Function at 0x1400017da
Capabilities:
Read file on windows
Write file on windows

Disassembly:
jmp 0x1400074d0
mov eax, 0x10d8
call fcn.140001825
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x10d0], rax
mov dword [rsp + 0x70], r8d
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x60], rcx
mov dword [rsp + 0x7c], 0
mov dword [rsp + 0x78], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov word [rsp + 0x3e], 0
mov dword [rsp + 0x38], 0
lea rcx, [rsp + 0x80]
xor edx, edx
mov r8d, 0x10
call fcn.140003148
mov word [rsp + 0x80], 5
mov byte [rsp + 0x82], 0xb
mov byte [rsp + 0x83], 3
mov dword [rsp + 0x84], 0x10
mov word [rsp + 0x88], 0x48
mov word [rsp + 0x8a], 0
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 8]
mov dword [rsp + 0x8c], eax
lea rcx, [rsp + 0x1098]
xor edx, edx
mov r8d, 0x38
call fcn.140003148
mov word [rsp + 0x1098], 0x1000
mov word [rsp + 0x109a], 0x1000
mov dword [rsp + 0x109c], 0
mov byte [rsp + 0x10a0], 1
mov word [rsp + 0x10a4], 0
mov word [rsp + 0x10a6], 1
mov dword [rsp + 0x10cc], 2
lea rdx, [rsp + 0x1098]
add rdx, 0xc
add rdx, 4
mov rcx, qword [rsp + 0x68]
mov r8d, 0x10
call fcn.14000221b
cmp eax, 0
je 0x14000762f
mov dword [rsp + 0x74], 1
jmp 0x1400078b5
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x10b8], eax
lea rdx, [rsp + 0x1098]
add rdx, 0xc
add rdx, 0x18
lea rcx, str.8a885d04_1ceb_11c9_9fe8_08002b104860
mov r8d, 0x10
call fcn.14000221b
cmp eax, 0
je 0x140007672
mov dword [rsp + 0x74], 1
jmp 0x1400078b5
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax]
lea rdx, [rsp + 0x80]
mov r8d, 0x10
lea r9, [rsp + 0x7c]
xor eax, eax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 0
jne 0x1400076b4
mov dword [rsp + 0x74], 1
jmp 0x1400078b5
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax]
lea rdx, [rsp + 0x1098]
mov r8d, 0x38
lea r9, [rsp + 0x7c]
xor eax, eax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 0
jne 0x1400076f6
mov dword [rsp + 0x74], 1
jmp 0x1400078b5
mov rax, qword [rsp + 0x60]
mov ecx, dword [rax + 8]
add ecx, 1
mov dword [rax + 8], ecx
lea rcx, [rsp + 0x90]
xor edx, edx
mov r8d, 0x1000
call fcn.140003148
lea rdx, [rsp + 0x90]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax]
mov r8d, 0x1000
lea r9, [rsp + 0x78]
xor eax, eax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 0
jne 0x14000775b
mov dword [rsp + 0x74], 1
jmp 0x1400078b5
lea rax, [rsp + 0x90]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
movzx eax, word [rax]
cmp eax, 5
je 0x140007786
mov dword [rsp + 0x74], 1
jmp 0x1400078b5
mov rax, qword [rsp + 0x58]
movzx eax, byte [rax + 2]
cmp eax, 0xc
je 0x1400077a5
mov dword [rsp + 0x74], 1
jmp 0x1400078b5
mov rax, qword [rsp + 0x58]
movzx eax, byte [rax + 3]
cmp eax, 3
je 0x1400077c4
mov dword [rsp + 0x74], 1
jmp 0x1400078b5
mov rax, qword [rsp + 0x58]
movzx eax, word [rax + 8]
cmp eax, dword [rsp + 0x78]
je 0x1400077e4
mov dword [rsp + 0x74], 1
jmp 0x1400078b5
mov rax, qword [rsp + 0x58]
add rax, 0x10
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
add rax, 8
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov ax, word [rax]
mov word [rsp + 0x3e], ax
movzx eax, word [rsp + 0x3e]
cmp eax, 0x100
jle 0x14000782a
mov dword [rsp + 0x74], 1
jmp 0x1400078b5
movzx eax, word [rsp + 0x3e]
add rax, 2
add rax, 4
sub rax, 1
shr rax, 2
shl rax, 2
movzx ecx, word [rsp + 0x3e]
add rcx, 2
sub rax, rcx
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x40]
add rax, 2
movzx ecx, word [rsp + 0x3e]
movsxd rcx, ecx
add rax, rcx
mov ecx, dword [rsp + 0x38]
add rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
cmp dword [rax], 1
je 0x14000788e
mov dword [rsp + 0x74], 1
jmp 0x1400078b5
mov rax, qword [rsp + 0x48]
movzx eax, word [rax + 4]
cmp eax, 0
je 0x1400078ad
mov dword [rsp + 0x74], 1
jmp 0x1400078b5
mov dword [rsp + 0x74], 0
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x34], eax
mov rcx, qword [rsp + 0x10d0]
xor rcx, rsp
call fcn.1400025b8
mov eax, dword [rsp + 0x34]
add rsp, 0x10d8
ret