Function at 0x1400197c0
Capabilities:
Create thread
Read file on windows

Disassembly:
push r12
push r13
push r14
push r15
push rbp
sub rsp, 0xeb0
mov r13, rcx
mov rdx, r13
lea rcx, [rsp + 0xc60]
call fcn.14001a1c0
xor r14d, r14d
cmp byte [rsp + 0xc78], 0
seta r14b
test r14d, r14d
je 0x140019986
mov rcx, r13
lea rdx, [0x14000878c]
lea r8, [0x14000879c]
call fcn.14001a3d0
mov r15d, eax
mov rcx, r13
lea rdx, [0x1400087a0]
mov r8d, 0x2000000
lea r9, [0x14000879c]
call fcn.14002c4d0
mov r12, rax
mov ebp, dword [r13 + 0x28c]
cmp ebp, 1
jne 0x14001987d
mov rbp, rsp
lea rdx, [rsp + 0xdd4]
mov rcx, qword [r13 + 0x290]
mov r8d, 2
lea r9, [rsp + 0xdd0]
mov qword [rbp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0xdd0]
test eax, eax
jl 0x140019887
jmp 0x140019940
cmp ebp, 2
je 0x140019898
mov eax, 0xffffffff
add rsp, 0xeb0
pop rbp
pop r15
pop r14
pop r13
pop r12
ret
lea rcx, [rsp + 0xdd4]
cmp rcx, qword [r13 + 0x30]
je 0x14001a187
mov qword [rsp + 0xdb0], rbx
mov ebp, 2
mov qword [rsp + 0xdb8], rsi
mov rsi, rcx
mov qword [rsp + 0xdc0], rdi
mov rbx, qword [r13 + 0x38]
cmp rbx, rbp
cmovae rbx, rbp
mov ebx, ebx
test rbx, rbx
je 0x140019920
mov rdi, qword [r13 + 0x28]
mov dword [rdi], 1
mov dword [rdi + 4], ebx
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [r13 + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rdi + 8]
test eax, eax
jg 0x140019911
jl 0x14001a0a9
jmp 0x140019920
mov rcx, rsi
mov r8, rbx
mov rdx, qword [r13 + 0x30]
call fcn.14002ef20
add rsi, rbx
sub rbp, rbx
jne 0x1400198ca
mov rbx, qword [rsp + 0xdb0]
mov rsi, qword [rsp + 0xdb8]
mov rdi, qword [rsp + 0xdc0]
movzx ebp, word [rsp + 0xdd4]
lea rcx, [rsp + 0xc60]
shl ebp, 0x10
call fcn.14001a700
mov r8d, eax
xor edx, edx
add r8, rbp
mov rax, r12
div r8
cmp eax, r15d
cmovb r15d, eax
mov r10d, 1
cmp r15d, 1
cmova r10d, r15d
dec r10d
mov byte [rsp + 0xc79], r10b
mov dword [rsp + 0xc58], 0
lea rcx, [rsp + 0xc30]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov r8d, dword [rsp + 0xc7c]
xor eax, eax
shl r8d, 0x15
xor r12d, r12d
movzx r15d, byte [rsp + 0xc79]
add r8d, 0x200000
inc r15
mov dword [rsp + 0xe88], r8d
mov qword [rsp + 0xe80], r15
mov dword [rsp + 0xe90], r14d
mov qword [rsp + 0xdb0], rbx
lea rbx, [rsp + 0xc30]
mov qword [rsp + 0xdb8], rsi
xor esi, esi
mov qword [rsp + 0xdc0], rdi
mov rdi, rax
cmp dword [rsp + 0xe90], 0
jne 0x140019c53
mov ebp, dword [r13 + 0x28c]
cmp ebp, 1
jne 0x140019a5c
mov rbp, rsp
lea rdx, [rsp + 0xe58]
mov rcx, qword [r13 + 0x290]
mov r8d, 6
lea r9, [rsp + 0xdcc]
mov qword [rbp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0xdcc]
test eax, eax
jl 0x14001a0c6
jmp 0x140019b0f
cmp ebp, 2
je 0x140019a8f
mov rbx, qword [rsp + 0xdb0]
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xdb8]
mov rdi, qword [rsp + 0xdc0]
add rsp, 0xeb0
pop rbp
pop r15
pop r14
pop r13
pop r12
ret
lea r14, [rsp + 0xe58]
cmp r14, qword [r13 + 0x30]
je 0x14001a154
mov ebp, 6
mov rbx, qword [r13 + 0x38]
cmp rbx, rbp
cmovae rbx, rbp
mov ebx, ebx
test rbx, rbx
je 0x140019aff
mov r15, qword [r13 + 0x28]
mov dword [r15], 1
mov dword [r15 + 4], ebx
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [r13 + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [r15 + 8]
test eax, eax
jg 0x140019af0
jl 0x14001a0e3
jmp 0x140019aff
mov rcx, r14
mov r8, rbx
mov rdx, qword [r13 + 0x30]
call fcn.14002ef20
add r14, rbx
sub rbp, rbx
jne 0x140019aa6
lea rbx, [rsp + 0xc30]
movzx ebp, word [rsp + 0xe58]
mov r15d, dword [rsp + 0xe5a]
shl ebp, 0x10
test r15, r15
jne 0x140019b2c
mov rax, rsi
jmp 0x140019b40
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, r15
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r10d, dword [r13 + 0x28c]
mov qword [rsp + r12 + 0xd0], rax
cmp r10d, 1
jne 0x140019b87
mov r10, rsp
mov rdx, rax
mov rcx, qword [r13 + 0x290]
mov r8d, r15d
lea r9, [rsp + 0xdc8]
mov qword [r10 + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0xdc8]
jmp 0x140019c49
cmp r10d, 2
je 0x140019bbb
mov rbx, qword [rsp + 0xdb0]
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xdb8]
mov rdi, qword [rsp + 0xdc0]
add rsp, 0xeb0
pop rbp
pop r15
pop r14
pop r13
pop r12
ret
cmp rax, qword [r13 + 0x30]
je 0x14001a123
mov r14, r15
test r15, r15
je 0x140019c46
mov dword [rsp + 0xe60], ebp
mov rbp, rax
mov rbx, qword [r13 + 0x38]
cmp rbx, r14
cmovae rbx, r14
mov ebx, ebx
test rbx, rbx
je 0x140019c2d
mov rsi, qword [r13 + 0x28]
mov dword [rsi], 1
mov dword [rsi + 4], ebx
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [r13 + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsi + 8]
test eax, eax
jg 0x140019c1e
jl 0x14001a0f0
jmp 0x140019c2d
mov rcx, rbp
mov r8, rbx
mov rdx, qword [r13 + 0x30]
call fcn.14002ef20
add rbp, rbx
sub r14, rbx
jne 0x140019bd7
mov ebp, dword [rsp + 0xe60]
xor esi, esi
lea rbx, [rsp + 0xc30]
mov eax, r15d
test eax, eax
jl 0x14001a106
jmp 0x140019c7e
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + r12 + 0xd0], rax
mov qword [rsp + r12 + 0xe0], 0x1000
xor ecx, ecx
xor edx, edx
mov r10, qword [rsp + 0xe80]
xor r8d, r8d
xor r9d, r9d
mov r14d, edi
mov qword [rsp + r12 + 0x30], rbx
mov dword [rsp + r12 + 0x38], r14d
mov dword [rsp + r12 + 0x3c], r10d
mov dword [rsp + r12 + 0x58], 0
call qword [sym.imp.KERNEL32.dll_CreateEventA]
xor ecx, ecx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
mov qword [rsp + r12 + 0x60], rax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rsp + rdi*8 + 0xdd8], rax
xor r10b, r10b
mov qword [rsp + r12 + 0x68], rax
lea r8, [rsp + r12 + 0x70]
mov r9d, ebp
lea rcx, [rsp + r12 + 0x74]
mov qword [rcx - 0x2c], 0
lea rdx, [rsp + r12 + 0x80]
mov dword [rdx - 0x30], 0
lea rax, [rsp + r12 + 0x90]
mov dword [rax - 0x3c], r14d
lea r11, [rsp + r12 + 0x88]
mov qword [rsp + 0xe98], r11
lea r14, [rsp + r12 + 0x98]
mov qword [rsp + 0xe78], r12
mov r15, rsi
mov qword [rsp + 0xe70], rdi
mov rbx, rax
mov dword [rsp + 0xe60], ebp
mov r12, rcx
mov qword [rsp + 0xe68], r13
mov r13, rdx
mov rdi, r8
mov rsi, r9
mov bpl, r10b
mov r11d, dword [rsp + 0xe88]
mov rcx, rsi
lea r8, [0x1400086d8]
lea rdx, [rsp + 0xc30]
mov dword [r15 + rdi], 0
mov dword [r15 + r12], 0xffffffff
mov dword [r15 + r13], r11d
mov qword [r15 + rbx], 0
mov qword [r15 + r14], rsi
call fcn.14002ba80
mov r11, qword [rsp + 0xe98]
cmp dword [rsp + 0xe90], 0
mov qword [r15 + r11], rax
jne 0x140019db4
inc bpl
add r15, 0x30
cmp bpl, 2
jl 0x140019d52
mov r12, qword [rsp + 0xe78]
xor esi, esi
mov rdi, qword [rsp + 0xe70]
lea rbx, [rsp + 0xc30]
mov ebp, dword [rbx + 0x230]
mov r13, qword [rbx + 0x238]
mov r11, rsp
xor ecx, ecx
xor edx, edx
lea r9, [rsp + r12 + 0x30]
lea r8, [0x14001b890]
lea r10, [rsp + 0xea0]
mov dword [r11 + 0x20], 0
mov qword [r11 + 0x28], r10
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
mov edx, 0xffffffff
mov qword [rsp + r12 + 0xe8], rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
inc rdi
add r12, 0xc0
cmp rdi, qword [rsp + 0xe80]
jl 0x140019a00
mov r15, qword [rsp + 0xe80]
mov r14d, dword [rsp + 0xe90]
mov rbx, qword [rsp + 0xdb0]
mov rsi, qword [rsp + 0xdb8]
mov rdi, qword [rsp + 0xdc0]
test r14d, r14d
jne 0x140019e82
mov r9, r13
lea rcx, [rsp + 0xc30]
lea rdx, [rsp + 0x30]
lea r8, [rsp + 0xdd8]
call fcn.14001a770
jmp 0x140019e9f
mov r9, r13
lea rcx, [rsp + 0xc30]
lea rdx, [rsp + 0x30]
lea r8, [rsp + 0xdd8]
call fcn.14001ae90
mov r13d, eax
xor ebp, ebp
xor r12d, r12d
mov qword [rsp + 0xdb0], rbx
lea rbx, [rsp + 0xc30]
mov qword [rsp + 0xdb8], rsi
xor esi, esi
mov qword [rsp + 0xdc0], rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [rsp + r12 + 0x50]
cmp edx, 1
jne 0x140019f0e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsp + rbp*8 + 0xdd8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [rsp + r12 + 0x50], 1
je 0x140019edc
mov edx, dword [rsp + r12 + 0x50]
cmp edx, 2
je 0x140019f54
mov rcx, rbx
mov dword [rsp + r12 + 0x50], 2
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsp + r12 + 0x60]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rsp + rbp*8 + 0xdd8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [rsp + r12 + 0x50], 2
jne 0x140019f13
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsp + r12 + 0x60]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rsp + rbp*8 + 0xdd8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [rsp + r12 + 0x58]
test edx, edx
mov rdi, qword [rsp + r12 + 0xd0]
cmovl r13d, edx
test rdi, rdi
je 0x140019fa7
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + r12 + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + r12 + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8b, r8b
lea rcx, [rsp + r12 + 0x90]
mov qword [rsp + 0xe68], r12
lea rdx, [rsp + r12 + 0x98]
mov dword [rsp + 0xe60], r13d
lea rax, [rsp + r12 + 0x88]
mov qword [rsp + 0xe80], r15
mov rdi, rsi
mov rbx, rax
mov r15, rdx
mov r13, rcx
mov r12b, r8b
mov qword [rdi + r13], rsi
mov qword [rdi + r15], rsi
mov rcx, qword [rdi + rbx]
test rcx, rcx
je 0x14001a01e
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test r14d, r14d
jne 0x14001a030
inc r12b
add rdi, 0x30
cmp r12b, 2
jl 0x140019fff
mov r12, qword [rsp + 0xe68]
lea rbx, [rsp + 0xc30]
mov r13d, dword [rbx + 0x230]
mov r15, qword [rbx + 0x250]
mov rcx, qword [rsp + r12 + 0xe8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc rbp
add r12, 0xc0
cmp rbp, r15
jl 0x140019ec9
mov rbx, qword [rsp + 0xdb0]
mov rsi, qword [rsp + 0xdb8]
mov rdi, qword [rsp + 0xdc0]
lea rcx, [rsp + 0xc30]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, r13d
add rsp, 0xeb0
pop rbp
pop r15
pop r14
pop r13
pop r12
ret
mov rbx, qword [rsp + 0xdb0]
mov rsi, qword [rsp + 0xdb8]
mov rdi, qword [rsp + 0xdc0]
jmp 0x140019874
mov rbx, qword [rsp + 0xdb0]
mov rsi, qword [rsp + 0xdb8]
mov rdi, qword [rsp + 0xdc0]
jmp 0x140019a7e
lea rbx, [rsp + 0xc30]
jmp 0x140019a4f
mov ebp, dword [rsp + 0xe60]
xor esi, esi
lea rbx, [rsp + 0xc30]
jmp 0x140019c49
mov rbx, qword [rsp + 0xdb0]
mov rsi, qword [rsp + 0xdb8]
mov rdi, qword [rsp + 0xdc0]
jmp 0x140019baa
mov r14, qword [r13 + 0x28]
mov dword [r14], 1
mov dword [r14 + 4], r15d
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [r13 + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [r14 + 8]
jmp 0x140019c49
mov rbp, qword [r13 + 0x28]
mov dword [rbp], 1
mov dword [rbp + 4], 6
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [r13 + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rbp + 8]
jmp 0x140019a4f
mov rbp, qword [r13 + 0x28]
mov dword [rbp], 1
mov dword [rbp + 4], 2
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [r13 + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rbp + 8]
jmp 0x140019874