Function at 0x18009b9a0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x2f8
mov rax, qword [0x180118258]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
mov r15d, dword [rsp + 0x350]
mov r14, r9
mov rsi, qword [rsp + 0x358]
mov rbx, r8
mov rdi, rdx
mov rbp, rcx
cmp r15d, 1
je 0x18009b9f6
test r15d, r15d
jne 0x18009ba0a
test rsi, rsi
jne 0x18009b9fb
lea eax, [rsi + 0x32]
jmp 0x18009bd83
test rsi, rsi
je 0x18009ba14
cmp dword [rsi + 0x10], 0xc
jne 0x18009ba0a
test dword [rsi + 0x58], 0x1200
jne 0x18009ba14
mov eax, 0x32
jmp 0x18009bd83
mov rax, qword [rsp + 0x360]
xorps xmm0, xmm0
mov qword [rdx + 0x70], rax
mov dword [rdx + 8], 3
mov qword [rdx + 0x80], rbx
mov qword [rdi + 0xa8], 0xffffffffffffffff
mov qword [rsp + 0x2f0], r12
lea r12, [rdx + 0x40]
xor edx, edx
mov qword [rsp + 0x2e8], r13
mov dword [rdi + 0x88], edx
mov qword [rdi + 0xa0], rdx
movups xmmword [r12], xmm0
movups xmmword [r12 + 0x10], xmm0
cmp dword [r8 + 0x110], edx
je 0x18009bc48
mov dword [rsp + 0x40], edx
mov ecx, edx
test rsi, rsi
je 0x18009bad7
mov edx, dword [r8 + 0x1e0]
test edx, edx
jne 0x18009ba9a
call fcn.180003e6d
mov dword [rbx + 0x1e0], eax
mov edx, eax
lea r8, [rsp + 0x50]
mov rcx, rsi
call fcn.18000165e
test eax, eax
jne 0x18009bd73
mov ecx, dword [rsp + 0x40]
mov eax, dword [rsi + 0x118]
or ecx, 2
test dword [rsi + 0x58], 0x1000
mov dword [rsp + 0x2c4], eax
mov dword [rsp + 0x40], ecx
je 0x18009bad7
or ecx, 4
mov dword [rsp + 0x40], ecx
cmp r15d, 1
jne 0x18009baec
mov eax, dword [r14]
or ecx, r15d
mov dword [rsp + 0x40], ecx
mov qword [rsp + 0x48], rax
test cl, 1
jne 0x18009baf6
mov rsi, rdi
jmp 0x18009bb28
cmp dword [rbx + 0x138], 3
je 0x18009bb59
lea rsi, [rbx + 0x130]
xor eax, eax
mov dword [rsi + 8], 3
mov qword [rsi + 0x40], rax
mov qword [rsi + 0x70], rax
mov qword [rsi + 0x80], rbx
mov dword [rsi + 0x88], 1
xorps xmm0, xmm0
lea r15, [rsi + 0x40]
xor r9d, r9d
xor r8d, r8d
movups xmmword [r15], xmm0
xor ecx, ecx
movups xmmword [r15 + 0x10], xmm0
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 0x58], rax
test rax, rax
je 0x18009bf0f
jmp 0x18009bb71
mov ecx, 0xb0
call fcn.180001aeb
mov rsi, rax
test rax, rax
je 0x18009bf24
jmp 0x18009bb06
test byte [rsp + 0x40], 2
lea rdx, [rsp + 0x40]
mov rcx, qword [rbx + 0x118]
mov eax, 0x288
mov r8d, select
mov qword [rsp + 0x20], r15
cmovne r8d, eax
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x18009bbdc
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x18009bbc3
mov rcx, qword [rsi + 0x58]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x18009bbdc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsi + 0x58]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x18009bd73
mov rcx, qword [rsi + 0x58]
mov qword [rsi + 0x60], 0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov qword [rsi + 0x58], rdx
mov ecx, dword [rbx + 0x7c]
lea eax, [rcx + 1]
mov dword [rbx + 0x7c], eax
test ecx, ecx
jne 0x18009bc19
mov eax, dword [rbx + 0x58]
test al, 0x40
jne 0x18009bc19
or eax, 0x40
mov dword [rbx + 0x58], eax
test al, 0x20
je 0x18009bc19
mov rax, qword [rbx + 8]
inc dword [rax + 8]
lea rcx, [rsi + 0x10]
lea r15, [rbp + 0x20]
mov qword [rcx], r15
mov rax, qword [rbp + 0x28]
mov qword [rsi + 0x18], rax
mov qword [rax], rcx
mov qword [rbp + 0x28], rcx
inc dword [rbx + 0x78]
inc dword [rbx + 0x100]
test byte [rsp + 0x40], 1
jne 0x18009bc4c
jmp 0x18009bd71
lea r15, [rcx + 0x20]
mov ecx, dword [rbx + 0x58]
mov eax, ecx
and eax, 0x1200000
cmp eax, 0x1200000
jne 0x18009bcf3
mov r8d, dword [r14]
lea r9, [rsp + 0x30]
mov rcx, qword [rbx + 0x118]
mov qword [rsp + 0x20], rdx
mov rdx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18009bf04
mov qword [rdi + 0x60], 0
mov ecx, dword [rbx + 0x7c]
lea eax, [rcx + 1]
mov dword [rbx + 0x7c], eax
test ecx, ecx
jne 0x18009bcb4
mov eax, dword [rbx + 0x58]
test al, 0x40
jne 0x18009bcb4
or eax, 0x40
mov dword [rbx + 0x58], eax
test al, 0x20
je 0x18009bcb4
mov rax, qword [rbx + 8]
inc dword [rax + 8]
lea rdx, [rdi + 0x10]
mov r9, r12
lea rax, [rbp + 0x20]
xor r8d, r8d
mov qword [rdx], rax
mov rax, qword [rbp + 0x28]
mov qword [rdi + 0x18], rax
mov qword [rax], rdx
mov qword [rbp + 0x28], rdx
xor edx, edx
inc dword [rbx + 0x78]
inc dword [rbx + 0x100]
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
je 0x18009bf36
jmp 0x18009bd71
bt ecx, 0x18
jae 0x18009bda3
movups xmm0, xmmword [r14]
mov rdx, rdi
mov rcx, rbx
movups xmmword [rdi + 0x90], xmm0
call fcn.18009a110
cmp dword [rbx + 0x100], 0
jne 0x18009bd21
call fcn.18009cc90
mov eax, dword [r14]
mov qword [rdi + 0x60], rax
add qword [rbx + 0x60], rax
mov ecx, dword [rbx + 0x7c]
lea eax, [rcx + 1]
mov dword [rbx + 0x7c], eax
test ecx, ecx
jne 0x18009bd51
mov eax, dword [rbx + 0x58]
test al, 0x40
jne 0x18009bd51
or eax, 0x40
mov dword [rbx + 0x58], eax
test al, 0x20
je 0x18009bd51
mov rax, qword [rbx + 8]
inc dword [rax + 8]
mov qword [rdi + 0x10], r15
lea rcx, [rdi + 0x10]
mov rax, qword [rbp + 0x28]
mov qword [rdi + 0x18], rax
mov qword [rax], rcx
mov qword [rbp + 0x28], rcx
inc dword [rbx + 0x78]
inc dword [rbx + 0x100]
xor eax, eax
mov r12, qword [rsp + 0x2f0]
mov r13, qword [rsp + 0x2e8]
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.180002752
add rsp, 0x2f8
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
xor r9d, r9d
bt ecx, 0x15
jae 0x18009be65
xor r8d, r8d
lea edx, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi + 0x58], rax
test rax, rax
je 0x18009bf4b
mov r8d, dword [r14]
xor r9d, r9d
mov rdx, qword [r14 + 8]
mov rcx, qword [rbx + 0x118]
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x18009be4e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x18009be12
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rdi + 0x58]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x18009bd73
mov eax, dword [r14]
mov edx, 0xffffffff
mov qword [rdi + 0x60], rax
add qword [rbx + 0x60], rax
mov rcx, qword [rdi + 0x58]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x18009be56
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rdi + 0x58]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, ebx
call fcn.180001f37
jmp 0x18009bd73
mov qword [rdi + 0x60], 0
mov rcx, qword [rdi + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18009bd2c
mov r8d, dword [r14]
mov rdx, qword [r14 + 8]
mov rcx, qword [rbx + 0x118]
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x18009be9c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x18009bf04
mov eax, dword [r14]
mov qword [rdi + 0x60], rax
add qword [rbx + 0x60], rax
jmp 0x18009bea4
mov qword [rdi + 0x60], 0
test dword [rbx + 0x58], 0x100000
je 0x18009bd2c
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi + 0xa0], rax
test rax, rax
je 0x18009bf60
mov rdx, qword [rdi + 0x58]
lea r8, [0x180099c30]
mov dword [rsp + 0x28], 4
lea rcx, [rdi + 0xa8]
mov r9, rdi
mov dword [rsp + 0x20], 0xffffffff
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
test eax, eax
jne 0x18009bd2c
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18009bd73
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
lea rdx, str.CreateEvent
call fcn.180002982
int3
lea rdx, str.uv__malloc
mov ecx, select
call fcn.180002982
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
lea rdx, str.PostQueuedCompletionStatus
call fcn.180002982
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
lea rdx, str.CreateEvent
call fcn.180002982
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
lea rdx, str.CreateEvent
call fcn.180002982
int3