Function at 0x140107bdc
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x17]
mov eax, 0x90
call fcn.14024eae0
sub rsp, rax
mov r15d, r9d
mov rsi, rdx
mov rdi, rcx
call fcn.140108780
mov rdx, qword [rbp + 0x7f]
lea rcx, [rbp - 0x29]
mov r14, rax
xor r12b, r12b
call fcn.14010fb58
lea rax, [0x14027b8b8]
mov edx, 1
mov qword [rbp - 0x29], rax
lea rcx, [rsi + r15]
mov eax, 0x10000
mov qword [rbp + 0x5f], rcx
cmp r15d, eax
mov r13d, eax
mov rax, qword [rbp + 0x77]
cmovb r13d, r15d
mov qword [rbp - 1], rax
and dword [rbp + 0xf], 0
mov eax, r15d
test r15d, r15d
cmove eax, edx
mov qword [rbp + 7], rax
lea rax, [r14 + 0x10000]
cmp rcx, rax
jbe 0x140107d29
cmp qword [rbp - 0x21], 0
je 0x140107d02
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub rax, qword [rbp - 0x11]
cmp rax, 0xfa
jb 0x140107cfa
mov rax, qword [rbp - 0x29]
lea rcx, [fcn.14004fbd0]
mov rax, qword [rax + 0x28]
cmp rax, rcx
je 0x140107caf
lea rcx, [rbp - 0x29]
call qword [case.0x14004a846.0]
mov rax, qword gs:[0x58]
lea rdx, [rbp - 9]
mov rcx, qword [rbp - 0x21]
mov r12d, 0x130
mov rbx, qword [rax]
mov rax, qword [rcx]
inc dword [r12 + rbx]
mov rax, qword [rax + 0x18]
call qword [case.0x14004a846.0]
dec dword [r12 + rbx]
test eax, eax
jne 0x140107ce9
mov ebx, 0x80004004
jmp 0x140107cfc
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov qword [rbp - 0x11], rax
mov qword [0x14037d5d8], rax
xor ebx, ebx
mov rcx, qword [rbp + 0x5f]
jmp 0x140107d04
xor ebx, ebx
test ebx, ebx
js 0x140107e2d
mov rax, qword [rdi]
mov rdx, rcx
mov r8, qword [rbp + 0x7f]
mov rcx, rdi
mov rax, qword [rax + 0x30]
call qword [case.0x14004a846.0]
test eax, eax
setns r12b
and qword [rbp - 0x31], 0
jmp 0x140107de4
mov rdx, qword [rbp + 0x67]
lea rax, [rbp - 0x49]
mov rcx, qword [rdi + 0x28]
lea r9, [rbp + 0x6f]
mov r8d, r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [rdi + 0x34], 0
mov ecx, eax
je 0x140107d89
test eax, eax
jne 0x140107da5
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x140107d8d
mov rcx, qword [rdi + 0x28]
lea r8, [rbp + 0x6f]
mov r9d, 1
lea rdx, [rbp - 0x49]
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x140107da5
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
jne 0x140107e10
mov ecx, dword [rbp + 0x6f]
mov rax, qword [rbp + 0x77]
add rsi, rcx
add qword [rbp + 0x67], rcx
sub r15d, ecx
add dword [rax], ecx
mov rax, rsi
cmp r14, rsi
cmova rax, r14
mov r14, rax
cmp r13d, ecx
jne 0x140107e0b
xor ebx, ebx
test r15d, r15d
je 0x140107e06
mov eax, 0x10000
cmp r15d, eax
mov r13d, eax
cmovb r13d, r15d
and qword [rbp - 0x31], rbx
mov rax, rsi
mov dword [rbp - 0x39], esi
shr rax, 0x20
lea rcx, [rbp - 0x29]
mov dword [rbp - 0x35], eax
call fcn.140106f10
mov ebx, eax
test eax, eax
jns 0x140107d33
jmp 0x140107e10
xor r12b, r12b
jmp 0x140107e10
mov ebx, 0x80004005
test r12b, r12b
je 0x140107e2d
mov rax, qword [rdi]
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
mov rax, qword [rax + 0x30]
call qword [case.0x14004a846.0]
jmp 0x140107e34
mov qword [rdi + 0x98], r14
mov rcx, qword [rbp - 0x21]
lea rax, [0x14027b888]
mov qword [rbp - 0x29], rax
test rcx, rcx
je 0x140107e5a
and qword [rbp - 0x21], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14004a846.0]
mov eax, ebx
mov rbx, qword [rsp + 0xd0]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret