Function at 0x14004b550
Capabilities:
Read file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r15
lea rbp, [rsp - 0x1d8]
sub rsp, 0x2d8
mov rax, qword [0x1400a91a0]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov rax, qword [rbp + 0x230]
mov rdi, r9
mov rsi, r8
mov qword [rsp + 0x48], rax
xor eax, eax
mov r12, rdx
mov qword [rsp + 0x30], rax
mov ebx, eax
mov qword [rsp + 0x38], rax
mov qword [rdx], rax
mov r15, rcx
test r8, r8
je 0x14004b9dc
lea r8d, [rax + 0x2a]
lea rdx, [rbp - 0x80]
call fcn.14004bd60
test eax, eax
jne 0x14004b9dc
lea rax, [rbp - 0x80]
lea r9, str.Content_Type:_multipart_form_data
test rdi, rdi
cmovne r9, rdi
lea r8, str._s__boundary_s_r_n
lea rcx, [rsp + 0x30]
xor edx, edx
mov qword [rsp + 0x20], rax
call fcn.14004c940
test eax, eax
jne 0x14004b9dc
mov qword [rsp + 0x2d0], r13
mov r13, qword [rsp + 0x30]
mov qword [rsp + 0x2c8], r14
mov qword [rsp + 0x40], r13
nop dword [rax]
test rbx, rbx
je 0x14004b635
lea r8, [0x1400a73f4]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call fcn.14004c940
mov edi, eax
test eax, eax
jne 0x14004b9c0
lea r9, [rbp - 0x80]
lea r8, str.___s_r_n
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call fcn.14004c940
mov edi, eax
test eax, eax
jne 0x14004b9c0
lea r8, str.Content_Disposition:_form_data__name_
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call fcn.14004c940
mov edi, eax
test eax, eax
jne 0x14004b9c0
movsxd r9, dword [rsi + 0x10]
mov r8, qword [rsi + 8]
lea rax, [rsp + 0x38]
lea edx, [rdi + 1]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.14004c780
mov edi, eax
test eax, eax
jne 0x14004b9c0
lea r8, [0x1400a7428]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call fcn.14004c940
mov edi, eax
test eax, eax
jne 0x14004b9c0
cmp qword [rsi + 0x48], 0
je 0x14004b709
lea r8d, [rax + 0x2a]
lea rdx, [rsp + 0x50]
mov rcx, r15
call fcn.14004bd60
mov edi, eax
test eax, eax
jne 0x14004b9c0
lea r9, [rsp + 0x50]
lea r8, str._r_nContent_Type:_multipart_mixed__boundary_s_r_n
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call fcn.14004c940
mov edi, eax
test eax, eax
jne 0x14004b9c0
mov r14, rsi
nop dword [rax]
cmp qword [rsi + 0x48], 0
je 0x14004b754
lea r9, [rsp + 0x50]
lea r8, str._r_n___s_r_nContent_Disposition:_attachment
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call fcn.14004c940
mov edi, eax
test eax, eax
jne 0x14004b9c0
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x30]
mov rcx, r14
call fcn.14004ca00
mov edi, eax
test eax, eax
jmp 0x14004b77c
mov eax, dword [rsi + 0x50]
test al, 0x51
je 0x14004b782
cmp qword [rsi + 0x58], 0
jne 0x14004b766
test al, 1
je 0x14004b77a
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.14004ca00
mov edi, eax
test edi, edi
jne 0x14004b9c0
mov r9, qword [r14 + 0x38]
test r9, r9
je 0x14004b7ab
lea r8, str._r_nContent_Type:__s
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call fcn.14004c940
mov edi, eax
test eax, eax
jne 0x14004b9c0
mov rbx, qword [r14 + 0x40]
test rbx, rbx
je 0x14004b7ee
nop word [rax + rax]
mov r9, qword [rbx]
lea r8, str._r_n_s
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call fcn.14004c940
mov edi, eax
test eax, eax
jne 0x14004b9c0
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x14004b7c0
jmp 0x14004b7f6
test edi, edi
jne 0x14004b9c0
lea r8, str._r_n_r_n
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call fcn.14004c940
mov edi, eax
test eax, eax
jne 0x14004b9c0
mov eax, dword [rsi + 0x50]
test al, 1
jne 0x14004b897
test al, 2
jne 0x14004b897
test al, 0x10
je 0x14004b82f
movsxd r9, dword [rsi + 0x30]
mov r8, qword [rsi + 0x28]
jmp 0x14004b877
test al, 0x40
je 0x14004b865
test al, al
jns 0x14004b83d
mov r9, qword [rsi + 0x68]
jmp 0x14004b841
movsxd r9, dword [rsi + 0x20]
mov r8, qword [rsi + 0x60]
lea rax, [rsp + 0x38]
lea rcx, [rsp + 0x30]
mov edx, 3
mov qword [rsp + 0x20], rax
call fcn.14004c780
mov edi, eax
jmp 0x14004b9af
test al, al
jns 0x14004b86f
mov r9, qword [rsi + 0x68]
jmp 0x14004b873
movsxd r9, dword [rsi + 0x20]
mov r8, qword [rsi + 0x18]
mov edx, 2
lea rax, [rsp + 0x38]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.14004c780
mov edi, eax
jmp 0x14004b9af
mov r9, qword [r14 + 0x18]
lea rax, [0x1400a742c]
mov r8, r9
sub r8, rax
nop dword [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14004b8c3
inc rax
test ecx, ecx
jne 0x14004b8b0
test edx, edx
jne 0x14004b8ce
call fcn.1400571bc
jmp 0x14004b8dd
lea rdx, [0x1400a74ac]
mov rcx, r9
call fcn.14005a8b4
mov rbx, rax
test rax, rax
je 0x14004b98a
call fcn.1400571bc
cmp rbx, rax
je 0x14004b90b
mov rcx, rbx
call fcn.140057ab8
mov r8, qword [r14 + 0x18]
xor r9d, r9d
lea edx, [r9 + 4]
jmp 0x14004b87c
lea rcx, [rbp - 0x50]
mov r9, rbx
mov edx, 1
mov r8d, 0x200
call fcn.14005b958
test rax, rax
je 0x14004b9af
nop dword [rax + rax]
lea rcx, [rsp + 0x38]
lea r8, [rbp - 0x50]
mov r9, rax
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x30]
mov edx, 2
call fcn.14004c780
mov edi, eax
test eax, eax
jne 0x14004b9af
mov rcx, rbx
call fcn.14005cd94
test eax, eax
jne 0x14004b9af
mov rcx, rbx
call fcn.14005cdbc
test eax, eax
jne 0x14004b9af
lea edx, [rdi + 1]
lea rcx, [rbp - 0x50]
mov r9, rbx
mov r8d, 0x200
call fcn.14005b958
test rax, rax
jne 0x14004b930
jmp 0x14004b9af
test r15, r15
je 0x14004b9a2
mov r8, qword [r14 + 0x18]
lea rdx, str.couldnt_open_file___s_
mov rcx, r15
call fcn.140023ea0
mov qword [r12], 0
mov edi, reloc.WLDAP32.dll_Ordinal_26
mov r14, qword [r14 + 0x48]
test r14, r14
je 0x14004b9fb
test edi, edi
je 0x14004b710
lea rcx, [rsp + 0x40]
call fcn.14004bbb0
mov eax, edi
mov r13, qword [rsp + 0x2d0]
mov r14, qword [rsp + 0x2c8]
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.140056190
add rsp, 0x2d8
pop r15
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
test edi, edi
jne 0x14004b9c0
cmp qword [rsi + 0x48], 0
je 0x14004ba27
lea r9, [rsp + 0x50]
lea r8, str._r_n___s__
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call fcn.14004c940
mov edi, eax
test eax, eax
jne 0x14004b9c0
mov rsi, qword [rsi]
test rsi, rsi
je 0x14004ba39
mov rbx, qword [rsp + 0x38]
jmp 0x14004b610
test edi, edi
jne 0x14004b9c0
lea r9, [rbp - 0x80]
lea r8, str._r_n___s___r_n
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call fcn.14004c940
mov edi, eax
test eax, eax
jne 0x14004b9c0
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
mov qword [rcx], rax
mov qword [r12], r13
xor eax, eax
jmp 0x14004b9cc