Function at 0x14000e5e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1200]
mov eax, 0x1300
call fcn.14002a630
sub rsp, rax
mov rax, qword [0x14003d040]
xor rax, rsp
mov qword [rbp + 0x11f0], rax
mov r14, rcx
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x40], 1
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rcx], xmm0
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rax
mov dword [rsp + 0x40], 1
mov ecx, 0x18
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x14000eb1f
xor edx, edx
mov r8d, 0x234
lea rcx, [rsp + 0x64]
call fcn.14002aaa0
mov dword [rsp + 0x60], 0x238
xor r15d, r15d
xor r12d, r12d
lea rdx, [rsp + 0x60]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
je 0x14000eb15
mov edi, 0xf
movabs rsi, 0x7fffffffffffffff
nop
test r12d, r12d
jne 0x14000e71b
lea rdx, [0x140038364]
lea rcx, [rbp + 0x90]
call fcn.140019724
mov rbx, rax
test rax, rax
jne 0x14000e6c5
xor r15d, r15d
jmp 0x14000e715
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp + 0x1f0]
call fcn.14002aaa0
mov r9, rbx
mov edx, 0x1000
mov r8d, 1
lea rcx, [rbp + 0x1f0]
call fcn.14001a870
mov rcx, rbx
call fcn.140019854
mov eax, dword [rbp + 0x22c]
xor r15d, r15d
mov ecx, 0x14c
cmp word [rbp + rax + 0x1f4], cx
sete r15b
mov r12d, 1
test r15d, r15d
je 0x14000e758
lea rdx, str.SYSTEM32
lea rcx, [rbp + 0x90]
call fcn.140012c00
test rax, rax
jne 0x14000eaff
lea rdx, str.System32
lea rcx, [rbp + 0x90]
call fcn.140012c00
test rax, rax
jne 0x14000eaff
lea rdx, str.WindowsApps
lea rcx, [rbp + 0x90]
call fcn.140012c00
test rax, rax
jne 0x14000eaff
xorps xmm0, xmm0
movups xmmword [rbp + 0x1a0], xmm0
mov qword [rbp + 0x1b0], rax
mov qword [rbp + 0x1b8], rdi
mov byte [rbp + 0x1a0], al
movups xmmword [rbp + 0x1c0], xmm0
mov qword [rbp + 0x1d0], rax
mov qword [rbp + 0x1d8], rdi
mov byte [rbp + 0x1c0], al
mov rax, qword [rsp + 0x78]
mov qword [rbp + 0x1e0], rax
mov eax, dword [rbp - 0x80]
mov qword [rbp + 0x1e8], rax
movups xmmword [rsp + 0x20], xmm0
lea rax, [rbp + 0x90]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x14000e7d6
cmp rbx, rsi
ja 0x14000eb52
cmp rbx, 0xf
ja 0x14000e816
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rdi
mov r8, rbx
lea rdx, [rbp + 0x90]
lea rcx, [rsp + 0x20]
call fcn.14002ae60
mov byte [rsp + rbx + 0x20], 0
jmp 0x14000e8c0
mov rdi, rbx
or rdi, 0xf
cmp rdi, rsi
jbe 0x14000e835
mov rdi, rsi
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x14000e865
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
test rcx, rcx
jne 0x14000e84f
xor esi, esi
jmp 0x14000e88c
cmp rcx, 0x1000
jb 0x14000e884
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000eb5e
mov rcx, rax
call fcn.140010c30
test rax, rax
je 0x14000eb58
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x14000e88c
call fcn.140010c30
mov rsi, rax
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rdi
mov r8, rbx
lea rdx, [rbp + 0x90]
mov rcx, rsi
call fcn.14002ae60
mov byte [rsi + rbx], 0
movabs rsi, 0x7fffffffffffffff
mov edi, 0xf
cmp rdi, 0xf
jbe 0x14000e8fb
lea rdx, [rdi + 1]
mov rcx, qword [rbp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e8f6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000eb58
call fcn.140010eac
movups xmm0, xmmword [rsp + 0x20]
movaps xmmword [rbp + 0x1a0], xmm0
movups xmm1, xmmword [rsp + 0x30]
movaps xmmword [rbp + 0x1b0], xmm1
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
lea rax, [rbp - 0x70]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x14000e926
cmp rbx, rsi
ja 0x14000eb52
cmp rbx, 0xf
ja 0x14000e963
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rdi
mov r8, rbx
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x20]
call fcn.14002ae60
mov byte [rsp + rbx + 0x20], 0
jmp 0x14000ea0a
mov rdi, rbx
or rdi, 0xf
cmp rdi, rsi
jbe 0x14000e982
mov rdi, rsi
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x14000e9b2
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
test rcx, rcx
jne 0x14000e99c
xor esi, esi
jmp 0x14000e9d9
cmp rcx, 0x1000
jb 0x14000e9d1
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000eb5e
mov rcx, rax
call fcn.140010c30
test rax, rax
je 0x14000eb58
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x14000e9d9
call fcn.140010c30
mov rsi, rax
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rdi
mov r8, rbx
lea rdx, [rbp - 0x70]
mov rcx, rsi
call fcn.14002ae60
mov byte [rsi + rbx], 0
movabs rsi, 0x7fffffffffffffff
mov edi, 0xf
movups xmm0, xmmword [rsp + 0x20]
movaps xmmword [rbp + 0x1c0], xmm0
movups xmm1, xmmword [rsp + 0x30]
movaps xmmword [rbp + 0x1d0], xmm1
mov rbx, qword [r14 + 8]
cmp rbx, qword [r14 + 0x10]
je 0x14000ea6e
mov qword [rsp + 0x50], rbx
lea rdx, [rbp + 0x1a0]
mov rcx, rbx
call fcn.140005410
nop
lea rcx, [rbx + 0x20]
lea rdx, [rbp + 0x1c0]
call fcn.140005410
mov rax, qword [rbp + 0x1e0]
mov qword [rbx + 0x40], rax
mov rax, qword [rbp + 0x1e8]
mov qword [rbx + 0x48], rax
add qword [r14 + 8], 0x50
jmp 0x14000ea81
lea r8, [rbp + 0x1a0]
mov rdx, rbx
mov rcx, r14
call fcn.140008960
nop
mov rdx, qword [rbp + 0x1d8]
cmp rdx, 0xf
jbe 0x14000eac2
inc rdx
mov rcx, qword [rbp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000eabd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000eb4c
call fcn.140010eac
mov rdx, qword [rbp + 0x1b8]
cmp rdx, 0xf
jbe 0x14000eaff
inc rdx
mov rcx, qword [rbp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000eafa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000eb4c
call fcn.140010eac
lea rdx, [rsp + 0x60]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x14000e6a0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rax, r14
mov rcx, qword [rbp + 0x11f0]
xor rcx, rsp
call fcn.140010af0
mov rbx, qword [rsp + 0x1350]
add rsp, 0x1300
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14001907c
nop
call fcn.140004910
int3
call fcn.14001907c
int3
call fcn.140001360
int3