Function at 0x1400d6af0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xb8]
sub rsp, 0x190
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14047b0a0]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov r12, r8
mov r15d, edx
mov ebx, 4
mov rax, qword gs:[0x58]
add rbx, qword [rax]
mov eax, dword [rbx]
cmp dword [0x140493300], eax
jle 0x1400d6baf
lea rcx, [0x140493300]
call fcn.1401af53c
cmp dword [0x140493300], 0xffffffff
jne 0x1400d6baf
movdqa xmm0, xmmword [0x1404156a0]
movdqu xmmword [0x140493318], xmm0
mov byte [0x140493308], 0
mov r8d, Ordinal_41
lea rdx, str.QuickLook.App.PipeMessages.RunAndClose
lea rcx, [0x140493308]
call fcn.14007dce0
lea rcx, [0x1403640d0]
call fcn.1401af30c
nop
lea rcx, [0x140493300]
call fcn.1401af4dc
lea r14, [0x140493330]
mov eax, dword [rbx]
cmp dword [0x140493328], eax
jle 0x1400d6c1a
lea rcx, [0x140493328]
call fcn.1401af53c
cmp dword [0x140493328], 0xffffffff
jne 0x1400d6c1a
movdqa xmm0, xmmword [0x1404156a0]
movdqu xmmword [0x140493340], xmm0
mov byte [0x140493330], 0
mov r8d, 0x21
lea rdx, str.QuickLook.App.PipeMessages.Switch
mov rcx, r14
call fcn.14007dce0
lea rcx, [0x1403640c0]
call fcn.1401af30c
nop
lea rcx, [0x140493328]
call fcn.1401af4dc
mov eax, dword [rbx]
cmp dword [0x140493350], eax
jle 0x1400d6c82
lea rcx, [0x140493350]
call fcn.1401af53c
cmp dword [0x140493350], 0xffffffff
jne 0x1400d6c82
movdqa xmm0, xmmword [0x1404156a0]
movdqu xmmword [0x140493368], xmm0
mov byte [0x140493358], 0
mov r8d, 0x21
lea rdx, str.QuickLook.App.PipeMessages.Invoke
lea rcx, [0x140493358]
call fcn.14007dce0
lea rcx, [0x1403640b0]
call fcn.1401af30c
nop
lea rcx, [0x140493350]
call fcn.1401af4dc
lea rsi, [0x140493380]
mov eax, dword [rbx]
cmp dword [0x140493378], eax
jle 0x1400d6ced
lea rcx, [0x140493378]
call fcn.1401af53c
cmp dword [0x140493378], 0xffffffff
jne 0x1400d6ced
movdqa xmm0, xmmword [0x1404156a0]
movdqu xmmword [0x140493390], xmm0
mov byte [0x140493380], 0
mov r8d, 0x21
lea rdx, str.QuickLook.App.PipeMessages.Toggle
mov rcx, rsi
call fcn.14007dce0
lea rcx, [0x1403640a0]
call fcn.1401af30c
nop
lea rcx, [0x140493378]
call fcn.1401af4dc
mov eax, dword [rbx]
cmp dword [0x1404933a0], eax
jle 0x1400d6d55
lea rcx, [0x1404933a0]
call fcn.1401af53c
cmp dword [0x1404933a0], 0xffffffff
jne 0x1400d6d55
movdqa xmm0, xmmword [0x1404156a0]
movdqu xmmword [0x1404933b8], xmm0
mov byte [0x1404933a8], 0
mov r8d, 0x21
lea rdx, str.QuickLook.App.PipeMessages.Forget
lea rcx, [0x1404933a8]
call fcn.14007dce0
lea rcx, [0x140364090]
call fcn.1401af30c
nop
lea rcx, [0x1404933a0]
call fcn.1401af4dc
lea rdi, [0x1404933d0]
mov eax, dword [rbx]
cmp dword [0x1404933c8], eax
jle 0x1400d6dc0
lea rcx, [0x1404933c8]
call fcn.1401af53c
cmp dword [0x1404933c8], 0xffffffff
jne 0x1400d6dc0
movdqa xmm0, xmmword [0x1404156a0]
movdqu xmmword [0x1404933e0], xmm0
mov byte [0x1404933d0], 0
mov r8d, 0x20
lea rdx, str.QuickLook.App.PipeMessages.Close
mov rcx, rdi
call fcn.14007dce0
lea rcx, [0x140364080]
call fcn.1401af30c
nop
lea rcx, [0x1404933c8]
call fcn.1401af4dc
mov eax, dword [rbx]
cmp dword [0x1404933f0], eax
jle 0x1400d6e28
lea rcx, [0x1404933f0]
call fcn.1401af53c
cmp dword [0x1404933f0], 0xffffffff
jne 0x1400d6e28
movdqa xmm0, xmmword [0x1404156a0]
movdqu xmmword [0x140493408], xmm0
mov byte [0x1404933f8], 0
mov r8d, 0x1f
lea rdx, str.QuickLook.App.PipeMessages.Quit
lea rcx, [0x1404933f8]
call fcn.14007dce0
lea rcx, [0x140364070]
call fcn.1401af30c
nop
lea rcx, [0x1404933f0]
call fcn.1401af4dc
xor r13d, r13d
mov qword [rbp - 0x58], r13
mov qword [rbp - 0x50], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x68], r13b
cmp r15d, 0x1b
je 0x1400d6e8c
cmp r15d, 0x20
je 0x1400d6e70
lea eax, [r15 - 0x25]
cmp eax, 3
ja 0x1400d72c3
cmp qword [0x140493348], 0x10
cmovae r14, qword [0x140493330]
mov r8, qword [0x140493340]
mov rdx, r14
jmp 0x1400d6ea6
cmp qword [0x140493398], 0x10
cmovae rsi, qword [0x140493380]
mov r8, qword [0x140493390]
mov rdx, rsi
jmp 0x1400d6ea6
cmp qword [0x1404933e8], 0x10
cmovae rdi, qword [0x1404933d0]
mov r8, qword [0x1404933e0]
mov rdx, rdi
lea rcx, [rbp - 0x68]
call fcn.14007dce0
cmp qword [rbp - 0x58], 0
je 0x1400d72c3
mov eax, dword [rbx]
cmp dword [0x140493418], eax
jle 0x1400d6f0a
lea rcx, [0x140493418]
call fcn.1401af53c
cmp dword [0x140493418], 0xffffffff
jne 0x1400d6f0a
mov qword [0x140493430], r13
mov qword [0x140493438], 0xf
mov byte [0x140493420], 0
lea rcx, [0x140364060]
call fcn.1401af30c
lea rcx, [0x140493418]
call fcn.1401af4dc
mov rdi, 0xffffffffffffffff
lea r14, [0x140493420]
cmp qword [0x140493430], 0
jne 0x1400d71e8
lea rax, vtable.ATL::CAccessToken.0
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r13
lea rax, vtable.ATL::CSid.0
mov qword [rbp - 0x20], rax
mov byte [rbp + 0x2c], 0
mov dword [rbp + 0x30], 7
call fcn.1400c02f0
mov rcx, rax
test rax, rax
je 0x1400d7307
mov rax, qword [rax]
call qword [rax + ILCombine]
add rax, 0x18
mov qword [rbp + 0x38], rax
call fcn.1400c02f0
mov rcx, rax
test rax, rax
je 0x1400d7312
mov rax, qword [rax]
call qword [rax + ILCombine]
add rax, 0x18
mov qword [rbp + 0x40], rax
call fcn.1400c02f0
mov rcx, rax
test rax, rax
je 0x1400d731d
mov rax, qword [rax]
call qword [rax + ILCombine]
add rax, 0x18
mov qword [rbp + 0x48], rax
call fcn.1400c02f0
mov rcx, rax
test rax, rax
je 0x1400d72fc
mov rax, qword [rax]
call qword [rax + ILCombine]
add rax, 0x18
mov qword [rbp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x40]
mov edx, 0x20008
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400d718f
lea rcx, [rsp + 0x48]
mov rax, qword [rsp + 0x48]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x50], rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x48]
call fcn.1400dcf10
test al, al
je 0x1400d718f
lea rcx, [rbp - 0x20]
call fcn.1400c5bd0
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.140082cf0
mov rsi, rax
mov qword [rsp + 0x40], rax
mov r8, rax
cmp qword [rax + 0x18], 8
jb 0x1400d704b
mov r8, qword [rax]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
mov r9d, dword [rax + 0x10]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd r15, eax
lea ecx, [r15 + 1]
movsxd rcx, ecx
call fcn.1401af66c
mov rbx, rax
mov qword [rsp + 0x68], rax
test rax, rax
jne 0x1400d70af
movdqa xmm0, xmmword [0x1404156a0]
movdqu xmmword [rbp - 0x38], xmm0
mov byte [rbp - 0x48], al
xor r8d, r8d
lea rdx, [0x1403fe710]
lea rcx, [rbp - 0x48]
call fcn.14007dce0
nop
jmp 0x1400d7120
mov r8, rsi
cmp qword [rsi + 0x18], 8
jb 0x1400d70bc
mov r8, qword [rsi]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rbx
mov r9d, dword [rsi + 0x10]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov byte [r15 + rbx], 0
movdqa xmm0, xmmword [0x1404156a0]
movdqu xmmword [rbp - 0x38], xmm0
mov byte [rbp - 0x48], 0
mov r8, rdi
nop word [rax + rax]
inc r8
cmp byte [rbx + r8], 0
jne 0x1400d7100
mov rdx, rbx
lea rcx, [rbp - 0x48]
call fcn.14007dce0
nop
mov rcx, rbx
call fcn.1401aed44
nop
mov rcx, rsi
call fcn.14007ec70
nop
lea r8, [rbp - 0x48]
cmp qword [rbp - 0x30], 0x10
cmovae r8, qword [rbp - 0x48]
lea rdx, str..pipeQuickLook.App.Pipe._s
lea rcx, [rbp + 0x60]
call fcn.140134960
mov rbx, rax
cmp r14, rax
je 0x1400d717b
mov rcx, r14
call fcn.14007ea30
movups xmm0, xmmword [rbx]
movups xmmword [0x140493420], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x140493430], xmm1
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
lea rcx, [rbp + 0x60]
call fcn.14007ea30
nop
lea rcx, [rbp - 0x48]
call fcn.14007ea30
nop
lea rcx, [rbp - 0x20]
call fcn.1400c5b20
nop
lea rax, vtable.ATL::CAccessToken.0
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
test rdx, rdx
je 0x1400d71c9
test rcx, rcx
je 0x1400d71c4
call qword [sym.imp.USERENV.dll_UnloadUserProfile]
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x58], r13
test rcx, rcx
je 0x1400d71d9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x50], r13
mov edx, 8
mov rcx, qword [rsp + 0x60]
call fcn.1401aed44
cmp qword [0x140493438], 0x10
cmovae r14, qword [0x140493420]
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400d72c3
mov dword [rsp + 0x68], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x68]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
test eax, eax
je 0x1400d72b9
mov r8d, 1
lea rdx, [0x140407e44]
lea rcx, [rbp - 0x68]
call fcn.14008dbb0
nop
inc rdi
cmp byte [r12 + rdi], 0
jne 0x1400d7260
mov r8, rdi
mov rdx, r12
lea rcx, [rbp - 0x68]
call fcn.14008dbb0
mov r8d, 2
lea rdx, [0x140407e40]
lea rcx, [rbp - 0x68]
call fcn.14008dbb0
mov dword [rsp + 0x40], r13d
lea rdx, [rbp - 0x68]
cmp qword [rbp - 0x50], 0x10
cmovae rdx, qword [rbp - 0x68]
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x40]
mov r8d, dword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp - 0x68]
call fcn.14007ea30
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.1401aed20
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80004005
call fcn.140080080
nop
mov ecx, 0x80004005
call fcn.140080080
nop
mov ecx, 0x80004005
call fcn.140080080
nop
mov ecx, 0x80004005
call fcn.140080080
int3