Function at 0x14000f0e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r15d, r15d
mov rbx, r9
mov r13, r8
mov r12, rdx
mov r14, rcx
lea esi, [r15 + 0x5a]
mov ebp, r15d
mov qword [rsp + 0x30], r15
test rdx, rdx
jne 0x14000f11e
xor eax, eax
jmp 0x14000f2cc
test r8, r8
je 0x14000f3f8
test rbx, rbx
je 0x14000f3f8
lea rdx, str.sha256__
mov r8d, 8
mov rcx, r12
mov qword [rsp + 0x70], rdi
call sub.MSVCR120.dll_strncmp
test eax, eax
jne 0x14000f2eb
mov rax, qword [case.0x14001ea1c.2]
cmp qword [rax + 0xb8], rbp
je 0x14000f2c5
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call qword [sub.MSVCR120.dll_malloc]
mov rbp, rax
test rax, rax
je 0x14000f216
mov r8, rax
mov rax, qword [case.0x14001ea1c.2]
mov r9d, reloc.WLDAP32.dll_Ordinal_32
mov rdx, rbx
mov rcx, r13
call qword [rax + 0xb8]
test eax, eax
jne 0x14000f2c7
lea rax, [rsp + 0x38]
lea r9, [rsp + 0x78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov rdx, rbp
mov rcx, r14
mov qword [rsp + 0x20], rax
call fcn.14002a020
mov rcx, rbp
mov edi, eax
call qword [sub.MSVCR120.dll_free]
test edi, edi
je 0x14000f1d7
mov eax, edi
jmp 0x14000f2c7
mov r8, qword [rsp + 0x78]
lea rdx, str._t_public_key_hash:_sha256___s_n
mov rcx, r14
call fcn.140018f20
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r12
repne scasb al, byte [rdi]
not rcx
lea rdi, [rcx - 1]
call qword [sub.MSVCR120.dll_malloc]
mov rbp, rax
test rax, rax
jne 0x14000f220
mov rcx, qword [rsp + 0x78]
call qword [sub.MSVCR120.dll_free]
mov eax, reloc.WLDAP32.dll_Ordinal_27
jmp 0x14000f2c7
lea r8, [rdi + 1]
mov rdx, r12
mov rcx, rax
call sub.MSVCR120.dll_memcpy
mov rdi, rbp
nop word [rax + rax]
lea rdx, str._sha256__
mov rcx, rdi
call sub.MSVCR120.dll_strstr
mov rbx, rax
test rax, rax
je 0x14000f25a
mov byte [rax], r15b
mov r8, qword [rsp + 0x38]
or rcx, 0xffffffffffffffff
lea rdx, [rdi + 8]
xor eax, eax
mov rdi, rdx
repne scasb al, byte [rdi]
mov rdi, qword [rsp + 0x78]
not rcx
dec rcx
cmp r8, rcx
jne 0x14000f28a
mov rcx, rdi
call sub.MSVCR120.dll_memcmp
test eax, eax
je 0x14000f2e6
test rbx, rbx
je 0x14000f2ae
lea rdx, str.sha256__
mov rcx, rbx
mov byte [rbx], Ordinal_60
call sub.MSVCR120.dll_strstr
mov rdi, rax
test rax, rax
jne 0x14000f240
mov rdi, qword [rsp + 0x78]
mov rcx, rdi
call qword [sub.MSVCR120.dll_free]
mov rcx, rbp
mov qword [rsp + 0x78], r15
call qword [sub.MSVCR120.dll_free]
mov eax, esi
mov rdi, qword [rsp + 0x70]
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rsi
ret
mov esi, r15d
jmp 0x14000f2ae
lea rdx, [0x14011802c]
mov rcx, r12
call fcn.14002a1b0
mov r12, rax
test rax, rax
je 0x14000f2c5
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 2]
call sub.MSVCR120.dll_fseek
test eax, eax
jne 0x14000f3d2
mov rcx, r12
call sub.MSVCR120.dll_ftell
xor r8d, r8d
xor edx, edx
mov rcx, r12
movsxd rdi, eax
call sub.MSVCR120.dll_fseek
test eax, eax
jne 0x14000f3d2
cmp edi, 0x100000
ja 0x14000f3d2
mov rcx, rdi
call fcn.14001d100
mov rdi, rax
cmp rbx, rax
ja 0x14000f3d2
lea rcx, [rax + 1]
call qword [sub.MSVCR120.dll_malloc]
mov rbp, rax
test rax, rax
je 0x14000f3d2
mov r9, r12
mov r8d, 1
mov rdx, rdi
mov rcx, rax
call sub.MSVCR120.dll_fread
cmp eax, 1
jne 0x14000f3d2
cmp rbx, rdi
jne 0x14000f39b
mov r8, rbx
mov rdx, rbp
mov rcx, r13
call sub.MSVCR120.dll_memcmp
test eax, eax
jne 0x14000f3d2
mov esi, r15d
jmp 0x14000f3d2
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x30]
mov rcx, rbp
mov byte [rdi + rbp], r15b
call fcn.14000efd0
test eax, eax
jne 0x14000f3d2
cmp rbx, qword [rsp + 0x78]
jne 0x14000f3d2
mov rdx, qword [rsp + 0x30]
mov r8, rbx
mov rcx, r13
call sub.MSVCR120.dll_memcmp
test eax, eax
cmove esi, r15d
mov rcx, rbp
call qword [sub.MSVCR120.dll_free]
mov rcx, qword [rsp + 0x30]
call qword [sub.MSVCR120.dll_free]
mov rcx, r12
mov qword [rsp + 0x30], r15
call sub.MSVCR120.dll_fclose
jmp 0x14000f2c5
mov eax, esi
jmp 0x14000f2cc