Function at 0x14000b810
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x14000b832
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x14000b841
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14000b864
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14000b866
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14000b8a2
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14000b93e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14000b8dd
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14000b91e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14000b93e
cmp rbx, rax
ja 0x14000b8f0
test rbx, rbx
je 0x14000b93e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
and al, 0x18
mov qword [rsp + 0x20], rdi
jl 0x140024492
and byte [rbp + 0x41], dl
push rsp
push r13
push r14
push r15
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov rax, qword [0x14003d460]
xor rax, rsp
mov qword [rbp + 0x10], rax
mov rdi, rdx
mov qword [rsp + 0x78], rdx
push rsp
and al, 0x78
movsxd rsi, ecx
lea rcx, [0x140024280]
call qword [str.____Failed_to_remove_from_RuntimeDriversArray]
mov r15d, 1
mov r14d, r15d
cmp esi, r15d
jle 0x140024559
popfq
add byte [rax], al
invalid
lea rbx, [rdi + 8]
mov rcx, qword [rbx]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400244d0
cmp rax, 5
jne 0x140024502
add rcx, 2
lea rdx, [0x140037688]
call qword [0x14002c9a8]
test eax, eax
jne 0x140024502
mov rax, qword [rbx]
cmp word [rax], 0x2f
je 0x140024858
mov rcx, qword [rbx]
mov rax, 0xffffffffffffffff
invalid
invalid
invalid
dec dword [rdi]
invalid
invalid
invalid
inc rax
cmp word [rcx + rax*2], 0
jne 0x140024510
cmp rax, 6
jne 0x140024549
add rcx, 4
lea rdx, [0x140037688]
call qword [0x14002c9a8]
test eax, eax
jne 0x140024549
mov rax, qword [rbx]
cmp word [rax], 0x2d
invalid
invalid
jne 0x140024549
cmp word [rax + 2], 0x2d
je 0x140024858
inc r14d
add rbx, 8
cmp r14d, esi
jl 0x1400244c0
mov byte [rsp + 0x51], 0
lea r8, [0x140037698]
mov rdx, rdi
mov ecx, esi
call 0x140024330
test eax, eax
setg r12b
mov byte [rsp + 0x50], r12b
and al, 0x50
mov r14d, 0xffffffff
cmp esi, r15d
jle 0x140024625
lea rbx, [rdi + 8]
mov r13d, r15d
mov rcx, qword [rbx]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400245a0
cmp rax, 9
jne 0x1400245ce
add rcx, 2
lea rdx, str.Fatal_error:_failed_to_acquire_SE_LOAD_DRIVER_PRIVILEGE._Make_sure_you_are_running_as_administrator.
call qword [0x14002c9a8]
test eax, eax
jne 0x1400245ce
mov rax, qword [rbx]
cmp word [rax], 0x2f
cmp byte [rdi], ch
je 0x140024634
mov rcx, qword [rbx]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400245e0
cmp rax, 0xa
or dh, byte [rbp + 0x25]
add rcx, 4
lea rdx, str.Fatal_error:_failed_to_acquire_SE_LOAD_DRIVER_PRIVILEGE._Make_sure_you_are_running_as_administrator.
call qword [0x14002c9a8]
test eax, eax
jne 0x140024615
mov rax, qword [rbx]
cmp word [rax], 0x2d
jne 0x140024615
cmp word [rax + 2], 0x2d
je 0x140024634
inc r13d
add rbx, 8
cmp r13d, esi
jl 0x140024590
mov r13d, 0xffffffff
cmp esi, r15d
jle 0x1400246d3
lea rbx, [rdi + 8]
mov edi, r15d
nop dword [rax + rax]
mov rcx, qword [rbx]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140024650
cmp rax, 0x12
jne 0x14002467e
add rcx, 2
lea rdx, [0x1400376b8]
call qword [0x14002c9a8]
test eax, eax
jne 0x14002467e
mov rax, qword [rbx]
cmp word [rax], 0x2f
cmp byte [rdi], ch
je 0x1400246d8
mov rcx, qword [rbx]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140024690
cmp rax, 0x13
jne 0x1400246c5
add rcx, 4
lea rdx, [0x1400376b8]
call qword [0x14002c9a8]
test eax, eax
jne 0x1400246c5
mov rax, qword [rbx]
cmp word [rax], 0x2d
invalid
invalid
jne 0x1400246c5
cmp word [rax + 2], 0x2d
je 0x1400246d8
inc edi
add rbx, 8
cmp edi, esi
jl 0x140024640
mov edi, 0xffffffff
test edi, edi
setg byte [rsp + 0x52]
and al, 0x52
test r14d, r14d
jle 0x140024707
lea rdx, [0x1400376e0]
mov rcx, qword [0x14002c6f8]
call 0x14001fec0
lea rdx, [0x1400200a0]
mov rcx, rax
call qword [0x14002c600]
test r12b, r12b
je 0x14002472f
lea rdx, [0x140037738]
mov rcx, qword [0x14002c6f8]
call 0x14001fec0
lea rdx, [0x1400200a0]
mov rcx, rax
call qword [0x14002c600]
test r13d, r13d
jle 0x140024757
lea rdx, str.___NtLoadDriver_Status_0x
mov rcx, qword [0x14002c6f8]
call 0x14001fec0
lea rdx, [0x1400200a0]
mov rcx, rax
call qword [0x14002c600]
test edi, edi
jle 0x14002477e
lea rdx, [0x1400377e0]
mov rcx, qword [0x14002c6f8]
call 0x14001fec0
lea rdx, [0x1400200a0]
mov rcx, rax
call qword [0x14002c600]
mov r12d, r15d
mov qword [rbp - 0x60], rsi
cmp rsi, r12
jle 0x140024a10
xor esi, esi
test r14d, r14d
setg byte [rsp + 0x51]
and al, 0x51
lea r8, [0x140037698]
mov rdx, rdi
mov ecx, esi
call 0x140024330
test eax, eax
setg r12b
mov byte [rsp + 0x50], r12b
jmp 0x140024589