Function at 0x1400697b0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x70
mov qword [rax - 0x58], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rdi, rcx
cmp byte [rcx + 0x78], 0
je 0x1400697e1
call fcn.140069ad0
test al, al
je 0x140069ab1
lea rsi, [rdi + 0xb0]
mov rax, qword [rsi + 8]
xor r14d, r14d
cmp qword [rsi], rax
jne 0x140069958
lea rax, [rdi + 0xd0]
mov qword [rsp + 0x98], rax
lea rbx, [rax + 8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
cmp qword [rdi + 0x120], r14
jne 0x14006982c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x140069ab1
lea rcx, [rdi + 0x100]
lea rdx, [rsp + 0x50]
call fcn.14003d030
mov rdx, rax
mov rcx, qword [rax]
test rcx, rcx
mov rax, r14
je 0x14006984e
mov rax, qword [rcx]
mov rcx, qword [rax + 0x10]
dec rcx
and rcx, qword [rdx + 0x10]
mov rax, qword [rax + 8]
mov rdx, qword [rax + rcx*8]
add rdx, 8
mov rcx, rsi
call fcn.140037ec0
mov qword [rdi + 0xc8], r14
mov r8d, dword [0x1401ddd80]
mov ecx, r8d
imul ecx, r8d
imul ecx, r8d
mov eax, 0x38e38e39
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 2
jne 0x1400698c4
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov r8d, dword [0x1401ddd80]
mov ecx, r8d
imul ecx, r8d
mov eax, 0x30c30c31
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 6
jne 0x14006994f
mov ecx, r14d
mov eax, 0x78787879
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x11
mov eax, r8d
sub eax, edx
cmp eax, 0xbe
je 0x140069949
nop word [rax + rax]
mov eax, r8d
or eax, 0xffffff1c
add r8d, eax
inc ecx
mov eax, r8d
imul eax, r8d
cmp ecx, eax
jg 0x140069949
mov eax, 0x78787879
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x11
mov eax, r8d
sub eax, edx
cmp eax, 0xbe
jne 0x140069910
mov dword [0x1401ddd80], ecx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [rsp + 0x90], r14d
mov rdx, qword [rsi]
mov r8, qword [rsi + 8]
sub r8, rdx
lea rcx, [rdi + 0x80]
add rdx, qword [rdi + 0xc8]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x90]
mov rcx, qword [rdi + 0xa8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140069a27
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x1400699f2
cmp eax, 0x3e5
je 0x1400699ec
lea rax, str.Channel_write_failure
mov qword [rsp + 0x98], rax
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x50]
call fcn.1400da728
nop
lea rax, vtable.CRSimpleIPCException.0
mov qword [rsp + 0x50], rax
lea rdx, [0x1401a02f8]
lea rcx, [rsp + 0x50]
call fcn.1400df178
int3
mov byte [rdi + 0x78], 1
jmp 0x140069a27
lea rcx, [rsp + 0x38]
call fcn.1400da7a0
nop
lea rax, vtable.CRSimpleIPCException.0
mov qword [rsp + 0x38], rax
lea rax, vtable.CRSimpleIPCExceptionDisconnected.0
mov qword [rsp + 0x38], rax
lea rdx, [0x1401a02b0]
lea rcx, [rsp + 0x38]
call fcn.1400df178
int3
cmp byte [rdi + 0x78], 0
jne 0x140069ab1
mov eax, dword [rsp + 0x90]
add qword [rdi + 0xc8], rax
mov bpl, 1
mov rax, qword [rsi + 8]
sub rax, qword [rsi]
cmp qword [rdi + 0xc8], rax
jne 0x140069a9e
lea rax, [rdi + 0xd0]
mov qword [rsp + 0x98], rax
lea rbx, [rax + 8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rcx, [rdi + 0x100]
call fcn.140069f50
mov rax, qword [rsi]
mov qword [rsi + 8], rax
mov qword [rdi + 0xc8], r14
cmp qword [rdi + 0x120], 0
setne bpl
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rdi + 0xa0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movzx eax, bpl
jmp 0x140069ab3
xor al, al
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret