Function at 0x140069120
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x2b8
mov rdi, qword [sym.imp.msvcrt.dll__dup]
mov ecx, dword [rsp + 0x328]
mov r13d, edx
mov ebx, edx
mov rbp, r8
mov rsi, r9
and r13d, 8
sete byte [rsp + 0x63]
call rdi
mov ecx, dword [rsp + 0x330]
mov dword [rsp + 0x48], eax
call rdi
mov dword [rsp + 0x4c], eax
test r13d, r13d
je 0x140069340
mov rdi, qword [sym.imp.msvcrt.dll__get_osfhandle]
mov ecx, dword [rsp + 0x48]
call rdi
mov ecx, dword [rsp + 0x4c]
mov r12, rax
call rdi
mov dword [rsp + 0x50], 0
mov rdi, rax
mov r14, rax
mov dword [rsp + 0x100], 0x94
lea rcx, [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x110], 1
jne 0x1400692e8
mov dword [rsp + 0x54], 0
mov eax, dword [rsp + 0x54]
shr ebx, 1
pxor xmm0, xmm0
mov r8, rsi
mov qword [rsp + 0xe0], r12
lea r12, [rsp + 0x70]
lea r15, [rsp + 0x90]
mov edx, ebx
mov qword [rsp + 0x30], r12
and edx, 1
mov rcx, rbp
mov r9, qword [rsp + 0x320]
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], eax
movups xmmword [rsp + 0xc4], xmm0
mov qword [rsp + 0xf0], rdi
mov dword [rsp + 0x90], 0x68
mov dword [rsp + 0xcc], 0x100
mov qword [rsp + 0xe8], r14
movups xmmword [rsp + 0x94], xmm0
movups xmmword [rsp + 0xa4], xmm0
movups xmmword [rsp + 0xb4], xmm0
movups xmmword [rsp + 0xd0], xmm0
call sym.win32_spawn
mov rdi, qword [sym.imp.msvcrt.dll__close]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400693a0
mov eax, dword [rsp + 0x328]
test eax, eax
jne 0x140069388
cmp dword [rsp + 0x330], 1
je 0x14006928d
mov ecx, dword [rsp + 0x330]
call rdi
mov ecx, dword [rsp + 0x50]
cmp ecx, 2
je 0x14006929d
cmp byte [rsp + 0x63], 0
jne 0x1400692c8
mov ecx, dword [rsp + 0x48]
call rdi
mov ecx, dword [rsp + 0x4c]
call rdi
test r13d, r13d
je 0x1400692d6
mov rax, rbx
add rsp, 0x2b8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call rdi
mov ecx, dword [rsp + 0x48]
call rdi
mov ecx, dword [rsp + 0x4c]
call rdi
mov ecx, dword [rsp + 0x338]
call rdi
jmp 0x1400692ae
mov dword [rsp + 0x28], pe_nt_image_headers64
xor r9d, r9d
mov r8d, 2
mov edx, 0x40000000
mov qword [rsp + 0x30], 0
lea rcx, str.CONOUT_
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [rsp + 0x54], 0x8000000
cmp rax, 0xffffffffffffffff
je 0x1400691c4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400691bc
mov ecx, dword [rsp + 0x338]
call rdi
mov rdi, qword [sym.imp.msvcrt.dll__get_osfhandle]
mov ecx, dword [rsp + 0x48]
mov r15d, eax
call rdi
mov ecx, dword [rsp + 0x4c]
mov r12, rax
call rdi
mov ecx, r15d
mov r14, rax
call rdi
mov rdi, rax
mov eax, dword [rsp + 0x338]
mov dword [rsp + 0x338], r15d
mov dword [rsp + 0x50], eax
jmp 0x140069195
mov ecx, dword [rsp + 0x328]
call rdi
jmp 0x14006927a
mov rax, qword [sym.imp.msvcrt.dll__errno]
mov qword [rsp + 0x68], rax
call rax
mov rcx, rbp
xor edx, edx
mov eax, dword [rax]
mov dword [rsp + 0x64], eax
call qword [sym.imp.msvcrt.dll__open]
mov ecx, eax
test eax, eax
js 0x140069414
lea r14, [rsp + 0x1a0]
mov dword [rsp + 0x58], eax
mov r8d, 0x108
mov rdx, r14
call qword [sym.imp.msvcrt.dll__read]
mov ecx, dword [rsp + 0x58]
movsxd rbp, eax
call rdi
cmp ebp, 3
jle 0x140069414
mov edx, 0xa
mov rcx, r14
mov byte [rsp + rbp + 0x1a0], 0
call sym.strchr
test rax, rax
je 0x140069414
cmp word [rsp + 0x1a0], 0x2123
je 0x140069450
mov rax, qword [rsp + 0x68]
call rax
mov esi, dword [rsp + 0x64]
mov dword [rax], esi
mov rax, qword [rsp + 0x350]
lea rsi, str.CreateProcess
mov dword [rax], 2
mov rax, qword [rsp + 0x348]
mov qword [rax], rsi
jmp 0x14006929d
mov byte [rax], 0
movzx edx, byte [rax - 1]
sub rax, 1
mov ecx, edx
and ecx, 0xfffffffb
cmp cl, 9
je 0x140069450
cmp dl, 0x20
je 0x140069450
movzx eax, byte [rsp + 0x1a2]
cmp al, 0x20
je 0x140069560
cmp al, 9
lea rbp, [rsp + 0x1a2]
sete al
test al, al
jne 0x140069560
mov rcx, rbp
jmp 0x14006949b
mov byte [rcx], 0x5c
mov edx, 0x2f
call sym.strchr
mov rcx, rax
test rax, rax
jne 0x140069498
cmp qword [rsi], 0
je 0x14006957e
mov rax, rsi
nop word [rax + rax]
add rax, 8
cmp qword [rax], 0
jne 0x1400694c0
sub rax, rsi
mov rcx, rax
sar rcx, 3
add ecx, 2
movsxd rcx, ecx
shl rcx, 3
lea r8, [rcx - 8]
mov qword [rsp + 0x58], r8
call sym.xmalloc
mov r8, qword [rsp + 0x58]
mov rdx, rsi
mov qword [rax], rbp
lea rcx, [rax + 8]
mov r14, rax
call sym.memcpy
mov edx, 0x5c
mov rcx, rbp
call sym.strrchr
mov qword [rsp + 0x30], r12
mov r8, r14
mov edx, 1
lea rcx, [rax + 1]
mov eax, dword [rsp + 0x54]
mov qword [rsp + 0x28], r15
mov r9, qword [rsp + 0x320]
mov dword [rsp + 0x20], eax
call sym.win32_spawn
mov rcx, r14
mov rsi, rax
call sym.free
cmp rsi, 0xffffffffffffffff
je 0x140069414
mov rbx, rsi
jmp 0x14006926b
lea rbp, [rsp + 0x1a2]
movzx eax, byte [rbp + 1]
add rbp, 1
cmp al, 0x20
je 0x140069568
cmp al, 9
jne 0x14006948f
jmp 0x140069568
mov r8d, 8
mov ecx, 0x10
jmp 0x1400694e2