Function at 0x180007450
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov r14d, edx
lea rax, [rbp - 0x40]
xor esi, esi
mov qword [rbp - 0x30], rax
mov r13, rcx
mov qword [rbp - 0x20], rsi
lea r12, [0x180038e28]
mov r15, r8
lea rdi, [r14 + 8]
mov qword [rbp - 0x28], r12
mov rdx, rdi
mov qword [rbp - 0x18], r12
lea ecx, [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp - 0x20], rax
test rax, rax
je 0x180007723
lea r8d, [rsi + 8]
mov qword [rsp + 0xc0], rbx
mov rdx, r13
lea rcx, [rbp - 0x30]
call fcn.180001c40
test eax, eax
je 0x18000770e
mov rdx, qword [rbp - 0x40]
mov r8, qword [r13 + 8]
mov qword [rbp - 0x30], rdx
mov qword [rbp - 0x28], r8
cmp rdx, qword [r13]
je 0x18000770e
mov r10, qword [rbp - 0x20]
nop word [rax + rax]
mov r9, qword [rbp - 0x18]
mov ebx, esi
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], r12
mov qword [rbp - 0x38], rdi
mov ecx, dword [r9]
test ecx, ecx
je 0x180007648
sub ecx, 1
je 0x1800075d3
sub ecx, 2
je 0x180007576
cmp ecx, 3
jne 0x180007712
cmp dword [r8], ebx
jne 0x1800075f8
test r10, r10
je 0x180007558
mov rcx, qword [r9 + 8]
xor r8d, r8d
xor r9d, r9d
mov edx, r10d
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
je 0x18000770e
mov rdx, qword [rbp - 0x30]
mov r9, qword [rbp - 0x18]
mov rcx, qword [r9 + 8]
mov r8d, edi
lea r9, [rbp + 0x48]
mov qword [rsp + 0x20], rsi
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x180007708
cmp dword [r8], ebx
jne 0x1800075f8
mov rax, qword [r9 + 8]
lea rcx, [rbp + 0x58]
mov qword [rsp + 0x38], rsi
mov r8, rdx
mov qword [rsp + 0x30], rcx
mov r9d, edi
mov dword [rsp + 0x28], esi
mov edx, 0x22c187
mov rcx, qword [rax]
mov qword [rsp + 0x20], r10
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ebx, eax
test eax, eax
jne 0x18000770a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 0x22c187
lea rcx, str.ERROR____DeviceIoControl__0x_08x__:_0x_08x_n
mov r8d, eax
call fcn.1800023d0
jmp 0x18000770a
cmp dword [r8], ebx
jne 0x1800075f8
mov rcx, qword [r9 + 8]
mov r8, rdx
mov r9, rdi
mov qword [rsp + 0x20], rsi
mov rdx, r10
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x180007708
mov rdx, rdi
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp - 0x10], rax
test rax, rax
je 0x18000770e
mov r8, rdi
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x10]
call fcn.180001c40
test eax, eax
je 0x180007639
mov r8, rdi
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x20]
call fcn.180001c40
mov ebx, eax
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x18000770a
mov ecx, dword [r8]
test ecx, ecx
je 0x180007739
sub ecx, 1
je 0x1800076f0
sub ecx, 1
je 0x1800076d9
sub ecx, 1
je 0x1800076ae
cmp ecx, 3
jne 0x180007712
mov rcx, qword [r8 + 8]
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x18000770e
mov rax, qword [rbp - 0x28]
lea r9, [rbp + 0x48]
mov rdx, qword [rbp - 0x20]
mov r8d, edi
mov qword [rsp + 0x20], rsi
mov rcx, qword [rax + 8]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x180007708
mov rcx, qword [r8 + 8]
lea rax, [rbp - 0x38]
mov qword [rsp + 0x28], rax
mov r8, rdx
lea rax, [rbp - 0x20]
xor r9d, r9d
mov edx, 0x22c183
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx]
call fcn.180001a90
jmp 0x180007708
mov rcx, qword [r8 + 8]
mov r9, rdi
mov r8, rdx
mov rdx, r10
mov rcx, qword [rcx]
call fcn.1800020e0
jmp 0x180007708
mov rcx, qword [r8 + 8]
mov r9, rdi
mov r8, r10
mov qword [rsp + 0x20], rsi
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ebx, eax
test ebx, ebx
jne 0x180007744
mov r10, qword [rbp - 0x20]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbx, qword [rsp + 0xc0]
mov rax, rsi
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r8, rdi
mov rcx, r10
call fcn.1800214d0
mov r10, qword [rbp - 0x20]
mov eax, dword [r14 + r10]
cmp dword [r15], eax
jne 0x18000775c
mov eax, dword [r14 + r10 + 4]
cmp dword [r15 + 4], eax
je 0x180007772
mov rdx, qword [r10]
mov qword [rbp - 0x30], rdx
cmp rdx, qword [r13]
je 0x180007712
mov r8, qword [rbp - 0x28]
jmp 0x1800074f0
mov rsi, qword [rbp - 0x30]
jmp 0x180007712