Function at 0x18000a1e0
Capabilities:
Check if file exists
Get file size
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rbx, qword [rcx + 0x58]
xor r13d, r13d
mov dword [rsp + 0x70], r13d
mov r12d, r8d
mov ebp, edx
mov rdi, rcx
mov r14d, r13d
test rbx, rbx
je 0x18000a226
mov edx, 0x1388
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rdx, qword [rdi + 0xa0]
lea rsi, [rdi + 0xb8]
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rax, qword [rdi + 0xa0]
mov byte [rax], r13b
test rbx, rbx
je 0x18000a255
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov r15d, eax
test eax, eax
je 0x18000a2d7
cmp dword [rdi + 0x20], r13d
je 0x18000a326
mov rcx, qword [rdi + 0x50]
lea r8, [rsp + 0x70]
xor r9d, r9d
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
mov ecx, r13d
sete cl
mov dword [rdi + 0x20], ecx
test ebp, ebp
jne 0x18000a2f5
test ecx, ecx
je 0x18000a326
cmp r15d, 0xc00
jae 0x18000a2f5
mov ecx, dword [rdi + 0x24]
test ecx, ecx
je 0x18000a2b5
call qword [sym.imp.WINMM.dll_timeKillEvent]
mov dword [rdi + 0x24], r13d
mov r9, rdi
mov dword [rsp + 0x20], r13d
lea r8, [0x18000a4a0]
mov edx, 0x64
mov ecx, 0x1f4
call qword [sym.imp.WINMM.dll_timeSetEvent]
mov dword [rdi + 0x24], eax
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
test ecx, ecx
je 0x18000a326
mov rcx, qword [rdi + 0x50]
lea r8, [rsp + 0x70]
mov r9d, 1
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov ecx, dword [rdi + 0x24]
mov dword [rdi + 0x20], r13d
test ecx, ecx
je 0x18000a326
call qword [sym.imp.WINMM.dll_timeKillEvent]
mov dword [rdi + 0x24], r13d
lea rbx, [rdi + 0xd0]
mov rax, qword [rbx]
mov byte [rax], r13b
cmp rbx, rsi
je 0x18000a364
mov rax, qword [rsi]
mov rcx, qword [rbx]
mov qword [rbx], rax
mov qword [rsi], rcx
mov rax, qword [rsi + 8]
mov rcx, qword [rbx + 8]
mov qword [rbx + 8], rax
mov qword [rsi + 8], rcx
mov rax, qword [rsi + 0x10]
mov rcx, qword [rbx + 0x10]
mov qword [rbx + 0x10], rax
mov qword [rsi + 0x10], rcx
mov rcx, qword [rdi + 0x50]
test rcx, rcx
jne 0x18000a3c3
cmp qword [rdi + 0x48], 0x10
lea rcx, [rdi + 0x30]
jb 0x18000a37b
mov rcx, qword [rcx]
xor r9d, r9d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x40000080
mov edx, 0x40000000
mov dword [rsp + 0x20], 4
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r9d, 2
xor r8d, r8d
mov rcx, rax
mov qword [rdi + 0x50], rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rcx, qword [rdi + 0x50]
test rcx, rcx
je 0x18000a43c
lea rdx, [rdi + 0x14]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, qword [rdi + 0x50]
lea r9, [rsp + 0x70]
mov dword [rdi + 0x10], eax
mov r8d, r15d
mov rdx, qword [rbx]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x18000a404
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x18000a43c
mov dword [rdi + 0x20], 1
jmp 0x18000a43c
mov ecx, dword [rdi + 0x28]
test ecx, ecx
je 0x18000a415
call qword [sym.imp.WINMM.dll_timeKillEvent]
mov dword [rdi + 0x28], r13d
test r12d, r12d
je 0x18000a43c
mov r9, rdi
mov dword [rsp + 0x20], r13d
lea r8, [0x18000a4c0]
mov edx, 0xa
mov ecx, 0x7d0
call qword [sym.imp.WINMM.dll_timeSetEvent]
mov dword [rdi + 0x28], eax
test r14d, r14d
jne 0x18000a2d7
cmp qword [rdi + 0x48], 0x10
lea rcx, [rdi + 0x30]
jb 0x18000a453
mov rcx, qword [rcx]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x18000a2d7
mov rcx, qword [rdi + 0x50]
test rcx, rcx
je 0x18000a48f
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, qword [rdi + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rdi + 0x28]
mov qword [rdi + 0x50], r13
test ecx, ecx
je 0x18000a48f
call qword [sym.imp.WINMM.dll_timeKillEvent]
mov dword [rdi + 0x28], r13d
mov r14d, 1
jmp 0x18000a364