Function at 0x7fffb6db6490
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x220]
sub rsp, 0x320
mov rax, qword [0x7fffb6df6798]
xor rax, rsp
mov qword [rbp + 0x210], rax
mov qword [rbp - 0x58], rdx
lea rcx, [rbp]
xor edx, edx
mov qword [rsp + 0x60], r9
mov r8d, 0x208
mov r15, r9
call sub.msvcrt.dll_memset
xor r14d, r14d
lea r13, [rbp]
or rcx, 0xffffffffffffffff
mov qword [rbp - 0x38], r13
mov dword [rsp + 0x58], r14d
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], r14
mov dword [rsp + 0x70], r14d
mov qword [rbp - 0x48], r14
cmp dword [r15 + 0x18], r14d
je 0x7fffb6db6527
mov esi, 0x80004005
lea ecx, [r14 + 2]
mov r8d, esi
mov edx, 0x28713
mov ebx, esi
call fcn.7fffb6dc60a0
jmp 0x7fffb6db6c40
mov rax, qword [r15 + 0x10]
mov qword [rbp - 0x78], rax
mov rax, qword [r15 + 8]
mov qword [rbp - 0x70], rax
mov ebx, dword [rax + 0x20]
mov eax, 8
mul rbx
mov dword [rsp + 0x40], ebx
mov qword [rbp - 0x10], rbx
cmovo rax, rcx
mov rcx, rax
call qword [sym.imp.msvcrt.dll_malloc]
mov qword [rsp + 0x68], rax
mov r12, rax
mov edi, 2
test rax, rax
jne 0x7fffb6db657c
mov edx, 0x10303
mov r8d, 0x8007000e
mov cl, dil
call fcn.7fffb6dc60a0
test r12, r12
je 0x7fffb6db6598
test ebx, ebx
je 0x7fffb6db659d
mov r8, rbx
xor edx, edx
shl r8, 3
mov rcx, r12
call sub.msvcrt.dll_memset
jmp 0x7fffb6db659d
mov qword [rsp + 0x68], r14
mov esi, 0x80004005
test ebx, ebx
je 0x7fffb6db6675
mov rax, qword [rbp - 0x70]
mov rcx, qword [rbp - 0x78]
mov r13d, r14d
mov rax, qword [rax + 0x18]
mov ebx, dword [rcx + 0x50]
mov rax, qword [rax + r13*8]
mov qword [rsp + 0x78], rax
test ebx, ebx
je 0x7fffb6db65e8
mov r12, qword [rcx + 0x48]
dec ebx
mov rcx, rax
mov rdx, qword [r12 + rbx*8]
call fcn.7fffb6db71a8
test eax, eax
jne 0x7fffb6db65ea
mov rax, qword [rsp + 0x78]
test ebx, ebx
jne 0x7fffb6db65cd
xor eax, eax
cmp eax, 1
je 0x7fffb6db6712
add eax, 0xfffffffe
cmp eax, 1
jbe 0x7fffb6db6663
mov r12, qword [rsp + 0x68]
mov ecx, 0xa8
and qword [r12 + r13*8], 0
call qword [sym.imp.msvcrt.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x7fffb6db662b
mov edx, 0x10303
mov r8d, 0x8007000e
mov cl, dil
call fcn.7fffb6dc60a0
test rbx, rbx
je 0x7fffb6db6646
mov r8, qword [rbp - 0x58]
mov rcx, rbx
mov rdx, qword [rsp + 0x78]
call fcn.7fffb6db7274
mov rcx, rax
jmp 0x7fffb6db6648
xor ecx, ecx
test rcx, rcx
je 0x7fffb6db670b
cmp byte [rcx + 8], 1
jne 0x7fffb6db66f5
inc dword [rsp + 0x70]
mov qword [r12 + r13*8], rcx
inc r14d
cmp r14d, dword [rsp + 0x40]
jb 0x7fffb6db65aa
lea r13, [rbp]
mov r14, qword [rbp - 0x78]
lea r9, [rsp + 0x58]
mov r12d, 0x104
lea rdx, [rbp]
mov r8d, r12d
mov rcx, qword [r14 + 0x10]
call fcn.7fffb6db1690
mov ebx, eax
mov eax, dword [rsp + 0x58]
cmp ebx, 0x80028016
je 0x7fffb6db66ab
cmp eax, r12d
jb 0x7fffb6db6734
lea ebx, [rax + 1]
mov rax, rdi
mov ecx, ebx
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call qword [sym.imp.msvcrt.dll_malloc]
mov qword [rbp - 0x38], rax
mov r13, rax
test rax, rax
jne 0x7fffb6db66e9
mov edx, 0x10303
mov r8d, 0x8007000e
mov cl, dil
call fcn.7fffb6dc60a0
test r13, r13
jne 0x7fffb6db6720
mov ebx, esi
jmp 0x7fffb6db6bae
test rcx, rcx
je 0x7fffb6db670b
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [sym.imp.____1]
mov ebx, esi
jmp 0x7fffb6db6bf5
mov ebx, 1
mov dword [r15 + 0x18], edi
jmp 0x7fffb6db6bf0
mov rcx, qword [r14 + 0x10]
xor r9d, r9d
mov r8d, ebx
mov rdx, r13
call fcn.7fffb6db1690
mov ebx, eax
test ebx, ebx
js 0x7fffb6db6bae
and qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x8000000
mov edx, 0x80000100
mov rcx, r13
mov dword [rsp + 0x20], 3
lea r12d, [r9 + 5]
mov r8d, r12d
call qword [sym.imp.KernelBase.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x48], rax
or rax, 0xffffffffffffffff
cmp rbx, rax
je 0x7fffb6db679c
or eax, 0xffffffff
lea r8, [rbp - 0x60]
xor r9d, r9d
mov dword [rbp - 0x60], eax
xor edx, edx
mov dword [rbp - 0x5c], eax
mov rcx, rbx
call qword [sym.imp.KernelBase.dll_SetFileTime]
or r12, 0xffffffffffffffff
jmp 0x7fffb6db67ea
call qword [sym.imp.KernelBase.dll_GetLastError]
cmp eax, r12d
jne 0x7fffb6db6d11
and qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x8000000
mov r8d, r12d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, r13
call qword [sym.imp.KernelBase.dll_CreateFileW]
or r12, 0xffffffffffffffff
mov qword [rsp + 0x48], rax
mov rbx, rax
cmp rax, r12
je 0x7fffb6db6d11
mov rcx, rbx
call fcn.7fffb6db7138
mov qword [rsp + 0x78], rax
mov rbx, rax
cmp rax, r12
je 0x7fffb6db6d11
mov rax, qword [rbp - 0x70]
cmp rbx, qword [rax + 0x10]
jne 0x7fffb6db6d11
cmp rbx, qword [r14 + 0x18]
jne 0x7fffb6db6d11
cmp dword [rsp + 0x70], 0
jne 0x7fffb6db6834
xor ebx, ebx
mov dword [r15 + 0x18], 1
mov r13d, ebx
jmp 0x7fffb6db6bb3
mov eax, 0x40000
cmp rbx, rax
cmovb eax, ebx
mov ecx, eax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x28], rax
call qword [sym.imp.msvcrt.dll_malloc]
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x7fffb6db686c
mov edx, 0x10303
mov r8d, 0x8007000e
mov cl, dil
call fcn.7fffb6dc60a0
cmp dword [r15 + 0x18], 0
jne 0x7fffb6db6cdb
mov ecx, dword [rsp + 0x40]
mov rax, qword [rbp - 0x58]
mov r14, r12
xor r15d, r15d
xor r12d, r12d
mov al, byte [rax + 0xf8]
test al, al
jne 0x7fffb6db6cc4
xor eax, eax
mov dword [rsp + 0x58], eax
test ecx, ecx
je 0x7fffb6db6cd6
mov r13, qword [rsp + 0x68]
mov rcx, qword [r13]
test rcx, rcx
je 0x7fffb6db6905
mov rax, qword [rcx]
lea r8, [rbp - 0x50]
lea rdx, [rbp - 0x30]
mov rax, qword [rax + 0x10]
call qword [sym.imp.____1]
mov ebx, eax
test eax, eax
js 0x7fffb6db6c6c
mov rax, qword [rbp - 0x50]
mov rbx, qword [rsp + 0x78]
test rax, rax
je 0x7fffb6db6901
mov rcx, qword [rbp - 0x30]
cmp rcx, rbx
ja 0x7fffb6db6b97
cmp r14, rcx
cmova r14, rcx
add rax, rcx
cmp r15, rax
mov qword [rbp - 0x50], rax
cmovb r15, rax
mov eax, dword [rsp + 0x58]
inc eax
add r13, 8
mov dword [rsp + 0x58], eax
cmp eax, dword [rsp + 0x40]
jb 0x7fffb6db68a9
or rax, 0xffffffffffffffff
cmp r14, rax
je 0x7fffb6db6cd6
cmp r14, qword [rbp - 0x48]
jb 0x7fffb6db6cba
cmp r15, r14
jbe 0x7fffb6db6cba
mov r8, qword [rbp - 0x20]
mov rcx, r15
mov rax, rbx
mov edx, ebx
sub rax, r14
sub edx, r14d
cmp qword [rbp - 0x28], rax
cmovb edx, r8d
sub r15d, r14d
sub rcx, r14
mov eax, edx
cmp rax, rcx
cmovb r15d, edx
cmp r15d, r8d
jne 0x7fffb6db6a08
and dword [rsp + 0x58], r12d
mov r13, qword [rsp + 0x68]
mov eax, dword [rsp + 0x40]
mov r8d, r15d
mov qword [rbp - 0x80], r8
mov rcx, qword [r13]
test rcx, rcx
je 0x7fffb6db69dc
mov rax, qword [rcx]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x68]
mov rax, qword [rax + 0x10]
call qword [sym.imp.____1]
mov ebx, eax
test eax, eax
js 0x7fffb6db6c79
mov rcx, qword [rbp - 0x18]
mov r8, qword [rbp - 0x80]
test rcx, rcx
je 0x7fffb6db69d8
mov rax, qword [rbp - 0x68]
add rcx, rax
cmp rax, r14
jb 0x7fffb6db69d8
lea rdx, [r8 + r14]
cmp rax, rdx
jae 0x7fffb6db69d8
cmp rcx, rdx
jae 0x7fffb6db69d8
test r12, r12
je 0x7fffb6db69d5
cmp r12, rcx
jae 0x7fffb6db69d8
mov r12, rcx
mov eax, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x58]
add r13, 8
inc ecx
mov dword [rsp + 0x58], ecx
cmp ecx, eax
jb 0x7fffb6db697c
test r12, r12
je 0x7fffb6db6a08
mov rax, r12
sub rax, r14
cmp r8, rax
jb 0x7fffb6db6c86
sub r12d, r14d
mov r15d, r12d
mov r12, qword [rsp + 0x48]
lea r8, [rbp - 0x80]
mov rax, r14
xor r9d, r9d
shr rax, 0x20
mov edx, r14d
mov rcx, r12
mov dword [rbp - 0x80], eax
call qword [sym.imp.KernelBase.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x7fffb6db6a69
call qword [sym.imp.KernelBase.dll_GetLastError]
test eax, eax
je 0x7fffb6db6a69
call qword [sym.imp.KernelBase.dll_GetLastError]
test eax, eax
jns 0x7fffb6db6a4b
call qword [sym.imp.KernelBase.dll_GetLastError]
jmp 0x7fffb6db6a59
call qword [sym.imp.KernelBase.dll_GetLastError]
movzx eax, ax
or eax, 0x80070000
mov r8d, eax
mov edx, 0x28902
mov cl, dil
call fcn.7fffb6dc60a0
mov r13, qword [rsp + 0x50]
lea r9, [rsp + 0x74]
and qword [rsp + 0x20], 0
mov rdx, r13
mov r8d, r15d
mov rcx, r12
call qword [sym.imp.KernelBase.dll_ReadFile]
test eax, eax
je 0x7fffb6db6ca7
cmp dword [rsp + 0x74], r15d
jne 0x7fffb6db6ca7
mov eax, dword [rsp + 0x74]
xor r13d, r13d
mov ecx, dword [rsp + 0x40]
add rax, r14
mov qword [rbp - 0x48], rax
xor r12d, r12d
mov rax, qword [rsp + 0x68]
mov r15, qword [r12 + rax]
test r15, r15
je 0x7fffb6db6b59
mov rax, qword [r15]
mov rdx, r14
mov r8d, dword [rsp + 0x74]
mov rcx, r15
mov r9, qword [rsp + 0x50]
mov rax, qword [rax + 8]
call qword [sym.imp.____1]
mov ebx, eax
test eax, eax
js 0x7fffb6db6c9a
jne 0x7fffb6db6b60
mov r8, qword [rbp - 0x78]
lea rdx, [rbp - 0x40]
and qword [rbp - 0x40], 0
mov r9, r15
call fcn.7fffb6db4d64
mov ebx, eax
test eax, eax
js 0x7fffb6db6ba9
mov rax, qword [rbp - 0x70]
mov rdx, qword [rbp - 0x40]
mov rcx, qword [rax + 0x18]
mov rcx, qword [rcx + r12]
call fcn.7fffb6db71a8
cmp eax, 1
je 0x7fffb6db6b4e
add eax, 0xfffffffe
cmp eax, edi
ja 0x7fffb6db6c90
add dword [rsp + 0x70], 0xffffffff
mov r15, qword [rsp + 0x60]
mov rax, qword [rsp + 0x68]
mov ecx, dword [rsp + 0x40]
jne 0x7fffb6db6b6e
mov dword [r15 + 0x18], 1
jmp 0x7fffb6db6b6e
mov r15, qword [rsp + 0x60]
mov dword [r15 + 0x18], edi
jmp 0x7fffb6db6b65
mov r15, qword [rsp + 0x60]
jmp 0x7fffb6db6b6e
mov r15, qword [rsp + 0x60]
mov ecx, dword [rsp + 0x40]
mov rax, qword [rsp + 0x68]
inc r13d
add r12, 8
cmp r13d, ecx
jb 0x7fffb6db6ab5
cmp dword [r15 + 0x18], 0
jne 0x7fffb6db6cdb
mov rbx, qword [rsp + 0x78]
or r12, 0xffffffffffffffff
jmp 0x7fffb6db687b
mov edx, 0x28715
mov r8d, esi
mov ebx, esi
mov cl, dil
call fcn.7fffb6dc60a0
mov r15, qword [rsp + 0x60]
mov r13, qword [rsp + 0x50]
mov r12, qword [rsp + 0x48]
mov rcx, qword [rbp - 0x38]
lea rax, [rbp]
cmp rcx, rax
je 0x7fffb6db6bd0
test rcx, rcx
je 0x7fffb6db6bd0
call qword [sym.imp.msvcrt.dll_free]
test r13, r13
je 0x7fffb6db6bde
mov rcx, r13
call qword [sym.imp.msvcrt.dll_free]
or rax, 0xffffffffffffffff
cmp r12, rax
je 0x7fffb6db6bf0
mov rcx, r12
call qword [sym.imp.KernelBase.dll_CloseHandle]
mov r12, qword [rsp + 0x68]
test r12, r12
je 0x7fffb6db6c34
cmp dword [rsp + 0x40], 0
jbe 0x7fffb6db6c2b
mov r14, qword [rbp - 0x10]
mov rdi, r12
mov rcx, qword [rdi]
test rcx, rcx
je 0x7fffb6db6c21
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [sym.imp.____1]
add rdi, 8
sub r14, 1
jne 0x7fffb6db6c08
mov rcx, r12
call qword [sym.imp.msvcrt.dll_free]
test ebx, ebx
js 0x7fffb6db6c40
cmp dword [r15 + 0x18], 0
cmove ebx, esi
mov eax, ebx
mov rcx, qword [rbp + 0x210]
xor rcx, rsp
call fcn.7fffb6dcff80
mov rbx, qword [rsp + 0x360]
add rsp, 0x320
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r8d, eax
mov edx, 0x2870e
jmp 0x7fffb6db6ba1
mov r8d, eax
mov edx, 0x2870f
jmp 0x7fffb6db6ba1
mov edx, 0x28711
jmp 0x7fffb6db6b9c
mov edx, 0x28712
jmp 0x7fffb6db6b9c
mov r8d, eax
mov edx, 0x28710
jmp 0x7fffb6db6ba1
mov r15, qword [rsp + 0x60]
mov ebx, 1
mov dword [r15 + 0x18], edi
jmp 0x7fffb6db6bb8
mov edx, 0x28714
jmp 0x7fffb6db6b9c
mov ebx, 0x80004004
mov edx, 0x28724
mov r8d, ebx
jmp 0x7fffb6db6ba1
mov r15, qword [rsp + 0x60]
mov ecx, dword [r15 + 0x18]
sub ecx, 1
je 0x7fffb6db6d0a
cmp ecx, 1
je 0x7fffb6db6d00
mov r8d, esi
mov edx, 0x28716
mov cl, dil
mov ebx, esi
call fcn.7fffb6dc60a0
jmp 0x7fffb6db6bae
mov ebx, 1
jmp 0x7fffb6db6bae
xor ebx, ebx
jmp 0x7fffb6db6bae
mov ebx, 1
mov dword [r15 + 0x18], edi
jmp 0x7fffb6db6bae