Function at 0x140003090
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
xor r14d, r14d
xor eax, eax
mov qword [rbp + 0x77], r14
mov rsi, rdx
mov qword [rbp + 0x7f], r14
mov ebx, r14d
mov dword [rbp + 7], r14d
mov edi, 0xc0000001
mov qword [rbp + 0xf], rax
mov qword [rbp + 0x17], rax
mov qword [rbp + 0x1f], rax
mov qword [rbp + 0x27], rax
mov qword [rbp + 0x2f], rax
mov qword [rbp - 9], r14
mov qword [rbp - 1], rax
mov qword [rbp + 0x6f], r14
test rdx, rdx
je 0x1400032de
test rcx, rcx
je 0x1400032de
mov dword [rsp + 0x50], r14d
lea r9, [rbp - 9]
mov qword [rsp + 0x48], r14
lea r8, [rbp + 7]
mov dword [rsp + 0x40], 0x60
xorps xmm0, xmm0
mov dword [rsp + 0x38], 1
mov edx, 0x80000000
mov dword [rsp + 0x30], 1
mov qword [rbp + 0x17], rcx
lea rcx, [rbp + 0x77]
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], r14
mov dword [rbp + 7], 0x30
mov qword [rbp + 0xf], r14
mov dword [rbp + 0x1f], 0x240
movdqu xmmword [rbp + 0x27], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
test eax, eax
js 0x1400032b0
mov dword [rsp + 0x50], r14d
lea r9, [rbp - 9]
mov qword [rsp + 0x48], r14
lea r8, [rbp + 7]
mov dword [rsp + 0x40], 0x60
lea rcx, [rbp + 0x7f]
mov dword [rsp + 0x38], 5
xorps xmm0, xmm0
mov dword [rsp + 0x30], 1
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], r14
mov dword [rbp + 7], 0x30
mov qword [rbp + 0xf], r14
mov dword [rbp + 0x1f], 0x240
mov qword [rbp + 0x17], rsi
movdqu xmmword [rbp + 0x27], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
test eax, eax
js 0x1400032b0
mov edx, 0x1000
lea ecx, [r14 + 1]
mov r8d, 0x777078
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
je 0x1400032b0
mov rcx, qword [rbp + 0x77]
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x40], r14
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov dword [rsp + 0x30], 0x1000
lea rax, [rbp - 9]
mov qword [rsp + 0x28], rbx
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
test eax, eax
js 0x1400032a7
nop dword [rax + rax]
mov esi, dword [rbp - 1]
lea rax, [rbp + 0x6f]
mov rcx, qword [rbp + 0x7f]
xor r9d, r9d
mov qword [rsp + 0x40], r14
xor r8d, r8d
mov qword [rsp + 0x38], rax
xor edx, edx
mov dword [rsp + 0x30], esi
lea rax, [rbp - 9]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwWriteFile]
test eax, eax
js 0x1400032b0
mov rcx, qword [rbp + 0x77]
lea rax, [rbp + 0x6f]
add qword [rbp + 0x6f], rsi
xor r9d, r9d
mov qword [rsp + 0x40], r14
xor r8d, r8d
mov qword [rsp + 0x38], rax
xor edx, edx
mov dword [rsp + 0x30], 0x1000
lea rax, [rbp - 9]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
test eax, eax
jns 0x140003230
cmp eax, 0xc0000011
cmove edi, r14d
mov rcx, qword [rbp + 0x77]
test rcx, rcx
je 0x1400032bf
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rbp + 0x7f]
test rcx, rcx
je 0x1400032ce
call qword [sym.imp.ntoskrnl.exe_ZwClose]
test rbx, rbx
je 0x1400032de
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, edi
add rsp, 0xa0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret