Function at 0x1400010c0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x30
xor ebp, ebp
mov rbx, rcx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rbp
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov rcx, rax
lea edx, [rbp + 0x2e]
mov r14, rax
call qword [sym.imp.VCRUNTIME140.dll_strrchr]
mov rdx, rax
test rax, rax
je 0x1400012f9
mov ecx, ebp
lea r8, str..plist
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x1400012f9
cmp rcx, 7
jne 0x140001102
mov eax, dword [str..crash]
mov dword [rdx], eax
movzx eax, word [0x140004428]
mov word [rdx + 4], ax
movzx eax, byte [0x14000442a]
mov byte [rdx + 6], al
test rbx, rbx
je 0x1400012d0
mov qword [rsp + 0x50], rsi
lea rdx, [0x1400043b0]
mov rcx, rbx
mov rsi, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rbx, rax
test rax, rax
je 0x1400012cb
xor edx, edx
mov qword [rsp + 0x20], r15
mov rcx, rax
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov rcx, rbx
movsxd r15, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_rewind]
test r15, r15
jne 0x1400011a0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x1400012c6
lea rcx, [r15 + 1]
mov qword [rsp + 0x28], rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r9, rbx
mov r8, r15
mov rcx, rax
mov edx, 1
mov rdi, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, r15
je 0x1400011d6
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x1400011df
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rsi, r15
test rdi, rdi
je 0x1400012c1
cmp rsi, 8
jbe 0x14000120f
movabs rax, 0x30307473696c7062
cmp qword [rdi], rax
jne 0x14000120f
lea r8, [rsp + 0x58]
mov edx, esi
mov rcx, rdi
call qword [sym.imp.plist.dll_plist_from_bin]
jmp 0x14000121f
lea r8, [rsp + 0x58]
mov edx, esi
mov rcx, rdi
call qword [sym.imp.plist.dll_plist_from_xml]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x58]
lea rdx, str.description
call qword [sym.imp.plist.dll_plist_dict_get_item]
mov rbx, rax
test rax, rax
je 0x1400012c1
mov rcx, rax
call qword [sym.imp.plist.dll_plist_get_node_type]
cmp eax, 3
jne 0x1400012c1
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.plist.dll_plist_get_string_val]
mov rdi, qword [rsp + 0x60]
test rdi, rdi
je 0x1400012c1
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rdi + rbx], bpl
jne 0x140001273
lea rdx, [0x1400043b4]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rsi, rax
test rax, rax
je 0x1400012b1
mov r9, rax
mov r8, rbx
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ebp, 1
mov rdi, qword [rsp + 0x28]
mov r15, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400012e0
call qword [sym.imp.plist.dll_plist_free]
test r14, r14
je 0x1400012ee
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, ebp
add rsp, 0x30
pop r14
pop rbp
pop rbx
ret
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
add rsp, 0x30
pop r14
pop rbp
pop rbx
ret