Function at 0x140004dd0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xd0
mov rax, qword [0x14003f0b8]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov rsi, r8
mov r12, rdx
mov r8d, dword [rcx + 0x18]
mov r15, rcx
mov r14d, dword [rsi + 8]
cmp r8d, r14d
jbe 0x140004e16
mov r9d, 0x80000005
jmp 0x14000507b
cmp dword [rsi], 4
je 0x140004e26
mov r9d, 0xc0000059
jmp 0x14000507b
mov edi, dword [rsi + 0xc]
mov ecx, 0x28
mov ebx, dword [rsi + 0x10]
cmp ebx, edi
je 0x140004f88
lea eax, [r8 + rdi]
cmp eax, r14d
jbe 0x140004ec6
cmp ebx, edi
jbe 0x140004e4d
mov ebx, dword [rsi + 4]
mov r8, rcx
xor edx, edx
lea rcx, [rbp - 0x11]
call sub.msvcrt.dll_memset
mov rcx, qword [0x14003f0d0]
mov eax, 0x28
sub r14d, edi
mov qword [rbp - 0x59], rdi
cmp r14d, eax
cmova r14d, eax
and qword [rsp + 0x40], 0
lea rax, [rbp - 0x59]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
lea rax, [rbp - 0x11]
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x28], rax
xor edx, edx
lea rax, [rbp - 0x41]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtWriteFile]
nop dword [rax + rax]
mov r9d, eax
test eax, eax
js 0x14000507b
mov edi, dword [rsi + 4]
mov ecx, 0x28
mov r8d, dword [r15 + 0x18]
lea eax, [r8 + rdi]
cmp ebx, eax
ja 0x140004f68
mov edx, dword [rsi + 8]
cmp ebx, edx
jae 0x140004f68
cmp ebx, edi
jb 0x140004f68
and qword [rsp + 0x40], 0
lea rax, [rbp - 0x51]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov dword [rsp + 0x30], ecx
lea rax, [rbp - 0x11]
mov rcx, qword [0x14003f0d0]
xor r8d, r8d
mov qword [rsp + 0x28], rax
xor edx, edx
lea rax, [rbp - 0x31]
mov r14d, ebx
mov qword [rsp + 0x20], rax
mov qword [rbp - 0x51], r14
call qword [sym.imp.ntdll.dll_NtReadFile]
nop dword [rax + rax]
mov r9d, eax
test eax, eax
js 0x14000507b
mov edx, dword [rsi + 8]
lea rax, [r14 + 0x28]
cmp rax, rdx
ja 0x140004f65
mov eax, dword [rbp + 7]
test eax, eax
je 0x140004f65
add ebx, eax
cmp ebx, edx
ja 0x140004f65
mov ecx, dword [r15 + 0x18]
add ecx, edi
cmp ebx, ecx
mov ecx, 0x28
jbe 0x140004ed5
jmp 0x140004f68
mov ebx, dword [rsi + 4]
cmp ebx, dword [rsi + 8]
jb 0x140004f74
mov ebx, dword [rsi + 4]
mov eax, ebx
jmp 0x140004f77
mov eax, dword [rsi + 4]
cmp ebx, eax
jne 0x140004f83
cmp edi, eax
je 0x14000507b
mov ecx, 0x28
and qword [rsp + 0x40], 0
xor r9d, r9d
mov eax, edi
xor r8d, r8d
mov qword [rbp - 0x49], rax
xor edx, edx
lea rax, [rbp - 0x49]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x21]
mov dword [rsp + 0x30], ecx
mov rcx, qword [0x14003f0d0]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtWriteFile]
nop dword [rax + rax]
mov r9d, eax
test eax, eax
js 0x14000507b
add edi, 0x28
test r12, r12
je 0x14000502d
and qword [rsp + 0x40], 0
xor r9d, r9d
mov rcx, qword [0x14003f0d0]
xor r8d, r8d
mov eax, edi
xor edx, edx
mov qword [rbp - 0x51], rax
lea rax, [rbp - 0x51]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x31]
mov dword [rsp + 0x30], 0xc
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtWriteFile]
nop dword [rax + rax]
mov r9d, eax
test eax, eax
js 0x14000507b
add edi, 0xc
and qword [rsp + 0x40], 0
lea rax, [rbp - 0x59]
and qword [rbp - 0x59], 0
xor r9d, r9d
mov rcx, qword [0x14003f0d0]
xor r8d, r8d
mov qword [rsp + 0x38], rax
xor edx, edx
mov dword [rsp + 0x30], 0x14
lea rax, [rbp - 0x41]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
mov dword [rsi + 0xc], edi
mov dword [rsi + 0x10], ebx
call qword [sym.imp.ntdll.dll_NtWriteFile]
nop dword [rax + rax]
mov r9d, eax
mov eax, r9d
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.140026f10
add rsp, 0xd0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret