Function at 0x14000b728
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x1400220f0]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor ebx, ebx
mov rdi, r9
mov rsi, r8
mov r14d, edx
test r9, r9
je 0x14000b75c
mov byte [r9], bl
mov rdx, rcx
mov qword [rsp + 0x60], 0x50
lea rcx, [rbp - 0x78]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0x50], ebx
lea rax, [rbp - 0x78]
mov qword [rsp + 0x48], rbx
lea r9, [rsp + 0x78]
mov dword [rsp + 0x40], 0x60
lea r8, [rbp - 0x68]
mov dword [rsp + 0x38], 3
lea rcx, [rsp + 0x70]
mov qword [rbp - 0x58], rax
xorps xmm0, xmm0
mov dword [rsp + 0x30], ebx
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 6
mov edx, 0xc0000000
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x68], 0x30
mov qword [rbp - 0x60], rbx
mov dword [rbp - 0x50], 0x240
movdqu xmmword [rbp - 0x48], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
test eax, eax
jns 0x14000b7e8
lfence
jmp 0x14000b9c8
movabs rax, 0xfffff78000000014
mov rax, qword [rax]
cmp qword [rbp - 0x80], 2
mov qword [rsp + 0x68], rax
je 0x14000b8cf
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rbx
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
lea rax, [rbp - 0x30]
mov dword [rsp + 0x30], 0x50
mov qword [rsp + 0x28], rax
xor edx, edx
lea rax, [rsp + 0x78]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
test eax, eax
js 0x14000b8c5
cmp qword [rbp - 0x80], 0x50
jne 0x14000b8c5
mov edx, r14d
lea rcx, [rbp - 0x30]
call fcn.14000b0d0
test al, al
jne 0x14000b86c
mov ebx, 0xc000003e
jmp 0x14000b9bb
cmp dword [rbp - 0x14], 0x4a
jb 0x14000b8cf
cmp byte [rbp - 1], bl
je 0x14000b896
test rsi, rsi
je 0x14000b896
movaps xmm0, xmmword [rbp]
movaps xmm1, xmmword [rbp + 0x10]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
test rdi, rdi
je 0x14000b896
mov sil, 1
mov byte [rdi], sil
mov rcx, qword [rbp - 0x10]
test rcx, rcx
js 0x14000b862
mov rax, qword [rsp + 0x68]
cmp rcx, rax
jg 0x14000b862
sub rax, rcx
sar rax, 0x20
cmp eax, 0x1a0a
jb 0x14000b9bb
mov ebx, 0xc0000268
jmp 0x14000b9bb
mov ebx, 0xc0000001
jmp 0x14000b9bb
mov r9, rsi
mov byte [rsp + 0x20], 0x4a
mov r8d, r14d
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x30]
call fcn.14000b190
lea rcx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_RtlRandomEx]
mov ecx, dword [0x140022120]
mov r8d, 0x746f7250
mov eax, eax
imul r14, rax, 0x3b0
movabs rax, 0x400000011
mul r14
sub r14, rdx
shr r14, 1
add r14, rdx
shr r14, 0x1e
add r14d, 0x50
mov edx, r14d
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
test rax, rax
je 0x14000b963
movaps xmm0, xmmword [rbp - 0x30]
mov sil, 1
movups xmmword [rax], xmm0
movaps xmm1, xmmword [rbp - 0x20]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [rbp - 0x10]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [rbp]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [rbp + 0x10]
movups xmmword [rax + 0x40], xmm0
jmp 0x14000b970
mov r14d, 0x50
lea rdi, [rbp - 0x30]
mov sil, bl
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rbx
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov dword [rsp + 0x30], r14d
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rdi
xor edx, edx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x60], rbx
call qword [sym.imp.ntoskrnl.exe_ZwWriteFile]
test sil, sil
je 0x14000b9bb
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1400157c0
add rsp, 0x130
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret