Function at 0x1400056a0
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push rsi
push rdi
push r15
mov eax, 0x10050
call fcn.1400111e0
sub rsp, rax
xor r15d, r15d
lea rcx, [rsp + 0x40]
mov word [rsp + 0x40], r15w
sub rcx, 2
cmp word [rcx + 2], r15w
lea rcx, [rcx + 2]
jne 0x1400056c4
lea r8, [0x140045d10]
xor edx, edx
nop dword [rax + rax]
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x1400056e0
mov rsi, 0xffffffffffffffff
lea rcx, [rsp + 0x40]
mov rax, rsi
cmp word [rcx + rax*2 + 2], r15w
lea rax, [rax + 1]
jne 0x140005701
cmp word [rsp + rax*2 + 0x3e], 0x5c
je 0x140005733
lea rcx, [rsp + 0x40]
sub rcx, 2
nop
cmp word [rcx + 2], r15w
lea rcx, [rcx + 2]
jne 0x140005720
mov eax, dword [0x140019c88]
mov dword [rcx], eax
lea rcx, [rsp + 0x40]
sub rcx, 2
nop dword [rax]
cmp word [rcx + 2], r15w
lea rcx, [rcx + 2]
jne 0x140005740
lea r8, str.MpCmdRun.exe
xor edx, edx
nop dword [rax]
nop dword [rax + rax]
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x140005760
mov qword [rsp + 0x30], r15
lea rcx, str.ntsapi.dll
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, rsi
jne 0x1400057b8
mov eax, 1
add rsp, 0x10050
pop r15
pop rdi
pop rsi
ret
lea rdx, [rsp + 0x10070]
mov qword [rsp + 0x10088], rbx
mov rcx, rdi
mov dword [rsp + 0x10070], r15d
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x1400057fd
cmp dword [rsp + 0x10070], r15d
jne 0x1400057fd
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 2
jmp 0x14000597d
lea ecx, [rax + rax]
mov qword [rsp + 0x10048], rbp
call fcn.140008ad0
mov rbp, rax
mov rcx, rdi
test rax, rax
jne 0x140005826
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [rbp + 3]
jmp 0x140005975
lea r9, [rsp + 0x10078]
mov dword [rsp + 0x10078], r15d
mov r8d, ebx
mov qword [rsp + 0x20], r15
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
je 0x140005867
mov rcx, rbp
call fcn.140008ac8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 4
jmp 0x140005975
mov ecx, dword [0x140035884]
cmp ecx, 0xf
jge 0x140005877
add ecx, 0x57
jmp 0x140005879
dec ecx
movsxd rax, dword [rbp + 0x3c]
mov r8d, 0x14c
mov dword [0x140035884], ecx
lea rdx, [rax + rbp]
movzx eax, word [rax + rbp + 4]
cmp ax, r8w
je 0x1400058c1
mov r8d, 0x8664
cmp ax, r8w
je 0x1400058c1
cmp ecx, 0x10
mov eax, 0x58
cmovge eax, esi
mov esi, 1
add eax, ecx
mov dword [0x140035884], eax
jmp 0x140005962
mov qword [rsp + 0x10040], r14
lea rcx, [rsp + 0x40]
mov word [rdx + 0x5e], r15w
xor r9d, r9d
mov dword [rdx + 0x58], r15d
xor r8d, r8d
mov qword [rsp + 0x30], r15
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, rsi
je 0x140005942
lea r9, [rsp + 0x10080]
mov dword [rsp + 0x10080], r15d
mov r8d, ebx
mov qword [rsp + 0x20], r15
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 1
mov esi, 0xfffffffe
cmove esi, r15d
jmp 0x14000595a
mov eax, dword [0x140035884]
cmp eax, 0x11
jge 0x140005952
add eax, 0x59
jmp 0x140005954
dec eax
mov dword [0x140035884], eax
mov r14, qword [rsp + 0x10040]
mov rcx, rbp
call fcn.140008ac8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rbp, qword [rsp + 0x10048]
mov rbx, qword [rsp + 0x10088]
add rsp, 0x10050
pop r15
pop rdi
pop rsi
ret