Function at 0x140138ef4
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x270
mov rax, qword [0x14017d140]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov r12b, dl
mov r14, rcx
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x140138f5f
test byte [rcx + 0x1c], 1
je 0x140138f5f
cmp byte [rcx + 0x19], 4
jb 0x140138f5f
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400144c8]
mov edx, EventEnabled
call fcn.14001dd24
xor ebx, ebx
mov edi, 0x4000000
or rsi, 0xffffffffffffffff
mov ecx, edi
mov dword [rsp + 0x40], ebx
mov r15b, bl
mov ebp, ebx
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov r13, rax
test rax, rax
jne 0x140138fcb
mov edi, 0x8007000e
mov rcx, qword [0x14017d3a8]
lea rbx, [0x14017d3a8]
cmp rcx, rbx
je 0x140139440
test byte [rcx + 0x1c], 1
je 0x14013941a
cmp byte [rcx + 0x19], 2
jb 0x14013941a
mov rcx, qword [rcx + 0x10]
lea edx, [rsi + 0x38]
lea r8, [0x1400144c8]
call fcn.14001dd24
jmp 0x140139413
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
test r14, r14
je 0x140138fe3
cmp word [r14], bx
jne 0x140138ffb
lea r8, [0x140014110]
lea rcx, [0x1400140a0]
mov edx, 0x3da
call fcn.1400a8be8
lea rax, [rsp + 0x50]
mov r9d, 0x104
mov r8, r14
lea rcx, [rsp + 0x50]
mov edi, ebx
sub r8, rax
mov edx, r9d
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140139038
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140139038
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x140139016
test rdx, rdx
jne 0x140139046
sub rcx, 2
mov edi, 0x8007007a
mov word [rcx], bx
test edi, edi
jns 0x140139095
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x140139403
test byte [rcx + 0x1c], 1
je 0x140139403
cmp byte [rcx + 0x19], 2
jb 0x140139403
mov edx, reloc.ADVAPI32.dll_UnregisterTraceGuids
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400144c8]
mov r9d, edi
call fcn.14001de24
jmp 0x140139403
lea r8, [0x140001800]
lea rcx, [rsp + 0x50]
mov rdx, r9
call fcn.14006892c
mov edi, eax
test eax, eax
jns 0x1401390e1
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x140139403
test byte [rcx + 0x1c], 1
je 0x140139403
cmp byte [rcx + 0x19], 2
jb 0x140139403
mov edx, reloc.ADVAPI32.dll_EventRegister
jmp 0x14013907d
cmp byte [0x14017e455], bl
jne 0x1401393b6
test r12b, r12b
je 0x140139168
lea rdx, [rsp + 0x44]
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x44], ebx
call fcn.1400ae318
mov edi, eax
test eax, eax
jns 0x1401392fc
cmp eax, 0x800703ed
je 0x1401392fc
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x1401392c8
test byte [rcx + 0x1c], 1
je 0x140139298
cmp byte [rcx + 0x19], 4
jb 0x140139298
mov rcx, qword [rcx + 0x10]
lea r9, [rsp + 0x50]
lea r8, [0x1400144c8]
mov edx, reloc.ADVAPI32.dll_EventUnregister
mov dword [rsp + 0x20], edi
call fcn.14001ecbc
jmp 0x14013928a
test r15b, r15b
jne 0x140139232
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov edx, 0x80000000
lea r8d, [r9 + 7]
mov rcx, r14
mov dword [rsp + 0x28], reloc.ADVAPI32.dll_TraceEvent
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1401391f4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x14017d3a8]
lea rdx, [0x14017d3a8]
cmp rcx, rdx
je 0x1401392c8
test byte [rcx + 0x1c], 1
je 0x140139291
cmp byte [rcx + 0x19], 4
jb 0x140139291
mov rcx, qword [rcx + 0x10]
lea edx, [rsi + 0x3e]
lea r8, [0x1400144c8]
mov r9, r14
mov dword [rsp + 0x20], eax
call fcn.14001ecbc
jmp 0x14013928a
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x14013922f
test byte [rcx + 0x1c], 1
je 0x14013922f
cmp byte [rcx + 0x19], 4
jb 0x14013922f
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400144c8]
mov edx, 0x3e
mov r9, r14
mov dword [rsp + 0x20], ebp
call fcn.14001ecbc
mov r15b, 1
lea r9, [rsp + 0x40]
mov r8d, 0x4000000
mov rdx, r13
mov rcx, rsi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14013937d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x14017d3a8]
lea rdx, [0x14017d3a8]
cmp rcx, rdx
je 0x1401392c8
test byte [rcx + 0x1c], 1
je 0x140139291
cmp byte [rcx + 0x19], 4
jb 0x140139291
mov rcx, qword [rcx + 0x10]
mov r8d, eax
mov rdx, rsi
call fcn.1401379f4
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x1401392c8
test byte [rcx + 0x1c], 1
je 0x1401392c8
cmp byte [rcx + 0x19], 4
jb 0x1401392c8
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400144c8]
mov edx, 0x41
mov r9d, ebp
call fcn.14001de24
mov rcx, qword [0x14017d3a8]
mov eax, 0x10624dd3
mul dword [0x14017d604]
shr edx, 6
cmp ebp, edx
jae 0x140139346
cmp ebp, 0xa
sbb ebx, ebx
and ebx, 0xfffffffd
add ebx, 5
mov ecx, ebx
imul ecx, ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
add ebp, ebx
xor ebx, ebx
jmp 0x1401390e1
mov edi, ebx
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x1401393ef
test byte [rcx + 0x1c], 1
je 0x1401393ef
cmp byte [rcx + 0x19], 4
jb 0x1401393ef
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400144c8]
mov edx, 0x3c
mov r9d, ebp
call fcn.14001de24
jmp 0x1401393ef
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x140139376
test byte [rcx + 0x1c], 1
je 0x140139376
cmp byte [rcx + 0x19], 2
jb 0x140139376
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400144c8]
mov edx, 0x42
mov r9d, ebp
call fcn.14001de24
mov edi, 0x8078004f
jmp 0x1401393ef
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x1401393ef
test byte [rcx + 0x1c], 1
je 0x1401393ef
cmp byte [rcx + 0x19], 4
jb 0x1401393ef
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400144c8]
mov edx, 0x40
mov r9, rsi
call fcn.140029954
jmp 0x1401393ef
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x1401393ea
test byte [rcx + 0x1c], 1
je 0x1401393ea
cmp byte [rcx + 0x19], 2
jb 0x1401393ea
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400144c8]
mov edx, reloc.ADVAPI32.dll_EventEnabled
call fcn.14001dd24
mov edi, 0x80780075
test rsi, rsi
je 0x140139403
cmp rsi, 0xffffffffffffffff
je 0x140139403
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r13
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
lea rbx, [0x14017d3a8]
mov rcx, qword [0x14017d3a8]
cmp rcx, rbx
je 0x140139440
test byte [rcx + 0x1c], 1
je 0x140139440
cmp byte [rcx + 0x19], 4
jb 0x140139440
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400144c8]
mov edx, 0x43
call fcn.14001dd24
mov eax, edi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140168920
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret