Function at 0x1401b4afc
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xd0
mov qword [rbp + 7], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov r14, r9
mov rdi, r8
mov r13, rdx
mov r15, rcx
xor r9d, r9d
xor r8d, r8d
call fcn.1401b44bc
mov r12d, eax
xor esi, esi
test eax, eax
jne 0x1401b4f0b
mov rdi, qword [rdi + 8]
mov rax, qword [rdi]
or rbx, 0xffffffffffffffff
mov qword [rbp - 0x41], rax
cmp rax, rdi
je 0x1401b4c8e
lea rdx, [rax + 0x18]
lea rcx, [rbp - 0x21]
call fcn.14000c4d8
nop
mov rbx, qword [r15 + 8]
lea rdx, [rbp - 0x21]
lea rcx, [rbp + 0xf]
call fcn.14000c4d8
mov dword [rbp - 0x19], esi
mov r8, rax
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 0x1f]
call fcn.1400902f8
mov r9, rax
mov r8, qword [r15 + 8]
mov rdx, qword [r15]
lea rcx, [rbp + 0x17]
call fcn.1400903fc
mov rsi, qword [rax]
cmp rsi, rbx
je 0x1401b4c1c
mov r12, qword [r15 + 8]
cmp rbx, r12
je 0x1401b4be5
sub rbx, rsi
lea rdx, [rbx + rsi]
mov rcx, rsi
call fcn.14000c244
mov r11d, dword [rbx + rsi + 8]
mov dword [rsi + 8], r11d
mov eax, dword [rbx + rsi + 0xc]
mov dword [rsi + 0xc], eax
add rsi, 0x10
lea rax, [rbx + rsi]
cmp rax, r12
jne 0x1401b4bbc
mov r12, qword [r15 + 8]
mov rbx, rsi
cmp rsi, r12
je 0x1401b4c18
mov rdx, qword [rbx]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1401b4c0f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rbx, 0x10
cmp rbx, r12
jne 0x1401b4bf1
mov qword [r15 + 8], rsi
mov rdx, qword [rbp - 0x21]
add rdx, 0xffffffffffffffe8
or rbx, 0xffffffffffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
xor esi, esi
test eax, eax
jg 0x1401b4c40
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rbp - 0x41]
cmp byte [rax + 0x21], sil
jne 0x1401b4b5a
mov rcx, qword [rax + 0x10]
cmp byte [rcx + 0x21], sil
jne 0x1401b4c69
mov rax, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x21], sil
je 0x1401b4c58
jmp 0x1401b4b56
mov rcx, qword [rax + 8]
jmp 0x1401b4c7c
cmp rax, qword [rcx + 0x10]
jne 0x1401b4c82
mov rax, rcx
mov rcx, qword [rcx + 8]
cmp byte [rcx + 0x21], sil
je 0x1401b4c6f
mov rax, rcx
mov qword [rbp - 0x41], rcx
jmp 0x1401b4b5a
mov qword [rbp - 0x51], rsi
mov qword [rbp - 0x49], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
mov r9d, 3
mov r8d, 0xc0000000
mov rdx, r14
lea rcx, [rbp - 0x51]
call fcn.14007db5c
mov r12d, eax
test eax, eax
jne 0x1401b4ef9
mov rdi, qword [r15 + 8]
sub rdi, qword [r15]
sar rdi, 4
add edi, 2
mov ecx, edi
lea eax, [r12 + 4]
mul rcx
cmovo rax, rbx
mov rcx, rax
call fcn.1400b9290
mov rbx, rax
mov qword [rbp - 0x59], rax
lea rdx, [rbp - 0x59]
mov rcx, r15
call fcn.1401b410c
mov dword [rbp - 0x5d], esi
shl edi, 2
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x5d]
mov r8d, edi
mov rdx, rbx
mov r14, qword [rbp - 0x51]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1401b4d2b
call fcn.14001072c
cmp dword [rbp - 0x5d], edi
je 0x1401b4d3b
mov r12d, 1
jmp 0x1401b4eef
mov rcx, rbx
mov rbx, rsi
mov qword [rbp - 0x59], rbx
call fcn.1400bee7c
mov qword [rbp - 0x31], rsi
mov qword [rbp - 0x29], rsi
mov dword [rsp + 0x28], 0x80
mov eax, 3
mov dword [rsp + 0x20], eax
mov r9d, eax
mov r8d, 0x80000000
mov rdx, r13
lea rcx, [rbp - 0x31]
call fcn.14007db5c
mov r12d, eax
test eax, eax
jne 0x1401b4edf
mov dword [rbp - 0x61], esi
mov rbx, qword [r15]
mov rdi, qword [r15 + 8]
mov qword [rbp - 0x39], rbx
cmp rbx, rdi
je 0x1401b4ec4
mov byte [rbp - 0x69], 0
mov rdx, rbx
lea rcx, [rbp - 9]
call fcn.14000c4d8
mov esi, dword [rbx + 8]
mov dword [rbp - 1], esi
mov r13d, dword [rbx + 0xc]
mov dword [rbp + 3], r13d
and dword [rbp - 0x65], 0
mov ecx, r13d
call fcn.1400b9290
mov rbx, rax
mov qword [rbp - 0x11], rsi
xor r9d, r9d
lea r8, [rbp - 0xd]
mov edx, esi
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x1401b4de8
call fcn.14001072c
xor esi, esi
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x65]
mov r8d, r13d
mov rdx, rbx
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1401b4e0c
call fcn.14001072c
cmp dword [rbp - 0x65], r13d
jne 0x1401b4e79
mov dword [rbp - 0x65], esi
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x65]
mov r8d, r13d
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1401b4e36
call fcn.14001072c
cmp dword [rbp - 0x65], r13d
jne 0x1401b4e79
mov edx, esi
mov r8d, esi
mov eax, r8d
movzx ecx, byte [rax + rbx]
add edx, ecx
add r8d, 4
cmp r8d, r13d
jbe 0x1401b4e41
and r13b, 3
neg r13b
sbb eax, eax
not eax
and eax, 0xfd
sub edx, eax
mov esi, dword [rbp - 0x61]
add esi, edx
mov dword [rbp - 0x61], esi
mov rcx, rbx
call fcn.1400bee7c
mov bl, 1
jmp 0x1401b4e8d
mov r12d, 1
mov rcx, rbx
call fcn.1400bee7c
mov bl, byte [rbp - 0x69]
mov esi, dword [rbp - 0x61]
mov rdx, qword [rbp - 9]
add rdx, 0xffffffffffffffe8
or rcx, 0xffffffffffffffff
mov eax, ecx
lock xadd dword [rdx + 0x10], eax
add eax, ecx
test eax, eax
jg 0x1401b4eaf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r14, qword [rbp - 0x51]
test bl, bl
je 0x1401b4ec4
mov rbx, qword [rbp - 0x39]
add rbx, 0x10
jmp 0x1401b4d8d
test r12d, r12d
jne 0x1401b4edb
mov r8d, esi
lea rdx, [rbp - 0x51]
mov rcx, r15
call fcn.1401b42ac
mov r12d, eax
mov rbx, qword [rbp - 0x59]
mov rcx, qword [rbp - 0x31]
test rcx, rcx
je 0x1401b4eef
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, rbx
call fcn.1400bee7c
jmp 0x1401b4efd
mov r14, qword [rbp - 0x51]
test r14, r14
je 0x1401b4f0b
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r12d
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret