Function at 0x140072760
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x140430528]
xor rax, rsp
mov qword [rbp + 0x10], rax
mov rdi, qword [rbp + 0x90]
xorps xmm0, xmm0
xor eax, eax
mov qword [rsp + 0x60], r9
mov qword [rsp + 0x58], r8
mov rsi, 0xffffffffffffffff
mov qword [rsp + 0x48], rdx
mov r14, r9
mov qword [rsp + 0x40], rdi
mov rbx, rdx
mov qword [rsp + 0x38], rax
mov r15, rcx
mov qword [rsp + 0x50], rsi
mov byte [rsp + 0x30], al
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
test rcx, rcx
je 0x140072cde
cmp qword [rcx + 8], rax
je 0x140072cde
test rdx, rdx
je 0x140072cde
mov rdx, qword [rdx + 0x48]
test rdx, rdx
je 0x140072cde
cmp qword [rbx + 0x50], rax
je 0x140072cde
test r8, r8
je 0x140072819
cmp rdi, rsi
jne 0x140072819
lea eax, [rsi + 0xb]
jmp 0x140072858
cmp rdi, rsi
mov ecx, eax
sete cl
test r8, r8
sete al
cmp eax, ecx
jne 0x140072cde
mov qword [rsp + 0x128], r13
test r8, r8
jne 0x140072876
mov rcx, rdx
call fcn.14006b870
mov r13, rax
test rax, rax
jne 0x140072879
lea eax, [r13 + 6]
mov r13, qword [rsp + 0x128]
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.1402f09e0
add rsp, 0x130
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov r13, r8
cmp rdi, rsi
jne 0x140072895
mov edx, 0x81
mov rcx, r13
call fcn.140069ef0
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x40], rax
test r14, r14
jne 0x14007297a
mov rcx, qword [rbx + 0x50]
call fcn.14006b870
mov rdi, rax
test rax, rax
jne 0x1400728b9
mov ebx, 6
jmp 0x140072c8f
cmp dword [r15 + 0x70], 1
jne 0x14007297d
lea rax, str..exp
mov rcx, rsi
nop
inc rcx
cmp word [rax + rcx*2], 0
jne 0x1400728d0
test rcx, rcx
jne 0x1400728fb
mov rcx, rdi
call fcn.140314264
mov r14, rax
test rax, rax
jne 0x140072972
lea ebx, [rax + 6]
jmp 0x140072c8f
mov rbx, rsi
nop
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x140072900
mov rax, 0xfffffffffffffffd
sub rax, rcx
cmp rbx, rax
ja 0x1400728af
lfence
lea r12, [rcx + 2]
mov eax, 2
add r12, rbx
mul r12
cmovo rax, rsi
mov rcx, rax
call fcn.1402ff830
mov r14, rax
test rax, rax
je 0x1400728af
lfence
mov r8, rdi
mov rdx, r12
mov rcx, rax
call fcn.1402ffc60
lea rcx, [r14 + rbx*2]
lfence
sub r12, rbx
lea r8, str..exp
mov rdx, r12
call fcn.1402ffc60
mov rbx, qword [rsp + 0x48]
mov rcx, rdi
call fcn.1402ff780
mov rdi, r14
mov r12d, 1
lea rdx, str.Restoring_file_in_directory:___s___with_fileName:___s_
mov ecx, r12d
mov r9, rdi
mov r8, r13
call fcn.14006e290
mov rdx, rdi
mov rcx, r13
call fcn.1400667c0
mov qword [rsp + 0x38], rax
mov r14, rax
test rax, rax
jne 0x1400729b8
lea ebx, [rax + 6]
jmp 0x140072c94
mov rcx, qword [rsp + 0x40]
mov r8d, 0x2081
mov rdx, rdi
call fcn.140069f70
mov r14, rax
cmp rax, rsi
je 0x140072a25
mov r8, qword [rsp + 0x38]
cmp dword [r15 + 0x70], r12d
jne 0x1400729f9
lea rdx, str.Export_file_already_exists:___s_
mov ecx, 3
call fcn.14006e290
mov ebx, 0x19
jmp 0x140072c39
lea rdx, str.The_file_to_be_restored_already_exists:___s_
mov ecx, 2
call fcn.14006e290
mov r9, rdi
mov qword [rsp + 0x20], r14
mov r8, r13
mov rdx, rbx
mov rcx, r15
call fcn.14006abf0
jmp 0x140072c37
mov rcx, qword [rsp + 0x40]
mov r9d, 0x200
mov r8d, 0x20ce
mov rdx, rdi
call fcn.140069f70
mov r14, rax
cmp rax, rsi
jne 0x140072a72
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14, qword [rsp + 0x38]
lea rdx, str.Unable_to_create_file:___s___platError:__d_
mov r9d, eax
mov r8, r14
mov ecx, 3
call fcn.14006e290
mov ebx, 0xa
jmp 0x140072c94
mov byte [rsp + 0x30], r12b
cmp dword [r15 + 0x70], r12d
jne 0x140072bab
movups xmm0, xmmword [rbx + 0xb0]
mov rcx, qword [rbx + 0x50]
xor r8d, r8d
movups xmm1, xmmword [rbx + 0xc0]
mov rdx, qword [rbx + 0x58]
mov rax, rsi
movups xmmword [rsp + 0x7c], xmm0
mov dword [rsp + 0x70], 0x46455353
movups xmmword [rbp - 0x74], xmm1
mov word [rsp + 0x74], r12w
mov dword [rsp + 0x78], reloc.WS2_32.dll_setsockopt
mov qword [rbp - 0x60], rcx
mov qword [rbp - 0x58], rdx
inc rax
cmp byte [rcx + rax], r8b
jne 0x140072ac4
inc rax
cmp rax, 0xffff
jbe 0x140072ae2
mov ebx, 3
jmp 0x140072b7d
mov word [rbp - 0x64], ax
inc rsi
cmp byte [rdx + rsi], r8b
jne 0x140072ae6
inc rsi
cmp rsi, 0xffff
jbe 0x140072b02
mov ebx, 3
jmp 0x140072b7d
add ax, 0x30
mov word [rbp - 0x62], si
add si, ax
mov qword [rsp + 0x20], r8
lea r9, [rbp - 0x4c]
mov word [rsp + 0x76], si
mov r8d, gethostbyname
lea rdx, [rsp + 0x70]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140072b40
mov dword [rbp - 0x4c], 0xffffffff
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [rbp - 0x4c], 0x30
jne 0x140072b78
movzx r8d, word [rbp - 0x64]
mov rcx, r14
mov rdx, qword [rbp - 0x60]
call fcn.14006a3d0
movzx ecx, word [rbp - 0x64]
cmp eax, ecx
jne 0x140072b78
movzx r8d, word [rbp - 0x62]
mov rcx, r14
mov rdx, qword [rbp - 0x58]
call fcn.14006a3d0
movzx ecx, word [rbp - 0x62]
cmp eax, ecx
je 0x140072ba1
mov ebx, reloc.WS2_32.dll_inet_ntoa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [rsp + 0x38]
lea rdx, str.Unable_to_write_export_file:___s___platError:__d_
mov r9d, eax
mov ecx, 3
call fcn.14006e290
jmp 0x140072c39
mov dword [r15 + 0x68], shutdown
jmp 0x140072bce
cmp qword [rsp + 0x58], 0
jne 0x140072bce
cmp qword [rsp + 0x60], 0
jne 0x140072bce
mov rdx, qword [rsp + 0x38]
mov rcx, r14
call fcn.1400725a0
mov ebx, eax
test eax, eax
jne 0x140072c39
mov rsi, qword [rsp + 0x48]
lea rax, [0x14006d070]
mov qword [rbp - 0x38], rax
lea rdx, [rbp - 0x40]
lea rax, [0x14006d080]
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x30], rax
xor r9d, r9d
lea rax, [0x14006d090]
mov r8, rsi
mov qword [rbp - 0x28], rax
mov rcx, r15
lea rax, [0x14006d0a0]
mov qword [rbp - 0x20], rax
call fcn.14006c380
mov ebx, eax
test eax, eax
jne 0x140072c39
cmp dword [r15 + 0x70], r12d
jne 0x140072c29
mov dword [r15 + 0x68], reloc.WS2_32.dll_setsockopt
mov r9, r14
mov rdx, rsi
mov rcx, r15
call fcn.14006b0b0
mov ebx, eax
mov rcx, r14
call fcn.14006a150
test ebx, ebx
je 0x140072c8f
cmp byte [rsp + 0x30], 0
je 0x140072c8f
mov rcx, qword [rsp + 0x40]
mov r8d, 0x100
mov rdx, rdi
call fcn.140069f70
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140072c8f
mov r9d, r12d
mov byte [rbp - 0x50], r12b
lea r8, [rbp - 0x50]
mov edx, 4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFileInformationByHandle]
test rsi, rsi
je 0x140072c8f
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, qword [rsp + 0x38]
mov rax, qword [rsp + 0x50]
cmp rax, 0xffffffffffffffff
je 0x140072ca7
mov rcx, rax
call fcn.14006a150
test r13, r13
je 0x140072cbb
cmp r13, qword [rsp + 0x58]
je 0x140072cbb
mov rcx, r13
call fcn.1402ff780
test rdi, rdi
je 0x140072ccf
cmp rdi, qword [rsp + 0x60]
je 0x140072ccf
mov rcx, rdi
call fcn.1402ff780
mov rcx, r14
call fcn.1402ff780
mov eax, ebx
jmp 0x140072850
mov eax, 1
jmp 0x140072858