Function at 0x140013350
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x70
xor edi, edi
lea rax, [0x140078b48]
mov rbp, r8
mov qword [rsp + 0x50], rdi
mov r8, qword [rcx + 8]
mov r14, rcx
mov qword [rsp + 0x58], rax
mov rsi, rdx
mov ecx, dword [r8]
test ecx, ecx
je 0x1400134d0
sub ecx, 1
je 0x140013448
sub ecx, 2
je 0x1400133ff
cmp ecx, 3
jne 0x140013746
mov rax, qword [rdx + 8]
cmp dword [rax], edi
jne 0x140013476
mov rdx, qword [r14]
test rdx, rdx
je 0x1400133d0
mov rcx, qword [r8 + 8]
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
je 0x140013746
mov rax, qword [r14 + 8]
lea r9, [rsp + 0xa0]
mov rdx, qword [rsi]
mov r8d, ebp
mov qword [rsp + 0x20], rdi
mov rcx, qword [rax + 8]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_WriteFile]
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rax, qword [rdx + 8]
cmp dword [rax], edi
jne 0x140013476
mov rax, qword [r8 + 8]
mov r9d, ebp
mov r8, qword [rdx]
mov edx, 0x22c187
mov qword [rsp + 0x38], rdi
mov rcx, qword [rax]
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x30], rax
mov rax, qword [r14]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rax, qword [rdx + 8]
cmp dword [rax], edi
jne 0x140013476
mov rcx, qword [r8 + 8]
mov r9, rbp
mov r8, qword [rdx]
mov rdx, qword [r14]
mov qword [rsp + 0x20], rdi
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rdx, rbp
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140013746
mov r8, rbp
lea rcx, [rsp + 0x50]
mov rdx, rsi
call fcn.140013350
test eax, eax
je 0x1400134b8
mov r8, rbp
lea rdx, [rsp + 0x50]
mov rcx, r14
call fcn.140013350
mov edi, eax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rdx, qword [rdx + 8]
mov ecx, dword [rdx]
test ecx, ecx
je 0x140013733
sub ecx, 1
je 0x14001370d
sub ecx, 1
je 0x140013593
sub ecx, 1
je 0x14001354b
cmp ecx, 3
jne 0x140013746
mov rcx, qword [rdx + 8]
xor r9d, r9d
mov edx, dword [rsi]
xor r8d, r8d
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x140013746
mov rax, qword [rsi + 8]
lea r9, [rsp + 0xa0]
mov rdx, qword [r14]
mov r8d, ebp
mov qword [rsp + 0x20], rdi
mov rcx, qword [rax + 8]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_ReadFile]
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rax, qword [rdx + 8]
xor r9d, r9d
mov ebx, dword [rsp + 0xb0]
mov edx, 0x22c183
mov r8, qword [rsi]
mov qword [rsp + 0x38], rdi
mov rcx, qword [rax]
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x30], rax
mov rax, qword [r14]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rax, qword [r14]
mov r11, rdi
mov rsi, qword [rsi]
mov qword [rsp + 0x40], rax
mov rax, qword [rdx + 8]
mov qword [rsp + 0xb8], rdi
mov rcx, qword [rax]
mov eax, edi
mov r8, qword [rcx + 8]
mov r9d, dword [r8 + 0xc]
mov edx, dword [r8 + 8]
add r9, r8
test edx, edx
je 0x140013746
mov rcx, r9
nop dword [rax]
cmp dword [rcx], 9
je 0x1400135ec
inc eax
add rcx, 0xc
cmp eax, edx
jb 0x1400135d0
mov eax, edi
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rcx, [rax + rax*2]
mov ecx, dword [r9 + rcx*4 + 8]
add rcx, r8
mov qword [rsp + 0x48], rcx
je 0x140013746
mov qword [rsp + 0x68], r13
mov r13, qword [rcx + 8]
add r13, r8
mov qword [rsp + 0x60], r15
mov r15, rdi
cmp qword [rcx], rdi
jbe 0x1400136ef
mov qword [rsp + 0xa8], r12
lea r14, [rcx + 0x10]
nop dword [rax]
mov r9, qword [r14]
lea r12, [r14 + 8]
mov rax, qword [r12]
cmp rsi, r9
jb 0x14001364c
lea rcx, [rax + r9]
mov r10, rax
cmp rsi, rcx
jb 0x140013674
lea rcx, [rsi + rbp]
cmp rcx, r9
jb 0x140013663
lea rdx, [rax + r9]
mov r10, rax
cmp rcx, rdx
jb 0x140013674
jmp 0x140013667
lea rdx, [r9 + rax]
cmp rsi, r9
jae 0x1400136ce
mov r10, rax
cmp rcx, rdx
jbe 0x1400136ce
mov r8, r9
mov rbx, r10
sub r8, rsi
mov rax, rsi
cmp rsi, r9
mov rdx, rdi
mov rcx, rbp
cmovae r8, rdi
sub rax, r9
cmp rsi, r9
cmovae rdx, rax
sub rcx, r8
sub rbx, rdx
lea rax, [rcx + rdx]
cmp rax, r10
cmovbe rbx, rcx
mov rcx, qword [rsp + 0x40]
add rcx, r8
add rdx, r13
mov r8, rbx
call fcn.140033fa0
mov r11, qword [rsp + 0xb8]
add r11, rbx
mov qword [rsp + 0xb8], r11
mov rax, qword [rsp + 0x48]
inc r15
add r13, qword [r12]
add r14, 0x10
cmp r15, qword [rax]
jb 0x140013630
mov r12, qword [rsp + 0xa8]
mov r15, qword [rsp + 0x60]
cmp r11, rbp
mov r13, qword [rsp + 0x68]
sete dil
mov eax, edi
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rcx, qword [rdx + 8]
mov r9, rbp
mov r8, qword [r14]
mov rdx, qword [rsi]
mov qword [rsp + 0x20], rdi
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rdx, qword [rsi]
mov r8, rbp
mov rcx, qword [r14]
call fcn.140033fa0
mov edi, 1
mov eax, edi
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret