Function at 0x1400166b0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
push rbp
sub rsp, 0xc8
mov rsi, rcx
xor ebp, ebp
mov rbx, r9
mov byte [rsp + 0xb8], 0
xor r13d, r13d
mov r14, r8
mov r15, rdx
movzx edi, byte [rsi + 0x51]
xor r12d, r12d
inc rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, edi
mov eax, r12d
mov dword [rsp + 0x40], ebp
mov r12, r15
mov dword [rsp + 0xa0], edx
mov r15, rbx
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x98], r14
mov bl, byte [rsp + 0xb8]
jmp 0x14001673b
mov qword [rsp + 0x90], rsi
mov eax, edi
mov r13d, dword [rsp + 0x88]
mov rdi, r12
mov r12, r15
mov r15, qword [rsp + 0xa8]
xor r14d, r14d
lea rbp, [r12 + 0x40]
xor esi, esi
mov byte [rsp + 0xb8], bl
mov dword [rsp + 0xb0], eax
cmp dword [rbp], 0
jne 0x140016c45
mov eax, dword [r15 + 0x28c]
cmp eax, 1
jne 0x1400167a5
mov rax, rsp
lea rdx, [rsp + 0x84]
mov rcx, qword [r15 + 0x290]
mov r8d, 4
lea r9, [rsp + 0x7c]
mov qword [rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x7c]
test eax, eax
jl 0x140016d20
jmp 0x140016861
cmp eax, 2
je 0x1400167bc
mov rsi, qword [rsp + 0x90]
mov eax, 0xffffffff
jmp 0x140016b3c
lea rax, [rsp + 0x84]
cmp rax, qword [r15 + 0x30]
je 0x14001705c
mov dword [rsp + 0x88], r13d
lea rcx, [rsp + 0x84]
mov qword [rcx - 0x2c], rdi
mov ebx, 4
mov qword [rcx - 0x24], r12
mov r12, rcx
mov rax, qword [r15 + 0x38]
cmp rax, rbx
cmovae rax, rbx
mov edi, eax
test rdi, rdi
je 0x140016847
mov r13, qword [r15 + 0x28]
mov dword [r13], 1
mov dword [r13 + 4], edi
mov rcx, qword [r15]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [r15 + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [r13 + 8]
test eax, eax
jg 0x140016838
jl 0x140016d2d
jmp 0x140016847
mov rcx, r12
mov r8, rdi
mov rdx, qword [r15 + 0x30]
call fcn.14003f570
add r12, rdi
sub rbx, rdi
jne 0x1400167ee
mov r13d, dword [rsp + 0x88]
mov rdi, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov ebx, dword [rsp + 0x84]
test ebx, ebx
je 0x140017038
cmp ebx, dword [rsi + r12 + 0xb4]
ja 0x140016884
mov r8, qword [rsi + r12 + 0xa0]
jmp 0x1400168da
movabs rax, 0xfffff000
lea r9d, [rbx + 0xfff]
mov r8, qword [rsi + r12 + 0xa0]
and r9, rax
mov dword [rsi + r12 + 0xb4], r9d
je 0x1400168d2
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], r8
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x38]
mov r9, qword [rsp + 0x30]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov r8, rax
mov qword [rsi + r12 + 0xa0], r8
mov ecx, dword [r15 + 0x28c]
mov eax, ebx
cmp ecx, 1
jne 0x14001691b
mov rax, rsp
mov rdx, r8
mov rcx, qword [r15 + 0x290]
mov r8d, ebx
lea r9, [rsp + 0x78]
mov qword [rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x78]
mov ecx, dword [r15 + 0x28c]
jmp 0x1400169e2
cmp ecx, 2
je 0x140016932
mov rsi, qword [rsp + 0x90]
mov eax, 0xffffffff
jmp 0x140016b3c
cmp r8, qword [r15 + 0x30]
je 0x140017004
test rax, rax
je 0x1400169e0
mov qword [rsp + 0x50], r14
mov dword [rsp + 0x88], r13d
mov r13, rax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], r12
mov r12, r8
mov rdx, qword [r15 + 0x38]
cmp rdx, r13
cmovae rdx, r13
mov edi, edx
test rdi, rdi
je 0x1400169ba
mov r14, qword [r15 + 0x28]
mov dword [r14], 1
mov dword [r14 + 4], edi
mov rcx, qword [r15]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [r15 + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [r14 + 8]
test eax, eax
jg 0x1400169ab
jl 0x140016d44
jmp 0x1400169ba
mov rcx, r12
mov r8, rdi
mov rdx, qword [r15 + 0x30]
call fcn.14003f570
add r12, rdi
sub r13, rdi
jne 0x140016962
mov r14, qword [rsp + 0x50]
mov r13d, dword [rsp + 0x88]
mov rdi, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov ecx, dword [r15 + 0x28c]
mov eax, ebx
test eax, eax
jl 0x140016ff7
cmp ecx, 1
jne 0x140016a2b
mov rax, rsp
lea rdx, [rsp + 0x84]
mov rcx, qword [r15 + 0x290]
mov r8d, 4
lea r9, [rsp + 0x74]
mov qword [rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x74]
test eax, eax
jl 0x140016d67
jmp 0x140016ae7
cmp ecx, 2
je 0x140016a42
mov rsi, qword [rsp + 0x90]
mov eax, 0xffffffff
jmp 0x140016b3c
lea rax, [rsp + 0x84]
cmp rax, qword [r15 + 0x30]
je 0x140016fc6
mov dword [rsp + 0x88], r13d
lea rcx, [rsp + 0x84]
mov qword [rcx - 0x2c], rdi
mov ebx, 4
mov qword [rcx - 0x24], r12
mov r12, rcx
mov rax, qword [r15 + 0x38]
cmp rax, rbx
cmovae rax, rbx
mov edi, eax
test rdi, rdi
je 0x140016acd
mov r13, qword [r15 + 0x28]
mov dword [r13], 1
mov dword [r13 + 4], edi
mov rcx, qword [r15]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [r15 + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [r13 + 8]
test eax, eax
jg 0x140016abe
jl 0x140016d74
jmp 0x140016acd
mov rcx, r12
mov r8, rdi
mov rdx, qword [r15 + 0x30]
call fcn.14003f570
add r12, rdi
sub rbx, rdi
jne 0x140016a74
mov r13d, dword [rsp + 0x88]
mov rdi, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov ecx, dword [r15 + 0x28c]
mov eax, dword [rsp + 0x84]
mov rbx, qword [rbp + 0x18]
cmp ecx, 1
jne 0x140016b2a
mov r10, rsp
mov rdx, rbx
mov rcx, qword [r15 + 0x290]
mov r8d, eax
lea r9, [rsp + 0x70]
mov qword [r10 + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x70]
jmp 0x140016c0e
cmp ecx, 2
je 0x140016b5d
mov rsi, qword [rsp + 0x90]
mov eax, 0xffffffff
mov ebp, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebp
add rsp, 0xc8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
cmp rbx, qword [r15 + 0x30]
je 0x140016f99
mov rdx, rax
test rax, rax
je 0x140016c0e
mov qword [rsp + 0x50], r14
mov dword [rsp + 0x88], r13d
mov r13, rbx
mov qword [rsp + 0x58], rdi
mov rdi, rdx
mov qword [rsp + 0x60], r12
mov r12, rax
mov r8, qword [r15 + 0x38]
cmp r8, rdi
cmovae r8, rdi
mov ebx, r8d
test rbx, rbx
je 0x140016bec
mov r14, qword [r15 + 0x28]
mov dword [r14], 1
mov dword [r14 + 4], ebx
mov rcx, qword [r15]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [r15 + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [r14 + 8]
test eax, eax
jg 0x140016bdd
jl 0x140016d8b
jmp 0x140016bec
mov rcx, r13
mov r8, rbx
mov rdx, qword [r15 + 0x30]
call fcn.14003f570
add r13, rbx
sub rdi, rbx
jne 0x140016b93
mov r14, qword [rsp + 0x50]
mov rax, r12
mov r13d, dword [rsp + 0x88]
mov rdi, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
test eax, eax
jl 0x140016f8c
mov dword [rbp], 1
mov dword [rbp + 4], r13d
cmp dword [rsi + r12 + 0x20], 0
jne 0x140016c42
mov rcx, qword [rsi + r12 + 0x30]
mov dword [rsi + r12 + 0x20], 1
mov qword [rsi + r12 + 0x18], rbp
call qword [sym.imp.KERNEL32.dll_SetEvent]
inc r13d
inc r14
add rbp, 0xf0
add rsi, 0xf0
cmp r14, rdi
jl 0x140016753
mov bl, byte [rsp + 0xb8]
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x88], r13d
mov qword [rsp + 0xa8], r15
mov r15, r12
mov r13d, dword [rsp + 0xa0]
mov r12, rdi
mov rsi, qword [rsp + 0x90]
mov edi, eax
mov r14, qword [rsp + 0x98]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, r13d
mov rdx, r14
xor r8d, r8d
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov ebp, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r8, rbp
shl r8, 4
sub r8, rbp
shl r8, 4
cmp edi, dword [r8 + r15 + 0x44]
jne 0x140016d17
movsxd rbp, ebp
cmp rbp, r12
jge 0x140016d17
mov r9d, dword [rsp + 0x88]
mov r8, rbp
shl r8, 4
sub r8, rbp
shl r8, 4
cmp dword [r8 + r15 + 0x40], 2
je 0x140016da7
inc rbp
cmp rbp, r12
jl 0x140016ceb
nop
mov dword [rsp + 0x88], r9d
test bl, bl
jne 0x140016c9d
jmp 0x14001671b
mov rsi, qword [rsp + 0x90]
jmp 0x140016b3c
mov r13d, dword [rsp + 0x88]
mov rdi, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
jmp 0x140016798
mov r14, qword [rsp + 0x50]
mov r13d, dword [rsp + 0x88]
mov rdi, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov ecx, dword [r15 + 0x28c]
jmp 0x1400169e2
mov rsi, qword [rsp + 0x90]
jmp 0x140016b3c
mov r13d, dword [rsp + 0x88]
mov rdi, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
jmp 0x140016a1e
mov r14, qword [rsp + 0x50]
mov r13d, dword [rsp + 0x88]
mov rdi, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
jmp 0x140016c0e
cmp edi, dword [r8 + r15 + 0x44]
jne 0x140016d05
mov rax, rbp
shl rax, 4
sub rax, rbp
shl rax, 4
mov dword [r8 + r15 + 0x40], 0
mov ebp, dword [r8 + r15 + 0x4c]
mov edx, dword [r8 + r15 + 0x48]
mov rcx, qword [rax + r15 + 0x10]
test rbp, rbp
je 0x140016f5c
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x48], rax
mov byte [rsp + 0xb8], bl
mov dword [rsp + 0xb0], edi
mov rdi, rdx
mov dword [rsp + 0x88], r9d
mov qword [rsp + 0x60], r15
mov r15, rcx
mov r12, qword [rsp + 0xa8]
mov r14, rdi
mov r13, rdi
shr r14, 0x18
and r13, 0xffffff
mov rax, qword [r15 + r14*8 + 0x4b0]
mov r14, r13
neg r14
add r13, rax
add r14, 0x1000000
cmp r14, rbp
mov eax, dword [r12 + 0x28c]
cmovae r14, rbp
add rdi, r14
sub rbp, r14
cmp eax, 1
jne 0x140016e8a
mov rax, rsp
mov rdx, r13
mov rcx, qword [r12 + 0x298]
mov r8d, r14d
lea r9, [rsp + 0x80]
mov qword [rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rsp + 0x80]
jmp 0x140016f16
cmp eax, 2
je 0x140016e99
mov eax, 0xffffffff
jmp 0x140016b3c
mov rbx, r14
test r14, r14
je 0x140016f13
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x90], rsi
mov rax, qword [r12 + 0x48]
cmp rax, rbx
mov rdx, r13
cmovae rax, rbx
mov esi, eax
mov r8, rsi
mov rcx, qword [r12 + 0x40]
mov r15, qword [r12 + 0x28]
call fcn.14003f570
mov dword [r15], 2
mov dword [r15 + 4], esi
mov rcx, qword [r12]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [r12 + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [r15 + 8]
test eax, eax
jl 0x140016f7d
add r13, rsi
sub rbx, rsi
jne 0x140016eae
mov r15, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x90]
mov eax, r14d
test eax, eax
jl 0x140016b3c
test rbp, rbp
jne 0x140016e14
mov rax, qword [rsp + 0x48]
mov bl, byte [rsp + 0xb8]
mov r13d, dword [rsp + 0xa0]
mov edi, dword [rsp + 0xb0]
mov r9d, dword [rsp + 0x88]
mov r12, qword [rsp + 0x58]
mov r15, qword [rsp + 0x60]
mov r14, qword [rsp + 0x98]
inc edi
test bl, bl
je 0x140016f67
cmp edi, r9d
je 0x140016f73
mov rbp, 0xffffffffffffffff
jmp 0x140016d05
mov ebp, dword [rax + r15 + 0x28]
jmp 0x140016b3e
mov r15, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x90]
jmp 0x140016f16
mov rsi, qword [rsp + 0x90]
jmp 0x140016b3c
mov rbx, qword [r15 + 0x28]
mov dword [rbx], 1
mov dword [rbx + 4], eax
mov rcx, qword [r15]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [r15 + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rbx + 8]
jmp 0x140016c0e
mov rbx, qword [r15 + 0x28]
mov dword [rbx], 1
mov dword [rbx + 4], 4
mov rcx, qword [r15]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [r15 + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rbx + 8]
jmp 0x140016a1e
mov rsi, qword [rsp + 0x90]
jmp 0x140016b3c
mov rbx, qword [r15 + 0x28]
mov dword [rbx], 1
mov dword [rbx + 4], eax
mov rcx, qword [r15]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [r15 + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rbx + 8]
mov ecx, dword [r15 + 0x28c]
jmp 0x1400169e2
mov eax, dword [rsp + 0xb0]
cmp eax, r13d
je 0x14001704b
mov bl, 1
jmp 0x140016c6d
mov ebp, dword [rsp + 0x40]
mov rsi, qword [rsp + 0x90]
jmp 0x140016b3e
mov rbx, qword [r15 + 0x28]
mov dword [rbx], 1
mov dword [rbx + 4], 4
mov rcx, qword [r15]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [r15 + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rbx + 8]
jmp 0x140016798