Function at 0x1400b0070
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
cmp qword [r8 + 0x118], 0xffffffffffffffff
mov r12, qword [rsp + 0xe0]
mov r13, qword [rsp + 0xe8]
mov r15d, dword [rsp + 0xf0]
mov rbp, rcx
mov rbx, rdx
mov rsi, r8
mov rdi, r9
je 0x1400b0480
mov dword [rbx + 8], 3
mov qword [rbx + 0x80], rsi
mov qword [rbx + 0x78], 0
mov qword [rbx + 0x70], r13
mov dword [rbx + 0x88], 0
mov qword [rbx + 0xa0], 0
mov qword [rbx + 0xa8], 0xffffffffffffffff
mov qword [rbx + 0x40], 0
mov qword [rbx + 0x48], 0
mov qword [rbx + 0x50], 0
mov qword [rbx + 0x58], 0
test dword [rsi + 0x58], 0x180000
jne 0x1400b0338
mov dword [rbx + 0x90], 0
mov qword [rbx + 0x98], 0
test r12, r12
je 0x1400b0230
mov r13d, dword [rdi]
cmp r12, 1
jne 0x1400b04a0
and r15d, 1
jne 0x1400b04a0
mov r14, qword [rdi]
mov r10, qword [rdi + 8]
mov eax, dword [rsi + 0x58]
mov edx, eax
and edx, 0x1100000
cmp edx, 0x1100000
je 0x1400b03d8
test eax, 0x1000000
je 0x1400b0240
movabs rax, 0xffffffff00000000
mov qword [rbx + 0x98], r10
and r14, rax
mov qword [rbx + 0x68], 0
or r14, r13
mov qword [rbx + 0x90], r14
mov rax, qword [rsi + 0x208]
test rax, rax
je 0x1400b0608
mov rax, qword [rax + 0x68]
mov qword [rbx + 0x68], rax
mov rax, qword [rsi + 0x208]
mov qword [rax + 0x68], rbx
mov eax, dword [rsi + 0x100]
mov qword [rsi + 0x208], rbx
test eax, eax
je 0x1400b05f8
mov qword [rbx + 0x60], r13
add qword [rsi + 0x60], r13
mov eax, dword [rsi + 0x7c]
lea edx, [rax + 1]
mov dword [rsi + 0x7c], edx
test eax, eax
jne 0x1400b030b
mov eax, dword [rsi + 0x58]
test al, 4
je 0x1400b02f0
nop dword [rax]
add dword [rbp + 0x20], 1
add dword [rsi + 0x78], 1
add dword [rsi + 0x100], 1
xor r12d, r12d
mov eax, r12d
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor r10d, r10d
xor r13d, r13d
jmp 0x1400b0155
lea rdx, [rbx + 0x40]
mov rcx, qword [rsi + 0x118]
xor r9d, r9d
mov r8d, r13d
mov qword [rsp + 0x20], rdx
mov rdx, r10
test eax, 0x100000
je 0x1400b0368
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400b0618
mov qword [rbx + 0x60], 0
mov rcx, qword [rbx + 0xa0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0xa0], 0
mov eax, dword [rsi + 0x7c]
lea edx, [rax + 1]
mov dword [rsi + 0x7c], edx
test eax, eax
jne 0x1400b02c8
mov eax, dword [rsi + 0x58]
test al, 4
jne 0x1400b0200
mov edx, eax
or edx, 4
mov dword [rsi + 0x58], edx
test al, 8
je 0x1400b0200
mov rax, qword [rsi + 8]
add dword [rax + 8], 1
mov edx, dword [rsi + 0x7c]
nop dword [rax]
test edx, edx
jg 0x1400b0200
mov r8d, 0x63a
lea rdx, str.src_win_pipe.c
lea rcx, [0x14029de79]
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x1400b0200
mov edx, eax
or edx, 4
mov dword [rsi + 0x58], edx
test al, 8
je 0x1400b0200
mov rax, qword [rsi + 8]
add dword [rax + 8], 1
mov edx, dword [rsi + 0x7c]
test edx, edx
jg 0x1400b0200
mov r8d, 0x65b
lea rdx, str.src_win_pipe.c
lea rcx, [0x14029de79]
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x1400b0200
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0xa0], rax
test rax, rax
je 0x1400b0719
or rax, 1
mov qword [rbx + 0x58], rax
jmp 0x1400b0119
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400b0670
mov qword [rbx + 0x60], 0
test byte [rsi + 0x5a], 8
je 0x1400b01dd
mov rdx, qword [rbx + 0xa0]
lea rcx, [rbx + 0xa8]
mov dword [rsp + 0x28], 4
mov r9, rbx
mov dword [rsp + 0x20], 0xffffffff
lea r8, [0x1400af3a0]
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
test eax, eax
jne 0x1400b01dd
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x20], 0
mov rcx, qword [rsi + 0x118]
mov r8d, r13d
mov rdx, r10
lea r9, [rsp + 0x6c]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400b0700
mov qword [rbx + 0x60], 0
mov eax, dword [rsi + 0x7c]
lea edx, [rax + 1]
mov dword [rsi + 0x7c], edx
test eax, eax
jne 0x1400b0434
mov eax, dword [rsi + 0x58]
test al, 4
jne 0x1400b043c
mov edx, eax
or edx, 4
mov dword [rsi + 0x58], edx
test al, 8
je 0x1400b043c
mov rax, qword [rsi + 8]
add dword [rax + 8], 1
mov edx, dword [rsi + 0x7c]
test edx, edx
jle 0x1400b06c0
add dword [rbp + 0x20], 1
xor r8d, r8d
lea r9, [rbx + 0x40]
xor edx, edx
add dword [rsi + 0x78], 1
add dword [rsi + 0x100], 1
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
jne 0x1400b020f
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x14029dc0f]
mov ecx, eax
call fcn.1400a4140
nop word [rax + rax]
mov r8d, 0x5d7
lea rdx, str.src_win_pipe.c
lea rcx, str.handle__handle___INVALID_HANDLE_VALUE
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x1400b00b2
xor edx, edx
xor r15d, r15d
xor eax, eax
nop word [rax + rax]
shl rax, 4
mov eax, dword [rdi + rax]
add r15, rax
lea eax, [rdx + 1]
mov rdx, rax
cmp r12, rax
ja 0x1400b04b0
mov rax, r15
shr rax, 0x20
jne 0x1400b0690
lea rax, [r15 + 0xb8]
mov rcx, rax
mov qword [rsp + 0x40], rax
call fcn.14009f970
mov r14, rax
test rax, rax
je 0x1400b070e
movdqu xmm0, xmmword [rbx]
lea rax, [rax + 0xb8]
xor r11d, r11d
mov r13d, 0xb8
movups xmmword [rax - 0xb8], xmm0
movdqu xmm1, xmmword [rbx + 0x10]
movups xmmword [rax - 0xa8], xmm1
movdqu xmm2, xmmword [rbx + 0x20]
movups xmmword [rax - 0x98], xmm2
movdqu xmm3, xmmword [rbx + 0x30]
movups xmmword [rax - 0x88], xmm3
movdqu xmm4, xmmword [rbx + 0x40]
movups xmmword [rax - 0x78], xmm4
movdqu xmm5, xmmword [rbx + 0x50]
movups xmmword [rax - 0x68], xmm5
movdqu xmm0, xmmword [rbx + 0x60]
movups xmmword [rax - 0x58], xmm0
movdqu xmm1, xmmword [rbx + 0x70]
movups xmmword [rax - 0x48], xmm1
movdqu xmm2, xmmword [rbx + 0x80]
movups xmmword [rax - 0x38], xmm2
movdqu xmm3, xmmword [rbx + 0x90]
movups xmmword [rax - 0x28], xmm3
movdqu xmm4, xmmword [rbx + 0xa0]
mov qword [rax - 8], rbx
xor ebx, ebx
movups xmmword [rax - 0x18], xmm4
mov dword [rax - 0x30], 1
mov qword [rsp + 0x48], rax
nop dword [rax + rax]
shl rbx, 4
lea rcx, [r14 + r13]
mov dword [rsp + 0x3c], r11d
add rbx, rdi
mov rdx, qword [rbx + 8]
mov r8d, dword [rbx]
call sub.msvcrt.dll_memcpy
mov r11d, dword [rsp + 0x3c]
mov eax, dword [rbx]
lea ebx, [r11 + 1]
add r13, rax
mov r11, rbx
cmp r12, rbx
ja 0x1400b0590
cmp qword [rsp + 0x40], r13
jne 0x1400b06a0
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x50]
mov r8d, r15d
mov rbx, r14
call fcn.14009fb30
mov r14, qword [rsp + 0x50]
mov r10, qword [rsp + 0x58]
mov r13d, r14d
jmp 0x1400b0155
mov rcx, rsi
call fcn.1400afcd0
jmp 0x1400b01d5
mov qword [rbx + 0x68], rbx
jmp 0x1400b01c0
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rdi
cmp eax, 0x3e5
jne 0x1400b064a
mov qword [rbx + 0x60], r13
mov edx, 0xffffffff
add qword [rsi + 0x60], r13
mov rcx, qword [rbx + 0xa0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400b027a
call rdi
mov rcx, qword [rbx + 0xa0]
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0xa0], 0
jmp 0x1400b0212
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rdi
cmp eax, 0x3e5
jne 0x1400b06e0
mov qword [rbx + 0x60], r13
add qword [rsi + 0x60], r13
jmp 0x1400b037e
mov r12d, 0x2747
jmp 0x1400b0212
mov r8d, 0x5c3
lea rdx, str.src_win_pipe.c
lea rcx, str.heap_buffer_offset__heap_buffer_length
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x1400b05cd
mov r8d, 0x60a
lea rdx, str.src_win_pipe.c
lea rcx, [0x14029de79]
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x1400b043c
mov rax, rdi
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
jmp 0x1400b0212
mov r12d, 8
jmp 0x1400b0212
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x14029de3f]
mov ecx, eax
call fcn.1400a4140
nop
nop