Function at 0x14001ae90
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
push rbp
sub rsp, 0xd8
mov r13, rcx
xor ebx, ebx
mov rsi, r9
mov byte [rsp + 0xc8], 0
xor ebp, ebp
mov r14, r8
mov r12, rdx
movzx edi, byte [r13 + 0x49]
xor r15d, r15d
inc rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, edi
mov eax, r15d
mov dword [rsp + 0x50], ebx
mov dword [rsp + 0xb0], edx
mov qword [rsp + 0xa0], r13
mov qword [rsp + 0xa8], r14
mov r15b, byte [rsp + 0xc8]
jmp 0x14001af0f
mov qword [rsp + 0xa0], r13
mov eax, ebp
mov ebp, dword [rsp + 0x98]
mov rsi, qword [rsp + 0xb8]
xor r14d, r14d
lea rbx, [r12 + 0x40]
xor r13d, r13d
mov byte [rsp + 0xc8], r15b
mov dword [rsp + 0xc0], eax
cmp dword [rbx], 0
jne 0x14001b447
mov eax, dword [rsi + 0x28c]
cmp eax, 1
jne 0x14001af81
mov rax, rsp
lea rdx, [rsp + 0x94]
mov rcx, qword [rsi + 0x290]
mov r8d, 4
lea r9, [rsp + 0x8c]
mov qword [rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r10d, dword [rsp + 0x8c]
test r10d, r10d
jl 0x14001b50e
jmp 0x14001b043
cmp eax, 2
je 0x14001af9c
mov r13, qword [rsp + 0xa0]
mov r10d, 0xffffffff
mov ebx, r10d
jmp 0x14001b349
lea rax, [rsp + 0x94]
cmp rax, qword [rsi + 0x30]
je 0x14001b84f
mov dword [rsp + 0x98], ebp
lea rcx, [rsp + 0x94]
mov qword [rcx - 0x2c], rdi
mov r15d, 4
mov qword [rcx - 0x24], r12
mov rdi, rcx
mov rax, qword [rsi + 0x38]
cmp rax, r15
cmovae rax, r15
mov ebp, eax
test rbp, rbp
je 0x14001b02a
mov r12, qword [rsi + 0x28]
mov dword [r12], 1
mov dword [r12 + 4], ebp
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rsi + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r10d, dword [r12 + 8]
test r10d, r10d
jg 0x14001b01b
jl 0x14001b51b
jmp 0x14001b02a
mov rcx, rdi
mov r8, rbp
mov rdx, qword [rsi + 0x30]
call fcn.14002ef20
add rdi, rbp
sub r15, rbp
jne 0x14001afce
mov ebp, dword [rsp + 0x98]
mov rdi, qword [rsp + 0x68]
mov r12, qword [rsp + 0x70]
mov r10d, dword [rsp + 0x94]
test r10d, r10d
je 0x14001b82b
mov r15d, r10d
cmp r15, qword [r13 + r12 + 0xb0]
ja 0x14001b06b
mov r8, qword [r13 + r12 + 0xa0]
jmp 0x14001b0d5
movabs rax, 0xfffff000
lea r9d, [r10 + 0xfff]
mov r8, qword [r13 + r12 + 0xa0]
and r9, rax
mov qword [r13 + r12 + 0xb0], r9
je 0x14001b0cd
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r8
mov dword [rsp + 0x48], r10d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r10d, dword [rsp + 0x48]
mov r8, qword [rsp + 0x40]
mov r9, qword [rsp + 0x38]
mov dword [rsp + 0x48], r10d
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov r10d, dword [rsp + 0x48]
mov r8, rax
mov qword [r13 + r12 + 0xa0], r8
mov eax, dword [rsi + 0x28c]
cmp eax, 1
jne 0x14001b119
mov rax, rsp
mov rdx, r8
mov rcx, qword [rsi + 0x290]
mov r8d, r10d
lea r9, [rsp + 0x88]
mov qword [rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r10d, dword [rsp + 0x88]
mov eax, dword [rsi + 0x28c]
jmp 0x14001b1e3
cmp eax, 2
je 0x14001b134
mov r13, qword [rsp + 0xa0]
mov r10d, 0xffffffff
mov ebx, r10d
jmp 0x14001b349
cmp r8, qword [rsi + 0x30]
je 0x14001b7ec
test r15, r15
je 0x14001b1e3
mov qword [rsp + 0x60], r14
mov dword [rsp + 0x98], ebp
mov qword [rsp + 0x68], rdi
mov edi, r10d
mov qword [rsp + 0x70], r12
mov r12, r8
mov rax, qword [rsi + 0x38]
cmp rax, r15
cmovae rax, r15
mov ebp, eax
test rbp, rbp
je 0x14001b1bc
mov r14, qword [rsi + 0x28]
mov dword [r14], 1
mov dword [r14 + 4], ebp
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rsi + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r10d, dword [r14 + 8]
test r10d, r10d
jg 0x14001b1ad
jl 0x14001b531
jmp 0x14001b1bc
mov rcx, r12
mov r8, rbp
mov rdx, qword [rsi + 0x30]
call fcn.14002ef20
add r12, rbp
sub r15, rbp
jne 0x14001b163
mov r14, qword [rsp + 0x60]
mov r10d, edi
mov ebp, dword [rsp + 0x98]
mov rdi, qword [rsp + 0x68]
mov r12, qword [rsp + 0x70]
mov eax, dword [rsi + 0x28c]
test r10d, r10d
jl 0x14001b7df
cmp eax, 1
jne 0x14001b233
mov rax, rsp
lea rdx, [rsp + 0x94]
mov rcx, qword [rsi + 0x290]
mov r8d, 4
lea r9, [rsp + 0x84]
mov qword [rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x84]
test eax, eax
jl 0x14001b552
jmp 0x14001b2f0
cmp eax, 2
je 0x14001b24a
mov r13, qword [rsp + 0xa0]
mov eax, 0xffffffff
jmp 0x14001b347
lea rax, [rsp + 0x94]
cmp rax, qword [rsi + 0x30]
je 0x14001b7ab
mov dword [rsp + 0x98], ebp
lea rcx, [rsp + 0x94]
mov qword [rcx - 0x2c], rdi
mov r15d, 4
mov qword [rcx - 0x24], r12
mov rdi, rcx
mov rax, qword [rsi + 0x38]
cmp rax, r15
cmovae rax, r15
mov ebp, eax
test rbp, rbp
je 0x14001b2d7
mov r12, qword [rsi + 0x28]
mov dword [r12], 1
mov dword [r12 + 4], ebp
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rsi + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [r12 + 8]
test eax, eax
jg 0x14001b2c8
jl 0x14001b55f
jmp 0x14001b2d7
mov rcx, rdi
mov r8, rbp
mov rdx, qword [rsi + 0x30]
call fcn.14002ef20
add rdi, rbp
sub r15, rbp
jne 0x14001b27c
mov ebp, dword [rsp + 0x98]
mov rdi, qword [rsp + 0x68]
mov r12, qword [rsp + 0x70]
mov ecx, dword [rsi + 0x28c]
mov eax, dword [rsp + 0x94]
mov rdx, qword [rbx + 0x18]
cmp ecx, 1
jne 0x14001b335
mov r10, rsp
mov r8d, eax
mov rcx, qword [rsi + 0x290]
lea r9, [rsp + 0x80]
mov qword [r10 + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x80]
jmp 0x14001b413
cmp ecx, 2
je 0x14001b368
mov r13, qword [rsp + 0xa0]
mov eax, 0xffffffff
mov ebx, eax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebx
add rsp, 0xd8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
cmp rdx, qword [rsi + 0x30]
je 0x14001b77b
mov r15, rax
test rax, rax
je 0x14001b413
mov qword [rsp + 0x60], r14
mov dword [rsp + 0x98], ebp
mov qword [rsp + 0x68], rdi
mov rdi, rax
mov qword [rsp + 0x70], r12
mov r12, rdx
mov rbp, qword [rsi + 0x38]
cmp rbp, r15
cmovae rbp, r15
mov ebp, ebp
test rbp, rbp
je 0x14001b3f2
mov r14, qword [rsi + 0x28]
mov dword [r14], 1
mov dword [r14 + 4], ebp
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rsi + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [r14 + 8]
test eax, eax
jg 0x14001b3e3
jl 0x14001b575
jmp 0x14001b3f2
mov rcx, r12
mov r8, rbp
mov rdx, qword [rsi + 0x30]
call fcn.14002ef20
add r12, rbp
sub r15, rbp
jne 0x14001b39a
mov r14, qword [rsp + 0x60]
mov rax, rdi
mov ebp, dword [rsp + 0x98]
mov rdi, qword [rsp + 0x68]
mov r12, qword [rsp + 0x70]
test eax, eax
jl 0x14001b76e
mov dword [rbx], 1
mov dword [rbx + 4], ebp
cmp dword [r13 + r12 + 0x20], 0
jne 0x14001b445
mov rcx, qword [r13 + r12 + 0x30]
mov dword [r13 + r12 + 0x20], 1
mov qword [r13 + r12 + 0x18], rbx
call qword [sym.imp.KERNEL32.dll_SetEvent]
inc ebp
inc r14
add rbx, 0xc0
add r13, 0xc0
cmp r14, rdi
jl 0x14001af29
mov r15b, byte [rsp + 0xc8]
mov eax, dword [rsp + 0xc0]
mov qword [rsp + 0xb8], rsi
mov dword [rsp + 0x98], ebp
mov ebp, eax
mov esi, dword [rsp + 0xb0]
mov r13, qword [rsp + 0xa0]
mov r14, qword [rsp + 0xa8]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, esi
mov rdx, r14
xor r8d, r8d
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov ebx, eax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea r8, [rbx + rbx*2]
shl r8, 6
cmp ebp, dword [r8 + r12 + 0x44]
jne 0x14001b504
movsxd rbx, ebx
cmp rbx, rdi
jge 0x14001b504
mov r9d, dword [rsp + 0x98]
lea r8, [rbx + rbx*2]
shl r8, 6
cmp dword [r8 + r12 + 0x40], 2
je 0x14001b590
inc rbx
cmp rbx, rdi
jl 0x14001b4df
nop
mov dword [rsp + 0x98], r9d
test r15b, r15b
jne 0x14001b498
jmp 0x14001aef6
mov r13, qword [rsp + 0xa0]
jmp 0x14001af94
mov ebp, dword [rsp + 0x98]
mov rdi, qword [rsp + 0x68]
mov r12, qword [rsp + 0x70]
jmp 0x14001af73
mov r14, qword [rsp + 0x60]
mov ebp, dword [rsp + 0x98]
mov rdi, qword [rsp + 0x68]
mov r12, qword [rsp + 0x70]
mov eax, dword [rsi + 0x28c]
jmp 0x14001b1e3
mov r13, qword [rsp + 0xa0]
jmp 0x14001b347
mov ebp, dword [rsp + 0x98]
mov rdi, qword [rsp + 0x68]
mov r12, qword [rsp + 0x70]
jmp 0x14001b226
mov r14, qword [rsp + 0x60]
mov ebp, dword [rsp + 0x98]
mov rdi, qword [rsp + 0x68]
mov r12, qword [rsp + 0x70]
jmp 0x14001b413
cmp ebp, dword [r8 + r12 + 0x44]
jne 0x14001b4f3
mov dword [r8 + r12 + 0x40], 0
lea rax, [rbx + rbx*2]
shl rax, 6
mov ebx, dword [r8 + r12 + 0x4c]
mov edx, dword [r8 + r12 + 0x48]
mov rcx, qword [rax + r12 + 0x10]
test rbx, rbx
je 0x14001b73d
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x58], rax
mov byte [rsp + 0xc8], r15b
mov r15, rcx
mov dword [rsp + 0xc0], ebp
mov rbp, rdx
mov dword [rsp + 0x98], r9d
mov qword [rsp + 0x70], r12
mov rdi, qword [rsp + 0xb8]
mov r14, rbp
mov r12, rbp
shr r14, 0x18
and r12, 0xffffff
mov rax, qword [r15 + r14*8 + 0x4a8]
mov r14, r12
neg r14
add r12, rax
add r14, 0x1000000
cmp r14, rbx
mov eax, dword [rdi + 0x28c]
cmovae r14, rbx
add rbp, r14
sub rbx, r14
cmp eax, 1
jne 0x14001b66b
mov rax, rsp
mov rdx, r12
mov rcx, qword [rdi + 0x298]
mov r8d, r14d
lea r9, [rsp + 0x90]
mov qword [rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rsp + 0x90]
jmp 0x14001b6f7
cmp eax, 2
je 0x14001b67a
mov eax, 0xffffffff
jmp 0x14001b347
mov rsi, r14
test r14, r14
je 0x14001b6f4
mov qword [rsp + 0x78], r15
mov qword [rsp + 0xa0], r13
mov rax, qword [rdi + 0x48]
cmp rax, rsi
mov rdx, r12
cmovae rax, rsi
mov r13d, eax
mov r8, r13
mov rcx, qword [rdi + 0x40]
mov r15, qword [rdi + 0x28]
call fcn.14002ef20
mov dword [r15], 2
mov dword [r15 + 4], r13d
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rdi + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [r15 + 8]
test eax, eax
jl 0x14001b75f
add r12, r13
sub rsi, r13
jne 0x14001b68f
mov r15, qword [rsp + 0x78]
mov r13, qword [rsp + 0xa0]
mov eax, r14d
test eax, eax
jl 0x14001b347
test rbx, rbx
jne 0x14001b5f8
mov rax, qword [rsp + 0x58]
mov r15b, byte [rsp + 0xc8]
mov esi, dword [rsp + 0xb0]
mov ebp, dword [rsp + 0xc0]
mov r9d, dword [rsp + 0x98]
mov rdi, qword [rsp + 0x68]
mov r12, qword [rsp + 0x70]
mov r14, qword [rsp + 0xa8]
inc ebp
test r15b, r15b
je 0x14001b749
cmp ebp, r9d
je 0x14001b755
mov rbx, 0xffffffffffffffff
jmp 0x14001b4f3
mov ebx, dword [rax + r12 + 0x28]
jmp 0x14001b349
mov r15, qword [rsp + 0x78]
mov r13, qword [rsp + 0xa0]
jmp 0x14001b6f7
mov r13, qword [rsp + 0xa0]
jmp 0x14001b347
mov r15, qword [rsi + 0x28]
mov dword [r15], 1
mov dword [r15 + 4], eax
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rsi + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [r15 + 8]
jmp 0x14001b413
mov r15, qword [rsi + 0x28]
mov dword [r15], 1
mov dword [r15 + 4], 4
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rsi + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [r15 + 8]
jmp 0x14001b226
mov r13, qword [rsp + 0xa0]
jmp 0x14001b12c
mov rax, qword [rsi + 0x28]
mov qword [rsp + 0x30], rax
mov dword [rax], 1
mov dword [rax + 4], r15d
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rsi + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rax, qword [rsp + 0x30]
mov r10d, dword [rax + 8]
mov eax, dword [rsi + 0x28c]
jmp 0x14001b1e3
mov eax, dword [rsp + 0xc0]
cmp eax, ebp
je 0x14001b83e
mov r15b, 1
jmp 0x14001b470
mov ebx, dword [rsp + 0x50]
mov r13, qword [rsp + 0xa0]
jmp 0x14001b349
mov r15, qword [rsi + 0x28]
mov dword [r15], 1
mov dword [r15 + 4], 4
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rsi + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r10d, dword [r15 + 8]
jmp 0x14001af73