Function at 0x14027b2b0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rdi
push r12
push r13
push r15
mov eax, 0xc468
call sub.ntdll.dll___chkstk
sub rsp, rax
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + 0xc450], rax
mov rbx, rcx
mov r12, r8
lea rcx, [rsp + 0x52]
xor edx, edx
mov r8d, reloc.MFC80U.DLL_Ordinal_1022
mov word [rsp + 0x50], 0
call sub.ntdll.dll_memset
lea rdx, [0x140372c1c]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_wcsstr]
test rax, rax
jne 0x14027b384
cmp word [rbx], 0x5c
je 0x14027b384
cmp word [rbx + 2], 0x5c
je 0x14027b384
lea rdx, [rsp + 0x50]
mov r8d, 0x400
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x50]
mov dx, 0x5c
call qword [sym.imp.ntdll.dll_wcsrchr]
test rax, rax
je 0x14027b346
mov word [rax], 0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x50]
repne scasw ax, word [rdi]
mov eax, dword [0x140372cc4]
or rcx, 0xffffffffffffffff
mov dword [rdi - 2], eax
xor eax, eax
lea rdi, [rsp + 0x50]
repne scasw ax, word [rdi]
xor ecx, ecx
nop
movzx eax, word [rbx + rcx]
add rcx, 2
test ax, ax
mov word [rdi + rcx - 4], ax
jne 0x14027b370
jmp 0x14027b3a1
lea rcx, [rsp + 0x50]
sub rcx, rbx
nop
movzx eax, word [rbx]
add rbx, 2
test ax, ax
mov word [rcx + rbx - 2], ax
jne 0x14027b390
xor r13d, r13d
lea rcx, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x30], r13
lea r8d, [r13 + 3]
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov ebx, r13d
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea r15d, [r13 + 1]
cmp rax, 0xffffffffffffffff
mov rdi, rax
je 0x14027b431
lea rcx, [rsp + 0x451]
xor edx, edx
mov r8d, 0x1fff
mov byte [rsp + 0x450], bl
call sub.ntdll.dll_memset
lea rdx, [rsp + 0x450]
mov r8d, 0x2000
mov rcx, rdi
call fcn.140279d10
cmp byte [rsp + 0x450], 0xff
jne 0x14027b428
cmp byte [rsp + 0x451], 0xfe
cmove ebx, r15d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
mov qword [rsp + 0x30], r13
lea rcx, [rsp + 0x50]
lea r8d, [r9 + 3]
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbp, rax
jne 0x14027b46d
xor eax, eax
jmp 0x14027b849
lea rcx, [rsp + 0x2452]
xor edx, edx
mov r8d, 0x1ffe
mov qword [rsp + 0xc460], r14
mov word [rsp + 0x2450], r13w
call sub.ntdll.dll_memset
mov rdx, r13
lea r14, [0x1403782e8]
nop
movzx eax, word [rdx + r14]
add rdx, 2
test ax, ax
mov word [rsp + rdx + 0x244e], ax
jne 0x14027b4a0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x2450]
repne scasw ax, word [rdi]
mov eax, dword [0x140372e0c]
lea rcx, [rsp + 0x8452]
xor edx, edx
mov r8d, 0x3ffe
mov qword [rsp + 0xc4a8], rsi
mov dword [rdi - 2], eax
mov word [rsp + 0x8450], r13w
call sub.ntdll.dll_memset
test ebx, ebx
je 0x14027b689
nop
lea rcx, [rsp + 0x8450]
xor edx, edx
mov r8d, 0x2000
call sub.ntdll.dll_memset
lea rdi, [rsp + 0x8450]
mov ebx, r13d
mov rsi, r13
nop
nop
nop
nop
lea r9, [rsp + 0x40]
mov r8d, 2
mov rdx, rdi
mov rcx, rbp
mov dword [rsp + 0x40], r13d
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14027b619
cmp dword [rsp + 0x40], r13d
je 0x14027b619
movzx eax, word [rdi]
add ebx, r15d
add rsi, r15
add rdi, 2
cmp ax, 0xa
je 0x14027b57f
cmp ebx, 0x1000
jb 0x14027b530
mov word [rdi], r13w
cmp byte [rsp + 0x8450], 0xff
jne 0x14027b5d0
cmp byte [rsp + 0x8451], 0xfe
jne 0x14027b5d0
movzx ecx, word [rsp + 0x8452]
mov rax, r13
lea rdx, [rsp + 0x8452]
test cx, cx
je 0x14027b5c7
nop
add rdx, 2
mov word [rsp + rax*2 + 0x8450], cx
add rax, r15
mov cx, word [rdx]
test cx, cx
jne 0x14027b5b0
mov word [rsp + rax*2 + 0x8450], r13w
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x8450]
repne scasw ax, word [rdi]
not rcx
sub rcx, r15
cmp ecx, 2
jl 0x14027b620
movsxd rax, ecx
cmp word [rsp + rax*2 + 0x844c], 0xd
jne 0x14027b620
cmp word [rsp + rax*2 + 0x844e], 0xa
jne 0x14027b620
mov word [rsp + rax*2 + 0x844c], r13w
mov word [rsp + rax*2 + 0x844e], r13w
jmp 0x14027b620
mov word [rdi + rsi*2], r13w
mov ecx, ebx
test ecx, ecx
je 0x14027b7f5
lea rdx, [rsp + 0x2450]
lea rcx, [rsp + 0x8450]
call qword [sym.imp.ntdll.dll_wcsstr]
test rax, rax
mov r11, rax
je 0x14027b500
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r14
repne scasw ax, word [rdi]
not rcx
sub rcx, r15
movsxd rdx, ecx
lea rcx, [r11 + rdx*2 + 2]
mov rdx, r12
nop
nop
nop
movzx eax, word [rcx]
add rdx, 2
add rcx, 2
test ax, ax
mov word [rdx - 2], ax
jne 0x14027b670
jmp 0x14027b7f5
lea rcx, [rsp + 0x451]
xor edx, edx
mov r8d, 0x1fff
mov byte [rsp + 0x450], r13b
call sub.ntdll.dll_memset
lea rcx, [rsp + 0x6451]
xor edx, edx
mov r8d, 0x1fff
mov byte [rsp + 0x6450], r13b
call sub.ntdll.dll_memset
lea rcx, [rsp + 0x4451]
xor edx, edx
mov r8d, 0x1fff
mov byte [rsp + 0x4450], r13b
call sub.ntdll.dll_memset
lea rcx, [rsp + 0x6450]
mov r8d, 0x2000
mov rdx, r14
call qword [sym.imp.ntdll.dll_wcstombs]
nop
nop
nop
lea rcx, [rsp + 0x450]
xor edx, edx
mov r8d, 0x2000
call sub.ntdll.dll_memset
lea rdi, [rsp + 0x450]
mov ebx, r13d
mov rsi, r13
nop
nop
nop
nop
lea r9, [rsp + 0x40]
mov r8d, r15d
mov rdx, rdi
mov rcx, rbp
mov dword [rsp + 0x40], r13d
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14027b776
cmp dword [rsp + 0x40], r13d
je 0x14027b776
movzx eax, byte [rdi]
add ebx, r15d
add rsi, r15
add rdi, r15
cmp al, 0xa
je 0x14027b771
cmp ebx, 0x2000
jb 0x14027b730
mov byte [rdi], r13b
jmp 0x14027b77a
mov byte [rsi + rdi], r13b
test ebx, ebx
je 0x14027b7de
lea rdx, [rsp + 0x6450]
lea rcx, [rsp + 0x450]
call qword [sym.imp.ntdll.dll_strstr]
test rax, rax
mov r11, rax
je 0x14027b700
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x6450]
repne scasb al, byte [rdi]
lea rdi, [rsp + 0x4450]
not rcx
sub rcx, r15
movsxd rdx, ecx
sub rdi, rdx
sub rdi, r11
lea rcx, [rdx + r11 + 1]
nop
movzx eax, byte [rcx]
mov byte [rdi + rcx - 1], al
add rcx, r15
test al, al
jne 0x14027b7d0
lea rdx, [rsp + 0x4450]
mov r8d, 0x2000
mov rcx, r12
call qword [sym.imp.ntdll.dll_mbstowcs]
mov r14, qword [rsp + 0xc460]
mov rsi, qword [rsp + 0xc4a8]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
sub rcx, r15
cmp ecx, 2
jl 0x14027b83d
movsxd rcx, ecx
cmp word [r12 + rcx*2 - 4], 0xd
jne 0x14027b83d
cmp word [r12 + rcx*2 - 2], 0xa
jne 0x14027b83d
mov word [r12 + rcx*2 - 4], ax
mov word [r12 + rcx*2 - 2], ax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r15d
mov rcx, qword [rsp + 0xc450]
xor rcx, rsp
call fcn.140161080
add rsp, 0xc468
pop r15
pop r13
pop r12
pop rdi
pop rbp
pop rbx
ret