Function at 0x140087140
Capabilities:
Delete file
Get file size
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x1d0], rbx
mov rax, qword [0x1402ba4e0]
xor rax, rsp
mov qword [rbp + 0x70], rax
mov esi, r8d
mov r14, rdx
mov r13d, ecx
xor ebx, ebx
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x4c], ebx
xor r9d, r9d
lea r8, [rsp + 0x4c]
mov edx, ecx
mov rcx, qword [0x1402c0178]
call fcn.1400d2050
mov r15, rax
test rax, rax
jne 0x1400871b1
lea eax, [rbx + 1]
jmp 0x140087517
mov ecx, 0xe0
call fcn.1400854f0
mov qword [rsp + 0x58], rax
test rax, rax
je 0x1400871d2
mov rcx, rax
call fcn.140095e60
mov rdi, rax
jmp 0x1400871d5
mov rdi, rbx
mov r9d, dword [r15]
mov r8d, dword [r15 + 4]
lea rdx, [r15 + 8]
lea rcx, [rsp + 0x40]
call fcn.140095b00
mov r12d, ebx
test eax, eax
sete r12b
mov ebx, 1
test rdi, rdi
je 0x140087207
mov rax, qword [rdi]
mov edx, ebx
mov rcx, rdi
call qword [rax]
test r12d, r12d
je 0x140087213
mov eax, ebx
jmp 0x140087517
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x1402bfc40]
repne scasb al, byte [rdi]
not rcx
dec rcx
mov dword [rsp + 0x4c], ecx
mov edx, dword [r15]
sub edx, ecx
sub edx, 0xa
mov dword [rsp + 0x48], edx
lea r9, str.ocxdrv32.dll
lea r8, [0x1402bfc40]
mov rcx, qword [rsp + 0x40]
call fcn.1400820f0
mov rdx, r14
lea rcx, [rsp + 0x60]
sub rcx, r14
nop dword [rax + rax]
movzx eax, byte [rdx]
mov byte [rcx + rdx], al
inc rdx
test al, al
jne 0x140087260
test esi, esi
je 0x14008731d
lea rcx, [rsp + 0x60]
call fcn.1400d0090
test eax, eax
je 0x14008731d
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, ebx
mov edx, 0x80000000
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400872de
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x1400872de
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
xor edi, edi
lea rcx, [rsp + 0x60]
call fcn.1400d0090
test eax, eax
je 0x14008731d
nop
cmp edi, 0x64
jge 0x14008731d
inc edi
mov r9d, edi
mov r8, r14
lea rdx, str._s._d
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rsp + 0x60]
call fcn.1400d0090
test eax, eax
jne 0x1400872f0
mov rdi, qword [rsp + 0x40]
cmp dword [0x1402c0634], 0
jne 0x14008745b
cmp r13d, 0xb9
je 0x14008745b
cmp r13d, 0x1396
je 0x14008745b
cmp r13d, 0x1388
je 0x14008745b
cmp r13d, 0x1391
je 0x14008745b
mov rcx, rdi
call fcn.1400d78e0
test eax, eax
je 0x14008745b
mov rcx, rdi
call fcn.1400d7790
mov rsi, rax
mov rcx, rdi
call fcn.14010d304
test rsi, rsi
je 0x14008744c
or r8d, 0xffffffff
or edx, r8d
mov rcx, rsi
call fcn.1400d8fc0
mov rdi, rax
test rax, rax
je 0x1400873b3
mov rcx, rsi
call fcn.14010d304
mov rsi, rdi
jmp 0x1400873d5
cmp dword [0x1402c0968], 0
jne 0x1400873d5
xor r9d, r9d
lea r8, [0x1401ebd68]
lea rdx, str.Rebase_failed
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, rsi
call fcn.1400d8dc0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x60]
repne scasb al, byte [rdi]
not rcx
dec rcx
lea rax, [rsp + 0x60]
sub rax, 3
add rcx, rax
lea rdx, [0x14021fd5c]
call fcn.14010d534
test eax, eax
jne 0x140087414
mov rcx, rsi
call fcn.1400d7ed0
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.1400d7d20
test eax, eax
je 0x140087456
cmp dword [0x1402c0968], 0
jne 0x140087447
xor r9d, r9d
lea r8, [0x1401ebd68]
lea rdx, str.Could_not_save_image.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov r12d, ebx
jmp 0x140087456
mov r12d, ebx
xor ecx, ecx
call fcn.1400d2d50
mov rcx, rsi
jmp 0x1400874d7
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, ebx
mov edx, 0x40000000
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400874c8
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, dword [r15]
mov rdx, qword [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [r15]
cmp dword [rsp + 0x48], ecx
cmovne r12d, ebx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400874d2
mov r12d, ebx
xor ecx, ecx
call fcn.1400d2d50
mov rcx, qword [rsp + 0x40]
call fcn.14010d304
lea rcx, [rsp + 0x60]
call fcn.1400a8590
lea rcx, [rsp + 0x60]
mov rdi, r14
sub rdi, rcx
movzx edx, byte [rcx]
movzx eax, byte [rcx + rdi]
sub edx, eax
jne 0x140087503
inc rcx
test eax, eax
jne 0x1400874f1
test edx, edx
je 0x140087514
mov rdx, r14
lea rcx, [rsp + 0x60]
call fcn.1400d67e0
mov eax, r12d
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.14010d170
mov rbx, qword [rsp + 0x1d0]
add rsp, 0x180
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret