Function at 0x140002b00
Capabilities:
Get file size
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
sub rsp, 0x120
lea rbp, [rsp + 0x70]
and rbp, 0xffffffffffffffe0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0xa0], rax
mov esi, r8d
mov rdi, rdx
call fcn.140001fd0
mov rbx, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140002f0d
xor r14d, r14d
lea rax, [rbp + 0x58]
mov qword [rsp + 0x40], r14
xorps xmm0, xmm0
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov dword [rsp + 0x30], esi
lea rax, [rbp + 0x60]
mov qword [rsp + 0x28], rdi
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
mov rcx, rbx
mov qword [rbp + 0x58], r14
movups xmmword [rbp + 0x60], xmm0
call qword [sym.imp.ntdll.dll_NtWriteFile]
test eax, eax
jns 0x140002c91
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
movabs rdx, 0xc7be0e70576f5fe8
mov ebx, eax
movabs rax, 0xa5cd6dcec74e6b73
mov qword [rbp + 0x48], rax
movabs rax, 0xb86c43b4a6a618ac
mov rcx, qword [rbp + 0x48]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x48], rax
movabs rax, 0xcdeb4ae0b1a46ad6
mov rcx, qword [rbp + 0x48]
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x48], rax
movabs rax, 0xc79e3402381d2dad
mov rcx, qword [rbp + 0x48]
mov qword [rbp + 0x30], rcx
mov rcx, r8
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x38], rax
movabs rax, 0xd2ed09abab270a35
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x80], rax
movabs rax, 0xc84c24dacfd271de
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x88], rax
movabs rax, 0xedca2e81dec813b7
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x90], rax
mov qword [rbp + 0x48], rdx
lea rdx, [rbp + 0x20]
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x98], rax
vmovdqu ymm0, ymmword [rbp + 0x80]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
vzeroupper
call fcn.140003120
lea rdx, [0x140001fb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov edx, ebx
jmp 0x140003002
mov qword [rsp + 0x30], rbx
lea rcx, [rbp + 0x40]
mov dword [rsp + 0x28], 0x1000000
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0xf001f
mov qword [rbp + 0x40], r14
call qword [sym.imp.ntdll.dll_NtCreateSection]
mov edi, eax
movabs rdx, 0xc7be0e70576f5fe8
test eax, eax
je 0x140002dc3
mov r8, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
movabs rax, 0xb79968ced9647e7b
mov qword [rbp + 0x48], rax
movabs rax, 0xe8224bb3bbb1148d
mov rcx, qword [rbp + 0x48]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x48], rax
movabs rax, 0xcdf04ae4b2a172d1
mov rcx, qword [rbp + 0x48]
mov qword [rbp + 0x28], rcx
mov rcx, r8
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x48], rdx
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x38], rax
movabs rax, 0xd2ed09abab270a35
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x80], rax
movabs rax, 0xc84c24dacfd271de
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x88], rax
movabs rax, 0xedca2e81dec813b7
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x90], rax
mov qword [rbp + 0x48], rdx
lea rdx, [rbp + 0x20]
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x98], rax
vmovdqu ymm0, ymmword [rbp + 0x80]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
vzeroupper
call fcn.140003120
lea rdx, [0x140001fb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov edx, edi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
jmp 0x140003008
movabs rax, 0xa0887fe48b7a216e
lea rcx, [rbp + 0x20]
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0xe82b4ab3bbbb03a9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0x83a54da1bba47ad1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0xc7be0e7a23013a9c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0xd2ed09abab270a35
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
movabs rax, 0xc84c24dacfd271de
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
movabs rax, 0xedca2e81dec813b7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
vmovdqu ymm0, ymmword [rbp + 0x80]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
vzeroupper
call fcn.140001d70
lea rdx, [rbp + 0x48]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
lea edi, [rax - 0xc]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp edi, 8
jbe 0x140002efb
nop dword [rax]
lea r9, [rbp + 0x50]
mov qword [rsp + 0x20], r14
mov r8d, 8
lea rdx, [0x14000ccbc]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
sub edi, dword [rbp + 0x50]
cmp edi, 8
ja 0x140002ec0
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtClose]
mov rax, qword [rbp + 0x40]
jmp 0x14000301f
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
movabs rdx, 0xc7be0e70576f5fe8
movabs rax, 0xa6cd6dcec74e6b73
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0xad3845bfbdb151b1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0xedca2ee4b2a17597
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0xd2ed09abab270a35
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
movabs rax, 0xc84c24dacfd271de
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
movabs rax, 0xedca2e81dec813b7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
mov qword [rbp], rdx
lea rdx, [rbp + 0x20]
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
vmovdqu ymm0, ymmword [rbp + 0x80]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
vzeroupper
call fcn.140003120
lea rdx, [0x140001f90]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x1400032f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rax, 0xffffffffffffffff
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.14000a1a0
add rsp, 0x120
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret