Function at 0x140007bd8
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
xor edi, edi
mov r14d, r9d
or qword [rbp - 8], 0xffffffffffffffff
mov esi, r8d
mov r13, rcx
mov rcx, qword [0x1400be2f8]
lea r12, [0x1400be2f8]
mov r15d, dword [rbp + 0x68]
cmp rcx, r12
je 0x140007c25
test byte [rcx + 0x44], 0x80
jne 0x140023fb8
test r13, r13
je 0x1400244f8
cmp dword [r13], 0x6060
jne 0x1400244f8
lea rbx, [0x1400b3628]
cmp r14d, 1
jne 0x140023fd9
mov r14d, 0x18
cmp r15d, r14d
jb 0x140024038
mov r14, qword [rbp + 0x60]
test r14, r14
je 0x14002406e
or qword [r14 + 8], 0xffffffffffffffff
mov eax, 1
mov dword [r14], eax
mov dword [r14 + 0x10], eax
mov rax, qword [0x1400c02d8]
cmp qword [r13 + 8], rax
jne 0x140024116
mov rcx, qword [0x1400be2f8]
lea rbx, [0x1400b3628]
cmp rcx, r12
je 0x140007ca8
test byte [rcx + 0x44], 0x80
jne 0x1400240b2
movabs r10, 0x96f5aeea5c50d270
mov rcx, qword [r13 + 0x10]
mov edx, esi
mov rax, qword [rax + 0x2a8]
call qword [case.0x140007f48.0]
mov edi, eax
mov rax, qword [0x1400be2f8]
cmp rax, r12
je 0x140007cdd
test byte [rax + 0x44], 0x80
jne 0x1400240d2
mov eax, edi
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [rcx + 0x38]
mov edx, 0x1b
mov dword [rsp + 0x28], r15d
mov r9d, esi
mov dword [rsp + 0x20], r14d
call fcn.14006c9c4
nop
jmp 0x140007c25
mov esi, 0x7c
mov ecx, esi
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov rax, qword [0x1400be2f8]
cmp rax, r12
je 0x140007cdd
test byte [rax + 0x44], 0x20
je 0x1400244e0
lea edx, [rsi - 0x5d]
jmp 0x140024010
mov edx, 0x1d
mov dword [rsp + 0x20], r14d
jmp 0x140024024
mov edx, 0x23
mov dword [rsp + 0x20], 0x40000
mov rcx, qword [rax + 0x38]
mov r9d, esi
mov r8, rbx
call fcn.14003340c
jmp 0x1400244d9
mov esi, 0x7a
mov ecx, esi
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov rax, qword [rbp + 0x70]
mov dword [rax], r14d
mov rax, qword [0x1400be2f8]
cmp rax, r12
je 0x140007cdd
test byte [rax + 0x44], 0x20
je 0x1400244e0
jmp 0x14002400b
mov esi, 0x57
mov ecx, esi
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov rax, qword [0x1400be2f8]
cmp rax, r12
je 0x140007cdd
test byte [rax + 0x44], 0x20
je 0x1400244e0
mov rcx, qword [rax + 0x38]
lea edx, [rsi - 0x39]
mov r9d, esi
mov r8, rbx
call fcn.14002c238
jmp 0x1400244d9
mov rcx, qword [rcx + 0x38]
mov edx, 0x20
mov r9d, esi
mov r8, rbx
call fcn.14002c238
mov rax, qword [0x1400c02d8]
jmp 0x140007ca8
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edx, 0x21
jmp 0x1400240f6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edx, 0x2e
mov rcx, qword [0x1400be2f8]
mov r9d, edi
mov r8, rbx
mov dword [rsp + 0x20], eax
mov rcx, qword [rcx + 0x38]
call fcn.14003340c
nop
jmp 0x140007cdd
cmp qword [r13 + 0x38], 0xffffffffffffffff
jne 0x140024152
mov ebx, 6
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov rcx, qword [0x1400be2f8]
cmp rcx, r12
je 0x140024537
test byte [rcx + 0x44], 0x20
je 0x140024537
lea edx, [rbx + 0x1c]
jmp 0x140024520
mov ecx, 0x40000
call sym.spoolsv.exe_PrvDllAllocSplMem
mov r12, rax
test rax, rax
jne 0x14002419b
lea esi, [rax + 8]
mov ecx, esi
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov rax, qword [0x1400be2f8]
lea r12, [0x1400be2f8]
cmp rax, r12
je 0x140007cdd
test byte [rax + 0x44], 0x20
je 0x1400244e0
jmp 0x140024017
mov rcx, qword [0x1400be2f8]
lea rdx, [0x1400be2f8]
cmp rcx, rdx
je 0x1400241e2
test byte [rcx + 0x44], 0x80
je 0x1400241e2
mov rcx, qword [rcx + 0x38]
mov edx, 0x24
mov r8, rbx
call fcn.14002c20c
jmp 0x1400241db
mov rcx, qword [rcx + 0x38]
mov edx, 0x2c
mov r9d, r15d
mov r8, rbx
call fcn.14002c238
mov rcx, qword [0x1400be2f8]
cmp esi, 0x40000
jae 0x1400241f6
mov r15d, esi
test esi, esi
jne 0x1400241fc
jmp 0x14002442b
mov r15d, 0x40000
mov rcx, qword [r13 + 0x38]
lea r9, [rbp + 0x40]
mov r8d, r15d
mov qword [rsp + 0x20], rdi
mov rdx, r12
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
nop dword [rax + rax]
test eax, eax
je 0x140024424
mov rcx, qword [0x1400be2f8]
lea rax, [0x1400be2f8]
cmp rcx, rax
je 0x140024267
test byte [rcx + 0x44], 0x80
je 0x140024267
mov eax, dword [rbp + 0x40]
mov edx, 0x25
mov rcx, qword [rcx + 0x38]
mov r9d, esi
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r15d
call fcn.14006c9c4
mov rcx, qword [0x1400be2f8]
lea rax, [0x1400be2f8]
mov r8d, dword [rbp + 0x40]
test r8d, r8d
je 0x1400243eb
cmp esi, r8d
jb 0x1400243c5
cmp rcx, rax
je 0x1400242b7
test byte [rcx + 0x44], 0x80
je 0x1400242b7
mov rcx, qword [rcx + 0x38]
mov r9d, esi
mov dword [rsp + 0x28], r8d
sub r9d, r8d
mov edx, 0x27
mov dword [rsp + 0x20], esi
call fcn.14006c9c4
mov r8d, dword [rbp + 0x40]
lea rax, [0x1400be2f8]
mov rcx, qword [0x1400be2f8]
sub esi, r8d
cmp rcx, rax
je 0x1400242e1
test byte [rcx + 0x44], 0x80
je 0x1400242e1
mov rcx, qword [rcx + 0x38]
mov edx, 0x29
mov r8, rbx
call fcn.14002c20c
mov r8d, dword [rbp + 0x40]
mov rcx, qword [0x1400be2f8]
mov r15d, edi
test r8d, r8d
je 0x140024364
mov rax, qword [r13 + 8]
sub r8d, r15d
mov edx, r15d
add rdx, r12
movabs r10, 0xce998fb610d75970
mov rcx, qword [r13 + 0x10]
lea r9, [rbp - 0x10]
mov rax, qword [rax + 0xc8]
call qword [case.0x140007f48.0]
test eax, eax
je 0x140024383
mov rcx, qword [0x1400be2f8]
lea rax, [0x1400be2f8]
cmp rcx, rax
je 0x140024357
test byte [rcx + 0x44], 0x80
je 0x140024357
mov eax, dword [rbp + 0x40]
mov edx, 0x2b
mov r9d, dword [rbp - 0x10]
mov rcx, qword [rcx + 0x38]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r15d
call fcn.14006c9c4
mov rcx, qword [0x1400be2f8]
add r15d, dword [rbp - 0x10]
mov r8d, dword [rbp + 0x40]
cmp r15d, r8d
jb 0x1400242e9
lea rax, [0x1400be2f8]
cmp rcx, rax
je 0x1400241e2
test byte [rcx + 0x44], 0x80
je 0x1400241e2
jmp 0x1400241c7
mov rax, qword [0x1400be2f8]
lea rdx, [0x1400be2f8]
cmp rax, rdx
je 0x140024407
test byte [rax + 0x44], 0x20
je 0x140024407
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [0x1400be2f8]
mov edx, 0x2a
mov r9d, eax
mov r8, rbx
mov rcx, qword [rcx + 0x38]
call fcn.14002c238
jmp 0x140024407
cmp rcx, rax
je 0x140024407
test byte [rcx + 0x44], 0x20
je 0x140024407
mov rcx, qword [rcx + 0x38]
mov edx, 0x28
mov dword [rsp + 0x20], r8d
mov r9d, esi
mov r8, rbx
call fcn.14003340c
jmp 0x140024407
cmp rcx, rax
je 0x140024407
test byte [rcx + 0x44], 0x20
je 0x140024407
mov rcx, qword [rcx + 0x38]
mov edx, 0x26
mov r8, rbx
call fcn.14002c20c
mov rcx, qword [0x1400c02b8]
mov r8, r12
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
jmp 0x1400244d2
mov rcx, qword [0x1400be2f8]
lea rax, [0x1400be2f8]
cmp rcx, rax
je 0x14002444e
test byte [rcx + 0x44], 0x80
je 0x14002444e
mov rcx, qword [rcx + 0x38]
mov edx, 0x2d
mov r8, rbx
call fcn.14002c20c
mov rcx, qword [0x1400c02b8]
mov r8, r12
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x1400244d2
mov r8, qword [rbp + 0x48]
lea r9, [rbp - 8]
mov rdx, qword [r13 + 0x38]
mov r15d, 2
mov dword [rsp + 0x30], r15d
mov rcx, rax
lea r12d, [r15 - 1]
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], edi
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_DuplicateHandle]
nop dword [rax + rax]
test eax, eax
je 0x1400244c3
mov rax, qword [rbp - 8]
mov edi, r12d
mov qword [r14 + 8], rax
mov dword [r14], r12d
mov dword [r14 + 0x10], r15d
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
lea r12, [0x1400be2f8]
mov rax, qword [0x1400be2f8]
cmp rax, r12
je 0x140007cdd
test byte [rax + 0x44], 0x80
je 0x140007cdd
jmp 0x1400240e5
mov ebx, 6
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov rcx, qword [0x1400be2f8]
cmp rcx, r12
je 0x140024537
test byte [rcx + 0x44], 0x20
je 0x140024537
lea edx, [rbx + 0x16]
mov rcx, qword [rcx + 0x38]
lea r8, [0x1400b3628]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
call fcn.14003340c
xor eax, eax
jmp 0x140007cdf