Function at 0x140003920
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x14028a3e8]
xor rax, rsp
mov qword [rbp - 0x20], rax
mov rdi, rdx
mov rsi, rcx
movzx edx, word [rcx + 0xe]
mov eax, edx
and eax, 7
cmp eax, 5
ja case.default.0x140003971
lea r8, sym.imp.advapi32.dll_RegEnumKeyW
cdqe
mov ecx, dword [r8 + rax*4 + 0x411c]
add rcx, r8
jmp rcx
mov rcx, rdi
call fcn.140004ad0
mov rbx, qword [rdi]
mov r8, qword [rbx + 0x18]
mov rax, r8
cmp r8, qword [rbx + 0x10]
jb 0x1400039ac
mov rcx, qword [rbx + 8]
cmp r8, rcx
je 0x1400039ac
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call fcn.140191600
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
mov byte [rax], WSAGetLastError
inc qword [rbx + 0x18]
mov rbx, qword [rdi]
mov r8, qword [rbx + 0x18]
mov rax, r8
cmp r8, qword [rbx + 0x10]
jb 0x1400039e4
mov rcx, qword [rbx + 8]
cmp r8, rcx
je 0x1400039e4
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call fcn.140191600
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
mov byte [rax], 0x75
inc qword [rbx + 0x18]
mov rbx, qword [rdi]
mov r8, qword [rbx + 0x18]
mov rax, r8
cmp r8, qword [rbx + 0x10]
jb 0x140003a1c
mov rcx, qword [rbx + 8]
cmp r8, rcx
je 0x140003a1c
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call fcn.140191600
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
mov byte [rax], 0x6c
inc qword [rbx + 0x18]
mov rbx, qword [rdi]
mov r8, qword [rbx + 0x18]
mov rax, r8
cmp r8, qword [rbx + 0x10]
jb 0x140003a54
mov rcx, qword [rbx + 8]
cmp r8, rcx
je 0x140003a54
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call fcn.140191600
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
mov byte [rax], 0x6c
inc qword [rbx + 0x18]
jmp 0x1400040f6
mov rcx, rdi
call fcn.140004ad0
xor edx, edx
mov rcx, rdi
call fcn.140004830
jmp 0x1400040f8
mov rcx, rdi
call fcn.140004ad0
mov dl, 1
mov rcx, rdi
call fcn.140004830
jmp 0x1400040f8
mov rcx, rdi
call fcn.140004ad0
mov rcx, qword [rdi + 0x20]
lea rax, [rcx + 0x10]
cmp rax, qword [rdi + 0x28]
jbe 0x140003ab1
lea rcx, [rdi + 8]
call fcn.140004da0
mov rcx, qword [rdi + 0x20]
xor ebx, ebx
lea rax, [rcx + 0x10]
mov qword [rdi + 0x20], rax
mov qword [rcx], rbx
mov byte [rcx + 8], bl
mov rbx, qword [rdi]
mov r8, qword [rbx + 0x18]
mov rax, r8
cmp r8, qword [rbx + 0x10]
jb 0x140003af2
mov rcx, qword [rbx + 8]
cmp r8, rcx
je 0x140003af2
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call fcn.140191600
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
mov byte [rax], 0x7b
movabs r12, 0xffffffffffff
inc qword [rbx + 0x18]
mov rax, qword [rsi + 8]
mov ecx, dword [rsi]
and rax, r12
shl rcx, 5
add rcx, rax
cmp rax, rcx
je 0x140003ba4
lea rbx, [rax + 0xd]
mov r13d, reloc.WS2_32.dll_listen
mov eax, 0x1000
nop dword [rax + rax]
test word [rbx + 1], ax
je 0x140003b45
movsx eax, byte [rbx]
lea r15, [rbx - 0xd]
mov r14d, r13d
sub r14d, eax
jmp 0x140003b50
mov r15, qword [rbx - 5]
mov r14d, dword [rbx - 0xd]
and r15, r12
mov rcx, rdi
call fcn.140004ad0
mov r8d, r14d
mov rdx, r15
mov rcx, rdi
call fcn.140004550
test al, al
je 0x140003d8a
lea rcx, [rbx + 3]
mov rdx, rdi
call fcn.140003920
test al, al
je 0x140003d8a
mov ecx, dword [rsi]
add rbx, 0x20
mov rax, qword [rsi + 8]
and rax, r12
shl rcx, 5
add rcx, rax
lea rax, [rbx - 0xd]
cmp rax, rcx
mov eax, 0x1000
jne 0x140003b30
add qword [rdi + 0x20], 0xfffffffffffffff0
mov rax, qword [rdi + 0x20]
cmp qword [rax], 0
je 0x140003bf3
mov rbx, qword [rdi]
mov r8, qword [rbx + 0x18]
mov rax, r8
cmp r8, qword [rbx + 0x10]
jb 0x140003be4
mov rcx, qword [rbx + 8]
cmp r8, rcx
je 0x140003be4
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call fcn.140191600
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
mov byte [rax], 0xa
mov rcx, rdi
inc qword [rbx + 0x18]
call fcn.140004a10
mov rbx, qword [rdi]
mov r8, qword [rbx + 0x18]
mov rax, r8
cmp r8, qword [rbx + 0x10]
jb 0x140003c24
mov rcx, qword [rbx + 8]
cmp r8, rcx
je 0x140003c24
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call fcn.140191600
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
mov byte [rax], 0x7d
jmp 0x140003d47
mov rcx, rdi
call fcn.140004ad0
mov rcx, qword [rdi + 0x20]
lea rax, [rcx + 0x10]
cmp rax, qword [rdi + 0x28]
jbe 0x140003c4f
lea rcx, [rdi + 8]
call fcn.140004da0
mov rcx, qword [rdi + 0x20]
xor ebx, ebx
lea rax, [rcx + 0x10]
mov qword [rdi + 0x20], rax
mov qword [rcx], rbx
mov byte [rcx + 8], 1
mov rbx, qword [rdi]
mov r8, qword [rbx + 0x18]
mov rax, r8
cmp r8, qword [rbx + 0x10]
jb 0x140003c91
mov rcx, qword [rbx + 8]
cmp r8, rcx
je 0x140003c91
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call fcn.140191600
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
mov byte [rax], 0x5b
movabs r12, 0xffffffffffff
inc qword [rbx + 0x18]
mov rbx, qword [rsi + 8]
mov eax, dword [rsi]
and rbx, r12
shl rax, 4
add rax, rbx
cmp rbx, rax
je 0x140003cec
nop word [rax + rax]
mov rdx, rdi
mov rcx, rbx
call fcn.140003920
test al, al
je 0x140003d8a
mov ecx, dword [rsi]
add rbx, 0x10
mov rax, qword [rsi + 8]
shl rcx, 4
and rax, r12
add rcx, rax
cmp rbx, rcx
jne 0x140003cc0
add qword [rdi + 0x20], 0xfffffffffffffff0
mov rax, qword [rdi + 0x20]
cmp qword [rax], 0
je 0x140003d13
test byte [rdi + 0x48], 1
jne 0x140003d13
mov rcx, qword [rdi]
mov dl, 0xa
call fcn.1400021e0
mov rcx, rdi
call fcn.140004a10
mov rbx, qword [rdi]
mov r8, qword [rbx + 0x18]
mov rax, r8
cmp r8, qword [rbx + 0x10]
jb 0x140003d44
mov rcx, qword [rbx + 8]
cmp r8, rcx
je 0x140003d44
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call fcn.140191600
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
mov byte [rax], 0x5d
inc qword [rbx + 0x18]
mov rax, qword [rdi + 0x18]
cmp qword [rdi + 0x20], rax
jne 0x1400040f6
mov rbx, qword [rdi]
mov r8, qword [rbx + 0x18]
mov rcx, qword [rbx + 8]
cmp r8, rcx
je 0x1400040f6
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call fcn.140191600
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
jmp 0x1400040f6
xor al, al
jmp 0x1400040f8
mov eax, 0x1000
test ax, dx
je 0x140003daa
movsx eax, byte [rsi + 0xd]
mov r13d, reloc.WS2_32.dll_listen
sub r13d, eax
jmp 0x140003dbe
mov r13d, dword [rsi]
movabs r12, 0xffffffffffff
mov rsi, qword [rsi + 8]
and rsi, r12
mov rcx, rdi
call fcn.140004ad0
mov r8d, r13d
mov rdx, rsi
mov rcx, rdi
call fcn.140004550
jmp 0x1400040f8
movzx eax, dx
mov rcx, rdi
shr ax, 9
test al, 1
je 0x140003ea2
movaps xmmword [rsp + 0x50], xmm6
movsd xmm6, qword [rsi]
call fcn.140004ad0
movabs rcx, 0x7ff0000000000000
movsd qword [rbp - 0x40], xmm6
mov rax, qword [rbp - 0x40]
and rax, rcx
cmp rax, rcx
jne 0x140003e20
movaps xmm6, xmmword [rsp + 0x50]
xor al, al
jmp 0x1400040f8
mov r8d, dword [rdi + 0x38]
lea rdx, [rbp - 0x40]
movaps xmm0, xmm6
call fcn.1400031d0
xor ebx, ebx
lea rcx, [rbp - 0x40]
mov r15, rax
sub r15, rcx
lea rcx, [rbp - 0x40]
cmp rcx, rax
cmova r15, rbx
test r15, r15
je 0x140003e96
nop dword [rax]
mov rsi, qword [rdi]
movzx r14d, byte [rbp + rbx - 0x40]
mov r8, qword [rsi + 0x18]
mov rax, r8
cmp r8, qword [rsi + 0x10]
jb 0x140003e87
mov rcx, qword [rsi + 8]
cmp r8, rcx
je 0x140003e87
mov r9, qword [rsi]
sub r8, rcx
mov edx, 1
call fcn.140191600
mov rax, qword [rsi + 8]
mov qword [rsi + 0x18], rax
mov byte [rax], r14b
inc rbx
inc qword [rsi + 0x18]
cmp rbx, r15
jne 0x140003e50
movaps xmm6, xmmword [rsp + 0x50]
mov al, 1
jmp 0x1400040f8
movzx eax, dl
shr al, 5
test al, 1
je 0x140003f4b
mov ebx, dword [rsi]
call fcn.140004ad0
lea rdx, [rbp - 0x40]
test ebx, ebx
jns 0x140003ecb
not ebx
mov byte [rbp - 0x40], 0x2d
inc ebx
lea rdx, [rbp - 0x3f]
mov ecx, ebx
call fcn.140002250
xor ebx, ebx
lea rcx, [rbp - 0x40]
mov r15, rax
sub r15, rcx
lea rcx, [rbp - 0x40]
cmp rcx, rax
cmova r15, rbx
test r15, r15
je 0x1400040f6
nop dword [rax]
nop word [rax + rax]
mov rsi, qword [rdi]
movzx r14d, byte [rbp + rbx - 0x40]
mov r8, qword [rsi + 0x18]
mov rax, r8
cmp r8, qword [rsi + 0x10]
jb 0x140003f37
mov rcx, qword [rsi + 8]
cmp r8, rcx
je 0x140003f37
mov r9, qword [rsi]
sub r8, rcx
mov edx, 1
call fcn.140191600
mov rax, qword [rsi + 8]
mov qword [rsi + 0x18], rax
mov byte [rax], r14b
inc rbx
inc qword [rsi + 0x18]
cmp rbx, r15
jne 0x140003f00
jmp 0x1400040f6
movzx eax, dl
shr al, 6
test al, 1
je 0x140003fdb
mov ebx, dword [rsi]
call fcn.140004ad0
lea rdx, [rbp - 0x40]
mov ecx, ebx
call fcn.140002250
xor ebx, ebx
lea rcx, [rbp - 0x40]
mov r15, rax
sub r15, rcx
lea rcx, [rbp - 0x40]
cmp rcx, rax
cmova r15, rbx
test r15, r15
je 0x1400040f6
nop dword [rax + rax]
mov rsi, qword [rdi]
movzx r14d, byte [rbp + rbx - 0x40]
mov r8, qword [rsi + 0x18]
mov rax, r8
cmp r8, qword [rsi + 0x10]
jb 0x140003fc7
mov rcx, qword [rsi + 8]
cmp r8, rcx
je 0x140003fc7
mov r9, qword [rsi]
sub r8, rcx
mov edx, 1
call fcn.140191600
mov rax, qword [rsi + 8]
mov qword [rsi + 0x18], rax
mov byte [rax], r14b
inc rbx
inc qword [rsi + 0x18]
cmp rbx, r15
jne 0x140003f90
jmp 0x1400040f6
mov rbx, qword [rsi]
shr dl, 7
test dl, 1
je 0x140004078
call fcn.140004ad0
lea rdx, [rbp - 0x40]
test rbx, rbx
jns 0x140004006
not rbx
mov byte [rbp - 0x40], 0x2d
inc rbx
lea rdx, [rbp - 0x3f]
mov rcx, rbx
call fcn.1400024a0
xor ebx, ebx
lea rcx, [rbp - 0x40]
mov r15, rax
sub r15, rcx
lea rcx, [rbp - 0x40]
cmp rcx, rax
cmova r15, rbx
test r15, r15
je 0x1400040f6
nop
mov rsi, qword [rdi]
movzx r14d, byte [rbp + rbx - 0x40]
mov r8, qword [rsi + 0x18]
mov rax, r8
cmp r8, qword [rsi + 0x10]
jb 0x140004067
mov rcx, qword [rsi + 8]
cmp r8, rcx
je 0x140004067
mov r9, qword [rsi]
sub r8, rcx
mov edx, 1
call fcn.140191600
mov rax, qword [rsi + 8]
mov qword [rsi + 0x18], rax
mov byte [rax], r14b
inc rbx
inc qword [rsi + 0x18]
cmp rbx, r15
jne 0x140004030
jmp 0x1400040f6
call fcn.140004ad0
lea rdx, [rbp - 0x40]
mov rcx, rbx
call fcn.1400024a0
xor ebx, ebx
lea rcx, [rbp - 0x40]
mov r15, rax
sub r15, rcx
lea rcx, [rbp - 0x40]
cmp rcx, rax
cmova r15, rbx
test r15, r15
je 0x1400040f6
nop word [rax + rax]
mov rsi, qword [rdi]
movzx r14d, byte [rbp + rbx - 0x40]
mov r8, qword [rsi + 0x18]
mov rax, r8
cmp r8, qword [rsi + 0x10]
jb 0x1400040e7
mov rcx, qword [rsi + 8]
cmp r8, rcx
je 0x1400040e7
mov r9, qword [rsi]
sub r8, rcx
mov edx, 1
call fcn.140191600
mov rax, qword [rsi + 8]
mov qword [rsi + 0x18], rax
mov byte [rax], r14b
inc rbx
inc qword [rsi + 0x18]
cmp rbx, r15
jne 0x1400040b0
mov al, 1
mov rcx, qword [rbp - 0x20]
xor rcx, rsp
call fcn.140189130
mov rbx, qword [rsp + 0xb0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret