Function at 0x140012b10
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x4c], 0
mov qword [rsp + 0x60], 0
lea rax, [0x1401dd5c0]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x80]
mov rax, qword [rax + 8]
mov eax, dword [rax]
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0
je 0x140012b87
cmp dword [rsp + 0x48], 1
je 0x140012d51
cmp dword [rsp + 0x48], 3
je 0x140012e6a
cmp dword [rsp + 0x48], 6
je 0x140012dbf
jmp 0x140012ee1
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + 8]
mov eax, dword [rax]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x140012bcd
cmp dword [rsp + 0x44], 1
je 0x140012bfd
cmp dword [rsp + 0x44], 2
je 0x140012c46
cmp dword [rsp + 0x44], 3
je 0x140012cfb
cmp dword [rsp + 0x44], 6
je 0x140012c85
jmp 0x140012d4c
mov r8, qword [rsp + 0x90]
mov rax, qword [rsp + 0x88]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x80]
mov rcx, qword [rax]
call fcn.140161160
mov dword [rsp + 0x40], 1
jmp 0x140012d4c
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + 8]
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], 0
mov r9, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x80]
mov r8, qword [rcx]
mov rcx, qword [rsp + 0x88]
mov rdx, qword [rcx]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rsp + 0x40], eax
jmp 0x140012d4c
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + 8]
mov rax, qword [rax + 8]
mov r9, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x88]
mov r8, qword [rcx]
mov rcx, qword [rsp + 0x80]
mov rdx, qword [rcx]
mov rcx, qword [rax]
call fcn.140013940
mov dword [rsp + 0x40], eax
jmp 0x140012d4c
mov rax, qword [rsp + 0x88]
mov rcx, qword [rax]
call fcn.140012850
mov rcx, qword [rsp + 0x88]
mov rcx, qword [rcx + 8]
mov rcx, qword [rcx + 8]
xor r9d, r9d
xor r8d, r8d
mov edx, eax
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x140012cf9
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + 8]
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x58]
mov r8d, dword [rsp + 0x90]
mov rcx, qword [rsp + 0x80]
mov rdx, qword [rcx]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [rsp + 0x40], eax
jmp 0x140012d4c
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
mov rcx, qword [rcx + 8]
mov rcx, qword [rcx + 8]
mov dword [rsp + 0x30], 0
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov rax, qword [rsp + 0x88]
mov r8, qword [rax]
mov edx, 0x22c183
mov rcx, qword [rcx]
call fcn.140010930
mov dword [rsp + 0x40], eax
jmp 0x140012ee1
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + 8]
mov eax, dword [rax]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x140012d6c
jmp 0x140012db2
mov rax, qword [rsp + 0x80]
mov rax, qword [rax + 8]
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], 0
mov r9, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x88]
mov r8, qword [rcx]
mov rcx, qword [rsp + 0x80]
mov rdx, qword [rcx]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [rsp + 0x40], eax
jmp 0x140012dba
mov dword [rsp + 0x4c], 1
jmp 0x140012ee1
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + 8]
mov eax, dword [rax]
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x54], 0
je 0x140012ddd
jmp 0x140012e60
mov rax, qword [rsp + 0x80]
cmp qword [rax], 0
je 0x140012e20
mov rax, qword [rsp + 0x80]
mov rcx, qword [rax]
call fcn.140012850
mov rcx, qword [rsp + 0x80]
mov rcx, qword [rcx + 8]
mov rcx, qword [rcx + 8]
xor r9d, r9d
xor r8d, r8d
mov edx, eax
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
je 0x140012e5e
mov rax, qword [rsp + 0x80]
mov rax, qword [rax + 8]
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x58]
mov r8d, dword [rsp + 0x90]
mov rcx, qword [rsp + 0x88]
mov rdx, qword [rcx]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rsp + 0x40], eax
jmp 0x140012e68
mov dword [rsp + 0x4c], 1
jmp 0x140012ee1
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + 8]
mov eax, dword [rax]
mov dword [rsp + 0x5c], eax
cmp dword [rsp + 0x5c], 0
je 0x140012e85
jmp 0x140012ed9
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x80]
mov rcx, qword [rcx + 8]
mov rcx, qword [rcx + 8]
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x90]
mov rax, qword [rsp + 0x88]
mov r8, qword [rax]
mov edx, 0x22c187
mov rcx, qword [rcx]
call fcn.140010930
mov dword [rsp + 0x40], eax
jmp 0x140012ee1
mov dword [rsp + 0x4c], 1
cmp dword [rsp + 0x4c], 0
je 0x140012f4f
mov rdx, qword [rsp + 0x90]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
je 0x140012f4f
mov r8, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x88]
lea rcx, [rsp + 0x60]
call fcn.140012b10
test eax, eax
je 0x140012f44
mov r8, qword [rsp + 0x90]
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x80]
call fcn.140012b10
mov dword [rsp + 0x40], eax
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [rsp + 0x40]
add rsp, 0x78
ret