Function at 0x140035560
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp dword [rcx + 0x74], 0
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x1400355a8
mov eax, dword [rcx + 0x8c]
shr eax, 2
not eax
test al, 1
je 0x1400355d2
nop dword [rax]
or r8d, 0xffffffff
xor edx, edx
xor ecx, ecx
call fcn.140033c70
cmp eax, 0xffffffff
je 0x1400355dd
cmp dword [rdi + 0x74], 0
jne 0x140035590
mov qword [rsp + 0x40], rbx
mov ebx, dword [rdi + 0x78]
test ebx, ebx
je 0x14003566e
cmp ebx, 0xe
jg 0x1400355fe
je 0x1400355f7
cmp ebx, 1
je 0x1400355f0
jle 0x140035623
cmp ebx, 3
jle 0x140035617
cmp ebx, 5
je 0x140035610
jmp 0x140035623
call fcn.140084fc0
mov dword [rax], inet_ntoa
or eax, 0xffffffff
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov ebx, 0x82
jmp 0x140035623
mov ebx, reloc.WS2_32.dll_inet_ntoa
jmp 0x140035623
cmp ebx, 0x50
je 0x14003561e
cmp ebx, 0x7b
je 0x140035617
cmp ebx, 0x522
jne 0x140035623
mov ebx, reloc.WS2_32.dll_listen
jmp 0x140035623
mov ebx, 2
jmp 0x140035623
mov ebx, setsockopt
call fcn.140084fc0
mov dword [rax], ebx
call fcn.140084fc0
mov r8, rdi
lea rcx, str.write___ERROR:_d_on_prior_unblocking_write__io:_p
mov edx, dword [rax]
call fcn.140046c70
mov rcx, qword [rdi + 0x90]
xor esi, esi
mov dword [rdi + 0x78], esi
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
jne 0x1400356aa
call fcn.140084fc0
cmp dword [rax], 0x6d
jne 0x1400356aa
call fcn.140084fc0
mov dword [rax], 0x20
jmp 0x1400356aa
cmp qword [rdi + 0x60], 0
jne 0x1400356c9
mov ecx, 0x19000
call fcn.140088334
mov qword [rdi + 0x60], rax
test rax, rax
jne 0x1400356c2
call fcn.140084fc0
mov ebx, reloc.WS2_32.dll_inet_ntoa
mov dword [rax], ebx
call fcn.140084fc0
mov r8, rdi
lea rcx, str.write___ERROR:_d__io:_p
mov edx, dword [rax]
call fcn.140046c70
or eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov dword [rdi + 0x68], 0x19000
mov ebx, dword [rdi + 0x68]
mov r8, rbp
mov rcx, qword [rdi + 0x60]
cmp esi, ebx
mov rdx, rsi
cmovb ebx, esi
movsxd r9, ebx
call fcn.140028eb0
test eax, eax
je 0x1400356f7
mov edx, eax
lea rcx, str.memcpy_s_failed_with_error:__d.
call fcn.140046c70
jmp 0x1400356aa
cmp dword [rdi + 0x84], 3
je 0x1400357a4
mov rcx, qword [rdi + 0x90]
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
je 0x1400357a4
mov rdx, qword [rdi + 0x60]
lea rax, [0x140035500]
mov rcx, qword [rdi + 0x90]
lea r9, [rdi + 0x20]
mov r8d, ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFileEx]
test eax, eax
jne 0x1400357b6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140034510
mov ebx, eax
call fcn.140084fc0
mov dword [rax], ebx
mov rcx, qword [rdi + 0x90]
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
jne 0x14003578e
call fcn.140084fc0
cmp dword [rax], 0x6d
jne 0x14003578e
mov rdx, rdi
lea rcx, str.write___ERROR:read_end_of_the_pipe_closed__io:_p
call fcn.140046c70
call fcn.140084fc0
mov dword [rax], 0x20
call fcn.140084fc0
mov r8, rdi
lea rcx, str.write_ERROR_from_cb_2_:_d__io:_p
mov edx, dword [rax]
jmp 0x1400356a5
mov edx, ebx
mov rcx, rdi
call fcn.140037130
test eax, eax
jne 0x1400356aa
mov eax, dword [rdi + 0x8c]
xor esi, esi
shr eax, 2
not eax
mov dword [rdi + 0x6c], ebx
mov dword [rdi + 0x74], 1
test al, 1
je 0x140035806
or r8d, 0xffffffff
xor edx, edx
xor ecx, ecx
call fcn.140033c70
cmp eax, 0xffffffff
jne 0x140035801
call fcn.140084fc0
cmp dword [rax], 4
jne 0x1400356aa
cmp dword [rdi + 0x74], esi
jne 0x1400356aa
call fcn.140084fc0
mov dword [rax], esi
cmp dword [rdi + 0x74], esi
jne 0x1400357d1
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SleepEx]
cmp dword [rdi + 0x74], esi
jne 0x14003584a
mov ebp, dword [rdi + 0x78]
test ebp, ebp
je 0x14003584a
call fcn.140084fc0
mov ecx, ebp
mov rdx, rax
call fcn.140034510
mov dword [rdx], eax
lea rcx, str.write___ERROR_from_cb:_d__io:_p
mov edx, dword [rdi + 0x78]
mov r8, rdi
call fcn.140046c70
mov dword [rdi + 0x78], esi
jmp 0x1400356aa
mov eax, ebx
jmp 0x1400356ad