Function at 0x140081be0
Capabilities:
Write file on windows

Disassembly:
push rdi
mov eax, 0x12c0
call fcn.1400ea040
sub rsp, rax
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x12d8], rbx
mov qword [rsp + 0x12e0], rsi
mov rax, qword [0x14012df80]
xor rax, rsp
mov qword [rsp + 0x12b0], rax
mov rdi, rcx
mov rbx, qword [rcx + 0x178]
xor esi, esi
test rbx, rbx
je 0x140081cca
mov rax, qword [rbx]
cmp dword [rax + 0x174], 4
jl 0x140081cca
call fcn.14009d5e8
mov r11, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x140081c5e
mov ecx, 0x80004005
call fcn.1400034f0
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x48], rax
lea rax, [0x1400fb278]
mov qword [rsp + 0x20], rax
lea r9, str.EntryMyApp
lea r8, str.CSetupApp
lea rdx, str.private__s::_s__s_
lea rcx, [rsp + 0x48]
call fcn.14000a800
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.14002f200
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140081cca
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi + 0x148]
mov r8, qword [rax + 0x170]
cmp dword [r8 - 0x10], 0
cmove r8, rsi
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rdi + 0x168], rax
test rax, rax
je 0x140081f3d
mov rax, qword [rdi + 0x148]
mov r8, qword [rax + 0xf8]
cmp dword [r8 - 0x10], 0
cmove r8, rsi
mov ebx, 0x410
mov rdx, rbx
lea rcx, [rsp + 0x270]
mov r9d, esi
lea rax, [rsp + 0x270]
sub r8, rax
lea rax, [rdx + 0x7ffffbee]
test rax, rax
je 0x140081d58
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140081d58
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140081d33
jmp 0x140081d5d
test rdx, rdx
jne 0x140081d67
sub rcx, 2
mov r9d, 0x8007007a
mov word [rcx], 0
test r9d, r9d
jne 0x140081ea5
mov rdx, rbx
lea rcx, [rsp + 0xa90]
mov r9d, esi
lea r8, [rsp + 0x270]
lea rax, [rsp + 0xa90]
sub r8, rax
nop
nop
nop
lea rax, [rdx + 0x7ffffbee]
test rax, rax
je 0x140081dc5
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140081dc5
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140081da0
jmp 0x140081dca
test rdx, rdx
jne 0x140081dd4
sub rcx, 2
mov r9d, 0x8007007a
mov word [rcx], 0
test r9d, r9d
jne 0x140081ea5
lea rdx, str.hwnd.tmp
lea rcx, [rsp + 0xa90]
call fcn.14002ae40
lea rcx, [rsp + 0x270]
mov r8d, esi
lea rdx, [rsp + 0xa90]
lea rax, [rsp + 0x270]
sub rdx, rax
lea rax, [rbx + 0x7ffffbee]
test rax, rax
je 0x140081e38
movzx eax, word [rdx + rcx]
test ax, ax
je 0x140081e38
mov word [rcx], ax
add rcx, 2
sub rbx, 1
jne 0x140081e14
jmp 0x140081e3d
test rbx, rbx
jne 0x140081e47
sub rcx, 2
mov r8d, 0x8007007a
mov word [rcx], 0
mov eax, esi
test r8d, r8d
sete al
test eax, eax
je 0x140081ea5
mov edx, 0x104
lea rcx, [rsp + 0x60]
lea r8, [rsp + 0x270]
lea rax, [rsp + 0x60]
sub r8, rax
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140081e97
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140081e97
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140081e72
jmp 0x140081e9c
test rdx, rdx
jne 0x140081ea0
sub rcx, 2
mov word [rcx], 0
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 1]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140081f3d
mov dword [rsp + 0x40], 8
call fcn.1400a0754
test rax, rax
je 0x140081efa
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + pe_nt_image_headers64]
jmp 0x140081efd
mov rax, rsi
xor r9d, r9d
xor r8d, r8d
mov edx, 0x2b3f
mov rcx, qword [rax + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x40]
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x12b0]
xor rcx, rsp
call fcn.1400cd6e0
lea r11, [rsp + 0x12c0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret