Function at 0x14009ee30
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov rax, qword [0x14024a080]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov rax, qword gs:[0x58]
mov rdi, rcx
mov edx, 8
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x14025ab34], eax
jle 0x14009eea7
lea rcx, [0x14025ab34]
call fcn.1400c7b0c
cmp dword [0x14025ab34], 0xffffffff
jne 0x14009eea7
xor ecx, ecx
call fcn.140168fec
lea rcx, [0x14025ab34]
mov qword [0x14025ab38], rax
call fcn.1400c7aac
xor eax, eax
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [rdi + 0x70]
xor r14d, r14d
cmp word [rsp + 0x48], ax
jne 0x14009eee2
movzx eax, word [rdi + 0x72]
cmp word [rsp + 0x4a], ax
jne 0x14009eee2
movzx eax, word [rdi + 0x76]
cmp word [rsp + 0x4e], ax
je 0x14009ef01
mov rcx, qword [rdi + 0x68]
cmp rcx, 0xffffffffffffffff
je 0x14009ef01
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0x68], 0xffffffffffffffff
mov dword [rdi + 0x4a0], r14d
xor ecx, ecx
call fcn.140168fec
sub rax, qword [0x14025ab38]
cmp rax, 0xa
jle 0x14009ef6c
mov rcx, qword [rdi + 0x68]
cmp rcx, 0xffffffffffffffff
je 0x14009ef5e
xor eax, eax
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14009ef5e
cmp dword [rsp + 0x4c], 1
jge 0x14009ef46
cmp dword [rsp + 0x48], 0xc800000
jbe 0x14009ef5e
mov rcx, qword [rdi + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [rdi + 0x4a0]
mov qword [rdi + 0x68], 0xffffffffffffffff
xor ecx, ecx
call fcn.140168fec
mov qword [0x14025ab38], rax
cmp qword [rdi + 0x68], 0xffffffffffffffff
jne 0x14009f108
mov rcx, rdi
mov qword [rsp + 0x2b8], rbx
call fcn.14009f130
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x208
call fcn.140159570
mov r8d, 0x104
lea rdx, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x14009efc6
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea rdx, str.log_
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectory]
xor eax, eax
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [rsp + 0x5e]
lea r9, [rdi + 0x80]
movzx r8d, word [rsp + 0x5a]
lea rcx, [rdi + 0x288]
mov eax, dword [rdi + 0x4a0]
movzx r10d, word [rsp + 0x58]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], edx
mov rdx, qword [rdi + 8]
mov dword [rsp + 0x28], r8d
lea r8, [rsp + 0x70]
mov dword [rsp + 0x20], r10d
call fcn.14007de30
xor r9d, r9d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
lea rcx, [rdi + 0x288]
mov edx, 0x40000000
mov dword [rsp + 0x20], 4
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, qword [rsp + 0x2b8]
mov qword [rdi + 0x68], rax
cmp rax, 0xffffffffffffffff
jne 0x14009f085
xor al, al
jmp 0x14009f10a
lea r9, [rsp + 0x48]
mov word [rsp + 0x40], r14w
mov r8d, 2
mov dword [rsp + 0x48], r14d
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], r14
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, qword [rdi + 0x68]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rcx, qword [rdi + 0x68]
lea r9, [rsp + 0x48]
mov eax, 0xfffffeff
mov qword [rsp + 0x20], r14
mov r8d, 2
mov word [rsp + 0x40], ax
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rdi + 0x68]
mov r9d, 2
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea rcx, [rdi + 0x70]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
mov al, 1
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.1400c7300
mov rsi, qword [rsp + 0x2c0]
add rsp, 0x290
pop r14
pop rdi
pop rbp
ret