Function at 0x140006894
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x108]
sub rsp, 0x1c8
xor r12d, r12d
mov r15d, 0xc0000001
mov rax, r8
mov rdi, rcx
mov ebx, r15d
mov esi, r12d
cmp rcx, 0xffffffffffffffff
je 0x140006bcb
test rdx, rdx
jne 0x1400068ea
test rax, rax
je 0x140006bcb
mov qword [rsp + 0x40], r12
lea rax, [rbp + 0x128]
mov qword [rsp + 0x38], rax
xor r9d, r9d
lea rax, [rsp + 0x70]
mov dword [rsp + 0x30], 0x40
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rsp + 0x50]
mov qword [rbp + 0x128], r12
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov ebx, eax
test eax, eax
js 0x140006bcb
cmp dword [rsp + 0x58], 0x40
jne 0x140006bc8
lfence
movsxd rax, dword [rbp - 0x54]
mov r13d, 0x108
mov qword [rbp + 0x128], rax
xor r9d, r9d
mov qword [rsp + 0x40], r12
lea rax, [rbp + 0x128]
mov qword [rsp + 0x38], rax
xor r8d, r8d
lea rax, [rbp - 0x50]
mov dword [rsp + 0x30], r13d
mov qword [rsp + 0x28], rax
xor edx, edx
lea rax, [rsp + 0x50]
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov ebx, eax
test eax, eax
js 0x140006bcb
cmp dword [rsp + 0x58], r13d
jne 0x140006bc8
cmp dword [rbp - 0x50], 0x4550
movzx r14d, word [rbp - 0x4a]
jne 0x140006bc8
mov eax, 0x20b
cmp word [rbp - 0x38], ax
jne 0x1400069d1
movsxd rax, dword [rbp - 0x54]
mov edi, dword [rbp + 0x4c]
add rax, r13
mov r15d, dword [rbp + 0x48]
jmp 0x1400069f1
mov eax, 0x10b
cmp word [rbp - 0x38], ax
jne 0x140006bc8
movsxd rax, dword [rbp - 0x54]
mov edi, dword [rbp + 0x3c]
add rax, 0xf8
mov r15d, dword [rbp + 0x38]
mov qword [rbp + 0x128], rax
test r15d, r15d
je 0x140006bc3
test edi, edi
je 0x140006bc3
lea eax, [r14 - 1]
cmp eax, 0x13
ja 0x140006bc3
lfence
lea r13, [r14 + r14*4]
mov r8d, 0x746b734b
shl r13, 3
xor ecx, ecx
mov rdx, r13
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r12, rax
test rax, rax
jne 0x140006a44
mov ebx, 0xc0000001
jmp 0x140006bcb
lfence
and qword [rsp + 0x40], rsi
lea eax, [r14 + r14*4]
shl eax, 3
lea rcx, [rbp + 0x128]
mov qword [rsp + 0x38], rcx
xor r9d, r9d
mov rcx, qword [rbp + 0x110]
xor r8d, r8d
mov dword [rsp + 0x30], eax
xor edx, edx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov ebx, eax
test eax, eax
js 0x140006ba6
mov eax, dword [rsp + 0x58]
cmp rax, r13
je 0x140006aa4
mov ebx, 0xc0000001
jmp 0x140006ba6
lfence
mov r8d, r15d
mov edx, r14d
mov rcx, r12
call fcn.1400065e4
mov r15d, eax
test eax, eax
je 0x140006ba6
mov ebx, edi
mov r8d, 0x746b734b
xor ecx, ecx
lea rdx, [rbx + 4]
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rsi, rax
test rax, rax
je 0x140006a9a
lfence
lea r8, [rbx + 4]
xor edx, edx
mov rcx, rax
call fcn.140018240
and qword [rsp + 0x40], 0
lea rax, [rbp + 0x128]
mov rcx, qword [rbp + 0x110]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov dword [rsp + 0x30], edi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rsi
xor edx, edx
mov qword [rsp + 0x20], rax
mov qword [rbp + 0x128], r15
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov ebx, eax
test eax, eax
js 0x140006ba6
cmp dword [rsp + 0x58], edi
jne 0x140006a9a
lfence
lea r8, [rsp + 0x60]
mov edx, edi
mov rcx, rsi
call fcn.14000645c
test al, al
je 0x140006ba6
lfence
mov r8d, dword [rsp + 0x60]
mov edx, r14d
mov rcx, r12
call fcn.1400065e4
cmp eax, r15d
jb 0x140006ba6
lea edx, [r15 + rdi]
cmp edx, eax
jb 0x140006ba6
mov ecx, dword [rsp + 0x64]
cmp ecx, edi
ja 0x140006ba6
add ecx, eax
cmp ecx, edx
ja 0x140006ba6
lfence
mov r9, qword [rbp + 0x120]
sub eax, r15d
mov r8, qword [rbp + 0x118]
mov edx, dword [rsp + 0x64]
mov ecx, eax
add rcx, rsi
call fcn.140009ff4
mov ebx, eax
xor edx, edx
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
test rsi, rsi
je 0x140006bcb
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x140006bcb
mov ebx, r12d
jmp 0x140006bcb
mov ebx, r15d
mov eax, ebx
add rsp, 0x1c8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret