Function at 0x140013290
Capabilities:
Create thread
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
xor r12b, r12b
mov rbx, r9
mov rbp, r8
mov r15d, edx
mov rsi, rcx
cmp r8, 0xffffffffffffffff
je 0x140013701
test rbx, rbx
je 0x140013701
cmp edx, 3
ja 0x140013701
cmp edx, 2
jne 0x1400133ae
movzx eax, word [r9 + 8]
test ax, ax
je 0x140013701
mov rsi, qword [rsp + 0xc0]
test rsi, rsi
je 0x140013701
mov r14, qword [rsp + 0xb0]
test r14, r14
je 0x140013701
cmp dword [rsp + 0xb8], 1
jl 0x140013701
movsxd rcx, dword [rsp + 0xc8]
movzx eax, ax
cmp ecx, eax
jl 0x140013701
mov r8, rcx
xor edx, edx
mov rcx, rsi
call fcn.1401af400
movzx ecx, word [rbx + 8]
call fcn.14002174c
mov rdi, rax
test rax, rax
je 0x140013701
movzx r8d, word [rbx + 8]
xor edx, edx
mov rcx, rax
call fcn.1401af400
movzx eax, byte [r14]
mov rdx, rdi
mov byte [rdi], al
mov rcx, rbp
movzx eax, byte [r14 + 1]
mov byte [rdi + 1], al
movzx r8d, word [rbx + 8]
call sub.HID.DLL_HidD_GetFeature
movzx ebp, al
test al, al
je 0x140013397
movzx r8d, word [rbx + 8]
mov rdx, rdi
mov rcx, rsi
call fcn.1401afbb0
mov edx, 1
mov rcx, rdi
call fcn.140006de0
test ebp, ebp
setne al
jmp 0x140013703
cmp r15d, 3
jne 0x14001344d
movzx eax, word [r9 + 8]
test ax, ax
je 0x140013701
cmp qword [rsp + 0xc0], 0
je 0x140013701
mov edi, dword [rsp + 0xc8]
cmp edi, 1
jl 0x140013701
movzx ecx, ax
call fcn.14002174c
mov rsi, rax
test rax, rax
je 0x140013701
movzx r8d, word [rbx + 8]
xor edx, edx
mov rcx, rax
call fcn.1401af400
movzx eax, word [rbx + 8]
mov rcx, rsi
mov rdx, qword [rsp + 0xb0]
cmp eax, edi
cmovl edi, eax
movsxd r8, edi
call fcn.1401afbb0
movzx r8d, word [rbx + 8]
mov rdx, rsi
mov rcx, rbp
call sub.HID.DLL_HidD_SetFeature
lea edx, [r15 - 2]
movzx ebx, al
mov rcx, rsi
call fcn.140006de0
test ebx, ebx
setne al
jmp 0x140013703
cmp r15d, 1
ja 0x1400136fb
movzx ecx, word [r9 + 6]
test cx, cx
je 0x140013701
mov rdi, qword [rsp + 0xb0]
test rdi, rdi
je 0x140013701
movsxd r13, dword [rsp + 0xb8]
movzx eax, cx
cmp r13d, eax
jg 0x140013701
test r15d, r15d
jne 0x1400134ac
cmp qword [rsp + 0xc0], 0
je 0x140013701
cmp dword [rsp + 0xc8], 1
jl 0x140013701
movzx ecx, cx
call fcn.14002174c
mov r14, rax
test rax, rax
je 0x140013701
movzx r8d, word [rbx + 6]
xor edx, edx
mov rcx, rax
call fcn.1401af400
mov r8, r13
mov rdx, rdi
mov rcx, r14
call fcn.1401afbb0
xor r13d, r13d
xorps xmm0, xmm0
xor r9d, r9d
mov qword [rsp + 0x38], r13
xor r8d, r8d
xor ecx, ecx
movdqu xmmword [rsp + 0x40], xmm0
lea edx, [r13 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 0x208], rbp
mov qword [rsp + 0x50], rax
movzx eax, word [rbx + 4]
mov word [rsi + 0x262], ax
test r15d, r15d
jne 0x140013640
mov rax, qword [rsp + 0xc0]
lea edx, [r13 + 1]
mov qword [rsi + 0x248], rax
xor r9d, r9d
mov rax, qword [rsp + 0xd0]
xor r8d, r8d
mov qword [rsi + 0x250], rax
xor ecx, ecx
mov eax, dword [rsp + 0xc8]
mov dword [rsi + 0x258], eax
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r9d, r9d
lea edx, [r13 + 1]
xor r8d, r8d
mov qword [rsi + 0x228], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r9d, r9d
lea edx, [r13 + 1]
xor r8d, r8d
mov qword [rsi + 0x240], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r9d, r9d
lea edx, [r13 + 1]
xor r8d, r8d
mov qword [rsi + 0x230], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 0x238], rax
mov r9, rsi
lea r8, [0x140014a70]
xor edx, edx
lea rax, [rsp + 0x30]
xor ecx, ecx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
call fcn.1401b67b0
mov rcx, qword [rsi + 0x228]
mov edx, 0x1f4
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x14001367c
lea edi, [r13 + 3]
movzx r8d, word [rbx + 6]
lea rax, [rsp + 0x38]
lea r9, [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov rdx, r14
mov dword [rsp + 0xa0], r13d
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsi + 0x230]
mov edx, 0x3c
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140013675
mov eax, edi
dec edi
test eax, eax
jg 0x1400135f2
jmp 0x14001367c
movzx r8d, word [rbx + 6]
lea rax, [rsp + 0x38]
lea r9, [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov rdx, r14
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140013679
mov rcx, qword [rsp + 0x50]
lea edx, [rax + 0x32]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14001367c
mov r12b, 1
mov edx, 1
mov rcx, r14
call fcn.140006de0
test r15d, r15d
jne 0x1400136f0
mov rcx, qword [rsi + 0x240]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rsi + 0x238]
mov edx, 0xc8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbp
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CancelIo]
test ebx, ebx
jne 0x1400136f0
mov rcx, qword [rsi + 0x228]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsi + 0x230]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsi + 0x238]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsi + 0x240]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, r12b
jmp 0x140013703
xor al, al
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret