Function at 0x140014620
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xd0
mov rax, qword [0x1402878c8]
xor rax, rsp
mov qword [rbp + 0x17], rax
xor esi, esi
mov rbx, rdx
mov r13, rcx
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x40000080
xor r9d, r9d
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
lea r8d, [rsi + 3]
mov rcx, rbx
mov r14d, esi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x140014990
lea rdx, [rbp + 7]
mov rcx, rax
call sub.HID.DLL_HidD_GetAttributes
lea rdx, [rbp - 0x69]
mov rcx, r12
call sub.HID.DLL_HidD_GetPreparsedData
mov rcx, qword [rbp - 0x69]
lea rdx, [rbp - 0x39]
call sub.HID.DLL_HidP_GetCaps
mov eax, dword [rbx + 0x434]
lea r15d, [rsi + 1]
cmp eax, 0xb67c044f
je 0x140014854
cmp eax, 0xb683044f
je 0x140014854
cmp eax, 0xb687044f
je 0x140014854
cmp eax, 0xb68d044f
je 0x140014854
cmp eax, 0xb68f044f
je 0x140014854
mov rax, qword [rbp - 0x33]
test ax, ax
je 0x140014990
movzx ecx, ax
call fcn.14002174c
movzx r8d, word [rbp - 0x33]
xor edx, edx
mov rcx, rax
mov rdi, rax
call fcn.1401af400
mov rax, qword [rbx + 0x650]
mov ecx, dword [rax + 0x210]
cmp ecx, 0xb672044f
je 0x140014779
cmp ecx, 0x402044f
je 0x140014779
cmp ecx, 0x404044f
je 0x140014779
cmp ecx, 0xb660044f
je 0x140014779
cmp ecx, 0xb695044f
je 0x140014779
cmp ecx, 0xb698044f
je 0x140014779
cmp ecx, 0xb699044f
je 0x140014779
cmp byte [rbx + 0x412], sil
je 0x140014772
mov word [rdi], 0xa00
mov byte [rdi + 2], r15b
jmp 0x14001477e
mov word [rdi], 0x10a
jmp 0x14001477e
mov word [rdi], 0x101
mov rax, qword [rbp - 0x33]
movzx r15d, ax
test ax, ax
je 0x140014954
movzx ecx, ax
call fcn.14002174c
mov rbx, rax
test rax, rax
je 0x140014954
movzx r8d, word [rbp - 0x33]
xor edx, edx
mov rcx, rax
call fcn.1401af400
mov r8d, r15d
mov rdx, rdi
mov rcx, rbx
call fcn.1401afbb0
xor eax, eax
mov r15d, 1
mov edx, r15d
mov qword [rbp - 0x59], rax
xor r9d, r9d
mov qword [rbp - 0x51], rax
xor r8d, r8d
mov qword [rbp - 0x49], rax
xor ecx, ecx
mov qword [rbp - 0x41], rax
call qword [sym.imp.KERNEL32.dll_CreateEventW]
movzx r8d, word [rbp - 0x33]
lea r9, [rbp - 0x61]
mov qword [rbp - 0x41], rax
mov rdx, rbx
movzx eax, word [rbp - 0x35]
mov rcx, r12
mov word [r13 + 0x262], ax
lea rax, [rbp - 0x59]
mov qword [rsp + 0x20], rax
mov qword [r13 + 0x208], r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140014837
mov rcx, qword [rbp - 0x41]
lea edx, [rax + 0x32]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
cmove esi, r15d
jmp 0x14001483a
mov esi, r15d
mov rdx, r15
mov rcx, rbx
call fcn.140006de0
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14001495a
mov rax, qword [rbp - 0x31]
test ax, ax
je 0x140014990
movzx ecx, ax
call fcn.14002174c
movzx ecx, word [rbp - 0x31]
mov rdi, rax
call fcn.14002174c
movzx r8d, word [rbp - 0x31]
xor edx, edx
mov rcx, rdi
mov r14, rax
call fcn.1401af400
movzx r8d, word [rbp - 0x31]
xor edx, edx
mov rcx, r14
call fcn.1401af400
mov rax, qword [rbx + 0x650]
mov ecx, dword [rax + 0x210]
cmp ecx, 0xb67c044f
je 0x1400148d9
cmp ecx, 0xb683044f
je 0x1400148d9
cmp ecx, 0xb687044f
je 0x1400148d9
mov eax, dword [rbx + 0x434]
add eax, 0x4972fbb1
test eax, 0xfffdffff
jne 0x1400148e2
mov dword [rdi], 0x1044ff2
mov byte [rdi + 4], 0x3f
jmp 0x1400148e2
mov word [rdi], 0x1f1
mov byte [rdi + 2], 0x3f
mov rax, qword [rbp - 0x31]
movzx ebx, ax
test ax, ax
je 0x14001495a
test r14, r14
je 0x14001495a
cmp ebx, r15d
jb 0x14001495a
movzx ecx, ax
call fcn.14002174c
mov r15, rax
test rax, rax
je 0x140014954
movzx r8d, word [rbp - 0x31]
xor edx, edx
mov rcx, rax
call fcn.1401af400
movzx eax, word [rbp - 0x31]
mov rdx, rdi
cmp eax, ebx
mov rcx, r15
cmovb ebx, eax
mov r8d, ebx
call fcn.1401afbb0
movzx r8d, word [rbp - 0x31]
mov rdx, r15
mov rcx, r12
call sub.HID.DLL_HidD_SetFeature
mov edx, 1
movzx ebx, al
mov rcx, r15
call fcn.140006de0
test ebx, ebx
setne sil
mov r15d, 1
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x69]
call sub.HID.DLL_HidD_FreePreparsedData
test rdi, rdi
je 0x14001497c
mov rdx, r15
mov rcx, rdi
call fcn.140006de0
test r14, r14
je 0x14001498c
mov rdx, r15
mov rcx, r14
call fcn.140006de0
mov eax, esi
jmp 0x140014992
xor eax, eax
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1401adf80
mov rbx, qword [rsp + 0x120]
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret