Function at 0x7d23bda0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
mov byte [rsp + 0x18], r8b
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x20]
sub rsp, 0x120
lea rax, [rbp - 0x80]
mov dword [rbp - 0x70], 0x30
mov qword [rbp - 0x60], rax
mov r12, rdx
mov rax, qword [0x7d2ad5c0]
mov r14, rcx
xor esi, esi
mov qword [rbp - 0x50], rax
mov rdx, rcx
mov qword [rbp - 0x68], rsi
lea rcx, [rbp - 0x80]
mov dword [rbp - 0x58], 0x40
movzx edi, r9b
mov qword [rbp - 0x48], rsi
movzx r13d, r8b
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov dword [rsp + 0x50], esi
lea r9, [rsp + 0x70]
mov qword [rsp + 0x48], rsi
lea r8, [rbp - 0x70]
mov dword [rsp + 0x40], 0x20
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x38], 1
mov r15d, 0x120089
mov dword [rsp + 0x30], 7
mov edx, r15d
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
call qword [0x7d2ac098]
test r13b, r13b
je 0x7d23be5d
cmp eax, 0xc0000022
je 0x7d23be64
cmp eax, 0xc0000043
jne 0x7d23bebb
mov rdx, r14
lea rcx, [rsp + 0x60]
call fcn.7d22199c
test eax, eax
jns 0x7d23bec3
mov dword [rsp + 0x50], esi
lea r9, [rsp + 0x70]
mov qword [rsp + 0x48], rsi
lea r8, [rbp - 0x70]
mov dword [rsp + 0x40], 0x20
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x38], 1
xor dil, dil
mov dword [rsp + 0x30], 7
mov edx, 0x100080
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
call qword [0x7d2ac098]
test eax, eax
js 0x7d23c1b7
mov rcx, qword [rsp + 0x60]
lea r8, [rbp - 0x40]
mov r9d, 0x38
mov qword [rsp + 0x150], rbx
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x20], 0x22
call qword [0x7d2ac0b0]
mov ebx, eax
test eax, eax
jns 0x7d23befd
mov rcx, qword [rsp + 0x60]
jmp 0x7d23c1a7
test dil, dil
je 0x7d23bffe
cmp byte [0x7d2ac173], sil
je 0x7d23bf1b
mov byte [0x7d2ac173], sil
call fcn.7d238880
mov edi, dword [rbp - 0x18]
cmp dword [rbp - 0x14], esi
jne 0x7d23bf34
mov eax, dword [0x7d2aa568]
shl eax, 0xa
cmp edi, eax
jbe 0x7d23c004
mov edx, 0x5c
mov rcx, r14
call sub.ntdll.dll_wcsrchr
test rax, rax
lea rbx, str.places.sqlite
mov rsi, r14
lea rcx, [rax + 2]
cmovne rsi, rcx
cmp qword [str.places.sqlite], 0
je 0x7d23bf7d
mov rdx, qword [rbx]
mov rcx, rsi
call sub.ntdll.dll__wcsicmp
test eax, eax
je 0x7d23c002
add rbx, 8
cmp qword [rbx], 0
jne 0x7d23bf60
test rsi, rsi
je 0x7d23c002
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtClose]
cmp byte [0x7d2ac170], 0
jne 0x7d23bff4
or rax, 0xffffffffffffffff
nop
cmp word [rsi + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x7d23bfa0
lea ecx, [rax*2 + 0x80]
call fcn.7d2212da
mov r9, qword [0x7d2abf58]
lea rdx, str._s___s____d_
mov r8, rsi
mov dword [rsp + 0x20], edi
mov rcx, rax
mov rbx, rax
call sym.imfsbDll.dll_Sbie_swprintf
mov rdx, rbx
mov ecx, 0x836
call sym.imfsbDll.dll_SbieApi_Log
mov rcx, rbx
call fcn.7d221938
mov byte [0x7d2ac173], 1
mov eax, 0xc000000a
jmp 0x7d23c1af
mov edi, esi
jmp 0x7d23c004
xor esi, esi
mov rdx, r12
lea rcx, [rbp - 0x80]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov eax, dword [rbp - 0x10]
lea r9, [rsp + 0x70]
mov dword [rsp + 0x50], esi
lea r8, [rbp - 0x70]
mov qword [rsp + 0x48], rsi
and eax, 0x10
mov edx, 0x60
mov ecx, 0x21
cmove ecx, edx
mov edx, 0x120116
mov dword [rsp + 0x40], ecx
test eax, eax
mov dword [rsp + 0x38], 2
lea rcx, [rsp + 0x68]
cmove r15d, edx
mov dword [rsp + 0x30], 7
mov edx, r15d
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rsi
call qword [0x7d2ac098]
mov ebx, eax
test eax, eax
js 0x7d23bef3
test edi, edi
je 0x7d23c13d
mov ecx, 0x1000
call fcn.7d2212da
mov rsi, rax
test rax, rax
jne 0x7d23c09e
mov ebx, 0xc000009a
jmp 0x7d23c197
test edi, edi
je 0x7d23c135
xor r15d, r15d
mov r13d, 0x1000
nop
mov rcx, qword [rsp + 0x60]
mov eax, edi
mov qword [rsp + 0x40], r15
cmp edi, r13d
mov qword [rsp + 0x38], r15
cmova eax, r13d
xor r9d, r9d
mov dword [rsp + 0x30], eax
xor r8d, r8d
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rsi
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtReadFile]
mov ebx, eax
test eax, eax
js 0x7d23c130
mov rax, qword [rsp + 0x78]
xor r9d, r9d
mov rcx, qword [rsp + 0x68]
sub edi, eax
mov qword [rsp + 0x40], r15
xor r8d, r8d
mov qword [rsp + 0x38], r15
xor edx, edx
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtWriteFile]
mov ebx, eax
test eax, eax
js 0x7d23c130
test edi, edi
jne 0x7d23c0b0
movzx r13d, byte [rbp + 0x60]
mov rcx, rsi
call fcn.7d221938
test ebx, ebx
js 0x7d23c197
mov rdx, r12
mov rcx, r14
call fcn.7d232ac0
mov ebx, eax
test r13b, r13b
je 0x7d23c15a
cmp eax, 0xc0000022
je 0x7d23c15e
test eax, eax
js 0x7d23c197
mov rax, qword [rbp - 0x40]
lea r8, [rbp - 8]
mov rcx, qword [rsp + 0x68]
mov rdx, r12
mov qword [rbp - 8], rax
mov rax, qword [rbp - 0x38]
mov qword [rbp], rax
mov rax, qword [rbp - 0x30]
mov qword [rbp + 8], rax
mov rax, qword [rbp - 0x28]
mov qword [rbp + 0x10], rax
mov eax, dword [rbp - 0x10]
mov dword [rbp + 0x18], eax
call fcn.7d242cf0
mov ebx, eax
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
mov rbx, qword [rsp + 0x150]
lea r11, [rsp + 0x120]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret