Function at 0x140001350
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov rbx, rdx
mov r13d, ecx
mov rax, qword [0x1400c5038]
xor rax, rsp
mov qword [rsp + 0x80], rax
call fcn.140016eb0
mov ecx, 3
call fcn.14000dde0
mov ecx, 0x16
call fcn.14000ddf0
call fcn.140014610
mov qword [0x1400c5e20], rax
xor ecx, ecx
mov rdx, rax
call fcn.1400116d0
mov rcx, qword [0x1400c5e20]
mov edx, 2
call fcn.140014950
mov ecx, eax
call fcn.14000dde0
mov rcx, qword [0x1400c5e20]
mov edx, 1
call fcn.140014950
mov ecx, eax
call fcn.14000ddf0
lea rcx, str.PLINK_PROTOCOL
call fcn.14007dd44
test rax, rax
je 0x140001441
mov rcx, rax
call fcn.14000de00
test rax, rax
je 0x140001441
mov rsi, rax
mov ecx, dword [rax + 0xa0]
call fcn.14000dde0
mov ecx, dword [rsi + 0xa4]
call fcn.14000ddf0
mov r8d, dword [rsi + 0xa0]
mov rcx, qword [0x1400c5e20]
mov edx, 2
call fcn.1400150b0
mov r8d, dword [rsi + 0xa4]
mov rcx, qword [0x1400c5e20]
mov edx, 1
call fcn.1400150b0
mov r15d, r13d
add r15d, 0xffffffff
je 0x14000170e
mov dword [rsp + 0x58], 2
xor r14d, r14d
lea rsi, str.plink:_option___s__requires_an_argument_n
lea rdi, str._batch
mov dword [rsp + 0x64], 0
mov dword [rsp + 0x60], 0
mov dword [rsp + 0x5c], 2
jmp 0x1400014ae
add r13d, 0xfffffffe
add rbx, 0x10
mov r15d, r13d
mov rbp, rbx
mov r13d, r15d
mov rbx, rbp
add r15d, 0xffffffff
je 0x1400017d7
mov r9, qword [0x1400c5e20]
cmp r13d, 3
jl 0x1400014d0
mov rdx, qword [rbx + 0x10]
jmp 0x1400014d2
xor edx, edx
mov r12, qword [rbx + 8]
mov rcx, r12
mov r8d, 1
call fcn.14000c2c0
cmp eax, 2
je 0x140001490
lea rbp, [rbx + 8]
cmp eax, 1
je 0x14000149e
cmp eax, 0xfffffffe
jne 0x140001520
mov ecx, 2
call fcn.14006ef00
mov rcx, rax
mov rdx, rsi
mov r8, r12
call fcn.140001170
mov r14b, 1
jmp 0x14000149e
mov rcx, r12
mov rdx, rdi
call fcn.14007ef70
test eax, eax
je 0x1400016ac
mov rcx, r12
lea rdx, [0x1400ac50e]
call fcn.14007ef70
test eax, eax
je 0x1400016b8
mov rcx, r12
lea rdx, [0x1400b1526]
call fcn.14007ef70
test eax, eax
je 0x140001c7c
mov rcx, r12
lea rdx, str.__version
call fcn.14007ef70
test eax, eax
je 0x140001c7c
mov rcx, r12
lea rdx, str.__help
call fcn.14007ef70
test eax, eax
je 0x140001cb0
mov rcx, r12
lea rdx, str._pgpfp
call fcn.14007ef70
test eax, eax
je 0x140001cb5
mov rcx, r12
lea rdx, str._shareexists
call fcn.14007ef70
test eax, eax
je 0x1400016d0
mov rcx, r12
lea rdx, [0x1400ab4e5]
call fcn.14007ef70
test eax, eax
je 0x1400016c3
mov rcx, r12
lea rdx, [0x1400ab4d1]
call fcn.14007ef70
test eax, eax
je 0x1400016c3
mov rcx, r12
lea rdx, str._no_sanitise_stdout
call fcn.14007ef70
test eax, eax
je 0x1400016db
mov rcx, r12
lea rdx, str._no_sanitize_stdout
call fcn.14007ef70
test eax, eax
je 0x1400016db
mov rcx, r12
lea rdx, [0x1400ad21a]
call fcn.14007ef70
test eax, eax
je 0x1400016e8
mov rcx, r12
lea rdx, [0x1400ad206]
call fcn.14007ef70
test eax, eax
je 0x1400016e8
mov rcx, r12
lea rdx, str._no_sanitise_stderr
call fcn.14007ef70
test eax, eax
je 0x1400016f5
mov rcx, r12
lea rdx, str._no_sanitize_stderr
call fcn.14007ef70
test eax, eax
je 0x1400016f5
mov rcx, r12
lea rdx, str._no_antispoof
call fcn.14007ef70
test eax, eax
je 0x140001702
cmp byte [r12], 0x2d
jne 0x14000172a
mov ecx, 2
call fcn.14006ef00
mov rcx, rax
lea rdx, str.plink:_unknown_option___s__n
jmp 0x140001507
mov byte [0x1400c5f00], 1
jmp 0x14000149e
mov al, 1
mov dword [rsp + 0x64], eax
jmp 0x14000149e
mov dword [rsp + 0x5c], 0
jmp 0x14000149e
mov al, 1
mov dword [rsp + 0x60], eax
jmp 0x14000149e
mov dword [rsp + 0x5c], 1
jmp 0x14000149e
mov dword [rsp + 0x58], 0
jmp 0x14000149e
mov dword [rsp + 0x58], 1
jmp 0x14000149e
mov byte [0x1400c5020], 0
jmp 0x14000149e
mov dword [rsp + 0x58], 2
xor esi, esi
mov dword [rsp + 0x60], 0
mov ebx, 2
jmp 0x1400017ee
call fcn.140016610
mov rsi, rax
test r15d, r15d
jle 0x14000178f
mov rdi, rsi
add rdi, 0x18
add rbx, 0x10
lea r13, [rsp + 0x70]
cmp qword [rsi + 0x10], 0
jne 0x140001762
jmp 0x14000176c
add r15d, 0xffffffff
mov r12, qword [rbx]
add rbx, 8
cmp qword [rsi + 0x10], 0
je 0x14000176c
mov rcx, rdi
mov dl, 0x20
call fcn.140015860
mov rcx, r12
call fcn.14007fac0
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], rax
mov rcx, rdi
mov rdx, r13
call fcn.1400157c0
cmp r15d, 2
jge 0x140001750
mov r8, qword [rsi]
mov rcx, qword [0x1400c5e20]
mov edx, 0x14
call fcn.1400152a0
mov rcx, qword [0x1400c5e20]
lea r8, [0x1400b6791]
mov edx, 0x15
call fcn.1400152a0
mov rcx, qword [0x1400c5e20]
mov edx, 0x16
mov r8b, 1
call fcn.140014fc0
mov rcx, rsi
call fcn.140016710
mov edi, 1
test r14b, 1
mov ebx, dword [rsp + 0x5c]
mov esi, dword [rsp + 0x64]
jne 0x140001b44
mov rcx, qword [0x1400c5e20]
call fcn.14000dd80
test al, al
je 0x140001cb0
mov rcx, qword [0x1400c5e20]
call fcn.140016410
mov rcx, qword [0x1400c5e20]
call fcn.14000dc90
test sil, 1
je 0x140001834
mov rcx, qword [0x1400c5e20]
mov edx, 0x2f
mov r8b, 1
call fcn.140014fc0
mov rcx, qword [0x1400c5e20]
mov edx, 2
call fcn.140014950
mov ecx, eax
call fcn.14000de50
test rax, rax
je 0x140001ade
mov rsi, rax
test byte [rax + 0xa8], 2
jne 0x140001af6
call fcn.140011730
cmp qword [0x1400c5ff8], 0
je 0x140001b1b
mov rcx, qword [0x1400c5e20]
mov edx, 2
call fcn.140014950
cmp eax, 3
jne 0x1400018e5
mov rcx, qword [0x1400c5e20]
mov edx, 0xa9
call fcn.140014890
test al, al
jne 0x1400018e5
mov rcx, qword [0x1400c5e20]
mov edx, 0x1e
call fcn.140014890
test al, al
jne 0x1400018e5
mov rcx, qword [0x1400c5e20]
mov edx, 0xaf
xor r8d, r8d
call fcn.140014e10
test rax, rax
jne 0x1400018e5
mov rcx, qword [0x1400c5e20]
mov edx, 0xbe
mov r8b, 1
call fcn.140014fc0
mov rdx, qword [0x1400c5e20]
lea rcx, [0x1400c5010]
call fcn.140007820
mov qword [0x1400c5e28], rax
test byte [rsp + 0x60], 1
jne 0x140001b6a
call fcn.140017680
test al, al
je 0x14000192a
mov rax, qword [0x1400c5010]
lea rcx, [0x1400c5010]
lea rdx, str.Running_with_restricted_process_ACL
call qword [rax]
mov rdi, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff6
call rdi
mov qword [0x1400c5e30], rax
mov ecx, 0xfffffff5
call rdi
mov qword [0x1400c5e00], rax
mov ecx, 0xfffffff4
call rdi
mov qword [0x1400c5e08], rax
mov rcx, qword [0x1400c5e30]
lea rdx, [0x1400c5e38]
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov rcx, qword [0x1400c5e30]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
mov rcx, qword [0x1400c5e00]
lea rdi, [0x1400011e0]
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call fcn.140002af0
mov qword [0x1400c5e10], rax
mov rcx, qword [0x1400c5e08]
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call fcn.140002af0
mov qword [0x1400c5e18], rax
mov rdx, qword [0x1400c5e10]
lea rcx, [0x1400c5e40]
call fcn.140003150
mov rdx, qword [0x1400c5e18]
lea rcx, [0x1400c5e60]
call fcn.140003150
lea rcx, [0x1400c5e48]
mov qword [0x1400c5e80], rcx
lea rax, [0x1400c5e68]
mov qword [0x1400c5e88], rax
test ebx, ebx
mov edi, dword [rsp + 0x58]
je 0x140001a3b
cmp ebx, 2
jne 0x140001a53
mov rcx, qword [0x1400c5e00]
call fcn.140016f20
test al, al
je 0x140001a53
mov rcx, qword [0x1400c5e20]
mov edx, 0x16
call fcn.140014890
test al, al
je 0x140001a53
mov rcx, qword [0x1400c5e80]
mov dl, 1
xor r8d, r8d
call fcn.140016930
mov qword [0x1400c5e90], rax
mov qword [0x1400c5e80], rax
test edi, edi
je 0x140001a81
cmp edi, 2
jne 0x140001aa0
mov rcx, qword [0x1400c5e08]
call fcn.140016f20
test al, al
je 0x140001aa0
mov rcx, qword [0x1400c5e20]
mov edx, 0x16
call fcn.140014890
test al, al
je 0x140001aa0
mov rcx, qword [0x1400c5e88]
mov dl, 1
xor r8d, r8d
call fcn.140016930
mov qword [0x1400c5e98], rax
mov qword [0x1400c5e88], rax
call fcn.1400039e0
mov rcx, qword [0x1400c5e20]
mov edx, 7
call fcn.140014890
test al, al
je 0x140001bac
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
sete r14b
jmp 0x140001baf
mov ecx, 2
call fcn.14006ef00
lea rcx, str.Internal_fault:_Unsupported_protocol_found_n
mov edx, 0x2b
jmp 0x140001b31
mov rsi, qword [rsi + 0x98]
mov ecx, 2
call fcn.14006ef00
lea rdx, str.Plink_doesnt_support__s__which_needs_terminal_emulation_n
mov rcx, rax
mov r8, rsi
call fcn.140001170
jmp 0x140001b3f
mov ecx, 2
call fcn.14006ef00
lea rcx, str.Plink_requires_WinSock_2_n
mov edx, 0x19
mov r8d, 1
mov r9, rax
call fcn.14007da68
mov edi, 1
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14006cf60
mov eax, edi
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rbx, qword [rsi + 0x78]
test rbx, rbx
je 0x140001c5f
mov rsi, qword [0x1400c5e20]
mov rcx, rsi
mov edx, 1
call fcn.140014950
mov edi, eax
mov rcx, qword [0x1400c5e20]
xor edx, edx
call fcn.140014ae0
mov rcx, rax
mov edx, edi
mov r8, rsi
call rbx
xor al, 1
movzx edi, al
jmp 0x140001b44
xor r14d, r14d
mov rcx, qword [0x1400c5e20]
mov edx, 8
call fcn.140014890
mov ebx, eax
mov rcx, qword [0x1400c5e20]
mov edi, 1
mov edx, 1
call fcn.140014950
mov ebp, eax
mov rcx, qword [0x1400c5e20]
xor edx, edx
call fcn.140014ae0
mov rcx, qword [0x1400c5e20]
mov r9, qword [0x1400c5e28]
mov byte [rsp + 0x48], bl
mov byte [rsp + 0x40], r14b
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rdx, section..data
lea r8, [0x1400c5df8]
mov rcx, rsi
call qword [rsi]
test rax, rax
je 0x140001cc4
mov rsi, rax
mov ecx, 2
call fcn.14006ef00
lea rdx, str.Unable_to_open_connection:_n_s
mov rcx, rax
mov r8, rsi
call fcn.140001170
mov rcx, rsi
call fcn.140016210
jmp 0x140001b44
mov rsi, qword [rsi + 0x98]
mov ecx, 2
call fcn.14006ef00
lea rdx, str.Connection_sharing_not_supported_for_this_connection_type___s__n
jmp 0x140001b0e
lea rcx, [0x1400b670d]
call fcn.140014510
mov rsi, rax
lea rcx, str.plink:__s_n_s_n
lea rdx, [0x14009b0a4]
mov r8, rax
call fcn.140002100
mov rcx, rsi
call fcn.140016210
xor ecx, ecx
call fcn.140078628
call fcn.140001d50
call fcn.140004310
mov ecx, 1
call fcn.140078628
mov r8, qword [0x1400c5df8]
mov rcx, qword [0x1400c5e20]
lea r9, section..data
xor edx, edx
call fcn.1400034b0
mov rcx, qword [rsp + 0x68]
call fcn.140016210
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov byte [0x1400c5ea0], 0
lea rcx, [0x1400020a0]
lea rdx, [0x140002030]
xor r8d, r8d
call fcn.140002300
mov rcx, qword [0x1400c5df8]
mov rax, qword [rcx]
call qword [rax + 0x48]
test eax, eax
jns 0x140001d47
mov ecx, 2
call fcn.14006ef00
lea rcx, str.Remote_process_exit_code_unavailable_n
mov edx, 0x25
mov r8d, 1
mov r9, rax
call fcn.14007da68
mov eax, 1
mov ecx, eax
call fcn.140003b70
int3