Function at 0x1401aa4a0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov rax, qword [r8]
mov rdi, rcx
mov r9, rdx
mov rbp, r8
test rdx, rdx
jne 0x1401aa790
sub rax, 2
mov r12, 0xffffffffffffffff
mov r15d, 2
mov r9d, 1
mov r8d, 2
mov qword [rsp + 0x30], rax
mov esi, 1
mov qword [rsp + 0x50], r12
mov rdx, rsi
mov qword [rsp + 0x58], r8
mov qword [rsp + 0xb8], r9
nop dword [rax]
mov rsi, qword [rsp + 0x50]
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x48], rdx
sub rax, rdx
lea rcx, [rsi + rdx]
cmp qword [rsp + 0xb8], rdx
mov esi, 1
cmovge rcx, rax
mov eax, 1
xor r13d, r13d
shl rax, cl
shl esi, cl
mov qword [rsp + 0x38], rax
movsxd rax, esi
mov qword [rsp + 0x40], rax
nop dword [rax]
mov rsi, qword [rsp + 0x40]
mov rax, r13
mov rcx, qword [rdi]
lea rdx, [r13 + rsi]
sub rax, rsi
test qword [rsp + 0x38], r13
mov rsi, qword [rsp + 0x30]
cmove rax, rdx
mov rdx, qword [rdi + 0x10]
xor r8d, r8d
xor ebx, ebx
add rax, rsi
not rdx
and rdx, rax
shl edx, 5
call sub.msvcrt.dll_fseek
mov ecx, 0x20
call sub.msvcrt.dll_malloc
mov r9, qword [rdi]
mov r8d, 0x20
mov edx, 1
mov rcx, rax
mov r15, rax
call sub.msvcrt.dll_fread
mov rdx, qword [rbp]
mov rcx, qword [rdi]
cmp rax, 0x20
mov rax, qword [rsp + 0x28]
cmovne r15, rbx
xor r8d, r8d
sub rdx, rax
mov rax, qword [rdi + 0x10]
not rax
and rdx, rax
shl edx, 5
call sub.msvcrt.dll_fseek
mov ecx, 0x20
call sub.msvcrt.dll_malloc
mov r9, qword [rdi]
mov r8d, 0x20
mov edx, 1
mov rcx, rax
mov r12, rax
call sub.msvcrt.dll_fread
mov edx, 1
mov ecx, 0x20
cmp rax, 0x20
cmovne r12, rbx
call sub.msvcrt.dll_calloc
mov rdx, qword [rbp]
mov rbx, rax
lea rax, [rdx + rdx]
sar rdx, 0x3f
xor rax, rdx
cmp rax, 0x7f
jbe 0x1401aa788
xor edx, edx
nop word [rax + rax]
mov r8d, eax
mov ecx, edx
shr rax, 7
add edx, 1
or r8d, 0xffffff80
mov byte [rbx + rcx], r8b
cmp rax, 0x7f
ja 0x1401aa640
add rdx, rbx
mov byte [rdx], al
mov ecx, pe_nt_image_headers64
add r13, 1
call sub.msvcrt.dll_malloc
vmovdqu xmm2, xmmword [rbx]
vmovdqu xmm3, xmmword [rbx + 0x10]
mov ecx, 0x20
mov rsi, rax
mov rax, qword [rdi + 0x18]
vmovdqu xmm4, xmmword [r15]
vmovdqu xmm5, xmmword [r15 + 0x10]
vmovdqu xmm0, xmmword [rax]
vmovdqu xmmword [rsi], xmm0
vmovdqu xmm1, xmmword [rax + 0x10]
vmovdqu xmm0, xmmword [r12]
vmovdqu xmmword [rsi + 0x20], xmm2
vmovdqu xmmword [rsi + 0x10], xmm1
vmovdqu xmm1, xmmword [r12 + 0x10]
vmovdqu xmmword [rsi + 0x30], xmm3
vmovdqu xmmword [rsi + 0x40], xmm4
vmovdqu xmmword [rsi + 0x50], xmm5
vmovdqu xmmword [rsi + 0x60], xmm0
vmovdqu xmmword [rsi + 0x70], xmm1
call sub.msvcrt.dll_malloc
mov r9d, 0x20
mov edx, pe_nt_image_headers64
mov rcx, rsi
mov r8, rax
mov r14, rax
call fcn.1401acc90
mov rdx, qword [rdi + 0x10]
mov rcx, qword [rdi]
xor r8d, r8d
not rdx
and rdx, qword [rbp]
shl edx, 5
call sub.msvcrt.dll_fseek
mov r9, qword [rdi]
mov edx, 1
mov rcx, r14
mov r8d, 0x20
call sub.msvcrt.dll_fwrite
add qword [rbp], 1
mov rcx, r14
call sub.msvcrt.dll_free
mov rcx, rsi
call sub.msvcrt.dll_free
mov rcx, r15
call sub.msvcrt.dll_free
mov rcx, r12
call sub.msvcrt.dll_free
mov rcx, rbx
call sub.msvcrt.dll_free
cmp qword [rsp + 0x28], r13
jne 0x1401aa558
mov rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x58]
mov r15, qword [rsp + 0x28]
add qword [rsp + 0x30], r15
add rdx, 1
cmp rdx, rax
jne 0x1401aa508
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rdx, rbx
jmp 0x1401aa65d
lea r8, [rdx + rdx]
cmp r8, 1
jle 0x1401aa770
mov edx, 1
mov ecx, r9d
shl edx, cl
movsxd r15, edx
test r15, r15
jle 0x1401aa770
mov rdx, r8
sub rax, r15
sar rdx, 1
neg rdx
mov r12, rdx
jmp 0x1401aa4e2