Function at 0x140029cb0
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
sub rsp, 0x118
cmp dword [sym.4yUlCM3HuVsHzW5CaCX.exe_WindowsVersion], 0x3d
jb 0x140029fda
mov rdx, qword [0x140191180]
mov qword [rax + 0x18], rbx
mov rbx, qword [0x140188440]
mov qword [rax - 8], rbp
mov qword [rax - 0x18], rdi
mov rdi, qword [0x140192450]
mov qword [rax - 0x20], r14
mov qword [rax - 0x28], r15
add rbx, qword [rdi]
lea rcx, [rbx + 0x12]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhCreateObject
xor ebp, ebp
mov r14, rax
mov qword [rax], rbx
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + rbx], bp
mov r8, qword [rdi]
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
call fcn.1401317c0
mov rcx, qword [rdi]
add rcx, qword [r14 + 8]
mov r8, qword [0x140188440]
mov rdx, qword [0x140188448]
call fcn.1401317c0
mov rdi, qword [0x140192450]
mov rbx, qword [0x140188420]
mov rdx, qword [0x140191180]
add rbx, qword [rdi]
lea rcx, [rbx + 0x12]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhCreateObject
mov r15, rax
mov qword [rax], rbx
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + rbx], bp
mov r8, qword [rdi]
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
call fcn.1401317c0
mov rcx, qword [r15 + 8]
add rcx, qword [rdi]
mov r8, qword [0x140188420]
mov rdx, qword [str.processcheckr.sig]
call fcn.1401317c0
mov dword [rsp + 0x128], 1
lea r8, [rsp + 0x128]
mov byte [rsp + 0x12c], 1
mov rdx, qword [r14 + 8]
call fcn.1400ec650
mov rcx, qword [r15 + 8]
lea rdx, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
test al, al
je 0x140029f85
mov dword [rsp + 0x50], ebp
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rbp
lea r9, [rsp + 0xc8]
mov dword [rsp + 0x40], 0x60
lea r8, [rsp + 0x98]
mov dword [rsp + 0x38], 1
lea rcx, [rsp + 0x120]
mov dword [rsp + 0x30], 1
xorps xmm0, xmm0
mov dword [rsp + 0x28], 0x80
mov edx, 0x120089
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x98], 0x30
mov qword [rsp + 0xa0], rbp
mov dword [rsp + 0xb0], 0x40
mov qword [rsp + 0xa8], rax
movdqu xmmword [rsp + 0xb8], xmm0
call qword [sym.imp.ntdll.dll_NtCreateFile]
mov rcx, qword gs:[0x30]
xor edx, edx
mov r8, qword [rsp + 0x68]
mov ebx, eax
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
test ebx, ebx
js 0x140029f85
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhHeapHandle]
mov edx, 4
mov rdi, qword [rsp + 0x120]
mov r8d, 0x400
mov qword [rsp + 0x108], rsi
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov qword [rsp + 0x40], rbp
xor r9d, r9d
mov qword [rsp + 0x38], rbp
mov rsi, rax
mov dword [rsp + 0x30], 0x400
xor r8d, r8d
mov qword [rsp + 0x28], rax
xor edx, edx
lea rax, [rsp + 0x88]
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtReadFile]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x140029f6b
mov eax, dword [rsp + 0x90]
test rsi, rsi
je 0x140029f7d
mov dword [rsp + 0x48], ebp
lea rcx, [0x1400ed360]
mov qword [rsp + 0x40], rbp
xor r9d, r9d
mov dword [rsp + 0x80], eax
xor r8d, r8d
mov dword [rsp + 0x38], 0x18
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x70], rcx
mov rcx, qword [0x14018d910]
mov dword [rsp + 0x28], 0x99992007
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x78], rsi
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
test eax, eax
js 0x140029f6b
mov byte [0x1401910b4], 1
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhHeapHandle]
mov r8, rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rsi, qword [rsp + 0x108]
mov ebx, 0xffffffff
lea rcx, [r14 - 0x10]
mov eax, ebx
lock xadd dword [rcx + 8], eax
mov r14, qword [rsp + 0xf8]
mov rdi, qword [rsp + 0x100]
mov rbp, qword [rsp + 0x110]
cmp eax, 1
jne 0x140029fb7
call fcn.1400d9400
lea rcx, [r15 - 0x10]
lock xadd dword [rcx + 8], ebx
mov r15, qword [rsp + 0xf0]
cmp ebx, 1
mov rbx, qword [rsp + 0x130]
jne 0x140029fda
call fcn.1400d9400
add rsp, 0x118
ret