Function at 0x140010580
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x800]
sub rsp, 0x900
mov rax, qword [0x1400988a8]
xor rax, rsp
mov qword [rbp + 0x7f0], rax
mov r14, rdx
mov rbx, rcx
xor edi, edi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [rdi + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r15, rax
cmp rax, 0xffffffffffffffff
jne 0x1400106b8
mov dword [rbp - 0x70], 0xc0ffb0b
mov dword [rbp - 0x6c], 0x4400afe
mov dword [rbp - 0x68], 0x404cf3f0
mov word [rbp - 0x64], 0x69f7
xor eax, eax
mov qword [rbp - 0x62], rax
mov byte [rbp - 0x5a], al
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
movabs r9, 0x901290f1750757f1
nop dword [rax]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x40]
movzx edx, byte [rbp + rax - 0x70]
add rcx, r9
mov rax, rcx
and rax, rdx
imul r8, rax, 0xfffffffffffffffe
add r8, rcx
add r8, rdx
add r8b, 0x69
mov rax, qword [rsp + 0x40]
mov byte [rbp + rax - 0x70], r8b
mov rax, qword [rsp + 0x40]
inc rax
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
cmp rax, 0x17
jb 0x140010620
lea rax, [rbp - 0x50]
movzx ecx, byte [rbp - 0x70]
test cl, cl
je 0x14001068d
lea rdx, [rbp - 0x70]
lea r8, [rbp - 0x50]
sub rdx, r8
nop
mov byte [rax], cl
inc rax
movzx ecx, byte [rdx + rax]
test cl, cl
jne 0x140010680
mov byte [rax], dil
mov r9, rbx
lea r8, [rbp - 0x50]
mov edx, 0x400
lea rcx, [rbp - 0x10]
call fcn.14000b390
lea rcx, [rbp - 0x10]
call fcn.14000b450
mov eax, 0xffffffff
jmp 0x140010860
mov qword [rbp - 0x50], r15
mov ebx, edi
mov esi, dword [r14 + 0x10]
cmp qword [r14 + 0x18], 0x10
jb 0x1400106cc
mov r14, qword [r14]
test esi, esi
jle 0x140010855
nop dword [rax]
nop dword [rax + rax]
mov r8d, esi
sub r8d, ebx
mov dword [rsp + 0x48], edi
movsxd rdx, ebx
add rdx, r14
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x48]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140010714
add ebx, dword [rsp + 0x48]
cmp ebx, esi
jl 0x1400106e0
jmp 0x140010855
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, str.write_err__08x
mov edx, 0x400
lea rcx, [rbp + 0x3f0]
call fcn.14000b390
lea rcx, [rbp + 0x3f0]
call fcn.14000b450
mov dword [rsp + 0x50], 0xb7a89293
mov dword [rsp + 0x54], 0xd5afbc6a
mov dword [rsp + 0x58], 0xdcdaa4d5
mov dword [rsp + 0x5c], 0xd8a9dad6
mov dword [rsp + 0x60], 0x81dc9dd4
mov dword [rsp + 0x64], 0xa3e3e5e5
mov dword [rsp + 0x68], 0xe9f79b5e
mov dword [rsp + 0x6c], 0xe1eb51ad
mov dword [rsp + 0x70], 0xfd54a9e0
mov dword [rsp + 0x74], 0xb448fdf1
mov word [rsp + 0x78], 0x6d8a
xor eax, eax
mov qword [rsp + 0x7a], rax
mov word [rbp - 0x7e], ax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
movabs r9, 0xec0bfce6c45f3e0d
nop word [rax + rax]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x40]
movzx edx, byte [rsp + rax + 0x50]
add rcx, r9
mov rax, rcx
and rax, rdx
imul r8, rax, 0xfffffffffffffffe
add r8, rcx
add r8, rdx
sub r8b, 0x5b
mov rax, qword [rsp + 0x40]
mov byte [rsp + rax + 0x50], r8b
mov rax, qword [rsp + 0x40]
inc rax
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
cmp rax, 0x34
jb 0x1400107c0
lea rax, [rbp - 0x40]
movzx ecx, byte [rsp + 0x50]
test cl, cl
je 0x14001082e
lea rdx, [rsp + 0x50]
lea r8, [rbp - 0x40]
sub rdx, r8
mov byte [rax], cl
inc rax
movzx ecx, byte [rdx + rax]
test cl, cl
jne 0x140010821
mov byte [rax], 0
mov edi, 0xffffffff
mov r9d, edi
lea r8, [rbp - 0x40]
mov edx, 0x400
lea rcx, [rbp - 0x10]
call fcn.14000b390
lea rcx, [rbp - 0x10]
call fcn.14000b450
nop
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rbp + 0x7f0]
xor rcx, rsp
call fcn.1400428d0
mov rbx, qword [rsp + 0x940]
add rsp, 0x900
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret