Function at 0x14000ec10
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x320]
sub rsp, 0x420
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x460], rbx
mov rsi, rdx
mov rbx, rcx
xor r14d, r14d
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], r14
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.14000c720
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x78]
mov qword [rbp - 0x70], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x78], r14
mov byte [rsp + 0x78], r14b
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rsi
lea rcx, [rsp + 0x78]
call fcn.1400075c0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x78]
call fcn.14000e2e0
cmp qword [rsp + 0x48], r14
jne 0x14000ecca
lea rcx, [rsp + 0x40]
call fcn.14000cbf0
mov rcx, qword [rsp + 0x40]
call fcn.14007b800
nop
mov rcx, rsi
call fcn.140007010
xor al, al
jmp 0x14000f2dd
lea rcx, [rbx + 8]
cmp qword [rcx + 0x18], 0x10
jb 0x14000ecd8
mov rcx, qword [rcx]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x14000eca6
imul eax, dword [rsp + 0x48], 0x134
add eax, 4
mov dword [rsp + 0x50], eax
mov dword [rbp + 0x378], r14d
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x378]
mov eax, 4
mov dword [rbp + 0x370], eax
mov r8d, eax
lea rdx, [rsp + 0x50]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rcx, [rbp + 0x220]
call fcn.140008320
lea r12, [rbx + 0x28]
cmp qword [r12 + 0x18], 0x10
jb 0x14000ed60
mov rdx, qword [r12]
jmp 0x14000ed63
mov rdx, r12
lea rcx, [rbp + 0x220]
call fcn.140008360
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x54], eax
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14000f2ab
nop dword [rax + rax]
xor edx, edx
mov r8d, 0x134
lea rcx, [rbp - 0x20]
call fcn.1400ad020
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], r14
mov qword [rbp - 0x38], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x40], r14
mov byte [rbp - 0x50], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbx + 0x10]
lea rcx, [rbp - 0x50]
call fcn.1400075c0
lea rdx, [rbp - 0x68]
lea rcx, [rbp - 0x50]
call fcn.14000e890
test al, al
jne 0x14000ee38
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x14000f203
mov rax, qword [rbp - 0x58]
sub rax, rcx
cmp rax, 0x1000
jb 0x14000ee2e
test cl, 0x1f
jne 0x14000f226
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14000f220
sub rcx, rax
cmp rcx, 8
jb 0x14000f21a
cmp rcx, 0x27
ja 0x14000f214
mov rcx, rax
call fcn.14007b800
jmp 0x14000f203
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x58]
call fcn.14000ea30
nop
lea rax, [rsp + 0x58]
cmp qword [rsp + 0x70], 0x10
cmovae rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14000eed4
test rax, rax
je 0x14000ee81
cmp rcx, 0x29
ja 0x14000ee81
mov r8, rcx
mov rdx, rax
lea rcx, [rbp + 0xe8]
call fcn.1400ac270
jmp 0x14000eed4
xor edx, edx
mov qword [rbp + 0xe8], rdx
mov qword [rbp + 0xf0], rdx
mov qword [rbp + 0xf8], rdx
mov qword [rbp + 0x100], rdx
mov qword [rbp + 0x108], rdx
mov byte [rbp + 0x110], dl
test rax, rax
jne 0x14000eebe
call fcn.1400e49e8
mov dword [rax], reloc.WLDAP32.dll_Ordinal_22
jmp 0x14000eecf
cmp rcx, 0x29
jbe 0x14000eed4
call fcn.1400e49e8
mov dword [rax], Ordinal_35
call fcn.1400e460c
lea rcx, [rbp + 0x120]
call fcn.140008320
cmp qword [r12 + 0x18], 0x10
jb 0x14000eeee
mov rdx, qword [r12]
jmp 0x14000eef1
mov rdx, r12
lea rcx, [rbp + 0x120]
call fcn.140008360
mov r14, qword [rbp - 0x60]
mov rsi, qword [rbp - 0x68]
sub r14, rsi
mov r8d, r14d
mov rdx, rsi
lea rcx, [rbp + 0x120]
call fcn.140008450
test al, al
jne 0x14000efde
mov rax, qword [rsp + 0x70]
cmp rax, 0x10
jb 0x14000ef72
inc rax
mov rcx, qword [rsp + 0x58]
cmp rax, 0x1000
jb 0x14000ef6d
test cl, 0x1f
jne 0x14000f23e
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14000f238
sub rcx, rax
cmp rcx, 8
jb 0x14000f232
cmp rcx, 0x27
ja 0x14000f22c
mov rcx, rax
call fcn.14007b800
mov qword [rsp + 0x70], reloc.WS2_32.dll_ntohs
xor r14d, r14d
mov qword [rsp + 0x68], r14
mov byte [rsp + 0x58], r14b
test rsi, rsi
je 0x14000f203
mov rax, qword [rbp - 0x58]
sub rax, rsi
cmp rax, 0x1000
jb 0x14000efd1
test sil, 0x1f
jne 0x14000f256
mov rax, qword [rsi - 8]
cmp rax, rsi
jae 0x14000f250
sub rsi, rax
cmp rsi, 8
jb 0x14000f24a
cmp rsi, 0x27
ja 0x14000f244
mov rsi, rax
mov rcx, rsi
call fcn.14007b800
jmp 0x14000f203
mov rax, qword [rbp + 0x368]
mov r8, qword [rax + 0x10]
inc r8d
mov r9, qword [rbx + 0x20]
sub r9, r8
lea rdx, [rsp + 0x78]
lea rcx, [rbx + 0x10]
call fcn.14000d170
nop
lea rdx, [rsp + 0x78]
cmp qword [rbp - 0x70], 0x10
cmovae rdx, qword [rsp + 0x78]
mov r8, qword [rbp - 0x78]
lea rcx, [rbp - 0x18]
call fcn.1400ac270
mov r15d, dword [rsp + 0x54]
mov dword [rbp - 0x20], r15d
mov dword [rbp - 0x1c], r14d
mov r8d, 0x134
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x220]
call fcn.140008450
test al, al
jne 0x14000f166
mov rax, qword [rbp - 0x70]
cmp rax, 0x10
jb 0x14000f099
inc rax
mov rcx, qword [rsp + 0x78]
cmp rax, 0x1000
jb 0x14000f094
test cl, 0x1f
jne 0x14000f26e
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14000f268
sub rcx, rax
cmp rcx, 8
jb 0x14000f262
cmp rcx, 0x27
ja 0x14000f25c
mov rcx, rax
call fcn.14007b800
mov qword [rbp - 0x70], reloc.WS2_32.dll_ntohs
xor r14d, r14d
mov qword [rbp - 0x78], r14
mov byte [rsp + 0x78], r14b
mov rax, qword [rsp + 0x70]
cmp rax, 0x10
jb 0x14000f0fd
inc rax
mov rcx, qword [rsp + 0x58]
cmp rax, 0x1000
jb 0x14000f0f8
test cl, 0x1f
jne 0x14000f286
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14000f280
sub rcx, rax
cmp rcx, 8
jb 0x14000f27a
cmp rcx, 0x27
ja 0x14000f274
mov rcx, rax
call fcn.14007b800
mov qword [rsp + 0x70], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x68], r14
mov byte [rsp + 0x58], 0
test rsi, rsi
je 0x14000f203
mov rax, qword [rbp - 0x58]
sub rax, rsi
cmp rax, 0x1000
jb 0x14000f159
test sil, 0x1f
jne 0x14000f29e
mov rax, qword [rsi - 8]
cmp rax, rsi
jae 0x14000f298
sub rsi, rax
cmp rsi, 8
jb 0x14000f292
cmp rsi, 0x27
ja 0x14000f28c
mov rsi, rax
mov rcx, rsi
call fcn.14007b800
jmp 0x14000f203
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rbp + 0x370]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x378]
mov r8d, 0x134
lea rdx, [rbp - 0x20]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
add dword [rbp + 0x370], 0x134
xor r9d, r9d
xor r8d, r8d
mov edx, r15d
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x378]
mov r8d, r14d
mov rdx, rsi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
add r15d, r14d
mov dword [rsp + 0x54], r15d
lea rcx, [rsp + 0x78]
call fcn.140007010
nop
lea rcx, [rsp + 0x58]
call fcn.140007010
nop
lea rcx, [rbp - 0x68]
call fcn.14000c9b0
xor r14d, r14d
mov rbx, qword [rbx]
cmp rbx, rdi
je 0x14000f2a4
jmp 0x14000ed90
call fcn.1400e462c
int3
call fcn.1400e462c
int3
call fcn.1400e462c
int3
call fcn.1400e462c
nop
call fcn.1400e462c
int3
call fcn.1400e462c
int3
call fcn.1400e462c
int3
call fcn.1400e462c
nop
call fcn.1400e462c
int3
call fcn.1400e462c
int3
call fcn.1400e462c
int3
call fcn.1400e462c
nop
call fcn.1400e462c
int3
call fcn.1400e462c
int3
call fcn.1400e462c
int3
call fcn.1400e462c
nop
call fcn.1400e462c
int3
call fcn.1400e462c
int3
call fcn.1400e462c
int3
call fcn.1400e462c
nop
call fcn.1400e462c
int3
call fcn.1400e462c
int3
call fcn.1400e462c
int3
call fcn.1400e462c
int3
mov rsi, qword [rbp + 0x368]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x40]
call fcn.14000cbf0
mov edx, 1
lea r8d, [rdx + 0x2f]
mov rcx, qword [rsp + 0x40]
call fcn.14000c780
nop
mov rcx, rsi
call fcn.140007010
mov al, 1
mov rbx, qword [rsp + 0x460]
add rsp, 0x420
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret