Function at 0x140027050
Capabilities:
Clear file content
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xb0
mov rax, qword [0x140077040]
xor rax, rsp
mov qword [rbp + 0xf], rax
mov r15, r9
mov qword [rbp - 0x31], r9
mov rsi, r8
mov qword [rbp - 0x39], r8
mov rdi, rdx
mov rax, qword [rbp + 0x7f]
mov qword [rbp - 0x41], rax
xor r13d, r13d
mov dword [rbp - 0x19], r13d
mov ebx, r13d
nop dword [rax]
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 1]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
mov qword [rbp - 0x49], rax
cmp rax, 0xffffffffffffffff
jne 0x1400270f8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x1400271db
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0x10
jl 0x1400270a0
mov word [rbp - 0x29], 0xfeff
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x19]
mov r8d, 2
lea rdx, [rbp - 0x29]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
call fcn.140002ed0
mov rcx, rax
test rax, rax
je 0x140027677
mov rax, qword [rax]
call qword [rax + 0x18]
lea r14, [rax + 0x18]
mov qword [rbp + 7], r14
mov dword [rbp - 0x51], r13d
mov rcx, qword [rsi]
mov rax, qword [rsi + 8]
sub rax, rcx
sar rax, 3
mov r13d, 0xffffffff
test rax, rax
je 0x140027606
xor edx, edx
mov esi, edx
nop
mov rcx, qword [rcx + rsi*8]
sub rcx, 0x18
call fcn.140002120
lea rbx, [rax + 0x18]
mov qword [rbp - 0x11], rbx
mov rax, qword [r15]
mov rcx, qword [rax + rsi*8]
sub rcx, 0x18
call fcn.140002120
lea rdi, [rax + 0x18]
mov qword [rbp - 1], rdi
mov rax, qword [rbp - 0x41]
mov rax, qword [rax]
mov rcx, qword [rax + rsi*8]
sub rcx, 0x18
call fcn.140002120
lea rsi, [rax + 0x18]
mov qword [rbp - 9], rsi
xor eax, eax
mov r15d, eax
movzx eax, word [rbx]
test ax, ax
je 0x14002724a
mov r12, rbx
xor r13d, r13d
movzx ecx, ax
call fcn.140045dc4
test eax, eax
je 0x1400271e2
mov rax, r12
test r15, r15
cmovne rax, r15
mov r15, rax
jmp 0x1400271e5
xor al, al
jmp 0x140027645
mov r15, r13
add r12, 2
movzx eax, word [r12]
test ax, ax
jne 0x1400271c0
mov r13d, 0xffffffff
test r15, r15
je 0x140027246
sub r15, rbx
sar r15, 1
test r15d, r15d
js 0x140027682
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r15d
or eax, ecx
jge 0x14002722f
mov edx, r15d
lea rcx, [rbp - 0x11]
call fcn.140002b40
mov rbx, qword [rbp - 0x11]
cmp r15d, dword [rbx - 0xc]
jg 0x140027682
mov dword [rbx - 0x10], r15d
movsxd rax, r15d
xor edx, edx
mov word [rbx + rax*2], dx
mov r12, qword [rbp - 0x49]
lea rcx, [rbp - 0x11]
call fcn.1400098f0
mov r15, rdi
xor eax, eax
mov ebx, eax
movzx eax, word [rdi]
test ax, ax
je 0x1400272e0
xor r12d, r12d
movzx ecx, ax
call fcn.140045dc4
test eax, eax
je 0x140027280
mov rax, r15
test rbx, rbx
cmovne rax, rbx
mov rbx, rax
jmp 0x140027283
mov rbx, r12
add r15, 2
movzx eax, word [r15]
test ax, ax
jne 0x140027265
mov r12, qword [rbp - 0x49]
test rbx, rbx
je 0x1400272e0
sub rbx, rdi
sar rbx, 1
test ebx, ebx
js 0x140027682
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, ebx
or eax, ecx
jge 0x1400272c7
mov edx, ebx
lea rcx, [rbp - 1]
call fcn.140002b40
mov rdi, qword [rbp - 1]
cmp ebx, dword [rdi - 0xc]
jg 0x140027682
mov dword [rdi - 0x10], ebx
movsxd rax, ebx
xor r15d, r15d
mov word [rdi + rax*2], r15w
jmp 0x1400272e3
xor r15d, r15d
lea rcx, [rbp - 1]
call fcn.1400098f0
mov rdi, rsi
mov rbx, r15
movzx eax, word [rsi]
test ax, ax
je 0x140027371
nop word [rax + rax]
movzx ecx, ax
call fcn.140045dc4
test eax, eax
je 0x14002731b
mov rax, rdi
test rbx, rbx
cmovne rax, rbx
mov rbx, rax
jmp 0x14002731e
mov rbx, r15
add rdi, 2
movzx eax, word [rdi]
test ax, ax
jne 0x140027300
test rbx, rbx
je 0x140027371
sub rbx, rsi
sar rbx, 1
test ebx, ebx
js 0x140027682
mov ecx, 1
sub ecx, dword [rsi - 8]
mov eax, dword [rsi - 0xc]
sub eax, ebx
or eax, ecx
jge 0x14002735d
mov edx, ebx
lea rcx, [rbp - 9]
call fcn.140002b40
mov rsi, qword [rbp - 9]
cmp ebx, dword [rsi - 0xc]
jg 0x140027682
mov dword [rsi - 0x10], ebx
movsxd rax, ebx
mov word [rsi + rax*2], r15w
lea rcx, [rbp - 9]
call fcn.1400098f0
call fcn.140002ed0
mov rcx, rax
test rax, rax
je 0x14002766c
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x21], rax
test r14, r14
je 0x14002768d
mov rbx, qword [rbp - 0x11]
mov rax, rbx
mov r8, r14
sub r8, rbx
nop
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x1400273c4
add rax, 2
test ecx, ecx
jne 0x1400273b0
test edx, edx
je 0x140027479
lea rcx, [rbx - 0x18]
add r14, 0xffffffffffffffe8
cmp rcx, r14
je 0x140027429
cmp dword [r14 + 0x10], 0
jl 0x140027419
mov rax, qword [r14]
cmp qword [rcx], rax
jne 0x140027419
call fcn.140002120
mov rbx, rax
mov ecx, r13d
lock xadd dword [r14 + 0x10], ecx
sub ecx, 1
jg 0x14002740b
mov rcx, qword [r14]
mov r8, qword [rcx]
mov rdx, r14
call qword [rVariantCopy + 8]
lea rax, [rbx + 0x18]
mov qword [rbp + 7], rax
mov rbx, qword [rbp - 0x11]
jmp 0x140027429
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rbp + 7]
call fcn.140002210
mov r8, rbx
lea rdx, str.__s__r_n
lea rcx, [rbp - 0x21]
call fcn.140004a60
mov rbx, qword [rbp - 0x21]
mov edi, dword [rbx - 0x10]
cmp dword [rbx - 8], 1
jle 0x140027458
mov edx, edi
lea rcx, [rbp - 0x21]
call fcn.140002a20
mov rbx, qword [rbp - 0x21]
lea r8d, [rdi + rdi]
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x19]
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140027578
mov r9, qword [rbp - 9]
mov r8, qword [rbp - 1]
lea rdx, str._s_s_r_n
lea rcx, [rbp - 0x21]
call fcn.140004a60
mov rbx, qword [rbp - 0x21]
cmp dword [rbx - 8], 1
jle 0x1400274ab
mov edx, dword [rbx - 0x10]
lea rcx, [rbp - 0x21]
call fcn.140002a20
mov rbx, qword [rbp - 0x21]
mov r8d, dword [rbx - 0x10]
add r8d, r8d
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x19]
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140027578
lea rdx, [rbx - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400274ea
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rbp - 9]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140027509
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rbp - 1]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140027528
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rbp - 0x11]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140027546
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov edx, dword [rbp - 0x51]
inc edx
mov dword [rbp - 0x51], edx
mov rax, qword [rbp - 0x39]
mov rcx, qword [rax]
mov rax, qword [rax + 8]
sub rax, rcx
sar rax, 3
mov esi, edx
mov r14, qword [rbp + 7]
cmp rsi, rax
jae 0x140027606
mov r15, qword [rbp - 0x31]
jmp 0x140027160
test r12, r12
je 0x140027587
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rdx, [rbx - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400275a2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rbp - 9]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400275c1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rbp - 1]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400275e0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rbp - 0x11]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400275fe
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
xor bl, bl
mov r14, qword [rbp + 7]
jmp 0x140027628
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test r12, r12
je 0x140027626
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
lea rdx, [r14 - 0x18]
lock xadd dword [rdx + 0x10], r13d
sub r13d, 1
jg 0x140027642
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rVariantCopy + 8]
movzx eax, bl
mov rcx, qword [rbp + 0xf]
xor rcx, rsp
call fcn.1400398f0
mov rbx, qword [rsp + 0xf0]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.140002c40
nop
mov ecx, 0x80004005
call fcn.140002c40
nop
mov ecx, 0x80070057
call fcn.140002c40
nop
mov ecx, 0x80004005
call fcn.140002c40
int3