Function at 0x14000b9f0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x1400bb388]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r14, r9
mov r12, r8
mov r15, rdx
mov rbp, qword [rsp + 0xc0]
mov r13, qword [rsp + 0xc8]
xor edi, edi
mov qword [rsp + 0x38], rdi
mov ecx, edi
mov qword [rsp + 0x48], rcx
mov edx, 0xf
mov qword [rsp + 0x50], rdx
mov byte [rsp + 0x38], cl
mov esi, 0x100
movzx ebx, byte [rsp + 0x30]
cmp rcx, rdx
jae 0x14000ba77
lea rax, [rcx + 1]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x38]
cmp rdx, 0x10
cmovae rax, qword [rsp + 0x38]
mov word [rax + rcx], 0
jmp 0x14000ba8c
xor r9d, r9d
movzx r8d, bl
lea edx, [r9 + 1]
lea rcx, [rsp + 0x38]
call fcn.140016790
sub rsi, 1
je 0x14000ba9e
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
jmp 0x14000ba52
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 0x10
cmovae rdx, qword [rsp + 0x38]
mov qword [rsp + 0x20], rdi
mov r9, r12
mov r8d, 0x100
mov rcx, qword [r15]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14000baeb
mov rcx, qword [r15]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.key_and_iv_read_is_error
lea rcx, [0x1400c32a0]
call fcn.140015290
jmp 0x14000bc69
lea rdx, str.key_and_iv_read_is_ok
lea rcx, [0x1400c32a0]
call fcn.140015290
mov rcx, rax
call fcn.140015830
mov rcx, qword [r15]
mov rax, qword [rsp + 0xd0]
mov r9d, 2
xor r8d, r8d
cmp byte [rax], r8b
mov edx, 0xffffff00
je 0x14000bb29
mov edx, 0xfffffeff
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rcx, qword [r15]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [r15]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea rdx, str.crypted_key_and_iv_size_:
lea rcx, [0x1400c32a0]
call fcn.140015290
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call fcn.14000fdc0
mov rcx, rax
call fcn.140015830
lea rdx, str.crypted_key_and_iv_:
lea rcx, [0x1400c32a0]
call fcn.140015290
mov rbx, rdi
nop word [rax + rax]
lea rax, [rsp + 0x38]
cmp qword [rsp + 0x50], 0x10
cmovae rax, qword [rsp + 0x38]
movzx edx, byte [rbx + rax]
lea rcx, [0x1400c32a0]
call fcn.140015550
inc rbx
cmp rbx, 0x100
jl 0x14000bb90
lea rcx, [0x1400c32a0]
call fcn.140015830
mov r9, r13
lea r8, [rsp + 0x38]
mov rdx, rbp
mov rcx, r14
call fcn.140008210
lea rdx, str.DECRYPTED_AES_KEY:
lea rcx, [0x1400c32a0]
call fcn.140015290
mov rbx, rdi
nop dword [rax]
nop word [rax + rax]
mov rax, qword [r14 + 0x18]
movzx edx, byte [rbx + rax]
lea rcx, [0x1400c32a0]
call fcn.140015550
inc rbx
cmp rbx, 0x10
jl 0x14000bc00
lea rcx, [0x1400c32a0]
call fcn.140015830
lea rdx, str.DECRYPTED_AES_IV:
lea rcx, [0x1400c32a0]
call fcn.140015290
nop dword [rax]
mov rax, qword [rbp + 0x18]
movzx edx, byte [rdi + rax]
lea rcx, [0x1400c32a0]
call fcn.140015550
inc rdi
cmp rdi, 0x10
jl 0x14000bc40
lea rcx, [0x1400c32a0]
call fcn.140015830
mov rcx, rax
call fcn.140015830
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x14000bcab
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bca6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000bcd0
call fcn.1400574e0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400574c0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140069478
int3