Function at 0x140001890
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x78
xor edi, edi
lea rax, [0x140030d88]
mov rbp, r8
mov qword [rsp + 0x48], rdi
mov r8, qword [rcx + 8]
mov rsi, rcx
mov qword [rsp + 0x50], rax
mov rbx, rdx
mov ecx, dword [r8]
test ecx, ecx
je 0x140001a30
sub ecx, 1
je 0x1400019aa
sub ecx, 2
je 0x14000193b
cmp ecx, 3
jne 0x140001cb8
mov rax, qword [rdx + 8]
cmp dword [rax], edi
jne 0x1400019d8
mov rax, qword [rsi]
test rax, rax
je 0x14000190c
mov rcx, qword [r8 + 8]
xor r9d, r9d
xor r8d, r8d
mov edx, eax
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
je 0x140001cb8
mov rax, qword [rsi + 8]
lea r9, [rsp + 0xa0]
mov rdx, qword [rbx]
mov r8d, ebp
mov qword [rsp + 0x20], rdi
mov rcx, qword [rax + 8]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
add rsp, 0x78
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rax, qword [rdx + 8]
cmp dword [rax], edi
jne 0x1400019d8
mov rax, qword [r8 + 8]
mov r9d, ebp
mov r8, qword [rdx]
mov edx, 0x22c187
mov qword [rsp + 0x38], rdi
mov rcx, qword [rax]
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x30], rax
mov rax, qword [rsi]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ebx, eax
test eax, eax
jne 0x14000199d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 0x22c187
lea rcx, str.ERROR____DeviceIoControl__0x_08x__:_0x_08x_n
mov r8d, eax
call fcn.140001fb0
mov edi, ebx
mov eax, ebx
add rsp, 0x78
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rax, qword [rdx + 8]
cmp dword [rax], edi
jne 0x1400019d8
mov rcx, qword [r8 + 8]
mov r9, rbp
mov r8, qword [rdx]
mov rdx, qword [rsi]
mov qword [rsp + 0x20], rdi
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edi, eax
add rsp, 0x78
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rdx, rbp
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140001cb8
mov r8, rbp
lea rcx, [rsp + 0x48]
mov rdx, rbx
call fcn.140001890
test eax, eax
je 0x140001a1a
mov r8, rbp
lea rdx, [rsp + 0x48]
mov rcx, rsi
call fcn.140001890
mov edi, eax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
add rsp, 0x78
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rdx, qword [rdx + 8]
mov ecx, dword [rdx]
test ecx, ecx
je 0x140001ca5
sub ecx, 1
je 0x140001c7f
sub ecx, 1
je 0x140001b12
sub ecx, 1
je 0x140001aab
cmp ecx, 3
jne 0x140001cb8
mov rcx, qword [rdx + 8]
xor r9d, r9d
mov edx, dword [rbx]
xor r8d, r8d
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x140001cb8
mov rax, qword [rbx + 8]
lea r9, [rsp + 0xa0]
mov rdx, qword [rsi]
mov r8d, ebp
mov qword [rsp + 0x20], rdi
mov rcx, qword [rax + 8]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, eax
add rsp, 0x78
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rax, qword [rdx + 8]
xor r9d, r9d
mov r8, qword [rbx]
mov edx, 0x22c183
mov qword [rsp + 0x38], rdi
mov rcx, qword [rax]
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x30], rax
mov rax, qword [rsi]
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ebx, eax
test eax, eax
jne 0x14000199d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 0x22c183
lea rcx, str.ERROR____DeviceIoControl__0x_08x__:_0x_08x_n
mov r8d, eax
call fcn.140001fb0
mov eax, ebx
mov edi, ebx
add rsp, 0x78
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rax, qword [rdx + 8]
mov r10, rdi
mov r11, qword [rsi]
mov qword [rsp + 0x68], r14
mov r14, qword [rbx]
mov rcx, qword [rax]
mov qword [rsp + 0x40], r11
mov qword [rsp + 0xb8], rdi
mov eax, edi
mov r8, qword [rcx + 8]
mov r9d, dword [r8 + 0xc]
mov edx, dword [r8 + 8]
add r9, r8
test edx, edx
je 0x140001c6f
mov rcx, r9
cmp dword [rcx], 9
je 0x140001b6f
inc eax
add rcx, 0xc
cmp eax, edx
jb 0x140001b50
mov r14, qword [rsp + 0x68]
mov eax, edi
add rsp, 0x78
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov qword [rsp + 0x70], r13
lea rcx, [rax + rax*2]
mov r13d, dword [r9 + rcx*4 + 8]
add r13, r8
je 0x140001c6a
mov qword [rsp + 0xa8], r12
mov r12, qword [r13 + 8]
add r12, r8
mov qword [rsp + 0x60], r15
mov r15, rdi
cmp qword [r13], rdi
jbe 0x140001c56
lea rsi, [r13 + 0x18]
nop dword [rax + rax]
mov rcx, qword [rsi - 8]
mov r9, qword [rsi]
cmp r14, rcx
jb 0x140001bc5
lea rax, [r9 + rcx]
cmp r14, rax
jb 0x140001be4
lea rdx, [r14 + rbp]
lea rax, [rcx + r9]
cmp rdx, rcx
jb 0x140001bd7
cmp rdx, rax
jb 0x140001be4
mov r8, r9
cmp r14, rcx
jae 0x140001c42
cmp rdx, rax
jbe 0x140001c42
mov r8, rcx
mov rbx, r9
sub r8, r14
mov rax, r14
cmp r14, rcx
mov rdx, rdi
cmovae r8, rdi
sub rax, rcx
cmp r14, rcx
mov rcx, rbp
cmovae rdx, rax
sub rcx, r8
sub rbx, rdx
lea rax, [rcx + rdx]
cmp rax, r9
cmovbe rbx, rcx
lea rcx, [r8 + r11]
mov r8, rbx
add rdx, r12
call fcn.14000b100
mov r10, qword [rsp + 0xb8]
mov r8, qword [rsi]
add r10, rbx
mov r11, qword [rsp + 0x40]
mov qword [rsp + 0xb8], r10
inc r15
add rsi, 0x10
add r12, r8
cmp r15, qword [r13]
jb 0x140001bb0
mov r15, qword [rsp + 0x60]
cmp r10, rbp
mov r12, qword [rsp + 0xa8]
sete dil
mov r13, qword [rsp + 0x70]
mov r14, qword [rsp + 0x68]
mov eax, edi
add rsp, 0x78
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rcx, qword [rdx + 8]
mov r9, rbp
mov r8, qword [rsi]
mov rdx, qword [rbx]
mov qword [rsp + 0x20], rdi
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edi, eax
add rsp, 0x78
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rdx, qword [rbx]
mov r8, rbp
mov rcx, qword [rsi]
call fcn.14000b100
mov edi, 1
mov eax, edi
add rsp, 0x78
pop rdi
pop rsi
pop rbp
pop rbx
ret