Function at 0x140004f9c
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
mov r9, rcx
test edx, edx
jne 0x140004faf
lea eax, [rdx - 2]
jmp 0x140005247
cmp qword [0x1403bca20], 0
jne 0x140004fdb
lea r8, str.Program_assertion_failed___no_current_device
lea rdx, str.process_message
mov ecx, 3
call fcn.1400082ac
mov eax, 0xfffffffb
jmp 0x140005247
cmp dword [0x1403bca28], 0
je 0x140005007
mov eax, edx
lea r8, [0x14038704c]
lea rdx, str.install_filter
mov byte [rax + rcx], 0
mov ecx, 1
call fcn.1400082ac
jmp 0x140005245
movsx ecx, byte [rcx]
test ecx, ecx
je 0x14000521c
sub ecx, 1
je 0x140005202
sub ecx, 1
je 0x14000518c
sub ecx, 1
je 0x140005149
sub ecx, 1
je 0x1400050d0
sub ecx, 1
je 0x1400050af
sub ecx, 1
je 0x14000508b
sub ecx, 1
je 0x140005070
lea rdx, str.process_message
cmp ecx, 1
je 0x14000505d
lea r8, str.Unrecognized_installer_message
jmp 0x140004fc7
lea r8, str.Installer_process_completed
xor ecx, ecx
call fcn.1400082ac
jmp 0x140005245
cmp edx, 2
jae 0x140005081
lea r8, str.Set_status:_no_data
jmp 0x140004fc0
movsx eax, byte [r9 + 1]
jmp 0x140005247
lea r8, str.Switching_timeout_back_to_finite
xor ecx, ecx
lea rdx, str.process_message
call fcn.1400082ac
mov dword [0x1403ae520], 0x2710
jmp 0x140005245
lea r8, str.Switching_timeout_to_infinite
xor ecx, ecx
lea rdx, str.process_message
call fcn.1400082ac
or dword [0x1403ae520], 0xffffffff
jmp 0x140005245
call fcn.1400029b0
mov rcx, rax
lea rdx, [rsp + 0x50]
call sub.ADVAPI32.dll_ConvertSidToStringSidA
test eax, eax
je 0x14000512c
mov rdx, qword [rsp + 0x50]
test rdx, rdx
jne 0x1400050f4
xor eax, eax
jmp 0x140005101
mov rcx, rdx
call fcn.14001ad10
mov rdx, qword [rsp + 0x50]
mov rcx, qword [0x1403ae528]
lea r9, [rsp + 0x48]
and qword [rsp + 0x20], 0
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140005245
lea r8, str.No_user_sid___sending_empty_string
mov ecx, 2
lea rdx, str.process_message
call fcn.1400082ac
jmp 0x1400051db
lea r8, str.Got_request_for_hardware_id
xor ecx, ecx
lea rdx, str.process_message
call fcn.1400082ac
mov rax, qword [0x1403bca20]
mov rcx, qword [rax + 0x30]
test rcx, rcx
je 0x140005183
call fcn.14001ad10
mov rdx, qword [0x1403bca20]
mov r8d, eax
mov rdx, qword [rdx + 0x30]
jmp 0x1400051e8
lea r8, str.No_hardware_id___sending_empty_string
jmp 0x1400051cd
lea r8, str.Got_request_for_device_id
xor ecx, ecx
lea rdx, str.process_message
call fcn.1400082ac
mov rax, qword [0x1403bca20]
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x1400051c6
call fcn.14001ad10
mov rdx, qword [0x1403bca20]
mov r8d, eax
mov rdx, qword [rdx + 0x28]
jmp 0x1400051e8
lea r8, str.No_device_id___sending_empty_string
lea rdx, str.process_message
xor ecx, ecx
call fcn.1400082ac
mov r8d, 1
lea rdx, [0x14038735c]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov rcx, qword [0x1403ae528]
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x140005245
cmp edx, 2
jae 0x140005213
lea r8, str.Syslog_message:_no_data
jmp 0x140004fc0
lea rdx, str.syslog
jmp 0x140005234
cmp edx, 2
jae 0x14000522d
lea r8, str.Print_message:_no_data
jmp 0x140004fc0
lea rdx, str.installer_process
inc r9
lea r8, [0x14038704c]
xor ecx, ecx
call fcn.1400082ac
xor eax, eax
add rsp, 0x38
ret