Function at 0x13728
Capabilities:
Parse pe header
Read file on windows
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x320
mov rax, qword [0x0001c100]
xor rax, rsp
mov qword [rsp + 0x310], rax
mov ebx, edx
mov rdi, rcx
xor r15d, r15d
mov dword [r11 - 0x2b0], r15d
xor eax, eax
mov dword [rsp + 0x9c], eax
mov qword [r11 - 0x2a8], rax
mov dword [r11 - 0x280], r15d
xor edx, edx
lea r8d, [r15 + 0x28]
lea rcx, [r11 - 0x278]
call fcn.0001a360
mov r12, r15
mov qword [rsp + 0x88], r15
mov rsi, r15
mov r14, r15
mov qword [rsp + 0xb0], r15
mov r13, r15
mov qword [rsp + 0xa8], r15
mov dword [rsp + 0xb8], r15d
xor eax, eax
mov dword [rsp + 0xbc], eax
mov edx, 0xc0000001
mov dword [0x0001ce3c], edx
mov qword [rsp + 0x100], rdi
lea eax, [rbx - 2]
mov word [rsp + 0xf8], ax
mov word [rsp + 0xfa], bx
lea ecx, [r15 + 0x30]
mov dword [rsp + 0xc8], ecx
lea rax, [rsp + 0xf8]
mov qword [rsp + 0xd8], rax
lea eax, [rcx + 0x10]
mov dword [rsp + 0xe0], eax
mov dword [rsp + 0xc8], ecx
mov qword [rsp + 0xd0], r15
mov dword [rsp + 0xe0], eax
lea rax, [rsp + 0xf8]
mov qword [rsp + 0xd8], rax
mov qword [rsp + 0xe8], r15
mov qword [rsp + 0xf0], r15
cmp qword [0x0001c878], r15
je 0x13ac9
mov rcx, rdi
call fcn.00013168
mov rsi, rax
mov qword [rsp + 0x108], rax
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x68], 0x800
mov qword [rsp + 0x60], r15
mov dword [rsp + 0x58], r15d
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x48], r15
lea edi, [r15 + 0x60]
mov dword [rsp + 0x40], edi
lea ebx, [rdi - 0x5f]
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x98]
lea r8, [rsp + 0xc8]
mov edx, 0x40100003
lea rcx, [rsp + 0x90]
call qword [0x0001c878]
mov edx, eax
mov dword [0x0001ce3c], eax
cmp eax, r15d
je 0x1396c
lea rcx, [rsp + 0xb0]
call fcn.00013000
lea rdx, [rsp + 0xa8]
mov rcx, rsi
call fcn.00012eb8
mov qword [rsp + 0x70], rsi
mov dword [rsp + 0x68], 0x800
mov qword [rsp + 0x60], r15
mov dword [rsp + 0x58], r15d
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x98]
lea r8, [rsp + 0xc8]
mov edx, 0x40100003
lea rcx, [rsp + 0x90]
call qword [0x0001c878]
mov edx, eax
mov dword [0x0001ce3c], eax
mov r14, qword [rsp + 0xb0]
mov r13, qword [rsp + 0xa8]
cmp edx, 0xc0000043
jne 0x13ad1
mov qword [rsp + 0x70], rsi
mov dword [rsp + 0x68], 0x800
mov qword [rsp + 0x60], r15
mov dword [rsp + 0x58], r15d
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x98]
lea r8, [rsp + 0xc8]
mov edx, 0x100001
lea rcx, [rsp + 0xc0]
call qword [0x0001c878]
mov edx, eax
mov dword [0x0001ce3c], eax
cmp eax, r15d
jne 0x13ad1
mov qword [rsp + 0x28], r15
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
cmp eax, r15d
jne 0x13ab3
mov rcx, qword [rsp + 0x88]
mov al, byte [rcx + 0x4b]
mov byte [rsp + 0x80], al
mov rax, qword [rcx + 0x28]
mov r12, qword [rax + 0x10]
mov qword [rax + 0x10], r15
mov rax, qword [rsp + 0x88]
mov byte [rax + 0x4b], bl
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov qword [rsp + 0x70], rsi
mov dword [rsp + 0x68], 0x800
mov qword [rsp + 0x60], r15
mov dword [rsp + 0x58], r15d
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x98]
lea r8, [rsp + 0xc8]
mov edx, 0x40100003
lea rcx, [rsp + 0x90]
call qword [0x0001c878]
mov dword [0x0001ce3c], eax
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov edx, dword [0x0001ce3c]
jmp 0x13ad1
mov edi, 0x60
lea ebx, [rdi - 0x5f]
cmp edx, r15d
je 0x13b09
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ebx
lea r9, [rsp + 0x98]
lea r8, [rsp + 0xc8]
mov edx, 0x100003
lea rcx, [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_ZwOpenFile]
mov edx, eax
mov dword [0x0001ce3c], eax
cmp edx, r15d
jne 0x13d45
xor eax, eax
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x38], rax
mov ebx, 0x200
mov dword [rsp + 0x30], ebx
lea rax, [rsp + 0x110]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov r11d, eax
mov dword [0x0001ce3c], eax
cmp eax, r15d
jne 0x13ca0
cmp qword [rsp + 0xa0], rbx
jne 0x13ca0
cmp word [rsp + 0x110], 0x5a4d
jne 0x13bb9
movsxd rdx, dword [rsp + 0x14c]
lea ecx, [rdx + 0xa]
cmp ecx, ebx
jae 0x13bc0
cmp dword [rsp + rdx + 0x110], 0x4550
jne 0x13bc0
jmp 0x13beb
mov edx, dword [rsp + 0x14c]
cmp word [rsp + 0x110], 0x7a6d
jne 0x13be8
lea eax, [rdx + 0xa]
cmp eax, ebx
jae 0x13be8
movsxd rax, edx
cmp dword [rsp + rax + 0x110], 0x6570
jne 0x13be8
or edx, 0xffffffff
jmp 0x13beb
mov edx, r15d
movsxd rbx, edx
cmp rbx, r15
jbe 0x13c91
mov edi, 2
mov r8, rdi
lea rdx, [0x0001aa80]
lea rcx, [rsp + 0x110]
call qword [sym.imp.ntoskrnl.exe_strncpy]
lea rcx, [rsp + rbx + 0x110]
mov r8, rdi
lea rdx, [0x0001aa90]
call qword [sym.imp.ntoskrnl.exe_strncpy]
xor r11d, r11d
mov qword [rsp + 0x98], r11
mov qword [rsp + 0xa0], r11
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x200
lea rax, [rsp + 0x110]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_ZwWriteFile]
mov dword [0x0001ce3c], eax
jmp 0x13ca0
cmp rbx, 0xffffffffffffffff
cmove r11d, r15d
mov dword [0x0001ce3c], r11d
cmp r12, r15
je 0x13d02
mov qword [rsp + 0x28], r15
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
cmp eax, r15d
jne 0x13d02
mov rax, qword [rsp + 0x88]
mov rcx, qword [rax + 0x28]
mov qword [rcx + 0x10], r12
mov rcx, qword [rsp + 0x88]
mov al, byte [rsp + 0x80]
mov byte [rcx + 0x4b], al
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
cmp r14, r15
je 0x13d22
lea rcx, [rsp + 0xb0]
call fcn.00013000
cmp r13, r15
je 0x13d3f
lea rdx, [rsp + 0xa8]
mov rcx, rsi
call fcn.00012eb8
mov edx, dword [0x0001ce3c]
jmp 0x13d45
mov edx, dword [0x0001ce3c]
jmp 0x13d4d
mov eax, edx
mov rcx, qword [rsp + 0x310]
xor rcx, rsp
call fcn.0001a300
lea r11, [rsp + 0x320]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret