Function at 0x14000a720
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x218]
sub rsp, 0x2f0
mov rax, qword [0x14009e0d0]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
xor ebx, ebx
mov qword [rbp - 0x80], 0xfffffffffd050f80
and qword [rsp + 0x60], rbx
xor esi, esi
and qword [rsp + 0x78], rbx
xor r15d, r15d
xor edi, edi
mov qword [rsp + 0x70], rbx
mov eax, 0xcccccccd
mul edi
shr edx, 2
lea ecx, [rdx + rdx*4]
cmp edi, ecx
jne 0x14000a8f2
test edi, edi
jne 0x14000a824
lea ecx, [rdi + 0x28]
call fcn.1400076ac
mov r13, rax
test rax, rax
je 0x14000a7b7
xorps xmm0, xmm0
xor eax, eax
movups xmmword [r13], xmm0
movups xmmword [r13 + 0x10], xmm0
mov qword [r13 + 0x20], rax
mov ecx, 0x28
call fcn.1400076ac
mov r12, rax
test rax, rax
je 0x14000a7de
xorps xmm0, xmm0
xor eax, eax
movups xmmword [r12], xmm0
movups xmmword [r12 + 0x10], xmm0
mov qword [r12 + 0x20], rax
mov ebx, 0x50
mov ecx, ebx
call fcn.1400076ac
mov qword [rsp + 0x68], rax
mov r14, rax
test rax, rax
je 0x14000a804
mov r8d, ebx
xor edx, edx
mov rcx, rax
call sub.ntdll.dll_memset
mov rcx, rbx
call fcn.1400076ac
mov rbx, rax
test rax, rax
je 0x14000a86b
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 0x50]
call sub.ntdll.dll_memset
jmp 0x14000a86b
lea ebx, [rdi*8 + 0x28]
mov rcx, r15
mov edx, ebx
call fcn.1400078e4
mov edx, ebx
mov rcx, rsi
mov r13, rax
call fcn.1400078e4
mov rcx, qword [rsp + 0x70]
lea ebx, [rdi + 5]
shl ebx, 4
mov r12, rax
mov edx, ebx
call fcn.1400078e4
mov edx, ebx
mov qword [rsp + 0x68], rax
xor ecx, ecx
mov r14, rax
call fcn.1400078e4
mov rbx, rax
test r13, r13
je 0x14000aa31
test r14, r14
je 0x14000aa31
test r12, r12
je 0x14000aa31
test rbx, rbx
jne 0x14000aa31
mov rcx, qword [rsp + 0x68]
xorps xmm0, xmm0
movups xmmword [r13 + rdi*8], xmm0
xor eax, eax
mov ebx, edi
movups xmmword [r13 + rdi*8 + 0x10], xmm0
mov qword [r13 + rdi*8 + 0x20], rax
xor edx, edx
movups xmmword [r12 + rdi*8], xmm0
lea esi, [rax + 0x50]
shl rbx, 4
movups xmmword [r12 + rdi*8 + 0x10], xmm0
mov r8d, esi
mov r14d, edi
add rcx, rbx
mov qword [r12 + rdi*8 + 0x20], rax
call sub.ntdll.dll_memset
mov r8d, esi
xor edx, edx
mov rcx, rbx
call sub.ntdll.dll_memset
mov rbx, qword [rsp + 0x68]
mov r15, r13
mov qword [rsp + 0x70], rbx
mov rsi, r12
jmp 0x14000a8f5
mov r14d, edi
mov r9d, edi
lea r8, str.DeviceKeyboardClass_d
mov edx, 0x104
lea rcx, [rbp - 0x30]
call qword [sym.imp.ntdll.dll_swprintf_s]
nop dword [rax + rax]
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x48]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
and dword [rsp + 0x50], 0
lea rax, [rbp - 0x48]
and qword [rsp + 0x48], 0
lea rcx, [r15 + r14*8]
and qword [rbp - 0x70], 0
lea r8, [rbp - 0x78]
mov dword [rsp + 0x40], 1
xorps xmm0, xmm0
mov dword [rsp + 0x38], 1
mov r9, r14
and dword [rsp + 0x30], 0
mov edx, 0x80100080
shl r9, 4
add r9, rbx
mov dword [rsp + 0x28], 0x80
and qword [rsp + 0x20], 0
mov dword [rbp - 0x78], 0x30
mov dword [rbp - 0x60], 0x40
mov qword [rbp - 0x68], rax
movdqu xmmword [rbp - 0x58], xmm0
call qword [sym.imp.ntdll.dll_NtCreateFile]
nop dword [rax + rax]
mov r13d, eax
test eax, eax
js 0x14000aa3d
and qword [rbp - 0x70], 0
lea rcx, [rsi + r14*8]
and dword [rbp - 0x60], 0
lea r8, [rbp - 0x78]
and qword [rbp - 0x68], 0
xorps xmm0, xmm0
xor r9d, r9d
mov dword [rbp - 0x78], 0x30
mov edx, 0x1f01ff
mov byte [rsp + 0x20], 0
movdqu xmmword [rbp - 0x58], xmm0
call qword [sym.imp.ntdll.dll_NtCreateEvent]
nop dword [rax + rax]
mov r13d, eax
test eax, eax
js 0x14000aa2c
inc edi
cmp edi, 0x64
jb 0x14000a777
lea eax, [rdi + rdi*2]
shl eax, 2
mov ecx, eax
mov ebx, eax
call fcn.1400076ac
mov qword [rsp + 0x60], rax
mov r14, rax
test rax, rax
je 0x14000aa20
mov r8d, ebx
xor edx, edx
mov rcx, rax
call sub.ntdll.dll_memset
test r14, r14
jne 0x14000aa4b
xor bl, bl
jmp 0x14000aaf5
and qword [rsi + r14*8], 0
mov r14, qword [rsp + 0x60]
xor bl, bl
jmp 0x14000aaf5
cmp eax, 0xc0000034
je 0x14000a9f7
and qword [r15 + r14*8], 0
jmp 0x14000aa31
xor r12d, r12d
mov bl, 1
test edi, edi
je 0x14000aacb
mov rdx, rsi
mov rbx, r15
sub rdx, r15
mov qword [rsp + 0x68], rdx
and qword [rsp + 0x40], 0
lea r8, [rsp + 0x78]
mov rdx, qword [rdx + rbx]
lea rax, [r12 + r14]
mov qword [rsp + 0x38], r8
xor r9d, r9d
mov dword [rsp + 0x30], 0xc
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov ecx, r12d
shl rcx, 4
add rcx, qword [rsp + 0x70]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbx]
call qword [sym.imp.ntdll.dll_NtReadFile]
nop dword [rax + rax]
mov r13d, eax
test eax, eax
js 0x14000aac9
mov rdx, qword [rsp + 0x68]
inc r12d
add rbx, 8
cmp r12d, edi
jb 0x14000aa62
mov bl, 1
jmp 0x14000aacb
xor bl, bl
test r13d, r13d
js 0x14000aaf5
and qword [rsp + 0x20], 0
mov r9b, 1
mov r8d, 1
mov rdx, rsi
mov ecx, edi
call qword [sym.imp.ntdll.dll_NtWaitForMultipleObjects]
nop dword [rax + rax]
test eax, eax
setns bl
test edi, edi
je 0x14000ab51
mov r12, r15
mov r14d, edi
mov r13d, edi
mov rcx, qword [r12]
test rcx, rcx
je 0x14000ab1e
mov rdx, r14
shl rdx, 4
call qword [sym.imp.ntdll.dll_NtCancelIoFile]
nop dword [rax + rax]
add r12, 8
sub r13, 1
jne 0x14000ab02
mov r14, qword [rsp + 0x60]
test edi, edi
je 0x14000ab51
lea rax, [rbp - 0x80]
mov r9b, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov ecx, edi
call qword [sym.imp.ntdll.dll_NtWaitForMultipleObjects]
nop dword [rax + rax]
mov rdx, r15
mov ecx, edi
call fcn.14000a0bc
mov rdx, rsi
mov ecx, edi
call fcn.14000a0bc
test r15, r15
je 0x14000ab72
mov rcx, r15
call fcn.140007828
test rsi, rsi
je 0x14000ab7f
mov rcx, rsi
call fcn.140007828
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x14000ab91
mov rcx, rax
call fcn.140007828
test r14, r14
je 0x14000ab9e
mov rcx, r14
call fcn.140007828
mov al, bl
mov rcx, qword [rbp + 0x1e0]
xor rcx, rsp
call fcn.140093530
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret