Function at 0x140041bc0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1401b7030]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp byte [rcx + 0xb3d], 0
mov esi, r8d
mov edi, edx
mov rbx, rcx
je 0x140041e36
cmp byte [rcx + 0xb3e], 0
je 0x140041bfa
call fcn.140041e50
mov rcx, qword [rbx + 0x38]
mov byte [rbx + 0xb3c], 1
cmp edi, dword [rcx + 0x16f8]
ja 0x140041e36
mov qword [rsp + 0x90], rbp
xor ebp, ebp
cmp esi, 2
jne 0x140041c3d
mov rcx, qword [rbx + 0xb18]
lea r9d, [rbp + 1]
xor r8d, r8d
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x140041ca5
jmp 0x140041c99
mov rdx, qword [rcx + 0x16f0]
mov r8d, edi
call fcn.140025f70
mov eax, dword [rbx + 0xb58]
add eax, 0x400
test esi, esi
jne 0x140041caa
mov rdx, qword [rbx + 0x38]
xor cl, cl
mov byte [rbx + 0xb3c], bpl
mov rdx, qword [rdx + 0x16f0]
test cl, cl
mov qword [rsp + 0x20], rbp
mov rcx, qword [rbx + 0xb18]
lea r9, [rbx + 0xb24]
mov r8d, edi
cmovne r8d, eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140041d22
mov byte [rbx + 0xb3e], 1
cmp esi, 2
jne 0x140041d22
mov rax, rdi
jmp 0x140041d28
movzx ecx, byte [rbx + 0xb3c]
mov dword [rsp + 0x30], eax
test cl, cl
je 0x140041d0a
mov rcx, qword [rbx + 0x38]
mov edx, eax
call fcn.140026f90
mov rax, qword [rbx + 0x38]
lea r9, [rsp + 0x38]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x38], edi
mov r8, qword [rax + 0x16f0]
mov rcx, qword [rax + 0x16e0]
call sym.vncviewer.exe_uncompress2
test eax, eax
je 0x140041cf4
mov byte [rbx + 0xb3e], 1
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
movzx ecx, byte [rbx + 0xb3c]
mov eax, dword [rsp + 0x30]
mov rdx, qword [rbx + 0x38]
test cl, cl
je 0x140041c68
mov rdx, qword [rdx + 0x16e0]
jmp 0x140041c6f
mov eax, dword [rbx + 0xb24]
add qword [rbx + 0xb28], rax
mov rcx, rbx
mov r8, qword [rbx + 0xb28]
mov eax, ebp
mov rdx, qword [rbx + 0x40]
cmp esi, 2
cmove eax, edi
inc dword [rbx + 0xb20]
add qword [rbx + 0xb30], rax
call fcn.140040d70
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call fcn.14003dfb0
cmp dword [rbx + 0xb54], 1
jne 0x140041dc9
inc dword [rbx + 0xb38]
cmp dword [rbx + 0xb38], 0xa
jle 0x140041dfd
mov byte [rbx + 0x4b], 1
mov dword [rsp + 0x40], 0x507
mov dword [rsp + 0x48], ebp
cmp byte [rbx + 0x48], bpl
jne 0x140041da4
mov dword [rsp + 0x44], ebp
cmp byte [rbx + 0xb3e], bpl
je 0x140041dac
mov dword [rsp + 0x44], 0xffffffff
mov rcx, qword [rbx + 0x38]
lea rdx, [rsp + 0x40]
xor r9d, r9d
lea r8d, [r9 + 0xc]
call fcn.140026ae0
mov dword [rbx + 0xb38], ebp
jmp 0x140041dfd
cmp byte [rbx + 0x48], bpl
je 0x140041dfd
cmp byte [rbx + 0x4b], bpl
jne 0x140041dfd
mov rcx, qword [rbx + 0x38]
lea rdx, [rsp + 0x40]
mov r9b, 7
mov byte [rbx + 0x4b], 1
mov r8d, InitCommonControls
mov qword [rsp + 0x40], 0x30707
mov dword [rsp + 0x48], ebp
call fcn.1400266a0
cmp dword [rbx + 0xb54], 1
jne 0x140041e2a
mov rax, qword [rbx + 0x38]
cmp byte [rax + 0x4d60], bpl
je 0x140041e2a
cmp byte [rax + 0x4d61], bpl
jne 0x140041e2a
mov rcx, rbx
mov dword [rax + 0x4d54], ebp
call fcn.14003e030
mov rbp, qword [rsp + 0x90]
mov al, 1
jmp 0x140041e38
xor al, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14011c340
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret