Function at 0x140135810
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rdi
push r14
push r15
sub rsp, 0x80
mov qword [rax - 0x68], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov ebp, r9d
mov r14d, r8d
mov r15, rdx
mov rbx, rcx
lea rdi, [rcx + 0x10]
mov qword [rax - 0x60], rdi
mov rcx, rdi
call fcn.140148aa0
nop
mov rbx, qword [rbx]
xor esi, esi
test rbx, rbx
je 0x14013599f
mov edx, ebp
mov rcx, rbx
call fcn.140016ec0
test al, al
je 0x14013599f
test r14d, r14d
jg 0x14013587c
mov ebx, esi
jmp 0x1401359a4
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rax + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xa0]
mov r8d, r14d
mov rdx, r15
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1401358e5
mov ebx, dword [rsp + 0xa0]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1401359a4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x140135994
cmp byte [rbx + 0x1a], 0
jne 0x140135994
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x48], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x50], rax
mov r9d, 0xffffffff
test ebp, ebp
cmovns r9d, ebp
xor r8d, r8d
lea rdx, [rsp + 0x48]
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [rbx + 8]
test eax, eax
je 0x140135941
call qword [sym.imp.KERNEL32.dll_CancelIo]
jmp 0x140135994
xor r9d, r9d
lea r8, [rsp + 0xa0]
lea rdx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x14013596f
mov ebx, dword [rsp + 0xa0]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1401359a4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x140135994
cmp byte [rbx + 0x19], 0
je 0x140135994
cmp byte [rbx + 0x18], 0
je 0x140135994
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov byte [rbx + 0x18], 0
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebp, eax
mov qword [rsp + 0x40], rdi
mov rcx, rdi
call fcn.140147c70
nop
mov edx, esi
mov ecx, dword [rdi + 0x2c]
test ecx, ecx
jle 0x140135a4e
mov rax, qword [rdi + 0x20]
nop dword [rax + rax]
cmp qword [rax], rbp
je 0x1401359e1
inc edx
add rax, 0x10
cmp edx, ecx
jl 0x1401359d0
jmp 0x140135a4e
sub dword [rax + 8], 1
jne 0x140135a4e
mov eax, dword [rdi + 0x2c]
cmp edx, eax
jae 0x140135a43
movsxd rcx, edx
shl rcx, 4
add rcx, qword [rdi + 0x20]
sub eax, edx
dec eax
movsxd r8, eax
shl r8, 4
lea rdx, [rcx + 0x10]
call sub.VCRUNTIME140.dll_memmove
mov ecx, dword [rdi + 0x2c]
lea edx, [rcx - 1]
mov dword [rdi + 0x2c], edx
mov r9d, dword [rdi + 0x28]
lea eax, [rdx + rdx]
mov r8d, esi
test eax, eax
cmovg r8d, eax
cmp r9d, r8d
jle 0x140135a43
mov eax, 4
cmp ecx, eax
cmovle edx, eax
cmp edx, r9d
jge 0x140135a43
lea rcx, [rdi + 0x20]
call fcn.14001a7a0
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
nop
mov eax, ebx
xchg dword [rdi], esi
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret