Function at 0x140008110
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push r14
push r15
sub rsp, 0x38
test dword [rcx + 0x28], 0x200
mov r14, r8
mov r15, rdx
mov rbx, rcx
je 0x1400081a9
cmp qword [rcx + 0x18], 0
jne 0x1400081a9
mov rcx, qword [rcx]
mov edx, 0x20
call fcn.140003540
xor ecx, ecx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
mov qword [rbx + 0x18], rax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rcx, qword [rbx + 0x18]
mov qword [rcx + 0x18], rax
mov rax, qword [rbx + 0x18]
cmp qword [rax + 0x18], 0
jne 0x1400081a9
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140008190
xor esi, esi
mov eax, esi
add rsp, 0x38
pop r15
pop r14
pop rsi
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [rax + 0xafc80]
mov eax, esi
add rsp, 0x38
pop r15
pop r14
pop rsi
pop rbx
ret
cmp byte [rbx + 0x48], 0
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x30], rdi
je 0x140008287
test dword [rbx + 0x28], 0x200
mov rbp, qword [r14]
je 0x1400081d5
mov rcx, qword [rbx + 0x88]
call fcn.14000ba70
xor esi, esi
cmp dword [rbx + 0x78], esi
jne 0x140008220
mov rcx, qword [rbx + 0x80]
mov rdx, rcx
sub rdx, qword [rbx + 0x70]
add rdx, qword [rbx + 0x60]
mov rax, rdx
sar rax, 0x20
mov dword [rsp + 0x78], eax
cmp rdx, rcx
je 0x140008210
mov rcx, qword [rbx + 8]
lea r8, [rsp + 0x78]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov qword [rbx + 0x70], rsi
mov qword [rbx + 0x60], rsi
mov dword [rbx + 0x78], 1
nop
test rbp, rbp
je 0x14000826b
mov rax, qword [rbx + 0x68]
cmp qword [rbx + 0x60], rax
jne 0x140008239
mov rcx, rbx
call fcn.140007dc0
mov esi, eax
mov rcx, qword [rbx + 0x60]
mov rdi, rbp
mov rax, qword [rbx + 0x68]
mov rdx, r15
sub rax, rcx
cmp rbp, rax
cmova rdi, rax
add rcx, qword [rbx + 0x58]
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
add qword [rbx + 0x60], rdi
add r15, rdi
sub rbp, rdi
test esi, esi
je 0x140008220
test dword [rbx + 0x28], 0x200
je 0x140008280
mov rcx, qword [rbx + 0x88]
call fcn.14000bad0
mov eax, esi
jmp 0x140008476
xor esi, esi
cmp byte [rbx + 0x10], sil
jne 0x140008342
mov qword [rsp + 0x78], rsi
cmp dword [rbx + 0x50], esi
je 0x1400082e3
mov rcx, qword [rbx + 0x88]
call fcn.14000ba70
lea edx, [rsi + 2]
mov rcx, rbx
call fcn.14000c0b0
mov edi, eax
test eax, eax
je 0x1400082cb
mov rcx, qword [rbx + 0x88]
call fcn.14000bad0
jmp 0x140008474
lea r8, [rsp + 0x78]
mov edx, 2
mov rcx, rbx
call fcn.140008740
mov edi, eax
test eax, eax
jne 0x1400082ba
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x140008307
mov eax, dword [rbx + 0x80]
mov dword [rcx + 0x10], eax
mov rcx, qword [rbx + 0x80]
mov rax, qword [rbx + 0x18]
sar rcx, 0x20
mov dword [rax + 0x14], ecx
mov rax, qword [rbx + 0x18]
lea r9, [rsp + 0x60]
mov r8d, dword [r14]
mov rdx, r15
mov rcx, qword [rbx + 8]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
cmp dword [rbx + 0x50], esi
je 0x140008362
mov rcx, rbx
call fcn.14000c1d0
mov rcx, qword [rbx + 0x88]
call fcn.14000bad0
jmp 0x140008362
mov rax, qword [rbx + 0x18]
lea r9, [rsp + 0x60]
mov r8d, dword [r14]
mov rdx, r15
mov rcx, qword [rbx + 8]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
test edi, edi
je 0x140008374
mov eax, dword [rsp + 0x60]
mov edi, esi
mov qword [r14], rax
jmp 0x14000845e
mov qword [r14], rsi
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140008388
mov edi, esi
jmp 0x14000845e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea edi, [rax + 0xafc80]
cmp edi, 0xb0065
jne 0x14000845a
mov rcx, qword [rbx + 0x20]
test rcx, rcx
jne 0x1400083ad
mov ebp, esi
jmp 0x1400083d2
jns 0x1400083b4
or ebp, 0xffffffff
jmp 0x1400083d2
movabs rax, 0x20c49ba5e353f7cf
imul rcx
mov rbp, rdx
sar rbp, 7
mov rax, rbp
shr rax, 0x3f
add rbp, rax
mov rcx, qword [rbx + 0x18]
mov edx, ebp
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
cmp eax, 0xffffffff
je 0x140008429
test eax, eax
je 0x140008405
cmp eax, 0x102
jne 0x140008443
test ebp, ebp
mov edi, 0x11177
mov eax, ntohl
cmove edi, eax
jmp 0x140008443
mov rdx, qword [rbx + 0x18]
lea r8, [rsp + 0x60]
mov rcx, qword [rbx + 8]
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov eax, dword [rsp + 0x60]
mov edi, esi
mov qword [r14], rax
jmp 0x14000845e
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140008437
mov edi, esi
jmp 0x14000845e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea edi, [rax + 0xafc80]
test edi, edi
je 0x14000845e
cmp dword [0x1400152c4], 0xe
jl 0x14000845a
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CancelIo]
test edi, edi
jne 0x140008474
cmp qword [rbx + 0x18], rsi
je 0x140008474
cmp byte [rbx + 0x10], sil
jne 0x140008474
mov rax, qword [r14]
add qword [rbx + 0x80], rax
mov eax, edi
mov rbp, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x30]
add rsp, 0x38
pop r15
pop r14
pop rsi
pop rbx
ret