Function at 0x14000f300
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x4c], 0
mov dword [rsp + 0x34], 0
mov rax, qword [rsp + 0x60]
cmp dword [rax + 0x74], 0
je 0x14000f386
mov rcx, qword [rsp + 0x60]
call fcn.14000dfb0
test eax, eax
je 0x14000f371
mov rax, qword [rsp + 0x60]
cmp dword [rax + 0x74], 0
je 0x14000f36f
mov r8d, 0xffffffff
xor edx, edx
xor ecx, ecx
call fcn.14000e9c0
cmp eax, 0xffffffff
jne 0x14000f36d
mov eax, 0xffffffff
jmp 0x14000f6d2
jmp 0x14000f344
jmp 0x14000f386
call fcn.14001b7e4
mov dword [rax], 0xb
mov eax, 0xffffffff
jmp 0x14000f6d2
mov rax, qword [rsp + 0x60]
cmp dword [rax + 0x78], 0
je 0x14000f407
mov rax, qword [rsp + 0x60]
mov ecx, dword [rax + 0x78]
call fcn.14000f290
mov dword [rsp + 0x3c], eax
call fcn.14001b7e4
mov ecx, dword [rsp + 0x3c]
mov dword [rax], ecx
call fcn.14001b7e4
mov r8, qword [rsp + 0x60]
mov edx, dword [rax]
lea rcx, str.write___ERROR:_d_on_prior_unblocking_write__io:_p
call fcn.140003a10
mov rax, qword [rsp + 0x60]
mov dword [rax + 0x78], 0
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x90]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileType]
cmp eax, 3
jne 0x14000f3fd
call fcn.14001b7e4
cmp dword [rax], 0x6d
jne 0x14000f3fd
call fcn.14001b7e4
mov dword [rax], 0x20
mov eax, 0xffffffff
jmp 0x14000f6d2
mov rax, qword [rsp + 0x60]
cmp qword [rax + 0x60], 0
jne 0x14000f46b
mov ecx, 0x19000
call fcn.14001b724
mov rcx, qword [rsp + 0x60]
mov qword [rcx + 0x60], rax
mov rax, qword [rsp + 0x60]
cmp qword [rax + 0x60], 0
jne 0x14000f45f
call fcn.14001b7e4
mov dword [rax], 0xc
call fcn.14001b7e4
mov r8, qword [rsp + 0x60]
mov edx, dword [rax]
lea rcx, str.write___ERROR:_d__io:_p
call fcn.140003a10
mov eax, 0xffffffff
jmp 0x14000f6d2
mov rax, qword [rsp + 0x60]
mov dword [rax + 0x68], 0x19000
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 0x68]
cmp dword [rsp + 0x70], eax
jae 0x14000f483
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x38], eax
jmp 0x14000f48f
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 0x68]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x30], eax
movsxd rax, dword [rsp + 0x30]
mov r9, rax
mov r8, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x60]
call fcn.1400124a0
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
je 0x14000f4dc
mov edx, dword [rsp + 0x34]
lea rcx, [0x140059008]
call fcn.140003a10
mov eax, 0xffffffff
jmp 0x14000f6d2
mov rax, qword [rsp + 0x60]
cmp dword [rax + 0x84], 3
je 0x14000f501
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x90]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileType]
cmp eax, 2
jne 0x14000f53c
mov edx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
call fcn.140010510
test eax, eax
jne 0x14000f52d
mov rax, qword [rsp + 0x60]
mov dword [rax + 0x74], 1
mov rax, qword [rsp + 0x60]
mov ecx, dword [rsp + 0x30]
mov dword [rax + 0x6c], ecx
jmp 0x14000f537
mov eax, 0xffffffff
jmp 0x14000f6d2
jmp 0x14000f60d
mov rax, qword [rsp + 0x60]
add rax, 0x20
lea rcx, [0x14000f1e0]
mov qword [rsp + 0x20], rcx
mov r9, rax
mov r8d, dword [rsp + 0x30]
mov rax, qword [rsp + 0x60]
mov rdx, qword [rax + 0x60]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x90]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFileEx]
test eax, eax
je 0x14000f592
mov rax, qword [rsp + 0x60]
mov dword [rax + 0x74], 1
mov rax, qword [rsp + 0x60]
mov ecx, dword [rsp + 0x30]
mov dword [rax + 0x6c], ecx
jmp 0x14000f60d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, eax
call fcn.14000f290
mov dword [rsp + 0x40], eax
call fcn.14001b7e4
mov ecx, dword [rsp + 0x40]
mov dword [rax], ecx
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x90]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileType]
cmp eax, 3
jne 0x14000f5eb
call fcn.14001b7e4
cmp dword [rax], 0x6d
jne 0x14000f5eb
mov rdx, qword [rsp + 0x60]
lea rcx, str.write___ERROR:read_end_of_the_pipe_closed__io:_p
call fcn.140003a10
call fcn.14001b7e4
mov dword [rax], 0x20
call fcn.14001b7e4
mov r8, qword [rsp + 0x60]
mov edx, dword [rax]
lea rcx, str.write_ERROR_from_cb_2_:_d__io:_p
call fcn.140003a10
mov eax, 0xffffffff
jmp 0x14000f6d2
mov rcx, qword [rsp + 0x60]
call fcn.14000dfb0
test eax, eax
je 0x14000f663
mov rax, qword [rsp + 0x60]
cmp dword [rax + 0x74], 0
je 0x14000f663
mov r8d, 0xffffffff
xor edx, edx
xor ecx, ecx
call fcn.14000e9c0
cmp eax, 0xffffffff
jne 0x14000f661
call fcn.14001b7e4
cmp dword [rax], 4
jne 0x14000f64f
mov rax, qword [rsp + 0x60]
cmp dword [rax + 0x74], 0
je 0x14000f656
mov eax, 0xffffffff
jmp 0x14000f6d2
call fcn.14001b7e4
mov dword [rax], 0
jmp 0x14000f61b
mov edx, 1
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SleepEx]
mov rax, qword [rsp + 0x60]
cmp dword [rax + 0x74], 0
jne 0x14000f6ce
mov rax, qword [rsp + 0x60]
cmp dword [rax + 0x78], 0
je 0x14000f6ce
mov rax, qword [rsp + 0x60]
mov ecx, dword [rax + 0x78]
call fcn.14000f290
mov dword [rsp + 0x44], eax
call fcn.14001b7e4
mov ecx, dword [rsp + 0x44]
mov dword [rax], ecx
mov r8, qword [rsp + 0x60]
mov rax, qword [rsp + 0x60]
mov edx, dword [rax + 0x78]
lea rcx, str.write___ERROR_from_cb:_d__io:_p
call fcn.140003a10
mov rax, qword [rsp + 0x60]
mov dword [rax + 0x78], 0
mov eax, 0xffffffff
jmp 0x14000f6d2
mov eax, dword [rsp + 0x30]
add rsp, 0x58
ret