Function at 0x1401bea00
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov byte [rsp + 8], cl
push rbx
push rsi
push r14
push r15
sub rsp, 0x58
xor esi, esi
mov r14d, r9d
cmp byte [0x1411ec731], sil
mov r15, r8
mov rbx, rdx
movzx eax, cl
je 0x1401bea4b
test rdx, rdx
js 0x1401beaa7
cmp r14d, 1
jb 0x1401beaa7
mov r8d, r14d
mov rdx, r15
mov rcx, rbx
call fcn.1401b8fd0
mov esi, eax
add rsp, 0x58
pop r15
pop r14
pop rsi
pop rbx
ret
cmp byte [0x1411ec730], sil
je 0x1401beab4
test rbx, rbx
js 0x1401beaa7
cmp r14d, 1
jb 0x1401beaa7
mov r9, qword [0x1411ec630]
sub rbx, qword [r9 + 0x34]
mov qword [0x1411ec638], r9
mov rax, qword [r9 + 8]
cmp rbx, rax
jl 0x1401bea8c
mov r9, qword [r9]
sub rbx, rax
mov qword [0x1411ec638], r9
test r9, r9
jne 0x1401bea71
mov r8, r14
mov rdx, r15
mov rcx, rbx
call fcn.1401b9100
mov esi, eax
add rsp, 0x58
pop r15
pop r14
pop rsi
pop rbx
ret
xor eax, eax
add rsp, 0x58
pop r15
pop r14
pop rsi
pop rbx
ret
cmp byte [0x1411ec732], sil
jne 0x1401bed64
cmp byte [0x1411dd024], sil
je 0x1401beae5
mov r8d, r14d
mov rdx, r15
mov rcx, rbx
call fcn.1401bed80
mov esi, eax
add rsp, 0x58
pop r15
pop r14
pop rsi
pop rbx
ret
cmp byte [0x1411ec733], sil
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x90], rdi
je 0x1401beb65
mov rbp, qword [rsp + 0xa0]
xor r15b, r15b
test rbp, rbp
jne 0x1401beb2b
mov rax, qword [0x1411dcc50]
mov r15b, 1
mov rcx, qword [rax + 0xc]
movzx ecx, byte [rcx + 0x114]
call fcn.1401bdf40
mov rbp, rax
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8, r14
xor edx, edx
mov rcx, rax
mov rdi, rax
call sub.VCRUNTIME140.dll_memset
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
cmp r15b, 1
jne 0x1401bed54
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1401bed54
cmp al, 0x7f
ja 0x1401bec40
mov rdi, qword [rsp + 0xa0]
test rdi, rdi
jne 0x1401bebee
call fcn.1401bdf40
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1401bed54
shl rbx, 9
lea r8, [rsp + 0x34]
mov edx, ebx
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r9, [rsp + 0x38]
mov qword [rsp + 0x20], rsi
mov r8d, r14d
mov rdx, r15
mov rcx, rdi
cmp dword [rsp + 0xa8], esi
je 0x1401bebcc
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x1401bebd2
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, eax
test eax, eax
jne 0x1401bebde
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, ebx
jmp 0x1401bed54
shl rbx, 9
lea r8, [rsp + 0x34]
mov edx, ebx
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r9, [rsp + 0x38]
mov qword [rsp + 0x20], rsi
mov r8d, r14d
mov rdx, r15
mov rcx, rdi
cmp dword [rsp + 0xa8], esi
je 0x1401bec33
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
jmp 0x1401bed54
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
jmp 0x1401bed54
mov qword [rsp + 0x98], r12
mov r12, qword [rsp + 0xa0]
mov qword [rsp + 0x50], r13
xor r13b, r13b
test r12, r12
jne 0x1401becd6
movzx ecx, al
mov dword [rsp + 0x30], esi
mov edi, esi
call fcn.1401bdf40
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x1401beccb
mov rcx, rbx
lea r8, [rsp + 0x44]
shl rcx, 9
xor r9d, r9d
mov qword [rsp + 0x40], rcx
mov edx, ecx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rsi
mov r8d, r14d
mov rdx, r15
mov rcx, rbp
cmp byte [rsp + 0xa8], sil
jne 0x1401becc3
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rbp
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1401bed26
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1401bed26
mov rax, rbx
mov dword [rsp + 0x38], esi
shl rax, 9
lea r8, [rsp + 0x4c]
mov edx, eax
mov qword [rsp + 0x48], rax
xor r9d, r9d
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r9, [rsp + 0x38]
mov qword [rsp + 0x20], rsi
mov r8d, r14d
mov rdx, r15
mov rcx, r12
cmp byte [rsp + 0xa8], sil
jne 0x1401bed1e
call qword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x1401bed24
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
test dil, dil
jne 0x1401bed43
movzx eax, byte [rsp + 0x80]
inc r13b
cmp r13b, byte [0x1411d8011]
jne 0x1401bec58
mov r13, qword [rsp + 0x50]
mov r12, qword [rsp + 0x98]
movzx esi, dil
mov rbp, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x90]
mov eax, esi
add rsp, 0x58
pop r15
pop r14
pop rsi
pop rbx
ret