Function at 0x140056f90
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push r13
push r15
sub rsp, 0x50
mov r15, r8
mov r13, rdx
mov rbx, rcx
cmp rcx, 0x1000
jb 0x1400571f2
movabs rax, 0xffff800000000000
test rax, rcx
jne 0x1400571f2
cmp dword [rcx], 0x19570528
jne 0x1400571f2
cmp byte [rcx + 0x10], 0
jne 0x1400571e3
mov qword [rsp + 0x48], rsi
add rcx, 0x60
mov qword [rsp + 0x40], rdi
call fcn.1400518e0
mov edi, eax
test eax, eax
js 0x1400571cd
cmp dword [rbx + 0x18], 0
jne 0x1400571bf
cmp byte [rbx + 0x12], 0
mov qword [rsp + 0x78], rbp
mov ebp, 0xffffffff
mov qword [rsp + 0x38], r12
mov dword [rbx + 0x18], 1
je 0x14005705b
mov rcx, rbx
call fcn.140055780
mov edi, eax
cmp eax, 0x34
jne 0x140057053
nop
mov rdi, qword [rbx + 0x38]
lea rcx, [rbx + 0x60]
call fcn.140051ac0
mov edx, ebp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rcx, [rbx + 0x60]
call fcn.1400518e0
jmp 0x140057030
test eax, eax
js 0x1400571a4
xor r12d, r12d
mov byte [rbx + 0x15], 0
test r15, r15
je 0x140057175
mov qword [rsp + 0x30], r14
mov rcx, qword [rbx + 0x38]
lea rdi, [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rcx, [rbx + 0x60]
mov byte [rbx + 0x12], 1
call fcn.140051ac0
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x70]
cmp r15, rbp
mov dword [rsp + 0x70], 0
mov r14d, ebp
mov qword [rsp + 0x20], rdi
cmovbe r14d, r15d
mov rdx, r13
mov r8d, r14d
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400570cc
xor edi, edi
lea rcx, [rbx + 0x60]
call fcn.1400518e0
mov byte [rbx + 0x12], dil
jmp 0x14005713f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x140057112
mov rcx, qword [rbx + 0x38]
mov edx, ebp
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 8]
lea r8, [rsp + 0x70]
mov r9d, 1
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x14005711f
xor edi, edi
lea rcx, [rbx + 0x60]
call fcn.1400518e0
mov byte [rbx + 0x12], dil
jmp 0x14005713f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe8
je 0x14005715e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14005db40
lea rcx, [rbx + 0x60]
mov edi, eax
call fcn.1400518e0
mov byte [rbx + 0x12], 0
test edi, edi
js 0x140057170
mov eax, dword [rsp + 0x70]
cmp eax, r14d
cmova eax, r14d
add r13, rax
mov dword [rsp + 0x70], eax
add r12, rax
sub r15, rax
je 0x140057170
jmp 0x140057070
lea rcx, [rbx + 0x60]
mov edi, 0xfffffed3
call fcn.1400518e0
mov byte [rbx + 0x12], 0
mov r14, qword [rsp + 0x30]
mov rax, qword [rsp + 0x88]
test rax, rax
je 0x1400571a4
mov qword [rax], r12
test edi, edi
jns 0x1400571a4
test r12, r12
je 0x1400571a4
cmp edi, 0xfffffffa
je 0x1400571a4
mov r12, qword [rsp + 0x38]
xor edi, edi
add dword [rbx + 0x18], ebp
mov rbp, qword [rsp + 0x78]
jmp 0x1400571c4
cmp edi, 0xfffffed3
jne 0x1400571b0
mov byte [rbx + 0x14], 1
add dword [rbx + 0x18], ebp
mov rbp, qword [rsp + 0x78]
mov r12, qword [rsp + 0x38]
jmp 0x1400571c4
mov edi, 0xffffffea
lea rcx, [rbx + 0x60]
call fcn.140051ac0
mov rsi, qword [rsp + 0x48]
mov eax, edi
mov rdi, qword [rsp + 0x40]
add rsp, 0x50
pop r15
pop r13
pop rbx
ret
mov eax, 0xffffffda
add rsp, 0x50
pop r15
pop r13
pop rbx
ret
mov eax, 0xfffffffc
add rsp, 0x50
pop r15
pop r13
pop rbx
ret