Function at 0x14000d78c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x1400150f8]
xor rax, rsp
mov qword [rbp + 0x70], rax
xor edi, edi
mov r15, rdx
test rdx, rdx
je 0x14000d8ac
lea rbx, [0x1400158c0]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], dil
jne 0x14000d7d1
mov ecx, 5
cmp rax, rcx
jb 0x14000d8ac
lea rdx, [rbx - 4]
add rdx, rax
lea rcx, str..TTF
call qword [sym.imp.msvcrt.dll__stricmp]
nop dword [rax + rax]
test eax, eax
jne 0x14000d8ac
mov edx, 0x8000
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__open]
nop dword [rax + rax]
mov esi, eax
cmp eax, 0xffffffff
je 0x14000d8ac
mov r8d, reloc.Cabinet.dll_FCIFlushFolder
lea rdx, [rsp + 0x48]
mov ecx, eax
call qword [sym.imp.msvcrt.dll__read]
nop dword [rax + rax]
cmp eax, 0xc
jne 0x14000d89e
movzx ecx, byte [rsp + 0x4c]
mov ebx, edi
movzx eax, word [rsp + 0x4c]
shl cx, 8
movzx r14d, cx
shr eax, 8
or r14d, eax
jbe 0x14000d89e
mov r13d, 1
cmp ebx, 0x28
jae 0x14000d89e
mov r8d, 0x10
lea rdx, [rsp + 0x38]
mov ecx, esi
call qword [sym.imp.msvcrt.dll__read]
nop dword [rax + rax]
cmp eax, 0x10
jne 0x14000d89e
cmp dword [rsp + 0x38], 0x656d616e
je 0x14000d8d7
add ebx, r13d
cmp ebx, r14d
jb 0x14000d869
mov ecx, esi
call qword [sym.imp.msvcrt.dll__close]
nop dword [rax + rax]
xor eax, eax
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.14000e520
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret
mov ecx, dword [rsp + 0x40]
xor r8d, r8d
mov ebx, ecx
mov eax, ecx
shr eax, 0x10
and ebx, 0xff0000
or ebx, eax
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shr ebx, 8
shl eax, 8
mov ecx, esi
or ebx, eax
mov edx, ebx
call qword [sym.imp.msvcrt.dll__lseek]
nop dword [rax + rax]
cmp eax, ebx
jne 0x14000d89e
mov r8d, 6
lea rdx, [rsp + 0x20]
mov ecx, esi
call qword [sym.imp.msvcrt.dll__read]
nop dword [rax + rax]
cmp eax, 6
jne 0x14000d89e
movzx eax, byte [rsp + 0x22]
shl ax, 8
movzx ebx, ax
movzx eax, word [rsp + 0x22]
shr eax, 8
or ebx, eax
je 0x14000d89e
mov r14d, 5
mov r8d, reloc.Cabinet.dll_FCIFlushFolder
lea rdx, [rsp + 0x28]
mov ecx, esi
dec ebx
call qword [sym.imp.msvcrt.dll__read]
nop dword [rax + rax]
cmp eax, 0xc
jne 0x14000d89e
movzx eax, word [rsp + 0x28]
movzx ecx, al
shl cx, 8
shr ax, 8
or cx, ax
cmp cx, r13w
jne 0x14000d9b0
movzx eax, word [rsp + 0x2e]
movzx ecx, al
shl cx, 8
shr ax, 8
or cx, ax
cmp cx, r14w
je 0x14000d9ba
test ebx, ebx
je 0x14000d89e
jmp 0x14000d95a
mov ecx, dword [rsp + 0x40]
xor r8d, r8d
mov ebx, ecx
mov eax, ecx
shr eax, 0x10
and ebx, 0xff0000
or ebx, eax
mov eax, ecx
shl eax, 0x10
and ecx, 0xff00
or eax, ecx
shr ebx, 8
shl eax, 8
or ebx, eax
movzx eax, byte [rsp + 0x24]
shl ax, 8
movzx ecx, ax
movzx eax, word [rsp + 0x24]
shr eax, 8
or ecx, eax
movzx eax, byte [rsp + 0x32]
shl ax, 8
add ebx, ecx
movzx ecx, ax
movzx eax, word [rsp + 0x32]
shr eax, 8
or ecx, eax
movzx eax, byte [rsp + 0x30]
shl ax, 8
add ebx, ecx
movzx r14d, ax
mov edx, ebx
movzx eax, word [rsp + 0x30]
mov ecx, esi
shr eax, 8
or r14d, eax
call qword [sym.imp.msvcrt.dll__lseek]
nop dword [rax + rax]
cmp eax, ebx
jne 0x14000d89e
cmp r14d, 0xff
ja 0x14000d89e
mov r8d, r14d
lea rdx, [rsp + 0x70]
mov ecx, esi
call qword [sym.imp.msvcrt.dll__read]
nop dword [rax + rax]
cmp eax, r14d
jne 0x14000d89e
cmp r14d, 0x100
jae 0x14000db06
mov ecx, esi
mov byte [rsp + r14 + 0x70], dil
call qword [sym.imp.msvcrt.dll__close]
nop dword [rax + rax]
lea rdx, str.0123456789
lea rcx, [rsp + 0x70]
call qword [sym.imp.msvcrt.dll_strpbrk]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x14000dafb
mov rcx, rax
call qword [sym.imp.msvcrt.dll_atol]
nop dword [rax + rax]
lea rdx, str.0123456789
mov rcx, rbx
mov edi, eax
shl edi, 0x10
call qword [sym.imp.msvcrt.dll_strspn]
nop dword [rax + rax]
movsxd rcx, eax
cmp byte [rbx + rcx], 0x2e
jne 0x14000dafb
inc rcx
add rcx, rbx
call qword [sym.imp.msvcrt.dll_atol]
nop dword [rax + rax]
movzx ecx, ax
add edi, ecx
mov dword [r15], edi
mov eax, r13d
jmp 0x14000d8ae
call fcn.14000e6f8
int3