Function at 0x140001b18
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xd0
mov rax, qword [0x140036068]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov rsi, r8
mov r12, rdx
mov r8d, dword [rcx + 0x18]
mov r15, rcx
mov r14d, dword [rsi + 8]
cmp r8d, r14d
jbe 0x140001b5e
mov r9d, 0x80000005
jmp 0x140001d95
cmp dword [rsi], 4
je 0x140001b6e
mov r9d, 0xc0000059
jmp 0x140001d95
mov edi, dword [rsi + 0xc]
mov ecx, 0x28
mov ebx, dword [rsi + 0x10]
cmp ebx, edi
je 0x140001cb4
lea eax, [r8 + rdi]
cmp eax, r14d
jbe 0x140001c04
cmp ebx, edi
jbe 0x140001b91
mov ebx, dword [rsi + 4]
mov r8, rcx
xor edx, edx
lea rcx, [rbp - 0x11]
call sub.msvcrt.dll_memset
mov rcx, qword [0x140036080]
mov eax, 0x28
sub r14d, edi
mov qword [rbp - 0x59], rdi
cmp r14d, eax
cmova r14d, eax
and qword [rsp + 0x40], 0
lea rax, [rbp - 0x59]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
lea rax, [rbp - 0x11]
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x28], rax
xor edx, edx
lea rax, [rbp - 0x41]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtWriteFile]
mov r9d, eax
test eax, eax
js 0x140001d95
mov edi, dword [rsi + 4]
mov ecx, 0x28
mov r8d, dword [r15 + 0x18]
lea eax, [r8 + rdi]
cmp ebx, eax
ja 0x140001c94
mov edx, dword [rsi + 8]
cmp ebx, edx
jae 0x140001c94
cmp ebx, edi
jb 0x140001c94
and qword [rsp + 0x40], 0
lea rax, [rbp - 0x51]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov dword [rsp + 0x30], ecx
lea rax, [rbp - 0x11]
mov rcx, qword [0x140036080]
xor r8d, r8d
mov qword [rsp + 0x28], rax
xor edx, edx
lea rax, [rbp - 0x31]
mov r14d, ebx
mov qword [rsp + 0x20], rax
mov qword [rbp - 0x51], r14
call qword [sym.imp.ntdll.dll_NtReadFile]
mov r9d, eax
test eax, eax
js 0x140001d95
mov edx, dword [rsi + 8]
lea rax, [r14 + 0x28]
cmp rax, rdx
ja 0x140001c91
mov eax, dword [rbp + 7]
test eax, eax
je 0x140001c91
add ebx, eax
cmp ebx, edx
ja 0x140001c91
mov ecx, dword [r15 + 0x18]
add ecx, edi
cmp ebx, ecx
mov ecx, 0x28
jbe 0x140001c13
jmp 0x140001c94
mov ebx, dword [rsi + 4]
cmp ebx, dword [rsi + 8]
jb 0x140001ca0
mov ebx, dword [rsi + 4]
mov eax, ebx
jmp 0x140001ca3
mov eax, dword [rsi + 4]
cmp ebx, eax
jne 0x140001caf
cmp edi, eax
je 0x140001d95
mov ecx, 0x28
and qword [rsp + 0x40], 0
xor r9d, r9d
mov eax, edi
xor r8d, r8d
mov qword [rbp - 0x49], rax
xor edx, edx
lea rax, [rbp - 0x49]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x21]
mov dword [rsp + 0x30], ecx
mov rcx, qword [0x140036080]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtWriteFile]
mov r9d, eax
test eax, eax
js 0x140001d95
add edi, 0x28
test r12, r12
je 0x140001d4d
and qword [rsp + 0x40], 0
xor r9d, r9d
mov rcx, qword [0x140036080]
xor r8d, r8d
mov eax, edi
xor edx, edx
mov qword [rbp - 0x51], rax
lea rax, [rbp - 0x51]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x31]
mov dword [rsp + 0x30], 0xc
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtWriteFile]
mov r9d, eax
test eax, eax
js 0x140001d95
add edi, 0xc
and qword [rsp + 0x40], 0
lea rax, [rbp - 0x59]
and qword [rbp - 0x59], 0
xor r9d, r9d
mov rcx, qword [0x140036080]
xor r8d, r8d
mov qword [rsp + 0x38], rax
xor edx, edx
mov dword [rsp + 0x30], 0x14
lea rax, [rbp - 0x41]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
mov dword [rsi + 0xc], edi
mov dword [rsi + 0x10], ebx
call qword [sym.imp.ntdll.dll_NtWriteFile]
mov r9d, eax
mov eax, r9d
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.14001fbe0
add rsp, 0xd0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret