Function at 0x180003f10
Capabilities:
Write file on windows

Disassembly:
push rbp
push r14
push r15
lea rbp, [rsp - 0x290]
sub rsp, 0x390
mov r14, rcx
lea rcx, [rbp + 0x71]
xor edx, edx
mov r8d, 0x103
mov dword [rbp + 0x2c0], 5
mov byte [rbp + 0x70], 0
call fcn.180006fc0
lea rcx, [rbp + 0x181]
xor edx, edx
mov r8d, 0x103
mov byte [rbp + 0x180], 0
call fcn.180006fc0
lea rcx, [rsp + 0x54]
xor r15d, r15d
xor edx, edx
mov r8d, 0x118
mov dword [rsp + 0x50], r15d
call fcn.180006fc0
lea rcx, [0x180017ee0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x180004227
lea rdx, str.RtlGetVersion
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180004227
lea rcx, [rsp + 0x50]
call rax
test eax, eax
jne 0x180004227
mov eax, dword [rsp + 0x54]
cmp eax, 6
jb 0x18000421c
jne 0x180003fd4
cmp dword [rsp + 0x58], 3
jb 0x18000421c
mov qword [rsp + 0x3b0], rbx
mov qword [rsp + 0x3b8], rsi
mov qword [rsp + 0x3c8], rdi
call fcn.180007210
mov ebx, eax
shl ebx, 0x10
call fcn.180007210
mov esi, eax
or esi, ebx
call fcn.180007210
mov ebx, eax
shl ebx, 0x10
call fcn.180007210
mov edx, 0x104
mov edi, eax
lea r9, str..pipe_08x_08x
lea rcx, [rbp + 0x70]
or edi, ebx
mov r8d, edx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], esi
call fcn.1800071ec
mov edx, 0x104
lea r9, str.localhostpipe_08x_08x
lea rcx, [rbp + 0x180]
mov r8d, edx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], esi
call fcn.1800071ec
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov r10, qword [0x180021ea8]
lea r9, [rsp + 0x40]
mov rsi, rax
lea rax, [0x180003da0]
lea rdx, [rbp + 0x70]
lea rcx, [0x1800022f0]
mov r8, rsi
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], rax
call qword [r10 + 0x168]
mov rbx, rax
test rax, rax
jne 0x1800040b3
mov eax, 6
mov dword [rbp + 0x2c0], eax
jmp 0x1800041e3
mov rcx, rax
mov rax, qword [0x180021ea8]
call qword [rax + 0x158]
test eax, eax
jne 0x1800040d6
mov dword [rbp + 0x2c0], 5
jmp 0x1800041cd
test rsi, rsi
je 0x1800040fc
mov edx, 0x1f4
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x180004107
mov dword [rbp + 0x2c0], 5
jmp 0x1800041cd
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x30], r15
lea rcx, [rbp + 0x180]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x180004148
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x2c0], eax
jmp 0x1800041c4
xor r9d, r9d
lea rdx, [0x18001814c]
mov rcx, rax
lea r8d, [r9 + 1]
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x180004170
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1800041b9
mov rcx, qword [rbx + 8]
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rax, qword [0x180021ea8]
mov rcx, rbx
call qword [rax + 0x160]
mov rax, qword [0x180021ea8]
mov rcx, rbx
call qword [rax + 0x148]
mov rcx, qword [rbx + 8]
lea rdx, [rbp + 0x2c0]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
jne 0x1800041bf
mov eax, 6
mov dword [rbp + 0x2c0], eax
test rdi, rdi
je 0x1800041cd
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x180021ea8]
mov rcx, rbx
call qword [rax + 0x140]
mov eax, dword [rbp + 0x2c0]
mov rdi, qword [rsp + 0x3c8]
mov rbx, qword [rsp + 0x3b0]
test rsi, rsi
je 0x180004207
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x2c0]
mov rsi, qword [rsp + 0x3b8]
add rsp, 0x390
pop r15
pop r14
pop rbp
ret
mov ecx, 0x78
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x390
pop r15
pop r14
pop rbp
ret