Function at 0x14000ce00
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push r14
push r15
sub rsp, 0x38
test dword [rcx + 0x28], 0x200
mov r14, r8
mov r15, rdx
mov rbx, rcx
je 0x14000ce99
cmp qword [rcx + 0x18], 0
jne 0x14000ce99
mov rcx, qword [rcx]
mov edx, 0x20
call fcn.14000aa70
xor ecx, ecx
xor r9d, r9d
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
xor r8d, r8d
xor edx, edx
mov qword [rbx + 0x18], rax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rcx, qword [rbx + 0x18]
mov qword [rcx + 0x18], rax
mov rax, qword [rbx + 0x18]
cmp qword [rax + 0x18], 0
jne 0x14000ce99
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14000ce80
xor esi, esi
mov eax, esi
add rsp, 0x38
pop r15
pop r14
pop rsi
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [rax + 0xafc80]
mov eax, esi
add rsp, 0x38
pop r15
pop r14
pop rsi
pop rbx
ret
cmp byte [rbx + 0x48], 0
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x30], rdi
je 0x14000cf77
test dword [rbx + 0x28], 0x200
mov rbp, qword [r14]
je 0x14000cec5
mov rcx, qword [rbx + 0x88]
call fcn.140010e20
xor esi, esi
cmp dword [rbx + 0x78], esi
jne 0x14000cf10
mov rcx, qword [rbx + 0x80]
mov rdx, rcx
sub rdx, qword [rbx + 0x70]
add rdx, qword [rbx + 0x60]
mov rax, rdx
sar rax, 0x20
mov dword [rsp + 0x78], eax
cmp rdx, rcx
je 0x14000cf00
mov rcx, qword [rbx + 8]
lea r8, [rsp + 0x78]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov qword [rbx + 0x70], rsi
mov qword [rbx + 0x60], rsi
mov dword [rbx + 0x78], 1
nop
test rbp, rbp
je 0x14000cf5b
mov rax, qword [rbx + 0x68]
cmp qword [rbx + 0x60], rax
jne 0x14000cf29
mov rcx, rbx
call fcn.14000ca00
mov esi, eax
mov rcx, qword [rbx + 0x60]
mov rax, qword [rbx + 0x68]
mov rdi, rbp
sub rax, rcx
mov rdx, r15
cmp rbp, rax
cmova rdi, rax
add rcx, qword [rbx + 0x58]
mov r8, rdi
call sub.MSVCR110.dll_memcpy
add qword [rbx + 0x60], rdi
add r15, rdi
sub rbp, rdi
test esi, esi
je 0x14000cf10
test dword [rbx + 0x28], 0x200
je 0x14000cf70
mov rcx, qword [rbx + 0x88]
call fcn.140010e80
mov eax, esi
jmp 0x14000d166
xor esi, esi
cmp byte [rbx + 0x10], sil
jne 0x14000d032
mov qword [rsp + 0x78], rsi
cmp dword [rbx + 0x50], esi
je 0x14000cfd3
mov rcx, qword [rbx + 0x88]
call fcn.140010e20
lea edx, [rsi + 2]
mov rcx, rbx
call fcn.14000d670
mov edi, eax
test eax, eax
je 0x14000cfbb
mov rcx, qword [rbx + 0x88]
call fcn.140010e80
jmp 0x14000d164
lea r8, [rsp + 0x78]
mov edx, 2
mov rcx, rbx
call fcn.14000d400
mov edi, eax
test eax, eax
jne 0x14000cfaa
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x14000cff7
mov eax, dword [rbx + 0x80]
mov dword [rcx + 0x10], eax
mov rcx, qword [rbx + 0x80]
mov rax, qword [rbx + 0x18]
sar rcx, 0x20
mov dword [rax + 0x14], ecx
mov rax, qword [rbx + 0x18]
mov r8d, dword [r14]
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x60]
mov rdx, r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
cmp dword [rbx + 0x50], esi
je 0x14000d052
mov rcx, rbx
call fcn.14000d790
mov rcx, qword [rbx + 0x88]
call fcn.140010e80
jmp 0x14000d052
mov rax, qword [rbx + 0x18]
mov r8d, dword [r14]
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x60]
mov rdx, r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
test edi, edi
je 0x14000d064
mov eax, dword [rsp + 0x60]
mov edi, esi
mov qword [r14], rax
jmp 0x14000d14e
mov qword [r14], rsi
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14000d078
mov edi, esi
jmp 0x14000d14e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea edi, [rax + 0xafc80]
cmp edi, 0xb0065
jne 0x14000d14a
mov rcx, qword [rbx + 0x20]
test rcx, rcx
jne 0x14000d09d
mov ebp, esi
jmp 0x14000d0c2
jns 0x14000d0a4
or ebp, 0xffffffff
jmp 0x14000d0c2
movabs rax, 0x20c49ba5e353f7cf
imul rcx
mov rbp, rdx
sar rbp, 7
mov rax, rbp
shr rax, 0x3f
add rbp, rax
mov rcx, qword [rbx + 0x18]
mov edx, ebp
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
cmp eax, 0xffffffff
je 0x14000d119
test eax, eax
je 0x14000d0f5
cmp eax, 0x102
jne 0x14000d133
mov edi, 0x11177
mov eax, ntohl
test ebp, ebp
cmove edi, eax
jmp 0x14000d133
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rbx + 8]
lea r8, [rsp + 0x60]
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov eax, dword [rsp + 0x60]
mov edi, esi
mov qword [r14], rax
jmp 0x14000d14e
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14000d127
mov edi, esi
jmp 0x14000d14e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea edi, [rax + 0xafc80]
test edi, edi
je 0x14000d14e
cmp dword [0x14001c950], 0xe
jl 0x14000d14a
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CancelIo]
test edi, edi
jne 0x14000d164
cmp qword [rbx + 0x18], rsi
je 0x14000d164
cmp byte [rbx + 0x10], sil
jne 0x14000d164
mov rax, qword [r14]
add qword [rbx + 0x80], rax
mov eax, edi
mov rbp, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x30]
add rsp, 0x38
pop r15
pop r14
pop rsi
pop rbx
ret