Function at 0x1400afe1c
Capabilities:
Read file via mapping
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa00]
sub rsp, 0xb00
mov rax, qword [0x1401f5698]
xor rax, rsp
mov qword [rbp + 0x9f0], rax
mov r15, r8
mov byte [rsp + 0x41], dl
mov r14, rcx
xor r12d, r12d
mov qword [rbp + 0x4c0], r12
mov dword [rbp + 0x4d0], r12d
mov qword [rbp + 0x4c8], r12
or ebx, 0xffffffff
mov dword [rbp + 0x4d4], ebx
mov word [rbp + 0x4d8], r12w
mov word [rbp + 0x5dc], r12w
mov dword [rbp + 0x5d8], r12d
mov qword [rbp - 0x70], r12
mov dword [rbp - 0x60], r12d
mov qword [rbp - 0x68], r12
mov dword [rbp - 0x5c], ebx
mov word [rbp - 0x58], r12w
mov word [rbp + 0xac], r12w
mov dword [rbp + 0xa8], r12d
mov dword [rsp + 0x20], r12d
mov r9d, dword [rcx + 0x18]
lea r8, str.ConEmuLastOutputMapping._08X
mov r13d, 0x80
mov edx, r13d
lea rcx, [rbp + 0x4d8]
call fcn.1401140d0
mov rcx, qword [rbp + 0x4c0]
test rcx, rcx
je 0x1400aff2b
mov rax, qword [rbp + 0x4c8]
test rax, rax
je 0x1400aff05
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [rbp + 0x4c8], r12
mov rcx, qword [rbp + 0x4c0]
test rcx, rcx
je 0x1400aff10
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x4c0], r12
mov dword [rbp + 0x4d0], r12d
mov qword [rbp + 0x4c8], r12
mov dword [rbp + 0x4d4], ebx
mov dword [rbp + 0x5d8], r12d
mov word [rbp + 0x5dc], r12w
cmp word [rbp + 0x4d8], r12w
jne 0x1400b0023
lea rdx, str.Internal_error._Mapping_file_name_was_not_specified.
lea rcx, [rbp + 0x5dc]
call fcn.14000ca24
lea rcx, str.Stored_output_mapping_was_not_created_
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call fcn.140113304
mov dil, r12b
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x1400affbc
mov rax, qword [rbp - 0x68]
test rax, rax
je 0x1400aff9a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [rbp - 0x68], r12
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x1400affa5
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x70], r12
mov dword [rbp - 0x60], r12d
mov qword [rbp - 0x68], r12
or dword [rbp - 0x5c], 0xffffffff
mov dword [rbp + 0xa8], r12d
mov rcx, qword [rbp + 0x4c0]
test rcx, rcx
je 0x1400afff6
mov rdx, qword [rbp + 0x4c8]
test rdx, rdx
je 0x1400affeb
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [rbp + 0x4c8], r12
mov rcx, qword [rbp + 0x4c0]
test rcx, rcx
je 0x1400afff6
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, dil
mov rcx, qword [rbp + 0x9f0]
xor rcx, rsp
call fcn.14012bda0
mov rbx, qword [rsp + 0xb48]
add rsp, 0xb00
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov dword [rbp + 0x4d4], 0xce
mov dword [rbp + 0x4d0], r12d
lea r8, [rbp + 0x4d8]
xor edx, edx
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov qword [rbp + 0x4c0], rax
mov ebx, 0x208
lea rdi, str.ReadWrite
lea rsi, [0x14017f448]
test rax, rax
jne 0x1400b007b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.open
lea r8, str.Cant__s_console_data_file_mapping._ErrCode0x_08X_n_s
jmp 0x1400b00bd
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rcx, rax
mov qword [rbp + 0x4c8], rax
test rax, rax
jne 0x1400b00e9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9, rsi
cmp dword [rbp + 0x4d0], r12d
cmovne r9, rdi
lea r8, str.Cant_map_console_info___s_._ErrCode0x_08X_n_s
lea rcx, [rbp + 0x4d8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], eax
mov dword [rbp + 0x5d8], eax
mov rdx, rbx
lea rcx, [rbp + 0x5dc]
call fcn.1401140d0
mov rcx, qword [rbp + 0x4c8]
test rcx, rcx
je 0x1400aff5b
lea rbx, [rcx + 0x4e]
cmp word [rbx], r12w
je 0x1400aff5b
movsx edi, word [rcx + 0x32]
movsx eax, word [rcx + 0x30]
imul edi, eax
cmp edi, dword [rcx + 0x46]
cmovae edi, dword [rcx + 0x46]
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x1400b0157
mov rax, qword [rbp - 0x68]
test rax, rax
je 0x1400b0135
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [rbp - 0x68], r12
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x1400b0140
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x70], r12
mov dword [rbp - 0x60], r12d
mov qword [rbp - 0x68], r12
or dword [rbp - 0x5c], 0xffffffff
mov dword [rbp + 0xa8], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
mov r8, rbx
mov rdx, r13
lea rcx, [rbp - 0x58]
call fcn.1401140d0
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x1400b01ac
mov rax, qword [rbp - 0x68]
test rax, rax
je 0x1400b0191
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [rbp - 0x68], r12
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x1400b019c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x70], r12
mov dword [rbp - 0x60], r12d
mov qword [rbp - 0x68], r12
or dword [rbp - 0x5c], 0xffffffff
mov dword [rbp + 0xa8], r12d
mov word [rbp + 0xac], r12w
cmp word [rbp - 0x58], r12w
jne 0x1400b01da
lea rdx, str.Internal_error._Mapping_file_name_was_not_specified.
lea rcx, [rbp + 0xac]
call fcn.14000ca24
jmp 0x1400b0292
lea eax, [rdi*4 + 0x56]
mov r13d, 0x56
test eax, eax
cmovle eax, r13d
mov dword [rbp - 0x5c], eax
mov dword [rbp - 0x60], r12d
lea r8, [rbp - 0x58]
xor edx, edx
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov qword [rbp - 0x70], rax
test rax, rax
jne 0x1400b0222
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.open
lea r8, str.Cant__s_console_data_file_mapping._ErrCode0x_08X_n_s
jmp 0x1400b0265
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbx, rax
mov qword [rbp - 0x68], rax
test rax, rax
jne 0x1400b028d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [rbp - 0x60], r12d
lea rcx, str.ReadWrite
cmovne rsi, rcx
mov r9, rsi
lea r8, str.Cant_map_console_info___s_._ErrCode0x_08X_n_s
lea rcx, [rbp - 0x58]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], eax
mov dword [rbp + 0xa8], eax
mov edx, 0x208
lea rcx, [rbp + 0xac]
call fcn.1401140d0
mov rbx, qword [rbp - 0x68]
test rbx, rbx
jne 0x1400b029e
lea rcx, str.Stored_output_data_mapping_was_not_created_
jmp 0x1400aff62
movups xmm0, xmmword [rbx + 0x30]
movups xmmword [rsp + 0x68], xmm0
mov rdx, r15
mov rcx, r14
call fcn.1400b0528
mov rsi, rax
test rax, rax
setne dil
mov byte [rsp + 0x40], dil
cmp dword [rbx + 4], 0xa7
jne 0x1400b050a
cmp dword [rbx], r13d
jbe 0x1400b050a
movsx r13d, word [rsp + 0x68]
movsx r12d, word [rsp + 0x6a]
mov edx, dword [rbx + 0x46]
mov eax, r12d
imul eax, r13d
cmp rdx, rax
cmovae edx, eax
lea rdi, [rbx + 0x52]
lea rax, [rdi + rdx*4]
mov qword [rsp + 0x58], rax
xor eax, eax
test r13d, r13d
je 0x1400b0502
test r12d, r12d
je 0x1400b0502
cmp dword [rbx + 0x4e], eax
je 0x1400b0502
mov r14d, eax
lea eax, [r13 + 1]
mov ebx, eax
lea rcx, [rax + rax]
call fcn.140113e8c
mov r15, rax
xor ecx, ecx
mov word [rax + r13*2], cx
cmp byte [rsp + 0x41], cl
jne 0x1400b0353
mov ecx, ebx
call fcn.140113e8c
mov r14, rax
xor r9d, r9d
mov byte [r13 + rax], r9b
jmp 0x1400b037e
mov eax, 0xfeff
mov word [rsp + 0x48], ax
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x44]
mov r8d, 2
lea rdx, [rsp + 0x48]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor r9d, r9d
mov ecx, r13d
mov eax, 1
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x50], r9d
test r12d, r12d
je 0x1400b04e3
mov rdx, qword [rsp + 0x58]
cmp rdi, rdx
jae 0x1400b04e3
lea rbx, [rdi + rcx*4]
lea rcx, [rbx - 4]
jmp 0x1400b03ba
cmp word [rcx], 0x20
jne 0x1400b03bf
sub rcx, 4
cmp rcx, rdi
jae 0x1400b03b0
sub rcx, rdi
sar rcx, 2
add ecx, 1
jne 0x1400b03d3
test eax, eax
jne 0x1400b04ca
test eax, eax
je 0x1400b0439
mov dword [rsp + 0x4c], r9d
mov rdx, r15
test ecx, ecx
je 0x1400b03fa
mov r8d, ecx
movzx eax, word [rdi]
mov word [rdx], ax
lea rdx, [rdx + 2]
lea rdi, [rdi + 4]
sub r8, 1
jne 0x1400b03e6
cmp byte [rsp + 0x41], r9b
je 0x1400b0458
test ecx, ecx
je 0x1400b0425
lfence
lea r8d, [rcx + rcx]
mov qword [rsp + 0x20], r9
lea r9, [rsp + 0x44]
mov rdx, r15
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor r9d, r9d
mov qword [rsp + 0x20], r9
mov r8d, 4
lea rdx, [0x1401759f4]
jmp 0x1400b04b0
test ecx, ecx
jne 0x1400b03dc
mov rax, rbx
cmp rbx, rdx
jae 0x1400b04e3
cmp word [rax], 0x20
jne 0x1400b03dc
add rax, 4
cmp rax, rdx
jmp 0x1400b0443
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x30], r9
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r14
mov r9d, ecx
mov r8, r15
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x1400b049d
lfence
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, eax
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
and qword [rsp + 0x20], 0
mov r8d, 2
lea rdx, [0x1401af748]
lea r9, [rsp + 0x44]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor r9d, r9d
mov rdx, qword [rsp + 0x58]
mov eax, dword [rsp + 0x4c]
mov rdi, rbx
mov ecx, dword [rsp + 0x50]
inc ecx
mov dword [rsp + 0x50], ecx
cmp ecx, r12d
mov ecx, r13d
jb 0x1400b039d
xor r12d, r12d
test r14, r14
je 0x1400b04f3
mov rcx, r14
call fcn.140113e18
test r15, r15
je 0x1400b0505
mov rcx, r15
call fcn.140113e18
jmp 0x1400b0505
xor r12d, r12d
mov dil, byte [rsp + 0x40]
lea rax, [rsi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400aff77
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400aff77