Function at 0x1400011fe
Capabilities:
Read file on windows
Write file on windows

Disassembly:
jmp 0x140002270
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x4c], 0
mov qword [rsp + 0x60], 0
lea rax, [0x14000fd00]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x80]
mov rax, qword [rax + 8]
mov eax, dword [rax]
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0
je 0x1400022e7
cmp dword [rsp + 0x48], 1
je 0x1400024b1
cmp dword [rsp + 0x48], 3
je 0x1400025ca
cmp dword [rsp + 0x48], 6
je 0x14000251f
jmp 0x140002641
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + 8]
mov eax, dword [rax]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x14000232d
cmp dword [rsp + 0x44], 1
je 0x14000235d
cmp dword [rsp + 0x44], 2
je 0x1400023a6
cmp dword [rsp + 0x44], 3
je 0x14000245b
cmp dword [rsp + 0x44], 6
je 0x1400023e5
jmp 0x1400024ac
mov r8, qword [rsp + 0x90]
mov rax, qword [rsp + 0x88]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x80]
mov rcx, qword [rax]
call sub.VCRUNTIME140.dll_memcpy
mov dword [rsp + 0x40], 1
jmp 0x1400024ac
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + 8]
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], 0
mov r9, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x80]
mov r8, qword [rcx]
mov rcx, qword [rsp + 0x88]
mov rdx, qword [rcx]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rsp + 0x40], eax
jmp 0x1400024ac
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + 8]
mov rax, qword [rax + 8]
mov r9, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x88]
mov r8, qword [rcx]
mov rcx, qword [rsp + 0x80]
mov rdx, qword [rcx]
mov rcx, qword [rax]
call fcn.140001172
mov dword [rsp + 0x40], eax
jmp 0x1400024ac
mov rax, qword [rsp + 0x88]
mov rcx, qword [rax]
call fcn.140001208
mov rcx, qword [rsp + 0x88]
mov rcx, qword [rcx + 8]
mov rcx, qword [rcx + 8]
xor r9d, r9d
xor r8d, r8d
mov edx, eax
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x140002459
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + 8]
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x58]
mov r8d, dword [rsp + 0x90]
mov rcx, qword [rsp + 0x80]
mov rdx, qword [rcx]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [rsp + 0x40], eax
jmp 0x1400024ac
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
mov rcx, qword [rcx + 8]
mov rcx, qword [rcx + 8]
mov dword [rsp + 0x30], 0
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov rax, qword [rsp + 0x88]
mov r8, qword [rax]
mov edx, 0x22c183
mov rcx, qword [rcx]
call fcn.14000111d
mov dword [rsp + 0x40], eax
jmp 0x140002641
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + 8]
mov eax, dword [rax]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x1400024cc
jmp 0x140002512
mov rax, qword [rsp + 0x80]
mov rax, qword [rax + 8]
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], 0
mov r9, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x88]
mov r8, qword [rcx]
mov rcx, qword [rsp + 0x80]
mov rdx, qword [rcx]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [rsp + 0x40], eax
jmp 0x14000251a
mov dword [rsp + 0x4c], 1
jmp 0x140002641
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + 8]
mov eax, dword [rax]
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x54], 0
je 0x14000253d
jmp 0x1400025c0
mov rax, qword [rsp + 0x80]
cmp qword [rax], 0
je 0x140002580
mov rax, qword [rsp + 0x80]
mov rcx, qword [rax]
call fcn.140001208
mov rcx, qword [rsp + 0x80]
mov rcx, qword [rcx + 8]
mov rcx, qword [rcx + 8]
xor r9d, r9d
xor r8d, r8d
mov edx, eax
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
je 0x1400025be
mov rax, qword [rsp + 0x80]
mov rax, qword [rax + 8]
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x58]
mov r8d, dword [rsp + 0x90]
mov rcx, qword [rsp + 0x88]
mov rdx, qword [rcx]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rsp + 0x40], eax
jmp 0x1400025c8
mov dword [rsp + 0x4c], 1
jmp 0x140002641
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + 8]
mov eax, dword [rax]
mov dword [rsp + 0x5c], eax
cmp dword [rsp + 0x5c], 0
je 0x1400025e5
jmp 0x140002639
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x80]
mov rcx, qword [rcx + 8]
mov rcx, qword [rcx + 8]
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x90]
mov rax, qword [rsp + 0x88]
mov r8, qword [rax]
mov edx, 0x22c187
mov rcx, qword [rcx]
call fcn.14000111d
mov dword [rsp + 0x40], eax
jmp 0x140002641
mov dword [rsp + 0x4c], 1
cmp dword [rsp + 0x4c], 0
je 0x1400026af
mov rdx, qword [rsp + 0x90]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
je 0x1400026af
mov r8, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x88]
lea rcx, [rsp + 0x60]
call fcn.1400011fe
test eax, eax
je 0x1400026a4
mov r8, qword [rsp + 0x90]
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x80]
call fcn.1400011fe
mov dword [rsp + 0x40], eax
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [rsp + 0x40]
add rsp, 0x78
ret