Function at 0x140009b86
Capabilities:
Read file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov rax, qword [0x1400160c0]
xor rax, rbp
mov qword [rbp], rax
mov eax, dword [0x1400161dc]
mov ebx, dword [0x1400161d8]
lea edi, [rax - 1]
imul edi, eax
test dil, 1
sete byte [rbp - 1]
cmp ebx, 0xa
setl byte [rbp - 2]
mov rsi, r9
mov r14, r8
mov qword [rbp - 0x40], rdx
mov rbx, rcx
mov eax, 0x55cd6a1e
mov r13, qword [sym.imp.ntoskrnl.exe_ZwClose]
xor r15d, r15d
cmp eax, 0x4eb24e9
jle 0x140009c3e
cmp eax, 0x55cd6a1d
jg 0x140009cae
cmp eax, 0x48615113
jg 0x140009d3a
cmp eax, 0x4eb24ea
je 0x140009fdf
cmp eax, 0x379c0457
je 0x14000a00d
cmp eax, 0x47a6e79f
jne 0x140009be6
mov eax, dword [0x1400161dc]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x698a3ccb
mov ecx, 0xaa706f80
jmp 0x14000a133
cmp eax, 0xc2dc20f9
jle 0x140009cf0
cmp eax, 0xf56be2b9
jg 0x140009d79
cmp eax, 0xc2dc20fa
je 0x140009fd2
cmp eax, 0xd559668e
je 0x14000a046
cmp eax, 0xd6759190
jne 0x140009be6
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 8]
mov dword [rsi], eax
mov rax, qword [rbp - 0x10]
mov rcx, qword [rax]
sub rsp, 0x20
call r13
add rsp, 0x20
mov eax, dword [0x1400161dc]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa2a635e4
mov ecx, 0xc2dc20fa
jmp 0x14000a133
cmp eax, 0x698a3cca
jg 0x140009db8
cmp eax, 0x55cd6a1e
je 0x14000a050
cmp eax, 0x5e0396db
je 0x14000a06e
cmp eax, 0x63e56f7d
jne 0x140009be6
cmp byte [rbp - 3], 0
mov eax, 0x9726932b
mov ecx, 0x52b01275
cmovne eax, ecx
jmp 0x140009be6
cmp eax, 0xa2a635e3
jg 0x140009e88
cmp eax, 0x9726932b
je 0x14000a084
cmp eax, 0x97449ea2
je 0x140009fd2
cmp eax, 0xa13f816c
jne 0x140009be6
mov eax, dword [0x1400161dc]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x7276e3f3
mov ecx, 0x379c0457
jmp 0x14000a133
cmp eax, 0x48615114
je 0x14000a0a2
cmp eax, 0x5121311e
je 0x14000a10d
cmp eax, 0x52b01275
jne 0x140009be6
mov eax, dword [0x1400161dc]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xf7f6753e
mov ecx, 0x48615114
jmp 0x14000a133
cmp eax, 0xf56be2ba
je 0x14000a11a
cmp eax, 0xf7f6753e
je 0x14000a145
cmp eax, 0x4746434
jne 0x140009be6
mov eax, dword [0x1400161dc]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa2a635e4
mov ecx, 0xd6759190
jmp 0x14000a133
cmp eax, 0x698a3ccb
je 0x14000a199
cmp eax, 0x7276e3f3
je 0x14000a1a3
cmp eax, 0x7bfadba2
jne 0x140009be6
mov eax, 0x10
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rcx, rsp
mov eax, 0x10
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov r9, rsp
mov eax, 0x30
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov r8, rsp
mov qword [rcx], r15
mov qword [r9 + 8], r15
mov qword [r9], r15
mov qword [r8], r15
mov qword [r8 + 0x18], r15
mov qword [r8 + 8], r15
mov dword [r8], 0x30
mov dword [r8 + 0x18], 0x240
mov qword [r8 + 0x10], rbx
mov qword [r8 + 0x20], r15
mov qword [r8 + 0x28], r15
sub rsp, 0x60
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x20], r15
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x40], 0x60
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
add rsp, 0x60
mov eax, 0xa866e7b8
jmp 0x140009be6
cmp eax, 0xa2a635e4
je 0x14000a1c8
cmp eax, 0xa866e7b8
jne 0x14000a1ed
mov eax, 0x10
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax
mov eax, 0x10
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x10], rax
mov eax, 0x10
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x18], rax
mov eax, 0x30
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov r8, rsp
mov rax, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x40]
mov qword [rax], rcx
mov rax, qword [rbp - 0x10]
mov qword [rbp - 0x38], rax
mov rax, qword [rbp - 0x38]
mov rax, qword [rbp - 0x10]
mov qword [rax], r15
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov rax, qword [rbp - 0x20]
mov qword [rax + 8], r15
mov qword [rax], r15
mov qword [rbp - 0x30], r8
mov rax, qword [rbp - 0x30]
mov rax, qword [rbp - 0x30]
mov qword [rax + 0x28], r15
mov qword [rax + 0x20], r15
mov qword [rax + 0x18], r15
mov qword [rax + 0x10], r15
mov qword [rax + 8], r15
mov qword [rax], r15
mov dword [r8], 0x30
mov qword [r8 + 8], r15
mov dword [r8 + 0x18], 0x240
mov qword [r8 + 0x10], rbx
mov qword [r8 + 0x20], r15
mov qword [r8 + 0x28], r15
mov rcx, qword [rbp - 0x10]
mov r9, qword [rbp - 0x18]
sub rsp, 0x60
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x20], r15
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x40], 0x60
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
add rsp, 0x60
test eax, eax
setns byte [rbp - 3]
mov eax, dword [0x1400161dc]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x7bfadba2
mov ecx, 0x63e56f7d
jmp 0x14000a133
mov eax, 0x4eb24ea
xor r12d, r12d
jmp 0x140009be6
mov byte [rbp - 5], r12b
mov rax, qword [rbp - 0x30]
mov rax, qword [rbp - 0x20]
mov rax, qword [rbp - 0x38]
mov eax, dword [0x1400161dc]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x698a3ccb
mov ecx, 0x47a6e79f
jmp 0x14000a133
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 8]
mov dword [rsi], eax
mov rax, qword [rbp - 0x10]
mov rcx, qword [rax]
sub rsp, 0x20
call r13
add rsp, 0x20
mov eax, dword [0x1400161dc]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x7276e3f3
mov ecx, 0x5121311e
jmp 0x14000a133
mov eax, 0xf56be2ba
jmp 0x140009be6
mov cl, byte [rbp - 1]
cmp byte [rbp - 2], 0
mov eax, 0x7bfadba2
mov edx, 0xa866e7b8
cmovne eax, edx
test cl, cl
cmovne eax, edx
jmp 0x140009be6
cmp byte [rbp - 4], 0
mov eax, 0x4746434
mov ecx, 0xa13f816c
cmovne eax, ecx
jmp 0x140009be6
mov eax, dword [0x1400161dc]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xd559668e
mov ecx, 0xf56be2ba
jmp 0x14000a133
mov rax, qword [rbp - 0x20]
mov qword [rax + 8], r15
mov qword [rax], r15
mov eax, dword [rsi]
mov rcx, qword [rbp - 0x10]
mov rcx, qword [rcx]
mov rdx, qword [rbp - 0x28]
mov rdi, qword [rbp - 0x18]
sub rsp, 0x50
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
add rsp, 0x50
test eax, eax
setns byte [rbp - 4]
mov eax, dword [0x1400161dc]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xf7f6753e
mov ecx, 0x5e0396db
jmp 0x14000a133
mov eax, 0x4eb24ea
mov r12b, 1
jmp 0x140009be6
mov eax, dword [0x1400161dc]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xd559668e
mov ecx, 0x97449ea2
cmove eax, ecx
cmp dword [0x1400161d8], 0xa
cmovl eax, ecx
jmp 0x140009be6
mov rax, qword [rbp - 0x20]
mov qword [rax + 8], r15
mov qword [rax], r15
mov eax, dword [rsi]
mov rcx, qword [rbp - 0x10]
mov rcx, qword [rcx]
mov rdx, qword [rbp - 0x28]
mov rdi, qword [rbp - 0x18]
sub rsp, 0x50
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
add rsp, 0x50
mov eax, 0x48615114
jmp 0x140009be6
mov eax, 0x47a6e79f
jmp 0x140009be6
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 8]
mov dword [rsi], eax
mov rax, qword [rbp - 0x10]
mov rcx, qword [rax]
sub rsp, 0x20
call r13
add rsp, 0x20
mov eax, 0x379c0457
jmp 0x140009be6
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 8]
mov dword [rsi], eax
mov rax, qword [rbp - 0x10]
mov rcx, qword [rax]
sub rsp, 0x20
call r13
add rsp, 0x20
mov eax, 0xd6759190
jmp 0x140009be6
cmp eax, 0xaa706f80
jne 0x140009be6
mov bl, byte [rbp - 5]
mov rcx, qword [rbp]
xor rcx, rbp
sub rsp, 0x20
call fcn.140013f90
add rsp, 0x20
mov eax, ebx
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret