Function at 0x1400010f8
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
push r12
push r13
push r14
sub rsp, 0x130
mov qword [r11 - 0x90], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov r13, rcx
xor ebx, ebx
mov dword [rsp + 0x34], ebx
mov dword [rsp + 0x78], ebx
mov qword [r11 - 0xc8], rbx
lea edx, [rbx + 2]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x1400031ad
mov dword [0x14001b018], ebx
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x58], ebx
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x50]
call fcn.1400016b0
nop
mov r12, qword [rax]
mov r14d, 0x80040111
lea rsi, [0x14001b090]
mov qword [rsp + 0x90], rsi
mov rcx, qword [0x14001b168]
mov rdx, qword [0x14001b160]
mov rax, qword [rsi]
test rax, rax
je 0x140001213
cmp qword [rax], rdx
jne 0x1400031cd
cmp qword [rax + 8], rcx
jne 0x1400031cd
mov ecx, 0x18
call fcn.140001cd0
mov rdi, rax
test rax, rax
je 0x1400031bb
lea rax, [0x140011668]
mov qword [rdi], rax
mov dword [rdi + 8], 1
mov qword [rdi + 0x10], rsi
jmp 0x1400011e9
test rdi, rdi
je 0x1400031c4
mov rax, qword [rdi]
mov r8, r12
lea rdx, [0x140011578]
mov rcx, rdi
call qword [rax]
mov r14d, eax
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
jmp 0x140001213
test r14d, r14d
js 0x1400031df
mov rax, qword [rsp + 0x88]
cmp qword [rax], rbx
je 0x140001230
mov dword [rax + 8], 1
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x48], ebx
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x40]
call fcn.1400016b0
nop
mov r8, qword [rax]
mov edx, 1
xor ecx, ecx
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
js 0x1400031eb
mov rax, qword [rsp + 0x98]
cmp qword [rax], rbx
je 0x140001278
mov dword [rax + 8], 1
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
mov r8, qword [rsp + 0x50]
lea rdx, [0x140011578]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ole32.dll_CoMarshalInterface]
test eax, eax
js 0x1400031f6
cmp dword [rsp + 0x58], ebx
je 0x1400012bd
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400012b9
mov rax, qword [rcx]
call qword [rax + 0x10]
mov dword [rsp + 0x58], ebx
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
mov r8d, 1
lea rdx, [rsp + 0xd0]
call qword [rax + 0x60]
test eax, eax
js 0x140003204
mov eax, dword [rsp + 0xe0]
mov dword [rsp + 0x30], eax
mov ecx, eax
call fcn.140002444
mov rsi, rax
mov qword [rsp + 0x60], rax
mov edi, ebx
mov dword [rsp + 0x68], ebx
test rax, rax
je 0x14000130c
mov edi, 1
mov dword [rsp + 0x68], edi
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
call qword [rax + 0x28]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea r9, [rsp + 0x70]
mov r8d, dword [rsp + 0x30]
mov rdx, rsi
call qword [rax + 0x18]
test eax, eax
js 0x140003212
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 0x70], eax
jne 0x140003220
cmp dword [rsp + 0x48], ebx
je 0x140001368
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140001364
mov rax, qword [rcx]
call qword [rax + 0x10]
mov dword [rsp + 0x48], ebx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x38]
mov r8d, 4
lea rdx, [rsp + 0x30]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140003231
cmp dword [rsp + 0x38], 4
jne 0x14000323d
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x38]
mov r8d, dword [rsp + 0x30]
mov rdx, rsi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000324e
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 0x38], eax
jne 0x14000325a
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14001b170]
call qword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
je 0x14000326b
call section..text
test eax, eax
js 0x140003277
call qword [sym.imp.ole32.dll_CoUninitialize]
nop
test edi, edi
je 0x14000140c
mov rcx, rsi
call fcn.1400010a0
mov dword [rsp + 0x68], ebx
cmp dword [rsp + 0x48], ebx
jne 0x140003285
cmp dword [rsp + 0x58], ebx
jne 0x14000329f
mov edi, dword [rsp + 0x34]
test byte [rsp + 0x78], 2
jne 0x1400032b9
mov eax, edi
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.140001460
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret
mov ecx, eax
call fcn.140009034
nop
jmp 0x140001158
mov rdi, rbx
jmp 0x1400011e9
mov r14d, 0x8007000e
jmp 0x1400031df
add rsi, 0x18
mov qword [rsp + 0x90], rsi
jmp 0x1400011a0
mov ecx, r14d
call fcn.140009034
nop
jmp 0x1400031ea
nop
mov ecx, eax
call fcn.140009034
nop
jmp 0x1400031f5
nop
mov ecx, eax
call fcn.140009034
nop
jmp 0x1400012a3
mov ecx, eax
call fcn.140009034
nop
jmp 0x1400012de
mov ecx, eax
call fcn.140009034
nop
jmp 0x140001340
mov ecx, 0x80004005
call fcn.140009034
nop
jmp 0x14000134e
call fcn.140009120
nop
jmp 0x14000138e
mov ecx, 0x80004005
call fcn.140009034
nop
jmp 0x140001399
call fcn.140009120
nop
jmp 0x1400013bc
mov ecx, 0x80004005
call fcn.140009034
nop
jmp 0x1400013ca
call fcn.140009120
nop
jmp 0x1400013e8
mov ecx, eax
call fcn.140009034
nop
jmp 0x1400013f5
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140003295
mov rax, qword [rcx]
call qword [rax + 0x10]
mov dword [rsp + 0x48], ebx
jmp 0x140001416
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400032af
mov rax, qword [rcx]
call qword [rax + 0x10]
mov dword [rsp + 0x58], ebx
jmp 0x140001420
mov rcx, qword [0x14001b9a0]
test rcx, rcx
je 0x14000142f
call rcx
nop
jmp 0x14000142f