Function at 0x1800087c0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xd0
xor eax, eax
mov r13, rcx
lea rcx, [r11 - 0x58]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov byte [rsp + 0x70], al
mov rax, qword [0x180020ed0]
mov r12, r9
mov r14, r8
mov qword [rcx], rax
mov rax, qword [0x180020ed8]
mov ebx, edx
mov qword [rcx + 8], rax
mov rax, qword [0x180020ee0]
mov esi, 1
mov qword [rcx + 0x10], rax
mov rax, qword [0x180020ee8]
xor bp, bp
mov qword [rcx + 0x18], rax
mov rax, qword [0x180020ef0]
xor di, di
mov qword [rcx + 0x20], rax
mov rax, qword [0x180020ef8]
mov qword [rcx + 0x28], rax
lea rcx, [r11 - 0x58]
call fcn.180008070
mov rcx, qword [0x180020ed8]
movzx eax, bx
shr ax, 8
mov byte [rsp + 0x32], bl
mov byte [rsp + 0x31], al
call sub.HID.DLL_HidD_FlushQueue
xor r11d, r11d
xor r9d, r9d
mov r8d, esi
mov edx, esi
xor ecx, ecx
mov qword [rsp + 0x80], r11
mov qword [rsp + 0x88], r11
mov qword [rsp + 0x90], r11
mov qword [rsp + 0x98], r11
call qword [sym.imp.KERNEL32.dll_CreateEventA]
test bx, bx
mov qword [rsp + 0x98], rax
je 0x1800089ab
lea r15d, [rsi + 0x39]
nop
nop
nop
movzx eax, di
mov byte [rsp + 0x34], dil
mov byte [rsp + 0x35], 0
shr ax, 8
cmp bx, r15w
mov byte [rsp + 0x33], al
movzx eax, bl
cmova eax, r15d
cmp bx, r15w
mov byte [rsp + 0x36], al
mov eax, r15d
ja 0x180008910
movzx eax, bx
movzx edx, di
lea rcx, [rsp + 0x37]
movsxd r8, eax
add rdx, r13
call fcn.180003160
mov rcx, qword [0x180020ed8]
lea r11, [rsp + 0x80]
lea r9, [rsp + 0x108]
lea rdx, [rsp + 0x30]
mov r8d, 0x41
mov qword [rsp + 0x20], r11
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x180008965
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x180008b8a
mov rcx, qword [rsp + 0x98]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [0x180020ed8]
lea r8, [rsp + 0x108]
lea rdx, [rsp + 0x80]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
cmp bx, r15w
jbe 0x1800089ab
add di, r15w
add bx, 0xffc6
jne 0x1800088e0
xor eax, eax
mov dl, 0x3a
mov qword [rsp + 0x30], rax
movzx r8d, byte [rsp + 0x31]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov byte [rsp + 0x70], al
mov eax, r8d
mov byte [rsp + 0x32], dl
shl eax, 8
or eax, 0x3a
jle 0x180008ada
nop
nop
nop
mov rcx, qword [0x180020ed8]
lea rax, [rsp + 0x80]
lea r9, [rsp + 0x108]
lea rdx, [rsp + 0x30]
mov r8d, 0x41
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x180008a42
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x180008b8a
mov rcx, qword [rsp + 0x98]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x180008b8a
mov rcx, qword [0x180020ed8]
lea r8, [rsp + 0x108]
lea rdx, [rsp + 0x80]
mov r9d, esi
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x180008b8a
movzx eax, byte [rsp + 0x34]
movzx ecx, byte [rsp + 0x33]
shl cx, 8
or cx, ax
movzx eax, cx
cmp eax, dword [r12]
jae 0x180008b8a
movzx ebx, byte [rsp + 0x36]
movzx ecx, cx
lea rdx, [rsp + 0x37]
mov r8, rbx
add rcx, r14
call fcn.180003160
movzx r8d, byte [rsp + 0x31]
movzx edx, byte [rsp + 0x32]
add bp, bx
mov ecx, r8d
shl ecx, 8
movzx eax, bp
or ecx, edx
cmp eax, ecx
jl 0x180008a00
movzx ecx, r8b
movzx eax, dl
movzx r9d, bp
shl ecx, 8
or ecx, eax
cmp r9d, ecx
jne 0x180008b8a
mov dword [r12], r9d
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x180020ed0]
lea rax, [rsp + 0xa0]
mov qword [rax], rcx
mov rcx, qword [0x180020ed8]
mov qword [rsp + 0x98], 0
mov qword [rax + 8], rcx
mov rcx, qword [0x180020ee0]
mov qword [rax + 0x10], rcx
mov rcx, qword [0x180020ee8]
mov qword [rax + 0x18], rcx
mov rcx, qword [0x180020ef0]
mov qword [rax + 0x20], rcx
mov rcx, qword [0x180020ef8]
mov qword [rax + 0x28], rcx
lea rcx, [rsp + 0xa0]
call fcn.180008090
lea r11, [rsp + 0xd0]
mov eax, esi
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor esi, esi
jmp 0x180008af7