0
jmp 0x1400cfa75
lea rcx, str.bad_NTFS_signature:__t_n
mov r8d, 8
mov rdx, r10
call fcn.1400b3fb0
jmp 0x1400cfa75
lea rcx, str.unable_to_read_all_of_NTFS_boot_sector:__u_n
call fcn.1400b3fb0
jmp 0x1400cfa75
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.failed_to_read_NTFS_boot_sector:__u_n
mov edx, eax
call fcn.1400b3fb0
jmp 0x1400cfa75
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.failed_to_set_file_pointer_to_boot_sector__u_n
mov edx, eax
call fcn.1400b3fb0
mov rcx, rbx
call fcn.1400cf840
mov eax, ebp
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
lea rcx, str.failed_to_alloc_sector_buf
call fcn.1400b3fb0
mov eax, ebp
jmp 0x1400cfa7f
lea rcx, str.bad_sector_size__u_n
mov edx, esi
call fcn.1400b3fb0
mov eax, ebp
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret