Function at 0x180019f70
Capabilities:
Read file on windows

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x70
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov rax, qword [0x1800ff050]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbp, rcx
mov byte [rsp + 0x50], 0
xor eax, eax
mov qword [r11 - 0x47], rax
mov word [rsp + 0x59], ax
mov byte [rsp + 0x5b], al
mov rdx, qword [rcx + 0x20]
lea r14, [0x180013190]
xor r13d, r13d
test rdx, rdx
je 0x18001a034
mov rbx, qword [rcx + 0x370]
sub rbx, 0xc
mov qword [rsp + 0x38], rbx
lea r8d, [rax + 0xc]
mov rcx, qword [rdx + 0x188]
cmp rbx, rcx
jae 0x18001a09b
lea rax, [rbx + 0xc]
cmp rax, rcx
jbe 0x180019ffc
mov r8d, ecx
sub r8d, ebx
lea rcx, [rdx + 0xf0]
mov rax, qword [rcx]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r14
mov r9d, r8d
lea r8, [rsp + 0x50]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test eax, eax
js 0x18001a2d4
cmp eax, 1
jne 0x18001a092
cmp eax, eax
jne 0x18001a092
jmp 0x18001a2d4
mov r9d, 2
lea r8, [rsp + 0x38]
mov rdx, 0xfffffffffffffff4
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x18001a05e
call fcn.180003180
jmp 0x18001a2d4
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x30]
mov r8d, recv
lea rdx, [rsp + 0x50]
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x18001a092
cmp dword [rsp + 0x30], 0xc
jne 0x18001a092
call fcn.180003180
jmp 0x18001a2d4
mov al, byte [rsp + 0x5b]
mov rbx, qword [rsp + 0x38]
cmp dword [rsp + 0x50], 0x3552454e
jne 0x18001a0f4
mov qword [rsp + 0x30], r13
mov byte [rsp + 0x30], al
movzx eax, byte [rsp + 0x5a]
mov byte [rsp + 0x31], al
movzx eax, byte [rsp + 0x59]
mov byte [rsp + 0x32], al
movzx eax, byte [rsp + 0x58]
mov byte [rsp + 0x33], al
movzx eax, byte [rsp + 0x57]
mov byte [rsp + 0x34], al
movzx eax, byte [rsp + 0x56]
mov byte [rsp + 0x35], al
movzx eax, byte [rsp + 0x55]
mov byte [rsp + 0x36], al
movzx eax, byte [rsp + 0x54]
mov byte [rsp + 0x37], al
mov rsi, qword [rsp + 0x30]
jmp 0x18001a12a
cmp dword [rsp + 0x54], 0x4f52454e
jne 0x18001a2cf
mov dword [rsp + 0x30], r13d
mov byte [rsp + 0x30], al
movzx eax, byte [rsp + 0x5a]
mov byte [rsp + 0x31], al
movzx eax, byte [rsp + 0x59]
mov byte [rsp + 0x32], al
movzx eax, byte [rsp + 0x58]
mov byte [rsp + 0x33], al
mov esi, dword [rsp + 0x30]
cmp rbx, rsi
jae 0x18001a139
mov eax, 0x80004005
jmp 0x18001a2d4
mov qword [rbp + 0x370], rsi
sub ebx, esi
mov r12d, ebx
lea rdx, [0x180106f48]
mov ecx, ebx
call fcn.18006aaa4
mov rdi, rax
mov qword [rsp + 0x48], rax
test rax, rax
jne 0x18001a16a
mov eax, 0x8007000e
jmp 0x18001a2d4
mov r8, r12
xor edx, edx
mov rcx, rax
call fcn.18006cf60
mov r11, qword [rbp + 0x20]
test r11, r11
je 0x18001a1dd
mov r9d, ebx
mov rcx, qword [r11 + 0x188]
cmp rsi, rcx
jae 0x18001a249
lea rax, [rbx + rsi]
cmp rax, rcx
jbe 0x18001a1a2
mov r9d, ecx
sub r9d, esi
lea rcx, [r11 + 0xf0]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x20], r14
mov r8, rdi
mov rdx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov esi, eax
test eax, eax
js 0x18001a1ce
cmp eax, 1
jne 0x18001a249
cmp eax, eax
jne 0x18001a249
mov rcx, rdi
call fcn.18006aaac
mov eax, esi
jmp 0x18001a2d4
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x18001a20a
call fcn.180003180
mov ebx, eax
mov rcx, rdi
call fcn.18006aaac
mov eax, ebx
jmp 0x18001a2d4
mov dword [rsp + 0x30], r13d
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x30]
mov r8d, ebx
mov rdx, rdi
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x18001a249
cmp dword [rsp + 0x30], ebx
jne 0x18001a249
call fcn.180003180
mov ebx, eax
mov rcx, rdi
call fcn.18006aaac
mov eax, ebx
jmp 0x18001a2d4
mov ecx, r13d
test ebx, ebx
je 0x18001a2b5
mov edx, ecx
add rdx, rdi
mov eax, dword [rdx]
cmp eax, 0x21444e45
je 0x18001a2b5
cmp eax, 0x494f4144
je 0x18001a29f
cmp eax, 0x584f4144
je 0x18001a29f
mov dword [rsp + 0x30], r13d
movzx eax, byte [rdx + 7]
mov byte [rsp + 0x30], al
movzx eax, byte [rdx + 6]
mov byte [rsp + 0x31], al
movzx eax, byte [rdx + 5]
mov byte [rsp + 0x32], al
movzx eax, byte [rdx + 4]
mov byte [rsp + 0x33], al
mov eax, dword [rsp + 0x30]
lea ecx, [rcx + rax + 8]
cmp ecx, ebx
jb 0x18001a250
jmp 0x18001a2b5
mov rcx, rbp
call fcn.18001a300
mov ebx, eax
mov rcx, rdi
call fcn.18006aaac
mov eax, ebx
jmp 0x18001a2d4
mov rdx, qword [rbp + 0x18]
mov rcx, rbp
call fcn.18001b650
mov ebx, eax
mov rcx, rdi
call fcn.18006aaac
mov eax, ebx
jmp 0x18001a2d4
mov eax, 0xe003200b
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18006a4f0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret