Function at 0x1400b1130
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbp
push rbx
push rsi
push rdi
push r14
mov eax, 0x260
call fcn.14024eae0
sub rsp, rax
lea rbp, [rsp + 0x40]
mov rax, qword [0x14035d028]
xor rax, rbp
mov qword [rbp + 0x210], rax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r14d, r14d
mov rbx, rax
test rax, rax
je 0x1400b11f5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x1400b11f5
lea rdi, [rbp + 0x258]
call fcn.140008bf0
mov rcx, qword [rbp + 0x250]
lea rdx, [rbp + 0x10]
mov qword [rsp + 0x30], rdi
mov esi, 0x200
mov qword [rsp + 0x28], r14
or rdi, 0xffffffffffffffff
mov qword [rsp + 0x20], rcx
mov r9, rdi
mov rcx, qword [rax]
mov r8d, esi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vsnprintf_s]
lea r9, [rbp]
mov qword [rsp + 0x20], r14
test eax, eax
lea rdx, [rbp + 0x10]
mov rcx, rbx
cmovs eax, edi
test eax, eax
cmovs eax, esi
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x1400b1356
mov r8, qword [rbp + 0x250]
mov eax, r14d
mov rcx, r8
cmp byte [r8], r14b
je 0x1400b1218
cmp eax, 0x80000000
jae 0x1400b1218
inc rcx
inc eax
cmp byte [rcx], r14b
jne 0x1400b1207
btr eax, 0x1f
lea r9d, [rax + 1]
lea rax, [r9 + r9]
mov edi, r9d
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1400b123a
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.14024eae0
sub rsp, rcx
mov esi, 0x10
lea rbx, [rsp + 0x40]
test rbx, rbx
jne 0x1400b1264
lea rbx, str.no_stack_
jmp 0x1400b1306
mov dword [rsp + 0x28], r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x1400b129b
mov rdx, r14
test rdi, rdi
je 0x1400b129b
mov rax, qword [rbp + 0x250]
movsx ecx, byte [rdx + rax]
mov word [rbx + rdx*2], cx
inc rdx
cmp rdx, rdi
jb 0x1400b1284
mov rdx, r14
test rdi, rdi
je 0x1400b1306
cmp word [rbx + rdx*2], 0x25
jne 0x1400b12fe
lea r8, [rbx + 2]
lea r8, [r8 + rdx*2]
movzx ecx, word [r8]
mov r9d, r14d
cmp ecx, 0x35
ja 0x1400b1373
je 0x1400b12ec
sub ecx, 0x2a
je 0x1400b12ec
sub ecx, 3
je 0x1400b12ec
sub ecx, 1
je 0x1400b12ec
sub ecx, 2
je 0x1400b12ec
sub ecx, 1
je 0x1400b12ec
sub ecx, 1
je 0x1400b12ec
sub ecx, 1
je 0x1400b12ec
cmp ecx, 1
jne 0x1400b12f9
inc rdx
mov r9d, 1
add r8, 2
test r9d, r9d
jne 0x1400b12b2
inc rdx
cmp rdx, rdi
jb 0x1400b12a3
lea rdi, [rbp + 0x258]
call fcn.140008bf0
mov qword [rsp + 0x30], rdi
lea rdx, [rbp + 0x10]
mov qword [rsp + 0x28], r14
or r9, 0xffffffffffffffff
mov r8d, 0x100
mov qword [rsp + 0x20], rbx
mov rcx, qword [rax]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vsnwprintf_s]
mov r9d, esi
mov word [rbp + 0x20e], r14w
lea r8, str.OpenSSL:_FATAL
xor ecx, ecx
lea rdx, [rbp + 0x10]
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, qword [rbp + 0x210]
xor rcx, rbp
call fcn.14024c6d0
lea rsp, [rbp + 0x220]
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
sub ecx, 0x36
je 0x1400b12ec
sub ecx, 1
je 0x1400b12ec
sub ecx, 1
je 0x1400b12ec
sub ecx, 1
je 0x1400b12ec
sub ecx, 0xa
je 0x1400b13c8
sub ecx, esi
je 0x1400b13c1
sub ecx, esi
je 0x1400b13ba
cmp ecx, esi
jne 0x1400b12f9
mov eax, 0x53
mov word [r8], ax
jmp 0x1400b12f9
mov eax, 0x43
jmp 0x1400b13b1
mov eax, reloc.WS2_32.dll_WSAStartup
jmp 0x1400b13b1
mov eax, 0x63
jmp 0x1400b13b1