Function at 0x1400a38e0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push r14
push r15
sub rsp, 0x38
test dword [rcx + 0x28], 0x200
mov r14, r8
mov r15, rdx
mov rbx, rcx
je 0x1400a3979
cmp qword [rcx + 0x18], 0
jne 0x1400a3979
mov rcx, qword [rcx]
mov edx, 0x20
call fcn.1400a0a70
xor ecx, ecx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
mov qword [rbx + 0x18], rax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rcx, qword [rbx + 0x18]
mov qword [rcx + 0x18], rax
mov rax, qword [rbx + 0x18]
cmp qword [rax + 0x18], 0
jne 0x1400a3979
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400a3960
xor esi, esi
mov eax, esi
add rsp, 0x38
pop r15
pop r14
pop rsi
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [rax + 0xafc80]
mov eax, esi
add rsp, 0x38
pop r15
pop r14
pop rsi
pop rbx
ret
cmp byte [rbx + 0x48], 0
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x30], rdi
je 0x1400a3a57
test dword [rbx + 0x28], 0x200
mov rbp, qword [r14]
je 0x1400a39a5
mov rcx, qword [rbx + 0x88]
call fcn.1400a1830
xor esi, esi
cmp dword [rbx + 0x78], esi
jne 0x1400a39f0
mov rcx, qword [rbx + 0x80]
mov rdx, rcx
sub rdx, qword [rbx + 0x70]
add rdx, qword [rbx + 0x60]
mov rax, rdx
sar rax, 0x20
mov dword [rsp + 0x78], eax
cmp rdx, rcx
je 0x1400a39e0
mov rcx, qword [rbx + 8]
lea r8, [rsp + 0x78]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov qword [rbx + 0x70], rsi
mov qword [rbx + 0x60], rsi
mov dword [rbx + 0x78], 1
nop
test rbp, rbp
je 0x1400a3a3b
mov rax, qword [rbx + 0x68]
cmp qword [rbx + 0x60], rax
jne 0x1400a3a09
mov rcx, rbx
call fcn.1400a3560
mov esi, eax
mov rcx, qword [rbx + 0x60]
mov rdi, rbp
mov rax, qword [rbx + 0x68]
mov rdx, r15
sub rax, rcx
cmp rbp, rax
cmova rdi, rax
add rcx, qword [rbx + 0x58]
mov r8, rdi
call fcn.1400c0dd0
add qword [rbx + 0x60], rdi
add r15, rdi
sub rbp, rdi
test esi, esi
je 0x1400a39f0
test dword [rbx + 0x28], 0x200
je 0x1400a3a50
mov rcx, qword [rbx + 0x88]
call fcn.1400a1890
mov eax, esi
jmp 0x1400a3c46
xor esi, esi
cmp byte [rbx + 0x10], sil
jne 0x1400a3b12
mov qword [rsp + 0x78], rsi
cmp dword [rbx + 0x50], esi
je 0x1400a3ab3
mov rcx, qword [rbx + 0x88]
call fcn.1400a1830
lea edx, [rsi + 2]
mov rcx, rbx
call fcn.1400a8f10
mov edi, eax
test eax, eax
je 0x1400a3a9b
mov rcx, qword [rbx + 0x88]
call fcn.1400a1890
jmp 0x1400a3c44
lea r8, [rsp + 0x78]
mov edx, 2
mov rcx, rbx
call fcn.1400a8ca0
mov edi, eax
test eax, eax
jne 0x1400a3a8a
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x1400a3ad7
mov eax, dword [rbx + 0x80]
mov dword [rcx + 0x10], eax
mov rcx, qword [rbx + 0x80]
mov rax, qword [rbx + 0x18]
sar rcx, 0x20
mov dword [rax + 0x14], ecx
mov rax, qword [rbx + 0x18]
lea r9, [rsp + 0x60]
mov r8d, dword [r14]
mov rdx, r15
mov rcx, qword [rbx + 8]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
cmp dword [rbx + 0x50], esi
je 0x1400a3b32
mov rcx, rbx
call fcn.1400a9030
mov rcx, qword [rbx + 0x88]
call fcn.1400a1890
jmp 0x1400a3b32
mov rax, qword [rbx + 0x18]
lea r9, [rsp + 0x60]
mov r8d, dword [r14]
mov rdx, r15
mov rcx, qword [rbx + 8]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
test edi, edi
je 0x1400a3b44
mov eax, dword [rsp + 0x60]
mov edi, esi
mov qword [r14], rax
jmp 0x1400a3c2e
mov qword [r14], rsi
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400a3b58
mov edi, esi
jmp 0x1400a3c2e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea edi, [rax + 0xafc80]
cmp edi, 0xb0065
jne 0x1400a3c2a
mov rcx, qword [rbx + 0x20]
test rcx, rcx
jne 0x1400a3b7d
mov ebp, esi
jmp 0x1400a3ba2
jns 0x1400a3b84
or ebp, 0xffffffff
jmp 0x1400a3ba2
movabs rax, 0x20c49ba5e353f7cf
imul rcx
mov rbp, rdx
sar rbp, 7
mov rax, rbp
shr rax, 0x3f
add rbp, rax
mov rcx, qword [rbx + 0x18]
mov edx, ebp
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
cmp eax, 0xffffffff
je 0x1400a3bf9
test eax, eax
je 0x1400a3bd5
cmp eax, 0x102
jne 0x1400a3c13
test ebp, ebp
mov edi, 0x11177
mov eax, reloc.WS2_32.dll_inet_addr
cmove edi, eax
jmp 0x1400a3c13
mov rdx, qword [rbx + 0x18]
lea r8, [rsp + 0x60]
mov rcx, qword [rbx + 8]
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov eax, dword [rsp + 0x60]
mov edi, esi
mov qword [r14], rax
jmp 0x1400a3c2e
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400a3c07
mov edi, esi
jmp 0x1400a3c2e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea edi, [rax + 0xafc80]
test edi, edi
je 0x1400a3c2e
cmp dword [0x140175f00], 0xe
jl 0x1400a3c2a
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CancelIo]
test edi, edi
jne 0x1400a3c44
cmp qword [rbx + 0x18], rsi
je 0x1400a3c44
cmp byte [rbx + 0x10], sil
jne 0x1400a3c44
mov rax, qword [r14]
add qword [rbx + 0x80], rax
mov eax, edi
mov rbp, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x30]
add rsp, 0x38
pop r15
pop r14
pop rsi
pop rbx
ret