Function at 0x140056600
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x80
mov qword [rax - 0x58], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rdi, rcx
cmp byte [rcx + 0x78], 0
je 0x140056634
call fcn.140056990
test al, al
je 0x14005696d
lea rsi, [rdi + 0xb0]
mov rax, qword [rsi + 8]
xor r14d, r14d
cmp qword [rsi], rax
jne 0x140056743
lea rax, [rdi + 0xd0]
mov qword [rsp + 0xa8], rax
lea rbx, [rax + 8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
cmp qword [rdi + 0x120], r14
jne 0x1400566f0
mov r8d, dword [0x1401a9d80]
mov ecx, r8d
imul ecx, r8d
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 7
sub ecx, edx
cmp ecx, 3
jne 0x1400566e2
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x2f4
movsxd rdx, r8d
mov eax, 4
mul rdx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400c1e58
mov rcx, rax
call fcn.1400c2f38
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x14005696d
lea rcx, [rdi + 0x100]
lea rdx, [rsp + 0x60]
call fcn.140031d80
mov rdx, rax
mov rax, qword [rax]
test rax, rax
jne 0x140056711
mov rax, r14
jmp 0x140056714
mov rax, qword [rax]
mov rcx, qword [rax + 0x10]
dec rcx
and rcx, qword [rdx + 0x10]
mov rax, qword [rax + 8]
mov rdx, qword [rax + rcx*8]
add rdx, 8
mov rcx, rsi
call fcn.14002d030
mov qword [rdi + 0xc8], r14
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [rsp + 0xa0], r14d
mov rdx, qword [rsi]
mov r8, qword [rsi + 8]
sub r8, rdx
lea rcx, [rdi + 0x80]
add rdx, qword [rdi + 0xc8]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0xa0]
mov rcx, qword [rdi + 0xa8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140056812
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x1400567dd
cmp eax, 0x3e5
je 0x1400567d7
lea rax, str.Channel_write_failure
mov qword [rsp + 0xa8], rax
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x60]
call fcn.1400c5c98
nop
lea rax, vtable.CRSimpleIPCException.0
mov qword [rsp + 0x60], rax
lea rdx, [0x14016cbb0]
lea rcx, [rsp + 0x60]
call fcn.1400ca6e8
int3
mov byte [rdi + 0x78], 1
jmp 0x140056812
lea rcx, [rsp + 0x48]
call fcn.1400c5d10
nop
lea rax, vtable.CRSimpleIPCException.0
mov qword [rsp + 0x48], rax
lea rax, vtable.CRSimpleIPCExceptionDisconnected.0
mov qword [rsp + 0x48], rax
lea rdx, [0x14016cb68]
lea rcx, [rsp + 0x48]
call fcn.1400ca6e8
int3
cmp byte [rdi + 0x78], 0
jne 0x14005690e
mov eax, dword [rsp + 0xa0]
add qword [rdi + 0xc8], rax
mov r8d, dword [0x1401a9d80]
mov ecx, r8d
imul ecx, r8d
imul ecx, r8d
mov eax, 0x6bca1af3
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13
sub ecx, edx
cmp ecx, 0xa
jne 0x14005689c
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x141
movsxd rcx, r8d
mov eax, 4
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400c1e58
mov rcx, rax
call fcn.1400c2f38
mov bpl, 1
mov rax, qword [rsi + 8]
sub rax, qword [rsi]
cmp qword [rdi + 0xc8], rax
jne 0x1400568fb
lea rax, [rdi + 0xd0]
mov qword [rsp + 0xa8], rax
lea rbx, [rax + 8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rcx, [rdi + 0x100]
call fcn.140056dc0
mov rax, qword [rsi]
mov qword [rsi + 8], rax
mov qword [rdi + 0xc8], r14
cmp qword [rdi + 0x120], 0
setne bpl
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rdi + 0xa0]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
movzx eax, bpl
jmp 0x14005696f
mov ecx, dword [0x1401a9d80]
lea r8d, [rcx + 2]
lea eax, [rcx + 1]
imul r8d, eax
imul r8d, ecx
mov eax, 0x92492493
imul r8d
add edx, r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe
sub r8d, edx
cmp r8d, 3
jne 0x14005696d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
xor al, al
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret