Function at 0x85c610
Capabilities:
Get file size
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov r8d, 0x20000
mov rsi, rdx
lea r9, [rsp + 0x50]
xor edx, edx
mov rbx, rcx
mov qword [rsp + 0x50], 0
call sym.mdb_txn_begin
mov r12d, eax
test eax, eax
jne 0x85c713
mov r13, qword [rbx + 0x48]
test r13, r13
je 0x85c6a0
mov rcx, qword [rsp + 0x50]
mov edx, 4
call sym.mdb_txn_end
mov r13, qword [rbx + 0xf8]
mov edx, 0xffffffff
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r8d, eax
test eax, eax
je 0x85c730
mov rdx, r13
mov rcx, rbx
call fcn.0085c500
test eax, eax
je 0x85c730
mov r12d, eax
jmp 0x85c709
mov eax, dword [rbx + 0x1c]
mov rbp, qword [rbx + 0x40]
lea edi, [rax + rax]
mov qword [rsp + 0x38], rdi
mov r14, rdi
test edi, edi
je 0x85c898
mov rdi, qword [sym.imp.KERNEL32.dll_WriteFile]
lea r15, [rsp + 0x4c]
mov r9, r15
mov r8d, r14d
mov rdx, rbp
mov rcx, rsi
mov qword [rsp + 0x20], 0
call rdi
test eax, eax
je 0x85c870
mov eax, dword [rsp + 0x4c]
test eax, eax
jne 0x85c818
test r13, r13
je 0x85c808
mov rcx, r13
mov r12d, 5
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rsp + 0x50]
call sym.mdb_txn_abort
mov eax, r12d
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x50]
call sym.mdb_txn_renew0
mov edi, eax
test eax, eax
jne 0x85c830
mov eax, dword [rbx + 0x1c]
mov rbp, qword [rbx + 0x40]
add eax, eax
mov qword [rsp + 0x38], rax
mov r14, rax
test eax, eax
jne 0x85c6ba
mov qword [rsp + 0x38], 0
test r13, r13
je 0x85c860
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [rbx + 0x1c]
mov edi, eax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rbx]
lea rdx, [rsp + 0x58]
imul rdi, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x85c848
mov rbx, qword [rsp + 0x58]
cmp rdi, rbx
cmovbe rbx, rdi
mov rdi, qword [sym.imp.KERNEL32.dll_WriteFile]
lea r15, [rsp + 0x4c]
mov r14d, 0x40000000
sub rbx, qword [rsp + 0x38]
je 0x85c709
cmp rbx, 0x40000000
mov r8, r14
mov r9, r15
mov rdx, rbp
mov qword [rsp + 0x20], 0
cmovbe r8, rbx
mov rcx, rsi
call rdi
test eax, eax
je 0x85c8a6
mov eax, dword [rsp + 0x4c]
test eax, eax
je 0x85c808
add rbp, rax
sub rbx, rax
jne 0x85c7c6
jmp 0x85c709
mov r12d, 5
jmp 0x85c709
mov edx, eax
add rbp, rdx
sub r14d, eax
jne 0x85c6c6
jmp 0x85c766
mov rcx, r13
mov r12d, edi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x85c709
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
test eax, eax
jne 0x85c697
jmp 0x85c7a9
mov eax, dword [rbx + 0x1c]
jmp 0x85c77b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test r13, r13
je 0x85c886
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
test edi, edi
je 0x85c860
mov r12d, edi
jmp 0x85c709
mov qword [rsp + 0x38], 0
jmp 0x85c77b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
jmp 0x85c709
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x268
xor r8d, r8d
mov qword [rsp + 0x38], 0
mov rsi, rcx
mov rbx, rdx
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, 0x200000
mov edx, dword [rsi + 0x20]
mov qword [rsp + 0x68], rax
call qword [sym.imp.msvcrt.dll__aligned_malloc]
mov qword [rsp + 0x70], rax
mov rcx, rax
test rax, rax
je 0x85da58
mov r8d, 0x200000
xor edx, edx
lea r13, [rsp + 0x60]
call sym.memset
mov rax, qword [rsp + 0x70]
mov r9, r13
xor edx, edx
lea r8, [0x0085bb00]
xor ecx, ecx
mov qword [rsp + 0xa0], 0
add rax, 0x100000
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0x78], rax
mov qword [rsp + 0xb0], 2
mov dword [rsp + 0xc0], 0
mov dword [rsp + 0xc4], 1
mov dword [rsp + 0xc8], 0
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0xb8], rbx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r9, [rsp + 0x38]
xor edx, edx
mov rcx, rsi
mov r8d, 0x20000
mov r12, rax
call sym.mdb_txn_begin
mov r14d, eax
test eax, eax
je 0x85d760
mov eax, r14d
add rsp, 0x268
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov eax, dword [rsi + 0x1c]
mov rcx, qword [rsp + 0x70]
xor edx, edx
xor edi, edi
lea r14, [rsp + 0xd0]
lea r15, [rsp + 0x50]
lea r8d, [rax + rax]
lea rbp, [rsp + 0x40]
call sym.memset
mov edx, 8
xor r9d, r9d
xor r8d, r8d
mov qword [rax], 0
mov rcx, rax
mov eax, 8
mov word [rcx + 0xa], ax
movabs rax, 0x1beefc0de
mov qword [rcx + 0x10], rax
mov rax, qword [rsi + 0x78]
mov ebx, dword [rsi + 0x1c]
mov qword [rcx + 0x88], 1
mov qword [rcx + 0x20], rax
movzx eax, word [rsi + 0x18]
mov dword [rcx + 0x28], ebx
add rbx, qword [rsp + 0x70]
or eax, 8
mov qword [rcx + 0x50], 0xffffffffffffffff
mov word [rcx + 0x2c], ax
mov rax, qword [rsi + 0x50]
mov qword [rcx + 0x80], 0xffffffffffffffff
mov rax, qword [rax + 8]
mov qword [rcx + 0x18], rax
movdqu xmm0, xmmword [rcx + 0x10]
mov word [rbx + 0xa], dx
movups xmmword [rbx + 0x10], xmm0
movdqu xmm1, xmmword [rcx + 0x20]
mov qword [rbx], 1
movups xmmword [rbx + 0x20], xmm1
movdqu xmm2, xmmword [rcx + 0x30]
movups xmmword [rbx + 0x30], xmm2
movdqu xmm3, xmmword [rcx + 0x40]
movups xmmword [rbx + 0x40], xmm3
movdqu xmm4, xmmword [rcx + 0x50]
movups xmmword [rbx + 0x50], xmm4
movdqu xmm5, xmmword [rcx + 0x60]
movups xmmword [rbx + 0x60], xmm5
movdqu xmm0, xmmword [rcx + 0x70]
movups xmmword [rbx + 0x70], xmm0
movdqu xmm1, xmmword [rcx + 0x80]
mov rdx, qword [rsp + 0x38]
movups xmmword [rbx + 0x80], xmm1
mov rax, qword [rcx + 0x90]
mov rcx, r14
mov qword [rbx + 0x90], rax
call sym.mdb_cursor_init
jmp 0x85d880
mov rax, qword [rsp + 0x58]
add rdi, qword [rax]
mov r9d, 8
mov r8, r15
mov rdx, rbp
mov rcx, r14
call sym.mdb_cursor_get
test eax, eax
je 0x85d878
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rcx + 0x58]
mov rax, qword [rcx + 0x10]
movdqu xmm2, xmmword [rdx + 0x30]
sub rax, 1
sub rax, qword [rdx + 8]
sub rax, qword [rdx + 0x10]
sub rax, qword [rdx + 0x18]
movups xmmword [rbx + 0x58], xmm2
movdqu xmm3, xmmword [rdx + 0x40]
sub rax, rdi
mov qword [rbx + 0x88], rax
movups xmmword [rbx + 0x68], xmm3
movdqu xmm4, xmmword [rdx + 0x50]
movups xmmword [rbx + 0x78], xmm4
cmp rax, 1
jbe 0x85da70
mov qword [rbx + 0x80], rax
mov qword [rbx + 0x90], 1
mov eax, dword [rsi + 0x1c]
mov qword [rsp + 0x98], rcx
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x60]
mov rbx, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add eax, eax
mov dword [rsp + 0xa0], eax
call rbx
mov eax, dword [rsp + 0xc4]
test eax, eax
je 0x85d95c
mov rsi, qword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
nop
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
xor r9d, r9d
mov r8d, 0xffffffff
call rsi
mov rcx, qword [rsp + 0x60]
mov edx, 0xffffffff
call rbx
mov eax, dword [rsp + 0xc4]
test eax, eax
jne 0x85d930
mov rcx, qword [rsp + 0x60]
mov rdi, qword [sym.imp.KERNEL32.dll_ReleaseMutex]
call rdi
mov rax, qword [rsp + 0x38]
xor r8d, r8d
mov rcx, r13
mov rdx, qword [rax + 0x58]
add rdx, 0x58
call fcn.0085cfb0
mov r14d, eax
test eax, eax
jne 0x85d9a2
movsxd rax, dword [rsp + 0xc8]
mov r14d, dword [rsp + rax*4 + 0xa0]
test r14d, r14d
jne 0x85da40
mov edx, 0xffffffff
mov rcx, r13
call fcn.0085bc60
mov rcx, qword [rsp + 0x60]
mov edx, 0xffffffff
call rbx
mov eax, dword [rsp + 0xc4]
test eax, eax
je 0x85d9fc
mov rsi, qword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
nop dword [rax]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
xor r9d, r9d
mov r8d, 0xffffffff
call rsi
mov rcx, qword [rsp + 0x60]
mov edx, 0xffffffff
call rbx
mov eax, dword [rsp + 0xc4]
test eax, eax
jne 0x85d9d0
mov rcx, qword [rsp + 0x60]
call rdi
mov edx, 0xffffffff
mov rcx, r12
call rbx
mov rcx, qword [rsp + 0x38]
call sym.mdb_txn_abort
mov rcx, qword [rsp + 0x68]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
mov rcx, qword [rsp + 0x60]
call rbx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.msvcrt.dll__aligned_free]
jmp 0x85d743
mov edx, 1
mov rcx, r13
call fcn.0085bc60
mov r14d, eax
jmp 0x85d9a2
call qword [sym.imp.msvcrt.dll__errno]
mov r14d, dword [rax]
jmp 0x85d743
mov qword [rbx + 0x80], 0xffffffffffffffff
jmp 0x85d8f6
and r8d, 1
je 0x85da90
jmp 0x85d620
jmp 0x85c610