Function at 0x140013e60
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x70
xor edi, edi
lea rax, [0x140079b48]
mov rbp, r8
mov qword [rsp + 0x50], rdi
mov r8, qword [rcx + 8]
mov r14, rcx
mov qword [rsp + 0x58], rax
mov rsi, rdx
mov ecx, dword [r8]
test ecx, ecx
je 0x140013fe0
sub ecx, 1
je 0x140013f58
sub ecx, 2
je 0x140013f0f
cmp ecx, 3
jne 0x140014256
mov rax, qword [rdx + 8]
cmp dword [rax], edi
jne 0x140013f86
mov rdx, qword [r14]
test rdx, rdx
je 0x140013ee0
mov rcx, qword [r8 + 8]
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
je 0x140014256
mov rax, qword [r14 + 8]
lea r9, [rsp + 0xa0]
mov rdx, qword [rsi]
mov r8d, ebp
mov qword [rsp + 0x20], rdi
mov rcx, qword [rax + 8]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_WriteFile]
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rax, qword [rdx + 8]
cmp dword [rax], edi
jne 0x140013f86
mov rax, qword [r8 + 8]
mov r9d, ebp
mov r8, qword [rdx]
mov edx, 0x22c187
mov qword [rsp + 0x38], rdi
mov rcx, qword [rax]
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x30], rax
mov rax, qword [r14]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rax, qword [rdx + 8]
cmp dword [rax], edi
jne 0x140013f86
mov rcx, qword [r8 + 8]
mov r9, rbp
mov r8, qword [rdx]
mov rdx, qword [r14]
mov qword [rsp + 0x20], rdi
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rdx, rbp
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140014256
mov r8, rbp
lea rcx, [rsp + 0x50]
mov rdx, rsi
call fcn.140013e60
test eax, eax
je 0x140013fc8
mov r8, rbp
lea rdx, [rsp + 0x50]
mov rcx, r14
call fcn.140013e60
mov edi, eax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rdx, qword [rdx + 8]
mov ecx, dword [rdx]
test ecx, ecx
je 0x140014243
sub ecx, 1
je 0x14001421d
sub ecx, 1
je 0x1400140a3
sub ecx, 1
je 0x14001405b
cmp ecx, 3
jne 0x140014256
mov rcx, qword [rdx + 8]
xor r9d, r9d
mov edx, dword [rsi]
xor r8d, r8d
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x140014256
mov rax, qword [rsi + 8]
lea r9, [rsp + 0xa0]
mov rdx, qword [r14]
mov r8d, ebp
mov qword [rsp + 0x20], rdi
mov rcx, qword [rax + 8]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_ReadFile]
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rax, qword [rdx + 8]
xor r9d, r9d
mov ebx, dword [rsp + 0xb0]
mov edx, 0x22c183
mov r8, qword [rsi]
mov qword [rsp + 0x38], rdi
mov rcx, qword [rax]
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x30], rax
mov rax, qword [r14]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rax, qword [r14]
mov r11, rdi
mov rsi, qword [rsi]
mov qword [rsp + 0x40], rax
mov rax, qword [rdx + 8]
mov qword [rsp + 0xb8], rdi
mov rcx, qword [rax]
mov eax, edi
mov r8, qword [rcx + 8]
mov r9d, dword [r8 + 0xc]
mov edx, dword [r8 + 8]
add r9, r8
test edx, edx
je 0x140014256
mov rcx, r9
nop dword [rax]
cmp dword [rcx], 9
je 0x1400140fc
inc eax
add rcx, 0xc
cmp eax, edx
jb 0x1400140e0
mov eax, edi
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rcx, [rax + rax*2]
mov ecx, dword [r9 + rcx*4 + 8]
add rcx, r8
mov qword [rsp + 0x48], rcx
je 0x140014256
mov qword [rsp + 0x68], r13
mov r13, qword [rcx + 8]
add r13, r8
mov qword [rsp + 0x60], r15
mov r15, rdi
cmp qword [rcx], rdi
jbe 0x1400141ff
mov qword [rsp + 0xa8], r12
lea r14, [rcx + 0x10]
nop dword [rax]
mov r9, qword [r14]
lea r12, [r14 + 8]
mov rax, qword [r12]
cmp rsi, r9
jb 0x14001415c
lea rcx, [rax + r9]
mov r10, rax
cmp rsi, rcx
jb 0x140014184
lea rcx, [rsi + rbp]
cmp rcx, r9
jb 0x140014173
lea rdx, [rax + r9]
mov r10, rax
cmp rcx, rdx
jb 0x140014184
jmp 0x140014177
lea rdx, [r9 + rax]
cmp rsi, r9
jae 0x1400141de
mov r10, rax
cmp rcx, rdx
jbe 0x1400141de
mov r8, r9
mov rbx, r10
sub r8, rsi
mov rax, rsi
cmp rsi, r9
mov rdx, rdi
mov rcx, rbp
cmovae r8, rdi
sub rax, r9
cmp rsi, r9
cmovae rdx, rax
sub rcx, r8
sub rbx, rdx
lea rax, [rcx + rdx]
cmp rax, r10
cmovbe rbx, rcx
mov rcx, qword [rsp + 0x40]
add rcx, r8
add rdx, r13
mov r8, rbx
call fcn.1400351a0
mov r11, qword [rsp + 0xb8]
add r11, rbx
mov qword [rsp + 0xb8], r11
mov rax, qword [rsp + 0x48]
inc r15
add r13, qword [r12]
add r14, 0x10
cmp r15, qword [rax]
jb 0x140014140
mov r12, qword [rsp + 0xa8]
mov r15, qword [rsp + 0x60]
cmp r11, rbp
mov r13, qword [rsp + 0x68]
sete dil
mov eax, edi
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rcx, qword [rdx + 8]
mov r9, rbp
mov r8, qword [r14]
mov rdx, qword [rsi]
mov qword [rsp + 0x20], rdi
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rdx, qword [rsi]
mov r8, rbp
mov rcx, qword [r14]
call fcn.1400351a0
mov edi, 1
mov eax, edi
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret