Function at 0x1403e1fc0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rdi
push r13
push r14
push r15
sub rsp, 0xa8
mov rbp, rdx
mov r15, rcx
mov edx, 0x20004
mov ecx, 0x42
mov rdi, r9
mov r13, r8
mov ebx, 0x8007000e
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r14, rax
test rax, rax
je 0x1403e22ff
mov qword [rsp + 0xf0], rsi
mov qword [rsp + 0xa0], r12
xor r12d, r12d
cmp r12w, word [r13 + 4]
jne 0x1403e2101
mov esi, dword [r13 + 0x10]
test rdi, rdi
je 0x1403e2045
mov rax, qword [rdi]
mov r8d, esi
xor edx, edx
mov rcx, rdi
call qword [rax + reloc.SHELL32.dll_ILFindChild]
mov ebx, r12d
mov eax, 0x20000
test esi, esi
je 0x1403e20e6
mov rcx, qword [r15 + 8]
lea r9, [rsp + 0x30]
cmp esi, eax
mov qword [rsp + 0x20], r12
mov r8d, esi
mov rdx, r14
cmova r8d, eax
call sym.ErrorReportClient.exe_SfReadFile
test eax, eax
je 0x1403e20e1
test rdi, rdi
je 0x1403e20a5
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x38]
mov ebx, eax
cmp eax, 0x8004e00c
je 0x1403e20e6
mov edx, dword [r13 + 0x10]
mov rcx, rdi
mov r8, qword [rdi]
sub edx, esi
call qword [r8 + 0x30]
mov ebx, eax
test eax, eax
js 0x1403e20e6
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x34]
mov rdx, r14
mov qword [rsp + 0x20], r12
mov rcx, rbp
sub esi, r8d
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1403e20da
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 0x34], eax
jne 0x1403e20da
test ebx, ebx
js 0x1403e20e6
jmp 0x1403e2048
mov ebx, 0x8004e009
jmp 0x1403e20e6
mov ebx, 0x8004e008
test rdi, rdi
je 0x1403e22cb
mov rax, qword [rdi]
mov rcx, rdi
mov edx, dword [r13 + 0x10]
call qword [rax + 0x30]
jmp 0x1403e22cb
mov edx, 0x23333
mov ecx, 0x42
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r12, rax
test rax, rax
je 0x1403e22cb
mov esi, dword [r13 + 0x10]
lea rcx, [rsp + 0x40]
xor ebx, ebx
xor edx, edx
lea r8d, [rbx + 0x58]
call sub.VCRUNTIME140.dll_memset
lea r9d, [rbx + 0x58]
lea r8, str.1.2.3
lea edx, [rbx - 0xf]
lea rcx, [rsp + 0x40]
call fcn.140403fb0
test eax, eax
jne 0x1403e22a7
test rdi, rdi
je 0x1403e2170
mov rax, qword [rdi]
xor edx, edx
mov r8d, dword [r13 + 0x10]
mov rcx, rdi
call qword [rax + reloc.SHELL32.dll_ILFindChild]
xor eax, eax
mov dword [rsp + 0x58], 0x23333
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x40], r14
mov ecx, 0x20000
mov r15d, 0x8004e009
test esi, esi
je 0x1403e2210
test eax, eax
jne 0x1403e2218
mov rax, qword [rsp + 0xe0]
lea r9, [rsp + 0x34]
cmp esi, ecx
mov qword [rsp + 0x20], 0
mov r8d, esi
mov rdx, r14
cmova r8d, ecx
mov rcx, qword [rax + 8]
call sym.ErrorReportClient.exe_SfReadFile
test eax, eax
je 0x1403e2218
test rdi, rdi
je 0x1403e21ff
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x38]
mov ebx, eax
cmp eax, 0x8004e00c
je 0x1403e2285
mov edx, dword [r13 + 0x10]
mov rcx, rdi
mov r8, qword [rdi]
sub edx, esi
call qword [r8 + 0x30]
mov ebx, eax
test eax, eax
js 0x1403e2285
mov eax, dword [rsp + 0x34]
sub esi, eax
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x40], r14
jmp 0x1403e2218
mov dword [rsp + 0x48], 1
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.1404023e0
mov ebp, eax
cmp eax, 1
ja 0x1403e2282
mov ecx, dword [rsp + 0x58]
cmp ecx, 0x23333
jae 0x1403e2270
mov r8d, 0x23333
mov qword [rsp + 0x20], 0
sub r8d, ecx
lea r9, [rsp + 0x30]
mov rcx, qword [rsp + 0xe8]
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1403e2282
mov dword [rsp + 0x58], 0x23333
mov qword [rsp + 0x50], r12
cmp ebp, 1
je 0x1403e2285
test ebx, ebx
js 0x1403e2285
mov eax, dword [rsp + 0x48]
jmp 0x1403e2188
mov ebx, r15d
lea rcx, [rsp + 0x40]
call fcn.140403950
test eax, eax
cmovne ebx, r15d
test rdi, rdi
je 0x1403e22a7
mov rax, qword [rdi]
mov rcx, rdi
mov edx, dword [r13 + 0x10]
call qword [rax + 0x30]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov r12, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0xf0]
mov eax, ebx
add rsp, 0xa8
pop r15
pop r14
pop r13
pop rdi
pop rbp
pop rbx
ret