Function at 0x140051430
Capabilities:
Read file on windows

Disassembly:
push r12
mov eax, 0x40b0
call sub.ntdll.dll___chkstk
sub rsp, rax
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + 0x4080], rax
mov qword [rsp + 0x48], rcx
call fcn.140051000
cmp rax, 0xffffffffffffffff
mov r12, rax
mov qword [rsp + 0x40], rax
jne 0x140051470
xor eax, eax
jmp 0x1400519bc
mov qword [rsp + 0x40c8], rbx
mov qword [rsp + 0x40d0], rbp
mov qword [rsp + 0x40d8], rsi
lea rcx, [rsp + 0x82]
xor edx, edx
mov r8d, 0x3ffe
mov qword [rsp + 0x40a8], rdi
mov word [rsp + 0x80], 0
mov qword [rsp + 0x40a0], r13
call sub.ntdll.dll_memset
movzx ebx, byte [rsp + 0x30]
mov qword [rsp + 0x4098], r14
mov qword [rsp + 0x4090], r15
xor r13d, r13d
nop
lea rcx, [rsp + 0x80]
xor edx, edx
mov r8d, 0x2000
call sub.ntdll.dll_memset
lea rdi, [rsp + 0x80]
mov esi, r13d
mov rbp, r13
nop
nop
nop
nop
lea r9, [rsp + 0x38]
mov r8d, 2
mov rdx, rdi
mov rcx, r12
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400515f5
cmp dword [rsp + 0x38], 0
je 0x1400515f5
movzx eax, word [rdi]
add esi, 1
add rbp, 1
add rdi, 2
cmp ax, 0xa
je 0x140051550
cmp esi, 0x1000
jb 0x140051500
mov word [rdi], 0
cmp byte [rsp + 0x80], 0xff
jne 0x1400515b2
cmp byte [rsp + 0x81], 0xfe
jne 0x1400515b2
movzx ecx, word [rsp + 0x82]
mov rax, r13
lea rdx, [rsp + 0x82]
test cx, cx
je 0x1400515a8
nop
nop
nop
nop
add rdx, 2
mov word [rsp + rax*2 + 0x80], cx
add rax, 1
mov cx, word [rdx]
test cx, cx
jne 0x140051590
mov word [rsp + rax*2 + 0x80], 0
or rsi, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x80]
mov rcx, rsi
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
cmp ecx, 2
jl 0x140051601
movsxd rax, ecx
cmp word [rsp + rax*2 + 0x7c], 0xd
jne 0x140051601
cmp word [rsp + rax*2 + 0x7e], 0xa
jne 0x140051601
mov word [rsp + rax*2 + 0x7c], 0
mov word [rsp + rax*2 + 0x7e], 0
jmp 0x140051601
mov ecx, esi
mov word [rdi + rbp*2], 0
or rsi, 0xffffffffffffffff
test ecx, ecx
je 0x140051976
lea rdx, [0x1402e0f14]
lea rcx, [rsp + 0x80]
call qword [sym.imp.ntdll.dll_wcsstr]
test rax, rax
mov r14, rax
je 0x1400514d0
lea r15, [rax + 2]
test r15, r15
je 0x1400514d0
lea rax, [rsp + 0x80]
sub r14, rax
mov eax, 2
sar r14, 1
lea ecx, [r14 + 1]
movsxd rbp, ecx
mul rbp
cmovo rax, rsi
mov rcx, rax
call sub.MFC80U.DLL_Ordinal_265
mov rcx, rsi
mov rdi, r15
mov r12, rax
mov qword [rsp + 0x50], rax
xor eax, eax
repne scasw ax, word [rdi]
mov eax, 2
not rcx
movsxd rdi, ecx
lea rsi, [rcx - 1]
mov rcx, 0xffffffffffffffff
mul rdi
cmovo rax, rcx
mov rcx, rax
call sub.MFC80U.DLL_Ordinal_265
lea r8, [rbp + rbp]
xor edx, edx
mov rcx, r12
mov r13, rax
mov qword [rsp + 0x58], rax
call sub.ntdll.dll_memset
lea r8, [rdi + rdi]
xor edx, edx
mov rcx, r13
call sub.ntdll.dll_memset
lea rdx, [rsp + 0x80]
movsxd r8, r14d
mov rcx, r12
call qword [sym.imp.ntdll.dll_wcsncpy]
movsxd r8, esi
mov rdx, r15
mov rcx, r13
call qword [sym.imp.ntdll.dll_wcsncpy]
lea rdx, [0x1402e0fb0]
mov rcx, r13
call qword [sym.imp.ntdll.dll_wcsstr]
test rax, rax
je 0x14005175d
nop
nop
nop
lea rdx, [0x1402e0fb0]
mov rcx, r13
call qword [sym.imp.ntdll.dll_wcsstr]
test rax, rax
je 0x140051748
mov word [rax], 9
add rax, 2
mov rcx, rax
je 0x140051748
movzx edx, word [rax + 2]
add rax, 2
test dx, dx
je 0x140051743
add rax, 2
mov word [rcx], dx
add rcx, 2
mov dx, word [rax]
test dx, dx
jne 0x140051730
mov word [rcx], 0
lea rdx, [0x1402e0fb0]
mov rcx, r13
call qword [sym.imp.ntdll.dll_wcsstr]
test rax, rax
jne 0x140051700
lea rdx, [0x1402e0fa8]
mov rcx, r13
call qword [sym.imp.ntdll.dll_wcsstr]
test rax, rax
je 0x1400517dd
nop
nop
nop
nop
lea rdx, [0x1402e0fa8]
mov rcx, r13
call qword [sym.imp.ntdll.dll_wcsstr]
test rax, rax
je 0x1400517c8
mov word [rax], 0xd
add rax, 2
mov rcx, rax
je 0x1400517c8
movzx edx, word [rax + 2]
add rax, 2
test dx, dx
je 0x1400517c3
add rax, 2
mov word [rcx], dx
add rcx, 2
mov dx, word [rax]
test dx, dx
jne 0x1400517b0
mov word [rcx], 0
lea rdx, [0x1402e0fa8]
mov rcx, r13
call qword [sym.imp.ntdll.dll_wcsstr]
test rax, rax
jne 0x140051780
lea rdx, [0x1402e0fa0]
mov rcx, r13
call qword [sym.imp.ntdll.dll_wcsstr]
test rax, rax
je 0x14005185d
nop
nop
nop
nop
lea rdx, [0x1402e0fa0]
mov rcx, r13
call qword [sym.imp.ntdll.dll_wcsstr]
test rax, rax
je 0x140051848
mov word [rax], 0xa
add rax, 2
mov rcx, rax
je 0x140051848
movzx edx, word [rax + 2]
add rax, 2
test dx, dx
je 0x140051843
add rax, 2
mov word [rcx], dx
add rcx, 2
mov dx, word [rax]
test dx, dx
jne 0x140051830
mov word [rcx], 0
lea rdx, [0x1402e0fa0]
mov rcx, r13
call qword [sym.imp.ntdll.dll_wcsstr]
test rax, rax
jne 0x140051800
mov rsi, qword [rsp + 0x48]
mov rdx, qword [rsi + 0x10]
add rsi, 8
test rdx, rdx
jne 0x140051877
xor r13d, r13d
mov rcx, r13
jmp 0x140051885
mov rcx, qword [rsi + 0x10]
sub rcx, rdx
sar rcx, 4
xor r13d, r13d
test rdx, rdx
je 0x1400518cd
mov rax, qword [rsi + 0x18]
sub rax, rdx
sar rax, 4
cmp rcx, rax
jae 0x1400518cd
mov rdi, qword [rsi + 0x10]
xor eax, eax
lea r8, [rsp + 0x50]
mov byte [rsp + 0x28], al
lea edx, [rax + 1]
mov r9, rsi
mov rcx, rdi
mov byte [rsp + 0x20], bl
call fcn.14004cd40
mov r12, qword [rsp + 0x40]
lea rdx, [rdi + 0x10]
mov qword [rsi + 0x10], rdx
jmp 0x1400514d0
mov rdi, qword [rsi + 0x10]
cmp rdx, rdi
jbe 0x1400518dc
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov rbp, qword [rsi + 8]
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rdi
test rbp, rbp
je 0x140051913
mov rcx, qword [rsi + 0x10]
mov rax, rcx
sub rax, rbp
sar rax, 4
je 0x140051913
cmp rbp, rcx
jbe 0x14005190a
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
sub rdi, rbp
sar rdi, 4
jmp 0x140051916
mov rdi, r13
movaps xmm0, xmmword [rsp + 0x60]
lea r9, [rsp + 0x50]
lea rdx, [rsp + 0x70]
mov r8d, 1
mov rcx, rsi
movdqa xmmword [rsp + 0x70], xmm0
call fcn.14004cda0
mov rbp, qword [rsi + 8]
cmp rbp, qword [rsi + 0x10]
jbe 0x140051949
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
add rdi, rdi
lea rax, [rbp + rdi*8]
cmp rax, qword [rsi + 0x10]
ja 0x140051966
cmp rax, qword [rsi + 8]
mov r12, qword [rsp + 0x40]
jae 0x1400514d0
call qword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov r12, qword [rsp + 0x40]
jmp 0x1400514d0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r15, qword [rsp + 0x4090]
mov r14, qword [rsp + 0x4098]
mov r13, qword [rsp + 0x40a0]
mov rdi, qword [rsp + 0x40a8]
mov rsi, qword [rsp + 0x40d8]
mov rbp, qword [rsp + 0x40d0]
mov rbx, qword [rsp + 0x40c8]
mov eax, 1
mov rcx, qword [rsp + 0x4080]
xor rcx, rsp
call fcn.140161080
add rsp, 0x40b0
pop r12
ret