Function at 0x14000b470
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push r14
push r15
sub rsp, 0x38
test dword [rcx + 0x28], 0x200
mov r14, r8
mov r15, rdx
mov rbx, rcx
je 0x14000b504
cmp qword [rcx + 0x18], 0
jne 0x14000b504
mov rcx, qword [rcx]
mov edx, 0x20
call fcn.140008540
xorps xmm0, xmm0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
mov qword [rbx + 0x18], rax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rcx, qword [rbx + 0x18]
mov qword [rcx + 0x18], rax
mov rax, qword [rbx + 0x18]
cmp qword [rax + 0x18], 0
jne 0x14000b504
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14000b4eb
xor esi, esi
mov eax, esi
add rsp, 0x38
pop r15
pop r14
pop rsi
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [rax + 0xafc80]
mov eax, esi
add rsp, 0x38
pop r15
pop r14
pop rsi
pop rbx
ret
cmp byte [rbx + 0x48], 0
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x30], rdi
je 0x14000b5e7
test dword [rbx + 0x28], 0x200
mov rbp, qword [r14]
je 0x14000b530
mov rcx, qword [rbx + 0x88]
call fcn.14000d1a0
xor esi, esi
cmp dword [rbx + 0x78], esi
jne 0x14000b580
mov rcx, qword [rbx + 0x80]
mov rdx, rcx
sub rdx, qword [rbx + 0x70]
add rdx, qword [rbx + 0x60]
mov rax, rdx
sar rax, 0x20
mov dword [rsp + 0x78], eax
cmp rdx, rcx
je 0x14000b56b
mov rcx, qword [rbx + 8]
lea r8, [rsp + 0x78]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov qword [rbx + 0x70], rsi
mov qword [rbx + 0x60], rsi
mov dword [rbx + 0x78], 1
nop word [rax + rax]
test rbp, rbp
je 0x14000b5cb
mov rcx, qword [rbx + 0x60]
mov rdi, qword [rbx + 0x68]
cmp rcx, rdi
jne 0x14000b5a4
mov rcx, rbx
call fcn.14000ad90
mov rcx, qword [rbx + 0x60]
mov esi, eax
mov rdi, qword [rbx + 0x68]
sub rdi, rcx
mov rdx, r15
cmp rbp, rdi
cmovbe rdi, rbp
add rcx, qword [rbx + 0x58]
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
add qword [rbx + 0x60], rdi
add r15, rdi
sub rbp, rdi
test esi, esi
je 0x14000b580
test dword [rbx + 0x28], 0x200
je 0x14000b5e0
mov rcx, qword [rbx + 0x88]
call fcn.14000d200
mov eax, esi
jmp 0x14000b7d8
xor esi, esi
cmp byte [rbx + 0x10], sil
jne 0x14000b6a2
mov qword [rsp + 0x78], rsi
cmp dword [rbx + 0x50], esi
je 0x14000b643
mov rcx, qword [rbx + 0x88]
call fcn.14000d1a0
lea edx, [rsi + 2]
mov rcx, rbx
call fcn.14000f390
mov edi, eax
test eax, eax
je 0x14000b62b
mov rcx, qword [rbx + 0x88]
call fcn.14000d200
jmp 0x14000b7d6
lea r8, [rsp + 0x78]
mov edx, 2
mov rcx, rbx
call fcn.14000f120
mov edi, eax
test eax, eax
jne 0x14000b61a
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x14000b66b
mov eax, dword [rbx + 0x80]
mov dword [rcx + 0x10], eax
mov rcx, qword [rbx + 0x80]
mov rax, qword [rbx + 0x18]
sar rcx, 0x20
mov dword [rax + 0x14], ecx
mov rcx, qword [rbx + 0x18]
mov r8d, dword [r14]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
mov rdx, r15
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
cmp dword [rbx + 0x50], esi
je 0x14000b6c2
mov rcx, rbx
call fcn.14000f4a0
mov rcx, qword [rbx + 0x88]
call fcn.14000d200
jmp 0x14000b6c2
mov rax, qword [rbx + 0x18]
lea r9, [rsp + 0x60]
mov r8d, dword [r14]
mov rdx, r15
mov rcx, qword [rbx + 8]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
test edi, edi
je 0x14000b6d4
mov eax, dword [rsp + 0x60]
mov edi, esi
mov qword [r14], rax
jmp 0x14000b7c0
mov qword [r14], rsi
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14000b6e8
mov edi, esi
jmp 0x14000b7c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea edi, [rax + 0xafc80]
cmp edi, 0xb0065
jne 0x14000b7bc
mov rcx, qword [rbx + 0x20]
test rcx, rcx
jne 0x14000b70d
mov ebp, esi
jmp 0x14000b734
jns 0x14000b716
mov ebp, 0xffffffff
jmp 0x14000b734
movabs rax, 0x20c49ba5e353f7cf
imul rcx
mov rbp, rdx
sar rbp, 7
mov rax, rbp
shr rax, 0x3f
add rbp, rax
mov rcx, qword [rbx + 0x18]
mov edx, ebp
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
cmp eax, 0xffffffff
je 0x14000b78b
test eax, eax
je 0x14000b767
cmp eax, 0x102
jne 0x14000b7a5
test ebp, ebp
mov edi, 0x11177
mov eax, ntohl
cmove edi, eax
jmp 0x14000b7a5
mov rdx, qword [rbx + 0x18]
lea r8, [rsp + 0x60]
mov rcx, qword [rbx + 8]
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov eax, dword [rsp + 0x60]
mov edi, esi
mov qword [r14], rax
jmp 0x14000b7c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14000b799
mov edi, esi
jmp 0x14000b7c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea edi, [rax + 0xafc80]
test edi, edi
je 0x14000b7c0
cmp dword [0x14001c380], 0xe
jl 0x14000b7bc
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CancelIo]
test edi, edi
jne 0x14000b7d6
cmp qword [rbx + 0x18], rsi
je 0x14000b7d6
cmp byte [rbx + 0x10], sil
jne 0x14000b7d6
mov rax, qword [r14]
add qword [rbx + 0x80], rax
mov eax, edi
mov rbp, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x30]
add rsp, 0x38
pop r15
pop r14
pop rsi
pop rbx
ret