Function at 0x140035be0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xf0
mov rax, qword [0x14036a3c8]
xor rax, rsp
mov qword [rbp + 0x27], rax
lea rcx, [rbp - 0x71]
call fcn.1400341d0
nop
mov rbx, qword [rbp - 0x71]
lea rsi, str.current_new
xor ecx, ecx
nop dword [rax]
movzx edi, word [rbx + rcx*2]
movzx eax, word [rsi + rcx*2]
sub edi, eax
jne 0x140035c54
movzx edi, word [rbx + rcx*2 + 2]
movzx eax, word [rsi + rcx*2 + 2]
sub edi, eax
jne 0x140035c54
add rcx, 2
cmp rcx, 0xc
jne 0x140035c30
call fcn.140004c80
mov rcx, rax
lea r15, [0x140288af8]
test edi, edi
jne 0x140035cc0
test rax, rax
je 0x140036205
mov rdx, qword [rax]
call qword [rdx + Ordinal_26]
add rax, 0x18
mov qword [rsp + 0x20], rax
mov r12, 0xffffffffffffffff
cmp r15, 0x10000
jae 0x140035c9f
movzx edx, r15w
lea rcx, [rsp + 0x20]
call fcn.140005650
jmp 0x140035cbe
mov rax, r12
inc rax
cmp word [r15 + rax*2], 0
jne 0x140035ca2
mov r8d, eax
mov rdx, r15
lea rcx, [rsp + 0x20]
call fcn.14000ae10
nop
jmp 0x140035d1b
test rcx, rcx
je 0x140036205
mov rax, qword [rax]
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [rsp + 0x20], rax
mov r12, 0xffffffffffffffff
cmp rsi, 0x10000
jae 0x140035cf7
movzx edx, si
lea rcx, [rsp + 0x20]
call fcn.140005650
jmp 0x140035d1b
mov rax, r12
nop word [rax + rax]
inc rax
cmp word [rsi + rax*2], 0
jne 0x140035d00
mov r8d, eax
mov rdx, rsi
lea rcx, [rsp + 0x20]
call fcn.14000ae10
nop
lea rdx, [rbx - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140035d36
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
nop
mov rax, qword [0x14036e940]
cmp dword [rax - 0x10], 0
jne 0x140035d6a
lea rcx, [rbp - 0x69]
call fcn.1400341d0
mov rdx, qword [rbp - 0x69]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140035d6a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
mov rcx, qword [0x14036e940]
add rcx, 0xffffffffffffffe8
call fcn.14000ce00
lea rbx, [rax + 0x18]
mov qword [rbp - 0x61], rbx
lea rcx, [rbp - 0x79]
call fcn.140031f00
nop
lea rdx, str.updatepath.bin
mov rax, r12
inc rax
cmp word [rdx + rax*2], 0
jne 0x140035d96
mov r8d, eax
lea rcx, [rbp - 0x79]
call fcn.14000cce0
mov r14d, reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x21], r14
mov qword [rbp - 0x29], InitCommonControls
movsd xmm0, qword [0x140288b38]
movsd qword [rbp - 0x39], xmm0
movzx eax, word [0x140288b40]
mov word [rbp - 0x31], ax
movzx eax, byte [0x140288b42]
mov byte [rbp - 0x2f], al
mov byte [rbp - 0x2e], 0
xor ecx, ecx
mov rdx, qword [rsp + 0x20]
nop dword [rax + rax]
movzx eax, word [rdx + rcx*2]
inc rcx
movabs r13, 0x8000000000000027
cmp ax, word [r15 + rcx*2 - 2]
jne 0x140035e36
cmp rcx, 8
jne 0x140035df0
lea rdi, [rbp - 0x39]
mov qword [rbp - 0x29], 7
lea r8d, [rcx - 1]
lea rdx, str.current
mov rcx, rdi
call fcn.1402430d0
mov byte [rdi + 7], 0
mov r14, qword [rbp - 0x21]
mov rsi, qword [rbp - 0x39]
mov qword [rbp - 0x59], 0
mov edi, reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x41], rdi
mov qword [rbp - 0x49], 7
mov eax, dword [str.release]
mov dword [rbp - 0x59], eax
movzx eax, word [0x140288b74]
mov word [rbp - 0x55], ax
movzx eax, byte [0x140288b76]
mov byte [rbp - 0x53], al
mov byte [rbp - 0x52], 0
xor ecx, ecx
lea rdx, [0x140288ae8]
nop
movzx eax, word [rbx + rcx*2]
inc rcx
cmp ax, word [rdx + rcx*2 - 2]
jne 0x140035eac
cmp rcx, 5
jne 0x140035e80
lea rax, [rbp - 0x59]
mov qword [rbp - 0x49], 4
mov dword [rax], 0x61746562
mov byte [rax + 4], 0
jmp 0x140035ed8
cmp word [rbx], 0x72
jne 0x140035edc
cmp word [rbx + 2], 0x63
jne 0x140035edc
cmp word [rbx + 4], 0
jne 0x140035edc
lea rax, [rbp - 0x59]
mov qword [rbp - 0x49], 2
mov ecx, 0x6372
mov word [rax], cx
mov byte [rax + 2], 0
mov rdi, qword [rbp - 0x41]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
mov r8, qword [rbp - 0x29]
sub rax, r8
cmp rax, 1
jb 0x140036210
lea rdx, [rbp - 0x39]
cmp r14, 0x10
cmovae rdx, rsi
mov qword [rsp + 0x38], rdx
mov qword [rbp + 7], 0
mov qword [rbp + 0x17], 0
mov qword [rbp + 0x1f], 0
lea rax, [r8 + 1]
mov qword [rsp + 0x30], rax
mov ebx, reloc.WS2_32.dll_ntohs
lea r15, [rbp + 7]
cmp rax, rbx
jbe 0x140035fc6
mov rbx, rax
or rbx, 0xf
cmp rbx, rcx
jbe 0x140035f7a
mov rbx, rcx
mov rcx, r13
call fcn.1402407f4
test rax, rax
je 0x140036216
lea r15, [rax + 0x27]
and r15, 0xffffffffffffffe0
mov qword [r15 - 8], rax
mov rax, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov r8, qword [rbp - 0x29]
jmp 0x140035fc2
mov ecx, reloc.WS2_32.dll_shutdown
cmp rbx, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140035fa2
lea r13, [rcx + 0x27]
cmp r13, rcx
jbe 0x1400361ff
jmp 0x140035f4d
test rcx, rcx
je 0x140035fbf
call fcn.1402407f4
mov r15, rax
mov rax, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov r8, qword [rbp - 0x29]
jmp 0x140035fc2
xor r15d, r15d
mov qword [rbp + 7], r15
mov qword [rbp + 0x17], rax
mov qword [rbp + 0x1f], rbx
mov rcx, r15
call fcn.1402430d0
mov rax, qword [rbp - 0x29]
mov word [r15 + rax], 0xa
lea rdx, [rbp - 0x59]
cmp rdi, 0x10
cmovae rdx, qword [rbp - 0x59]
mov r8, qword [rbp - 0x49]
lea rcx, [rbp + 7]
call fcn.140007910
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x19], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 9], xmm1
xor r15d, r15d
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], r15b
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0x10
jb 0x140036057
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140036052
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140036216
call fcn.140240d18
mov qword [rsp + 0x28], r15
lea r8, [0x140288b78]
mov rbx, qword [rbp - 0x79]
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140254e90
mov r9, qword [rsp + 0x28]
test r9, r9
jne 0x140036083
xor dil, dil
jmp 0x1400360b0
lea rcx, [rbp - 0x19]
cmp qword [rbp - 1], 0x10
cmovae rcx, qword [rbp - 0x19]
mov r8, qword [rbp - 9]
mov edx, 1
call fcn.140256278
cmp eax, dword [rbp - 9]
setge dil
mov rcx, qword [rsp + 0x28]
call fcn.140255000
mov rdx, qword [rbp - 1]
cmp rdx, 0x10
jb 0x1400360eb
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400360e6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003621c
call fcn.140240d18
mov qword [rbp - 9], r15
mov qword [rbp - 1], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x19], 0
mov rdx, qword [rbp - 0x41]
cmp rdx, 0x10
jb 0x140036137
inc rdx
mov rcx, qword [rbp - 0x59]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140036131
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140036222
call fcn.140240d18
nop
cmp r14, 0x10
jb 0x14003616f
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140036166
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400361f9
mov rcx, rsi
call fcn.140240d18
nop
lea rdx, [rbx - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003618a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
nop
mov rdx, qword [rbp - 0x61]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400361a9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
sub r12d, 1
jg 0x1400361c8
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rioctlsocket + 8]
movzx eax, dil
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140240e30
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1402480bc
nop
call fcn.140007830
nop
mov ecx, 0x80004005
call fcn.140004b00
nop
call fcn.140007870
int3
call fcn.1402480bc
int3
call fcn.1402480bc
nop
call fcn.1402480bc
int3