Function at 0x1400a9bc0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
mov eax, edx
mov rdx, qword [0x1402683e0]
test rdx, rdx
je 0x1400a9e0d
mov r8d, dword [0x140263af0]
mov r9d, reloc.WS2_32.dll_ntohl
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
call fcn.140076c30
test eax, eax
je 0x1400a9e0d
mov qword [rsp + 0x40], rbx
mov ebx, dword [0x140263af0]
mov qword [rsp + 0x48], rbp
mov rbp, qword [0x140268120]
mov qword [rsp + 0x58], rsi
add rbp, 0x50
mov rsi, qword [0x140263b00]
mov rcx, rbp
mov qword [rsp + 0x30], rdi
mov rdi, qword [0x1402683e0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], 0
mov r8d, ebx
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400a9df0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rdi, qword [0x140268120]
lea rcx, [rdi + 0x28]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rdi + 0x18]
lea rbp, str..pipemonect_pipe_cap_server
mov rbx, qword [rax]
cmp rbx, rax
je 0x1400a9d2c
nop dword [rax]
nop word [rax + rax]
mov r8, qword [rbx + 0x10]
xor ecx, ecx
nop word [rax + rax]
movzx edx, word [r8 + rcx*2]
cmp dx, word [rbp + rcx*2]
jne 0x1400a9d6d
movzx edx, word [r8 + rcx*2 + 2]
cmp dx, word [rbp + rcx*2 + 2]
jne 0x1400a9d6d
add rcx, 2
cmp rcx, 0x20
jne 0x1400a9cb0
dec dword [r8 + 0x210]
mov rcx, qword [rbx + 0x10]
cmp dword [rcx + 0x210], 0
ja 0x1400a9d2c
mov rcx, qword [rcx + 0x208]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r8, qword [rbx + 8]
mov edx, Ordinal_27
mov rax, qword [rbx]
mov rcx, rbx
mov qword [r8], rax
mov r8, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [r8 + 8], rax
dec qword [rdi + 0x20]
call fcn.1401d0398
lea rcx, [rdi + 0x28]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [0x140268120]
mov rdx, rbp
call fcn.140076d70
mov rcx, qword [0x1402683e0]
mov r8d, dword [0x140263af0]
mov qword [0x140263b00], rax
test rcx, rcx
jne 0x1400a9d7b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], reloc.WLDAP32.dll_Ordinal_22
jmp 0x1400a9d9b
mov rbx, qword [rbx]
cmp rbx, rax
jne 0x1400a9ca0
jmp 0x1400a9d2c
cmp r8, 2
jb 0x1400a9d88
mov word [rcx], 3
jmp 0x1400a9da1
xor edx, edx
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], Ordinal_35
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
mov rbp, qword [0x140268120]
mov ebx, dword [0x140263af0]
add rbp, 0x50
mov rdi, qword [0x1402683e0]
mov rcx, rbp
mov rsi, qword [0x140263b00]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], 0
mov r8d, ebx
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400a9df0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x30]
add rsp, 0x38
ret