Function at 0x14000a6f0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x78
xor edi, edi
lea rax, [0x1401b2860]
mov rbp, r8
mov qword [rsp + 0x48], rdi
mov r8, qword [rcx + 8]
mov rsi, rcx
mov qword [rsp + 0x50], rax
mov rbx, rdx
mov ecx, dword [r8]
test ecx, ecx
je 0x14000a88c
sub ecx, 1
je 0x14000a806
sub ecx, 2
je 0x14000a79b
cmp ecx, 3
jne 0x14000ab18
mov rax, qword [rdx + 8]
cmp dword [rax], edi
jne 0x14000a80e
mov rax, qword [rsi]
test rax, rax
je 0x14000a76c
mov rcx, qword [r8 + 8]
xor r9d, r9d
xor r8d, r8d
mov edx, eax
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
je 0x14000ab18
mov rax, qword [rsi + 8]
lea r9, [rsp + 0xa0]
mov rdx, qword [rbx]
mov r8d, ebp
mov qword [rsp + 0x20], rdi
mov rcx, qword [rax + 8]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
add rsp, 0x78
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rax, qword [rdx + 8]
cmp dword [rax], edi
jne 0x14000a80e
mov rax, qword [r8 + 8]
mov r9d, ebp
mov r8, qword [rdx]
mov edx, 0x22c187
mov qword [rsp + 0x38], rdi
mov rcx, qword [rax]
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x30], rax
mov rax, qword [rsi]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ebx, eax
test eax, eax
jne 0x14000a7f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 0x22c187
lea rcx, str.ERROR_kull_m_kernel_ioctl_handle___DeviceIoControl__0x_08x__:_0x_08x_n
mov r8d, eax
call fcn.14000afb0
mov edi, ebx
mov eax, ebx
add rsp, 0x78
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rax, qword [rdx + 8]
cmp dword [rax], edi
je 0x14000a866
mov rdx, rbp
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x48], rax
test rax, rax
je 0x14000ab18
mov r8, rbp
lea rcx, [rsp + 0x48]
mov rdx, rbx
call fcn.14000a6f0
test eax, eax
je 0x14000a850
mov r8, rbp
lea rdx, [rsp + 0x48]
mov rcx, rsi
call fcn.14000a6f0
mov edi, eax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
add rsp, 0x78
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rcx, qword [r8 + 8]
mov r9, rbp
mov r8, qword [rdx]
mov rdx, qword [rsi]
mov qword [rsp + 0x20], rdi
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edi, eax
add rsp, 0x78
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rdx, qword [rdx + 8]
mov ecx, dword [rdx]
test ecx, ecx
je 0x14000ab05
sub ecx, 1
je 0x14000aadf
sub ecx, 1
je 0x14000a96e
sub ecx, 1
je 0x14000a907
cmp ecx, 3
jne 0x14000ab18
mov rcx, qword [rdx + 8]
xor r9d, r9d
mov edx, dword [rbx]
xor r8d, r8d
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x14000ab18
mov rax, qword [rbx + 8]
lea r9, [rsp + 0xa0]
mov rdx, qword [rsi]
mov r8d, ebp
mov qword [rsp + 0x20], rdi
mov rcx, qword [rax + 8]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, eax
add rsp, 0x78
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rax, qword [rdx + 8]
xor r9d, r9d
mov r8, qword [rbx]
mov edx, 0x22c183
mov qword [rsp + 0x38], rdi
mov rcx, qword [rax]
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x30], rax
mov rax, qword [rsi]
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ebx, eax
test eax, eax
jne 0x14000a7f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 0x22c183
lea rcx, str.ERROR_kull_m_kernel_ioctl_handle___DeviceIoControl__0x_08x__:_0x_08x_n
mov r8d, eax
call fcn.14000afb0
mov edi, ebx
mov eax, ebx
add rsp, 0x78
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rax, qword [rdx + 8]
mov r10, rdi
mov r11, qword [rsi]
mov qword [rsp + 0x68], r14
mov r14, qword [rbx]
mov rcx, qword [rax]
mov qword [rsp + 0x40], r11
mov qword [rsp + 0xb8], rdi
mov eax, edi
mov r8, qword [rcx + 8]
mov r9d, dword [r8 + 0xc]
mov edx, dword [r8 + 8]
add r9, r8
test edx, edx
je 0x14000aacf
mov rcx, r9
nop dword [rax]
cmp dword [rcx], 9
je 0x14000a9cf
inc eax
add rcx, 0xc
cmp eax, edx
jb 0x14000a9b0
mov r14, qword [rsp + 0x68]
mov eax, edi
add rsp, 0x78
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov qword [rsp + 0x70], r13
lea rcx, [rax + rax*2]
mov r13d, dword [r9 + rcx*4 + 8]
add r13, r8
je 0x14000aaca
mov qword [rsp + 0xa8], r12
mov r12, qword [r13 + 8]
add r12, r8
mov qword [rsp + 0x60], r15
mov r15, rdi
cmp qword [r13], rdi
jbe 0x14000aab6
lea rsi, [r13 + 0x18]
nop dword [rax + rax]
mov rcx, qword [rsi - 8]
mov r9, qword [rsi]
cmp r14, rcx
jb 0x14000aa25
lea rax, [r9 + rcx]
cmp r14, rax
jb 0x14000aa44
lea rdx, [r14 + rbp]
lea rax, [r9 + rcx]
cmp rdx, rcx
jb 0x14000aa37
cmp rdx, rax
jb 0x14000aa44
mov r8, r9
cmp r14, rcx
jae 0x14000aaa2
cmp rdx, rax
jbe 0x14000aaa2
mov r8, rcx
mov rbx, r9
sub r8, r14
mov rax, r14
cmp r14, rcx
mov rdx, rdi
cmovae r8, rdi
sub rax, rcx
cmp r14, rcx
mov rcx, rbp
cmovae rdx, rax
sub rcx, r8
sub rbx, rdx
lea rax, [rcx + rdx]
cmp rax, r9
cmovbe rbx, rcx
lea rcx, [r8 + r11]
mov r8, rbx
add rdx, r12
call fcn.14011b4a0
mov r10, qword [rsp + 0xb8]
mov r8, qword [rsi]
add r10, rbx
mov r11, qword [rsp + 0x40]
mov qword [rsp + 0xb8], r10
inc r15
add rsi, 0x10
add r12, r8
cmp r15, qword [r13]
jb 0x14000aa10
mov r15, qword [rsp + 0x60]
cmp r10, rbp
mov r12, qword [rsp + 0xa8]
sete dil
mov r13, qword [rsp + 0x70]
mov r14, qword [rsp + 0x68]
mov eax, edi
add rsp, 0x78
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rcx, qword [rdx + 8]
mov r9, rbp
mov r8, qword [rsi]
mov rdx, qword [rbx]
mov qword [rsp + 0x20], rdi
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edi, eax
add rsp, 0x78
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rdx, qword [rbx]
mov r8, rbp
mov rcx, qword [rsi]
call fcn.14011b4a0
mov edi, 1
mov eax, edi
add rsp, 0x78
pop rdi
pop rsi
pop rbp
pop rbx
ret