Function at 0x1401285a0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r13
push r14
sub rsp, 0x58
mov rax, qword [0x1402e1040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r13, qword [rcx + 0x18]
mov rbx, r8
mov rdi, rdx
mov r14, rcx
test r8, r8
je 0x1401285dd
cmp dword [r8 + 0xa8], 4
jne 0x1401285dd
xor eax, eax
jmp 0x140128b9e
test rbx, rbx
je 0x1401285f6
cmp dword [r8 + 0xa8], 5
jne 0x1401285f6
mov eax, gethostname
jmp 0x140128b9e
mov qword [rsp + 0x98], rbp
xor ebp, ebp
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r15
nop
mov r8b, 1
xor edx, edx
mov rcx, rdi
call fcn.14010d7e0
test rax, rax
jle 0x140128aff
mov ecx, dword [rbx + 0xa8]
test ecx, ecx
je 0x140128650
sub ecx, 1
je 0x1401286ba
sub ecx, 1
je 0x14012883d
cmp ecx, 1
je 0x1401288ac
jmp 0x140128903
lea r8, str.CONNECT_start
mov rdx, r14
mov rcx, rdi
call fcn.140102040
mov r8, rbx
mov rdx, rdi
mov rcx, r14
call fcn.1401276c0
mov esi, eax
test eax, eax
jne 0x140128b13
cmp dword [rbx + 0xa8], 1
je 0x1401286ba
lea r8, str.new_tunnel_state_connect
mov rdx, r14
mov rcx, rdi
call fcn.140102040
mov dword [rbx + 0xa8], 1
mov dword [rbx + 0x98], 1
cmp qword [rbx + 8], 0
je 0x1401286b6
mov rax, qword [rbx]
mov byte [rax], sil
mov qword [rbx + 8], rbp
lea r8, str.CONNECT_send
mov rdx, r14
mov rcx, rdi
call fcn.140102040
mov rdx, qword [rbx + 0x40]
mov esi, ebp
mov r12, qword [rbx + 0x28]
mov dword [rsp + 0x34], ebp
cmp r12, rdx
jbe 0x1401287f6
mov rcx, qword [r14 + 8]
mov r9, r12
mov r15, qword [rbx + 0x20]
sub r9, rdx
add r15, rdx
lea rdx, [rsp + 0x34]
mov qword [rsp + 0x20], rdx
mov r8, r15
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + Ordinal_73]
mov rbp, rax
test rax, rax
jns 0x140128726
mov esi, dword [rsp + 0x34]
cmp esi, 0x51
jne 0x1401287db
xor esi, esi
jmp 0x1401287f6
add qword [rbx + 0x40], rbp
cmp byte [rdi + 0xa56], 0
je 0x1401287d7
cmp qword [rdi + 0x270], 0
je 0x14012879f
mov rcx, qword [rdi + 0xd8]
test rcx, rcx
je 0x14012875b
cmp byte [rcx + 0x22b], 0
je 0x14012875b
mov sil, 1
jmp 0x140128763
xor sil, sil
test rcx, rcx
je 0x14012876a
mov byte [rcx + 0x22b], 1
mov rax, qword [rdi + 0x1e8]
mov r9, rbp
mov r8, r15
mov qword [rsp + 0x20], rax
mov edx, 2
mov rcx, rdi
call qword [rdi + 0x270]
mov rax, qword [rdi + 0xd8]
test rax, rax
je 0x1401287d7
mov byte [rax + 0x22b], sil
jmp 0x1401287d7
mov r9, qword [rdi + 0x1e0]
lea rcx, [0x14026f8a6]
mov edx, 2
mov r8d, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rdi + 0x1e0]
mov r8d, 1
mov rdx, rbp
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov esi, dword [rsp + 0x34]
test esi, esi
je 0x1401287f6
lea rdx, str.Failed_sending_CONNECT_to_proxy
mov rcx, rdi
call fcn.140101e00
mov esi, dword [rsp + 0x34]
test esi, esi
jne 0x140128800
cmp qword [rbx + 0x40], r12
jb 0x140128800
mov al, 1
jmp 0x140128802
xor al, al
mov byte [rsp + 0x31], al
test esi, esi
jne 0x140128b13
test al, al
je 0x140128b85
cmp dword [rbx + 0xa8], 2
je 0x14012883b
lea r8, str.new_tunnel_state_receive
mov rdx, r14
mov rcx, rdi
call fcn.140102040
mov dword [rbx + 0xa8], 2
xor ebp, ebp
lea r8, str.CONNECT_receive
mov rdx, r14
mov rcx, rdi
call fcn.140102040
lea r9, [rsp + 0x31]
mov r8, rbx
mov rdx, rdi
mov rcx, r14
call fcn.1401280a0
mov rcx, rdi
mov esi, eax
call fcn.140125960
test eax, eax
jne 0x140128af8
test esi, esi
jne 0x140128b13
cmp byte [rsp + 0x31], sil
je 0x140128b85
cmp dword [rbx + 0xa8], 3
je 0x1401288ac
lea r8, str.new_tunnel_state_response
mov rdx, r14
mov rcx, rdi
call fcn.140102040
mov dword [rbx + 0xa8], 3
lea r8, str.CONNECT_response
mov rdx, r14
mov rcx, rdi
call fcn.140102040
cmp qword [rdi + 0x1b0], 0
je 0x140128911
lea rcx, [rdi + 0xf0]
mov rdx, rdi
call fcn.14011d300
cmp byte [rbx + 0xad], 0
jne 0x1401289f2
cmp byte [r13 + 0x3a6], 0
jne 0x1401289f2
mov r9, rdi
xor r8d, r8d
mov rdx, rbx
mov rcx, r14
call fcn.1401273b0
cmp qword [rdi + 0x1b0], 0
jne 0x140128610
mov eax, dword [rdi + 0x12bc]
sub eax, 0xc8
cmp eax, 0x64
jb 0x140128a61
xor ecx, ecx
call qword [0x1402e1138]
mov qword [rdi + 0x1b0], rbp
test r13, r13
je 0x14012895e
mov rcx, qword [r13 + 0x250]
test rcx, rcx
je 0x14012895e
mov rax, qword [rcx]
mov edx, dword [rax + 8]
test dl, 4
jne 0x140128970
test dl, 3
jne 0x14012895e
mov rcx, qword [rcx + 8]
test rcx, rcx
jne 0x140128945
mov al, 1
cmp al, byte [r13 + 0x3a6]
je 0x140128970
mov byte [r13 + 0x3a6], al
cmp dword [rbx + 0xa8], 5
je 0x1401289d2
lea r8, str.new_tunnel_state_failed
mov rdx, r14
mov rcx, rdi
call fcn.140102040
mov dword [rbx + 0xa8], 5
cmp qword [rbx + 8], 0
je 0x1401289a2
mov rax, qword [rbx]
mov byte [rax], 0
mov qword [rbx + 8], rbp
cmp qword [rbx + 0x28], 0
je 0x1401289b4
mov rax, qword [rbx + 0x20]
mov byte [rax], 0
mov qword [rbx + 0x28], rbp
mov rcx, qword [rdi + 0x1280]
mov dword [rdi + 0x12b8], ebp
call qword [0x1402e1138]
mov qword [rdi + 0x1280], rbp
mov r8d, dword [rdi + 0x13c]
lea rdx, str.CONNECT_tunnel_failed__response__d
mov rcx, rdi
call fcn.140101e00
mov eax, gethostname
jmp 0x140128b87
lea r8, str.CONNECT_need_to_closeopen
mov rdx, r14
mov rcx, rdi
call fcn.140102040
lea rdx, str.Connect_me_again_please
mov rcx, rdi
call fcn.140101ff0
mov rax, qword [r14]
mov rdx, rdi
mov rcx, r14
call qword [rax + 0x20]
cmp byte [r13 + 0x3a6], 0
je 0x140128a31
mov byte [r13 + 0x3a6], 0
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x140128a4f
mov rax, qword [rcx]
lea r9, [rsp + 0x31]
xor r8d, r8d
mov rdx, rdi
call qword [rax + Ordinal_26]
mov esi, eax
jmp 0x140128a54
mov esi, 2
test esi, esi
je 0x140128b85
jmp 0x140128b13
cmp dword [rbx + 0xa8], 4
je 0x140128adb
lea r8, str.new_tunnel_state_established
mov rdx, r14
mov rcx, rdi
call fcn.140102040
lea rdx, str.CONNECT_phase_completed
mov rcx, rdi
call fcn.140101ff0
mov word [rdi + 0xd24], 1
mov dword [rbx + 0xa8], 4
cmp qword [rbx + 8], 0
je 0x140128aab
mov rax, qword [rbx]
mov byte [rax], 0
mov qword [rbx + 8], rbp
cmp qword [rbx + 0x28], 0
je 0x140128abd
mov rax, qword [rbx + 0x20]
mov byte [rax], 0
mov qword [rbx + 0x28], rbp
mov rcx, qword [rdi + 0x1280]
mov dword [rdi + 0x12b8], ebp
call qword [0x1402e1138]
mov qword [rdi + 0x1280], rbp
mov r8d, dword [rdi + 0x12bc]
lea rdx, str.CONNECT_tunnel_established__response__d
mov rcx, rdi
call fcn.140101ff0
mov esi, ebp
jmp 0x140128b85
mov esi, Ordinal_46
jmp 0x140128b13
lea rdx, str.Proxy_CONNECT_aborted_due_to_timeout
mov rcx, rdi
call fcn.140101e00
mov esi, 0x1c
cmp dword [rbx + 0xa8], 5
je 0x140128b85
lea r8, str.new_tunnel_state_failed
mov rdx, r14
mov rcx, rdi
call fcn.140102040
mov dword [rbx + 0xa8], 5
cmp qword [rbx + 8], 0
je 0x140128b45
mov rax, qword [rbx]
mov byte [rax], 0
mov qword [rbx + 8], 0
cmp qword [rbx + 0x28], 0
je 0x140128b5b
mov rax, qword [rbx + 0x20]
mov byte [rax], 0
mov qword [rbx + 0x28], 0
mov rcx, qword [rdi + 0x1280]
mov dword [rdi + 0x12b8], 0
call qword [0x1402e1138]
mov qword [rdi + 0x1280], 0
mov eax, esi
mov r12, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov r15, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140171bd0
add rsp, 0x58
pop r14
pop r13
pop rdi
pop rbx
ret