Function at 0x140280b90
Capabilities:
Get file size
Resolve function by parsing pe exports
Write file on windows

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x90
mov rdi, rcx
mov qword [rsp + 0x88], r14
mov rcx, qword [rcx + 8]
xor r14b, r14b
mov rax, qword [rcx]
call qword [rax]
mov edx, dword [rdi + 0x38]
add rdx, rax
mov eax, dword [rdi + 0x28]
cmp rdx, rax
jb 0x140280c25
mov rbx, qword [rdi + 0x10]
mov rcx, qword [rbx + 8]
cmp rcx, 0xffffffffffffffff
je 0x140280bde
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
jne 0x140280bde
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbx + 8]
cmp rcx, 0xffffffffffffffff
je 0x140280c16
mov qword [rbx + 8], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x140280c00
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [rbx + 0x24], r14b
je 0x140280c16
call fcn.140281410
mov rdx, rbx
mov rcx, rax
call fcn.1402817d0
mov rcx, qword [rdi + 8]
xor edx, edx
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov r14b, 1
mov rax, qword [rdi + 0x10]
cmp qword [rax + 8], 0xffffffffffffffff
je 0x140280c94
mov rcx, qword [rdi + 8]
mov rax, qword [rcx]
call qword [rax + 0x18]
test al, al
je 0x140280c94
mov rbx, qword [rdi + 0x10]
mov rcx, qword [rbx + 8]
cmp rcx, 0xffffffffffffffff
je 0x140280c5c
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
jne 0x140280c5c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbx + 8]
cmp rcx, 0xffffffffffffffff
je 0x140280c94
mov qword [rbx + 8], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x140280c7e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [rbx + 0x24], 0
je 0x140280c94
call fcn.140281410
mov rdx, rbx
mov rcx, rax
call fcn.1402817d0
mov rax, qword [rdi + 0x10]
lea rbp, [0x1404830ad]
xor ebx, ebx
cmp qword [rax + 8], 0xffffffffffffffff
jne 0x140280ec6
mov rcx, qword [rdi + 8]
mov rax, qword [rcx]
call qword [rax + 0x18]
test al, al
jne 0x140280ec6
mov rax, qword [rdi + 0x18]
lea rcx, [rsp + 0x30]
test rax, rax
mov qword [rsp + 0xc8], rsi
mov rdx, rbp
mov qword [rsp + 0x40], rbx
cmovne rdx, rax
mov r8d, ebx
lea rax, vtable.CPathString.0
mov qword [rsp + 0x30], rax
call fcn.14027f9a0
lea rcx, [rsp + 0x30]
call fcn.14027f760
mov rcx, rax
lea rdx, [rsp + 0x48]
call fcn.140336eb0
mov rcx, qword [rsp + 0x40]
test eax, eax
je 0x140280d34
test rcx, rcx
je 0x140280d1c
call fcn.14031dc44
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140280d2b
call fcn.14031dc44
mov rsi, 0xffffffffffffffff
jmp 0x140280d52
mov rsi, qword [rsp + 0x60]
test rcx, rcx
je 0x140280d43
call fcn.14031dc44
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140280d52
call fcn.14031dc44
test r14b, r14b
jne 0x140280d68
test rsi, rsi
js 0x140280d68
mov eax, dword [rdi + 0x38]
add rax, rsi
cmp rax, qword [rdi + 0x28]
jle 0x140280ddf
cmp rsi, 0xffffffffffffffff
jne 0x140280d85
mov rax, qword [rdi + 0x18]
mov rcx, rbp
test rax, rax
cmovne rcx, rax
call fcn.14027e540
test al, al
je 0x140280ddc
mov rax, qword [rdi + 0x20]
mov rsi, rbp
test rax, rax
cmovne rsi, rax
mov rcx, rsi
call fcn.140281760
test al, al
jne 0x140280dbb
mov rcx, rsi
call fcn.14027e540
test al, al
je 0x140280dbb
mov rcx, rsi
call fcn.1402804f0
mov rcx, rsi
call fcn.140281760
mov rax, qword [rdi + 0x20]
mov rdx, rbp
test rax, rax
mov rcx, rbp
cmovne rdx, rax
mov rax, qword [rdi + 0x18]
test rax, rax
cmovne rcx, rax
call fcn.14027ef80
mov r14b, 1
mov rax, qword [rdi + 0x18]
mov rdx, rbp
mov rcx, qword [rdi + 0x10]
test rax, rax
mov r9b, 1
mov byte [rsp + 0x20], bl
cmovne rdx, rax
xor r14b, 1
movzx r8d, r14b
call fcn.14027e710
mov rax, qword [rdi + 0x10]
mov r14, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov rax, qword [r14]
cmp rcx, 0xffffffffffffffff
jne 0x140280e27
xor edx, edx
mov rcx, r14
call qword [rax + VariantCopy]
jmp 0x140280ebe
mov qword [rsp + 0x80], r15
lea rdx, [rsp + 0xc0]
mov r15, qword [rax + 8]
mov rsi, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x140280e5b
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140280e63
mov rsi, 0xffffffffffffffff
jmp 0x140280e63
mov rsi, qword [rsp + 0xc0]
mov rdx, rsi
mov rcx, r14
call r15
mov rax, qword [rdi + 0x10]
lea r9, [rsp + 0xb8]
mov r8d, 4
mov dword [rsp + 0xb8], ebx
lea rdx, str._r_n_r_n
mov qword [rsp + 0x20], rbx
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r15, qword [rsp + 0x80]
cmp eax, 1
je 0x140280ebe
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140280ebe
mov rcx, qword [rdi + 8]
xor edx, edx
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rsi, qword [rsp + 0xc8]
mov rax, qword [rdi + 0x10]
mov r14, qword [rsp + 0x88]
mov rcx, qword [rax + 8]
cmp rcx, 0xffffffffffffffff
je 0x140280fbe
mov r8d, dword [rdi + 0x38]
test r8d, r8d
je 0x140280f25
mov rax, qword [rdi + 0x30]
lea r9, [rsp + 0xb0]
test rax, rax
mov dword [rsp + 0xb0], ebx
mov qword [rsp + 0x20], rbx
cmovne rbp, rax
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
je 0x140280f1e
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140280f25
mov ebx, dword [rsp + 0xb0]
cmp dword [rdi + 0x38], 0
je 0x140280f93
test ebx, ebx
jne 0x140280f93
mov rcx, qword [rdi + 8]
xor edx, edx
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rbx, qword [rdi + 0x10]
mov rcx, qword [rbx + 8]
cmp rcx, 0xffffffffffffffff
je 0x140280f59
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
jne 0x140280f59
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbx + 8]
cmp rcx, 0xffffffffffffffff
je 0x140280fbe
mov qword [rbx + 8], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x140280f7b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [rbx + 0x24], 0
je 0x140280fbe
call fcn.140281410
mov rdx, rbx
mov rcx, rax
call fcn.1402817d0
jmp 0x140280fbe
cmp byte [rdi + 0x3c], 0
je 0x140280fb1
mov rax, qword [rdi + 0x10]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
jne 0x140280fb1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rdi + 8]
movsxd rdx, ebx
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rax, qword [rdi + 0x10]
lock dec dword [rax + 0x20]
add rsp, 0x90
pop rdi
pop rbp
pop rbx
ret