Function at 0x10010e250
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov r13, r8
mov rbp, rdx
mov rsi, rcx
mov rcx, qword [0x1001653b8]
lea rdi, [0x1001653b8]
cmp rcx, rdi
je 0x10010e2a3
test byte [rcx + 0x1c], 1
je 0x10010e2a3
cmp byte [rcx + 0x19], 4
jb 0x10010e2a3
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002fa0]
mov edx, 0x60
call fcn.10001c7b8
mov rcx, qword [0x1001653b8]
or qword [rsp + 0xa0], 0xffffffffffffffff
xor r12d, r12d
xor eax, eax
and dword [rsp + 0x90], r12d
xor r14b, r14b
mov qword [rsp + 0x98], r12
mov qword [rsp + 0x40], rax
test rsi, rsi
jne 0x10010e2ed
lea r8, [0x100012700]
lea rcx, [0x100012498]
mov edx, 0x947
call fcn.100099ad8
mov rcx, qword [0x1001653b8]
test rbp, rbp
jne 0x10010e311
lea r8, [0x100012710]
lea rcx, [0x100012498]
mov edx, 0x948
call fcn.100099ad8
mov rcx, qword [0x1001653b8]
cmp rcx, rdi
je 0x10010e33f
test byte [rcx + 0x1c], 1
je 0x10010e33f
cmp byte [rcx + 0x19], 4
jb 0x10010e33f
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002fa0]
mov edx, 0x61
mov r9, rsi
mov qword [rsp + 0x20], rbp
call fcn.10001df38
test r13, r13
je 0x10010e3c9
xor edx, edx
mov rcx, r13
mov dil, 1
call fcn.10010ad48
mov ebx, eax
test eax, eax
jns 0x10010e3cc
mov rcx, qword [0x1001653b8]
lea rdi, [0x1001653b8]
test r13, r13
je 0x10010e37d
mov rcx, r13
call fcn.10010aed8
mov rcx, qword [0x1001653b8]
test r12, r12
je 0x10010e392
mov rcx, r12
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x1001653b8]
cmp rcx, rdi
je 0x10010e3b8
test byte [rcx + 0x1c], 1
je 0x10010e3b8
cmp byte [rcx + 0x19], 4
jb 0x10010e3b8
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002fa0]
mov edx, 0x68
call fcn.10001c7b8
mov eax, ebx
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
xor dil, dil
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x98]
mov rcx, rsi
call fcn.10013481c
mov ebx, eax
test eax, eax
jns 0x10010e443
mov rcx, qword [0x1001653b8]
lea rdi, [0x1001653b8]
cmp rcx, rdi
je 0x10010e436
test byte [rcx + 0x1c], 1
je 0x10010e436
cmp byte [rcx + 0x19], 2
jb 0x10010e436
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002fa0]
mov edx, 0x62
mov r9, rsi
mov dword [rsp + 0x20], eax
call fcn.10001daa4
mov r12, qword [rsp + 0x98]
mov rcx, qword [0x1001653b8]
jmp 0x10010e369
mov r12, qword [rsp + 0x98]
jmp 0x10010e369
test dil, dil
je 0x10010e450
mov rcx, r13
call fcn.10010aed8
lea rax, [rsp + 0xa0]
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x30], r12b
and qword [rsp + 0x28], r12
mov edx, 0xc0000000
mov rcx, rbp
mov dword [rsp + 0x20], 0x80
call fcn.10009d520
mov r12, qword [rsp + 0x98]
mov ebx, eax
test eax, eax
jns 0x10010e4e8
mov rcx, qword [0x1001653b8]
lea rdx, [0x1001653b8]
cmp rcx, rdx
je 0x10010e4db
test byte [rcx + 0x1c], 1
je 0x10010e4db
cmp byte [rcx + 0x19], 2
jb 0x10010e4db
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002fa0]
mov edx, 0x63
mov r9, rbp
mov dword [rsp + 0x20], eax
call fcn.10001daa4
mov rdi, qword [rsp + 0xa0]
jmp 0x10010e65a
mov rdi, qword [rsp + 0xa0]
jmp 0x10010e661
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r12
and qword [rsp + 0x20], rax
repne scasw ax, word [rdi]
mov rdi, qword [rsp + 0xa0]
not rcx
lea r9, [rsp + 0x90]
mov rdx, r12
lea esi, [rcx + rcx]
mov rcx, rdi
mov r14b, 1
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10010e585
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x1001653b8]
lea rdx, [0x1001653b8]
cmp rcx, rdx
je 0x10010e661
test byte [rcx + 0x1c], r14b
je 0x10010e661
cmp byte [rcx + 0x19], 2
jb 0x10010e661
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002fa0]
mov edx, 0x64
mov r9, rbp
mov dword [rsp + 0x20], ebx
call fcn.10001daa4
jmp 0x10010e65a
mov eax, dword [rsp + 0x90]
cmp eax, esi
je 0x10010e5e0
mov rcx, qword [0x1001653b8]
lea rdx, [0x1001653b8]
cmp rcx, rdx
je 0x10010e5d6
test byte [rcx + 0x1c], 1
je 0x10010e5d6
cmp byte [rcx + 0x19], 2
jb 0x10010e5d6
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002fa0]
mov edx, 0x65
mov r9, rbp
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], eax
call fcn.10001dd64
mov rcx, qword [0x1001653b8]
mov ebx, 0x8007045d
jmp 0x10010e661
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
jne 0x10010e64a
call qword [sym.imp.ntdll.dll_RtlGetLastNtStatus]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x1001653b8]
lea rdx, [0x1001653b8]
cmp rcx, rdx
je 0x10010e661
test byte [rcx + 0x1c], 1
je 0x10010e661
cmp byte [rcx + 0x19], 2
jb 0x10010e661
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002fa0]
mov edx, 0x66
mov r9, rbp
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], ebx
call fcn.10001dd64
jmp 0x10010e65a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or rdi, 0xffffffffffffffff
xor r14b, r14b
mov rcx, qword [0x1001653b8]
cmp rdi, 0xffffffffffffffff
je 0x10010e677
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x1001653b8]
test r14b, r14b
je 0x10010e362
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call fcn.10009d894
test eax, eax
jns 0x10010e35b
mov rcx, qword [0x1001653b8]
lea rdi, [0x1001653b8]
cmp rcx, rdi
je 0x10010e369
test byte [rcx + 0x1c], 1
je 0x10010e369
cmp byte [rcx + 0x19], 3
jb 0x10010e369
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002fa0]
mov edx, 0x67
mov r9, rbp
mov dword [rsp + 0x20], ebx
call fcn.10001daa4
jmp 0x10010e42a