Function at 0x1400699c4
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xf8
movsx eax, word [rsp + 0x168]
mov r15d, dword [rsp + 0x168]
mov ebx, r8d
shr r15d, 0x1e
mov r13, rdx
xor edx, edx
and ebx, 0xfffffff0
and r15d, 1
cmp ax, dx
mov rsi, r9
mov r12, rcx
mov word [rsp + 0x148], ax
jge 0x140069a20
movzx ecx, ax
neg cx
mov word [rsp + 0x148], cx
lea rdi, [r13 + 0x100480]
mov word [r13 + 0x100000], dx
lea eax, [rbx + rbx*2]
lea r14, [rdi + 0xffc00]
add eax, eax
mov qword [rsp + 0xd0], rdi
mov dword [rsp + 0x158], edx
mov qword [r14 + 0x40], rdx
mov qword [r14], rdx
movsxd rbp, eax
cmp r9, rdx
je 0x140069a6a
mov rbp, qword [r13]
movsxd rax, ebx
mov qword [r13], rdx
sub rbp, rax
add rbp, r9
xor r8d, r8d
mov rdx, rbp
mov rcx, r12
call fcn.14005c3c8
cmp rax, rbp
je 0x140069a89
mov rax, 0xffffffffffffff00
jmp 0x14006a3d5
lea r9, [rsp + 0x158]
xor ebp, ebp
mov r8d, ebx
mov rdx, rdi
mov rcx, r12
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp ebx, dword [rsp + 0x158]
je 0x140069ab9
or rax, 0xffffffffffffffff
jmp 0x14006a3d5
lea rcx, str.PRIVHEAD
mov r8d, 8
mov rdx, rdi
call qword [sym.imp.SHLWAPI.dll_StrCmpNA]
cmp eax, ebp
jne 0x140069a7d
lea rdx, [rdi + 0x30]
mov r8d, 0x40
mov rcx, r14
call fcn.14001d7d8
cmp rsi, rbp
jne 0x140069b23
mov r9d, 8
lea rcx, [rdi + 0x11b]
mov edx, r9d
call fcn.14005fc48
lea rcx, [rdi + 0x12b]
mov edx, r9d
mov qword [rsp + 0x88], rax
call fcn.14005fc48
movsxd rcx, ebx
lea rsi, [rax + 1]
imul rsi, rcx
jmp 0x140069b33
mov rax, qword [rsp + 0x160]
mov qword [rsp + 0x88], rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrlenA]
xor r8d, r8d
mov rdx, rsi
mov rcx, r12
mov dword [rsp + 0x150], eax
call fcn.14005c3c8
cmp rax, rsi
je 0x140069b62
mov rax, 0xfffffffffffffeff
jmp 0x14006a3d5
lea r9, [rsp + 0x158]
mov r8d, 0x2000
mov rdx, rdi
mov rcx, r12
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r11d, 0x2000
cmp dword [rsp + 0x158], r11d
jne 0x140069ab0
xor r8d, r8d
mov qword [rsp + 0x58], rbp
mov rdx, rbp
mov qword [rsp + 0x98], rbp
mov rcx, rdi
cmp dword [rdi], r8d
jne 0x140069bc3
cmp rdx, r11
jge 0x140069bc3
movsxd rax, ebx
add rcx, rax
add rdx, rax
cmp dword [rcx], r8d
je 0x140069bb0
movsxd r9, ebx
add rcx, 0x2e
mov edx, 8
mov qword [rsp + 0xa0], r9
call fcn.14005fc48
xor r8d, r8d
lea r12, [rax - 1]
imul r12, r9
add r12, rsi
mov rsi, qword [rsp + 0x140]
mov rcx, rsi
mov rdx, r12
call fcn.14005c3c8
cmp rax, r12
jne 0x140069b56
and qword [rsp + 0x20], rbp
lea r9, [rsp + 0x158]
mov r8d, ebx
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp ebx, dword [rsp + 0x158]
jne 0x140069ab0
mov r11d, 4
lea rcx, [rdi + 8]
mov edx, r11d
call fcn.14005fc48
mov r10, rax
mov qword [rsp + 0x30], rax
test rax, rax
jle 0x140069ab0
mov eax, 0xffc00
lea rcx, [rdi + 4]
cqo
idiv r10
mov edx, r11d
mov r9, rax
call fcn.14005fc48
lea rcx, [rdi + 0xc]
cmp rax, r9
mov edx, r11d
cmovg rax, r9
mov rbx, rax
mov qword [rsp + 0x40], rax
imul rbx, r10
mov qword [rsp + 0xe0], rbx
call fcn.14005fc48
lea rcx, [rdi + 0x85]
lea r9, [r12 + rax]
mov edx, r11d
mov qword [rsp + 0x90], r9
call fcn.14005fc48
xor r8d, r8d
mov rdx, r9
mov rcx, rsi
mov qword [rsp + 0x50], rax
call fcn.14005c3c8
cmp rax, qword [rsp + 0x90]
jne 0x140069ab0
and qword [rsp + 0x20], rbp
lea r9, [rsp + 0x158]
mov r8d, ebx
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r11d, dword [rsp + 0x158]
cmp rbx, r11
jne 0x140069ab0
mov rbx, qword [rsp + 0x40]
xor r8d, r8d
cmp rbx, r8
mov ecx, r8d
mov r12, r8
mov r11, r8
mov qword [rsp + 0x48], r8
mov dword [rsp + 0x38], ecx
jle 0x140069e79
mov rax, qword [rsp + 0x30]
lea rsi, [rdi + 0x13]
movsxd rdi, dword [rsp + 0x150]
lea ebp, [r8 + 8]
cmp byte [rsi], 0x34
jne 0x140069dcb
movzx r9d, byte [rsi + 5]
lea rcx, [rsi + 6]
mov edx, r9d
call fcn.14005fc48
lea rbx, [rsi + r9 + 6]
movzx ecx, byte [rbx]
mov qword [rsp + 0x60], rax
movsx eax, dil
inc ecx
movsxd rcx, ecx
add rbx, rcx
movzx ecx, byte [rbx]
cmp ecx, eax
mov dword [rsp + 0x150], ecx
jl 0x140069e4a
lea rdx, [rbx + 1]
mov r8d, eax
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_StrCmpNIA]
xor r8d, r8d
cmp eax, r8d
jne 0x140069e43
movsx eax, dil
cmp eax, dword [rsp + 0x150]
je 0x140069db0
movsx rax, dil
cmp byte [rax + rbx + 1], r8b
jne 0x140069e43
mov ecx, dword [rsp + 0x60]
mov dword [rsp + 0x38], ecx
cmp r12, r8
jne 0x140069e6f
mov r11, qword [rsp + 0x48]
jmp 0x140069e51
cmp byte [rsi], 0x35
jne 0x140069e5b
movzx eax, byte [rsi + 5]
lea r12, [rax + rsi + 6]
movzx ecx, byte [r12]
cmp ecx, 1
lea eax, [rbp + rcx]
mov word [r13 + 0x100000], ax
jl 0x140069e16
lea rdx, [r12 + 1]
lea r8, [r13 + 0x100002]
mov r9, rcx
movzx eax, byte [rdx]
inc rdx
mov word [r8], ax
add r8, 2
sub r9, 1
jne 0x140069e02
lea rcx, [r13 + rcx*2 + 0x100002]
lea rdx, str.Volume
mov r8d, 0x10
call fcn.14001d7d8
mov ecx, dword [rsp + 0x38]
xor r8d, r8d
cmp ecx, r8d
jne 0x140069e6f
mov r11, qword [rsp + 0x48]
jmp 0x140069e56
mov r11, qword [rsp + 0x48]
jmp 0x140069e4d
xor r8d, r8d
mov ecx, dword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x30]
inc r11
add rsi, rax
cmp r11, rbx
mov qword [rsp + 0x48], r11
jl 0x140069d33
lea rdi, [r13 + 0x100480]
mov rbp, r8
mov qword [rsp + 0x60], r8
mov byte [rsp + 0x150], r8b
cmp ecx, r8d
jne 0x140069e92
xor eax, eax
jmp 0x14006a3d5
cmp qword [rsp + 0x50], r8
mov rax, r8
movsxd rcx, r15d
mov qword [rsp + 0x70], rax
mov qword [rsp + 0xc0], rcx
jle 0x14006a3ad
mov r11, qword [rsp + 0x40]
mov r9, qword [rsp + 0x30]
movsx esi, word [rsp + 0x168]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
lea r15, [rdi + 0x19]
mov qword [rsp + 0x78], r15
add r13, 0x36
cmp rax, r11
jge 0x14006a345
cmp byte [r15 - 6], 0x51
jne 0x14006a327
inc qword [rsp + 0x58]
xor edx, edx
lea rcx, [r13 - 0x16]
lea r8d, [rdx + 0x10]
call fcn.140101f00
movzx r11d, byte [r15 - 1]
mov rcx, r15
mov edx, r11d
call fcn.14005fc48
lea rbx, [r15 + r11]
xor r8d, r8d
movzx r12d, byte [rbx]
mov r11d, r8d
inc rbx
cmp r12d, 6
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0x68], r11
jle 0x140069f6e
lea rcx, [0x1401265e8]
mov r8d, 6
mov rdx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpNIA]
xor r8d, r8d
cmp eax, r8d
jne 0x140069f69
lea edx, [r12 - 6]
lea rcx, [rbx + 6]
call fcn.140069988
xor r8d, r8d
mov r11, rax
jmp 0x140069f6e
mov r11, qword [rsp + 0x68]
add rbx, r12
movzx ecx, byte [rbx]
inc ecx
movsxd rcx, ecx
add rbx, rcx
movzx ecx, byte [rbx]
inc ecx
movsxd rcx, ecx
lea rdx, [rbx + rcx + 0x12]
mov qword [rsp + 0xc8], rdx
mov al, byte [rdx]
and al, 0x80
test byte [rdx], 0x80
mov byte [rsp + 0x168], al
je 0x140069fab
mov eax, 0x100
mov word [r13 - 0x16], ax
movzx eax, byte [rdx + 3]
inc eax
cdqe
lea r10, [rdx + rax + 0x13]
movzx r9d, byte [r10]
lea rcx, [r10 + 1]
mov qword [r13 - 0x26], r8
mov edx, r9d
call fcn.14005fc48
lea rbx, [r10 + r9 + 5]
mov word [r13 - 0x14], r11w
movzx ecx, byte [rbx]
mov edx, 4
imul rax, qword [rsp + 0xa0]
mov word [r13 - 0x16], cx
lea ecx, [rbp + 1]
mov qword [rsp + 0xb0], rax
mov dword [r13 - 0x1e], ecx
lea rcx, [rbx + 1]
call fcn.14005fc48
lea rcx, [rbx + 5]
mov edx, 2
mov dword [r13 - 6], eax
call fcn.14005fc48
lea rcx, [rbx + 7]
mov edx, 2
mov dword [r13 - 2], eax
call fcn.14005fc48
lea rdx, [rbx + 9]
lea rcx, [r13 + 2]
mov r8d, 8
mov dword [r13], eax
call fcn.14001d7d8
xor r8d, r8d
mov qword [r13 + 0xa], r8
cmp byte [rbx + 0x11], r8b
jbe 0x14006a054
movzx eax, byte [rbx + 0x12]
mov qword [r13 + 0xa], rax
mov r11, qword [rsp + 0x40]
mov qword [r13 - 0x2e], r8
mov r9, r8
cmp r11, r8
mov qword [rsp + 0x68], r8
jle 0x14006a313
mov r12, qword [rsp + 0x30]
mov rbx, rdi
cmp byte [rbx + 0x13], 0x32
jne 0x14006a1e3
movzx r10d, byte [rbx + 0x18]
movzx ecx, byte [rbx + r10 + 0x19]
add rcx, rbx
movzx edx, byte [rcx + r10 + 0x38]
lea rcx, [rcx + r10 + 0x39]
call fcn.14005fc48
cmp dword [rsp + 0xa8], eax
jne 0x14006a1e3
lea rcx, [rbx + 0x19]
mov edx, r10d
call fcn.14005fc48
mov r9, qword [rsp + 0x40]
mov r11, qword [rsp + 0x30]
mov qword [rsp + 0xb8], rax
xor eax, eax
mov r12, rdi
mov r14, rax
mov r15, rax
cmp byte [r12 + 0x13], 0x33
jne 0x14006a1c2
movzx ecx, byte [r12 + 0x18]
mov rdx, rcx
mov qword [rsp + 0x80], rcx
movzx r8d, byte [r12 + rcx + 0x19]
lea r11, [r12 + rdx + 0x1a]
mov rax, r8
mov dword [rsp + 0x48], r8d
mov qword [rsp + 0xd8], rax
add rax, r12
movzx ecx, byte [rax + rcx + 0x36]
add ecx, r8d
movsxd r10, ecx
lea rax, [r12 + r10]
movzx r9d, byte [rax + rdx + 0x37]
lea rcx, [rax + rdx + 0x38]
mov edx, r9d
call fcn.14005fc48
mov rdx, qword [rsp + 0x80]
lea rcx, [r15 + r9]
add rcx, r10
add rcx, rdx
mov qword [rsp + 0x80], rcx
cmp dword [rsp + 0xb8], eax
jne 0x14006a1b8
mov rax, qword [rsp + 0xd8]
lea r10, [r15 + rax]
add r10, rdx
mov edx, 8
lea rcx, [r10 + rdi + 0x2e]
call fcn.14005fc48
lea rcx, [r10 + rdi + 0x26]
mov edx, 8
mov r9, rax
call fcn.14005fc48
mov r10, qword [rsp + 0x88]
add r10, r9
add r10, rax
mov rax, qword [rsp + 0x80]
movzx edx, byte [rax + rdi + 0x38]
lea rcx, [rax + rdi + 0x39]
imul r10, qword [rsp + 0xa0]
call fcn.14005fc48
cmp dword [rsp + 0x38], eax
je 0x14006a1fc
mov r11, qword [rsp + 0x30]
mov r9, qword [rsp + 0x40]
inc r14
add r15, r11
add r12, r11
cmp r14, r9
jl 0x14006a0d4
mov r9, qword [rsp + 0x68]
mov r11, qword [rsp + 0x40]
mov r12, qword [rsp + 0x30]
inc r9
add rbx, r12
cmp r9, r11
mov qword [rsp + 0x68], r9
jge 0x14006a30b
jmp 0x14006a076
movsxd rdx, dword [rsp + 0x48]
mov qword [r13 - 0x2e], r10
add rdx, r11
cmp r11, rdx
jae 0x14006a2ed
mov r8, qword [rsp + 0x78]
mov r9b, byte [rsp + 0x168]
mov di, word [rsp + 0x148]
mov r10, qword [rsp + 0xc8]
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0xb0]
cmp byte [r11], 0x2d
jne 0x14006a2cc
inc r11
xor r12d, r12d
mov ecx, r12d
jmp 0x14006a267
mov al, byte [r11]
sub al, 0x30
cmp al, 9
ja 0x14006a26c
movsx eax, byte [r11]
lea ecx, [rcx + rcx*4]
inc r11
lea ecx, [rax + rcx*2 - 0x30]
cmp r11, rdx
jb 0x14006a250
cmp ecx, r12d
mov dword [r13 - 0x1e], ecx
mov qword [r13 - 0x26], rbx
jle 0x14006a2cc
movsx eax, di
cmp eax, ecx
jne 0x14006a2b5
cmp esi, r12d
jle 0x14006a28d
cmp r9b, r12b
je 0x14006a294
cmp esi, r12d
jge 0x14006a2cc
cmp r9b, r12b
je 0x14006a2cc
cmp di, r12w
mov byte [rsp + 0x150], 1
setle al
dec al
and al, 0x80
mov byte [r10], al
cmp rbp, r12
jne 0x14006a2cc
lea rbp, [r8 - 0x19]
jmp 0x14006a2cc
cmp qword [rsp + 0xc0], r12
je 0x14006a2cc
cmp esi, r12d
jle 0x14006a2cc
cmp r9b, r12b
je 0x14006a2cc
mov byte [r10], r12b
inc r11
cmp r11, rdx
jb 0x14006a23b
mov rdi, qword [rsp + 0xd0]
mov qword [rsp + 0x60], rbp
mov rbp, qword [rsp + 0x98]
inc rbp
add r13, 0x90
cmp rbp, qword [rsp + 0x50]
mov qword [rsp + 0x98], rbp
jge 0x14006a342
mov r11, qword [rsp + 0x40]
mov r15, qword [rsp + 0x78]
xor r8d, r8d
mov r9, qword [rsp + 0x30]
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
inc rax
add r15, r9
cmp rdx, rcx
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], r15
jl 0x140069ed9
jmp 0x14006a345
xor r8d, r8d
mov al, byte [rsp + 0x150]
mov rsi, qword [rsp + 0x140]
cmp al, r8b
je 0x14006a3ad
mov rbx, qword [rsp + 0x90]
xor r8d, r8d
mov rcx, rsi
mov rdx, rbx
call fcn.14005c3c8
cmp rax, rbx
jne 0x14006a3a7
mov rbx, qword [rsp + 0xe0]
xor eax, eax
lea r9, [rsp + 0x158]
mov rdx, rdi
mov rcx, rsi
mov r8d, ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r11d, dword [rsp + 0x158]
cmp rbx, r11
je 0x14006a3aa
neg rbp
xor r8d, r8d
cmp byte [0x14013ccb1], r8b
je 0x14006a3d2
lea rdx, str._d:__nPart_d_r_n
lea rcx, [0x14013d130]
mov r9, rbp
mov r8d, 0x3979
call fcn.140018dd8
mov rax, rbp
add rsp, 0xf8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret