Function at 0x1400249d4
Capabilities:
Read file via mapping
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x58
xor r13d, r13d
mov rbx, rcx
test rcx, rcx
je 0x140024cc6
mov rax, qword [rcx + 0x20]
test rax, rax
je 0x140024cc6
cmp dword [rax + 0x4c], r13d
jne 0x140024a17
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
jmp 0x140024cd3
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x140024cc6
cmp dword [0x140042e20], r13d
mov edi, dword [rax + 0x20]
mov r15d, 0x80000000
mov eax, 0x82000000
mov ebp, r13d
cmovne r15d, eax
sub edi, 0x1060
jne 0x140024aab
mov rdi, qword [rbx + 0x10]
lea rax, [rdi - 1]
cmp rax, 0xfffffffffffffffd
jbe 0x140024a69
mov r9d, r15d
xor r8d, r8d
mov edx, 0x40000000
call fcn.140014f40
mov rdi, rax
cmp rdi, 0xffffffffffffffff
je 0x140024cd1
mov rdx, qword [rbx + 0x20]
lea r9, [rsp + 0xa0]
mov r8d, 0x1060
mov rcx, rdi
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
cmp rdi, qword [rbx + 0x10]
je 0x140024aa4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x140024cd3
call fcn.14003d3e0
mov r14, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140024cc2
xor r9d, r9d
xor edx, edx
or rcx, 0xffffffffffffffff
lea r8d, [r9 + 4]
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rsi, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140024cba
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 6]
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r12, rax
test rax, rax
je 0x140024cb1
mov rcx, qword [rbx + 0x20]
mov r8, qword [rbx + 0x28]
mov edx, r13d
mov r14d, dword [rcx + 0x20]
mov dword [rcx + 0x54], edx
mov rcx, qword [rbx + 0x20]
mov r11d, 0x10000
mov r9d, r13d
mov r10, rax
mov qword [rsp + 0xb8], rax
sub r14d, 0x1060
mov dword [rcx + 0x50], r11d
mov r13d, edi
jmp 0x140024c07
cmp r9d, 0x400
jae 0x140024c9e
cmp edi, r13d
jb 0x140024c9e
mov rax, qword [rbx + 0x20]
mov ecx, r9d
inc r9d
inc dword [rax + 0x54]
mov rax, qword [rbx + 0x20]
mov edx, edi
sub edx, r13d
cmp r14d, r11d
mov dword [rsp + 0xa8], r9d
mov dword [rax + rcx*4 + 0x5c], edx
mov rcx, qword [rsp + 0x40]
mov r9, r8
mov esi, r14d
mov r8d, r13d
mov rdx, r10
cmova esi, r11d
mov dword [rsp + 0x20], esi
call fcn.14003d140
mov edx, eax
test eax, eax
jle 0x140024c9e
cmp eax, esi
jb 0x140024bd0
mov rdx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xb8]
mov r8d, esi
call fcn.140039700
mov edx, esi
mov r10, qword [rsp + 0xb8]
mov r8, qword [rsp + 0xb0]
mov r9d, dword [rsp + 0xa8]
mov eax, esi
sub r13d, edx
mov r11d, 0x10000
add r8, rax
movsxd rax, edx
add r10, rax
sub r14d, esi
mov qword [rsp + 0xb8], r10
mov qword [rsp + 0xb0], r8
jne 0x140024b4f
mov rax, qword [rbx + 0x20]
mov dword [rax + 0x58], edx
mov rsi, qword [rbx + 0x10]
lea rax, [rsi - 1]
cmp rax, 0xfffffffffffffffd
jbe 0x140024c41
mov rcx, qword [rbx + 0x18]
mov r9d, r15d
xor r8d, r8d
mov edx, 0x40000000
call fcn.140014f40
mov rsi, rax
cmp rsi, 0xffffffffffffffff
je 0x140024c9e
mov rdx, qword [rbx + 0x20]
and qword [rsp + 0x20], rbp
lea r9, [rsp + 0xa0]
mov r8d, 0x1060
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebp, eax
test eax, eax
je 0x140024c8f
and qword [rsp + 0x20], 0
sub edi, r13d
lea r9, [rsp + 0xa0]
mov r8d, edi
mov rdx, r12
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebp, eax
cmp rsi, qword [rbx + 0x10]
je 0x140024c9e
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rsi, qword [rsp + 0x48]
mov r14, qword [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call fcn.14003d470
mov eax, ebp
jmp 0x140024cd3
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret