Function at 0x14001b660
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x70]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r9
mov ebx, edx
mov rsi, rcx
mov ecx, dword [rcx + 0x6c]
call sub.api_ms_win_crt_stdio_l1_1_0.dll__get_osfhandle
cmp rax, 0xfffffffffffffffe
je 0x14001bb35
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x14001bb49
movabs r13, 0x1ffffffff
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x10], r15
test ebx, ebx
je 0x14001ba7b
nop
cmp byte [rsi + 0x38], 0
je 0x14001b700
mov qword [rsp + 0x20], 0
mov rcx, r15
mov rdx, rdi
mov r8d, ebx
lea r9, [rbp - 0x24]
call sub.KERNEL32.dll_WriteFile
test eax, eax
je 0x14001ba6d
mov r14d, dword [rbp - 0x24]
jmp 0x14001b7f2
mov qword [rbp - 0x38], rdi
mov rax, qword [rsi + 0xa0]
mov qword [rbp - 0x40], rax
mov r14, qword [rsi + 0x98]
mov r15d, dword [rsi + 0x90]
mov ecx, 0x50
call sub.gc.dll_GC_malloc
mov qword [rax + 4], 0
mov qword [rax + 0xc], 0
mov qword [rax + 0x14], 0
mov qword [rax + 0x1c], 0
mov qword [rax + 0x24], 0
mov qword [rax + 0x2c], 0
mov qword [rax + 0x34], 0
mov qword [rax + 0x3c], 0
mov qword [rax + 0x44], 0
mov dword [rax + 0x4c], 0
mov qword [rbp - 0x20], rax
mov dword [rax], 0x76
call fcn.140019fa0
mov rcx, rax
call fcn.14001a600
mov rdi, r13
mov rax, qword [rax + 0x30]
mov r13, qword [rbp - 0x20]
mov qword [r13 + 8], rax
mov dword [r13 + 0x10], 1
mov r12, r13
add r12, 0x28
mov qword [rsp + 0x20], r12
mov rsi, qword [rbp - 0x10]
mov rcx, rsi
mov rdx, qword [rbp - 0x38]
mov r8d, ebx
lea r9, [rbp - 0x2c]
call sub.KERNEL32.dll_WriteFile
test eax, eax
je 0x14001b830
mov r14d, dword [rbp - 0x2c]
mov byte [r13 + 0x48], 1
mov rcx, r13
mov rdx, rsi
call fcn.14001a910
mov rsi, qword [rbp - 0x18]
mov r13, rdi
mov dword [rbp - 0x24], r14d
mov r15, qword [rbp - 0x10]
mov rdi, qword [rbp - 0x38]
test ebx, ebx
js 0x14001ba91
cmp ebx, r14d
jb 0x14001ba91
mov ebx, ebx
mov eax, r14d
sub rbx, rax
mov rcx, rbx
and rcx, r13
movsxd rdx, ebx
and rdx, r13
cmp rcx, rdx
jne 0x14001ba8c
add rdi, rax
test ebx, ebx
jne 0x14001b6c0
jmp 0x14001ba7b
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x6c
jle 0x14001b8da
cmp eax, 0x6d
mov rsi, qword [rbp - 0x18]
mov r13, rdi
je 0x14001b8ff
cmp eax, 0x3e5
jne 0x14001bb1c
test r15d, r15d
mov rdi, r12
je 0x14001b914
call fcn.140019fa0
mov rcx, rax
call fcn.14001a600
mov r12, qword [rax + 0x30]
mov ecx, 0x28
call sub.gc.dll_GC_malloc
mov r15, rax
mov dword [rax + 0x24], 0
mov qword [rax + 0x1c], 0
mov qword [rax + 0x14], 0
mov qword [rax + 0xc], 0
mov qword [rax + 4], 0
mov dword [rax], 0x88
call fcn.14001aa80
mov qword [r15 + 8], r12
mov qword [r15 + 0x10], rax
mov dword [r15 + 0x18], edx
mov byte [r15 + 0x20], 0
mov rcx, r15
mov rdx, r14
mov r8, qword [rbp - 0x40]
call fcn.14001ac90
jmp 0x14001b9b2
cmp eax, 0x26
mov rsi, qword [rbp - 0x18]
jne 0x14001ba9e
mov r13, rdi
xor r14d, r14d
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x10]
call fcn.14001a910
jmp 0x14001b7e6
xor r14d, r14d
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x10]
call fcn.14001a910
jmp 0x14001b7e6
call fcn.140019fa0
mov rcx, rax
call fcn.14001a600
mov r14, qword [rax + 0x30]
mov rcx, qword [0x14002f190]
lea rdx, [0x14002f47a]
lea r8, [0x14001afc0]
call fcn.140003310
mov r12b, byte [0x14002f479]
mov ecx, 0x28
call sub.gc.dll_GC_malloc
mov r15, rax
test r12b, 1
mov eax, 0
mov ecx, 0x3b9ac9ff
cmovne eax, ecx
mov ecx, 0
movabs rdx, 0x7fffffffffffffff
cmovne rcx, rdx
mov qword [r15 + 0xc], 0
mov qword [r15 + 4], 0
mov qword [r15 + 0x14], 0
mov dword [r15 + 0x24], 0
mov qword [r15 + 0x1c], 0
mov dword [r15], 0x88
mov qword [r15 + 8], r14
mov qword [r15 + 0x10], rcx
mov dword [r15 + 0x18], eax
call fcn.140019fa0
mov rcx, rax
call fcn.14001a600
mov rax, qword [rax + 0x10]
mov rcx, qword [rax + 0x18]
mov rdx, r15
call fcn.14001ad40
call fcn.14001afd0
call fcn.140019fa0
mov rcx, rax
call fcn.14001a600
mov rax, qword [rax + 0x10]
mov rcx, qword [rax + 0x18]
mov rdx, r15
call fcn.14001c190
mov r12, qword [rbp - 0x20]
mov ecx, dword [r12 + 0x10]
lea eax, [rcx - 1]
cmp eax, 2
jae 0x14001bac9
mov r15, qword [rbp - 0x10]
mov rcx, r15
mov rdx, rdi
lea r8, [rbp - 0x28]
xor r9d, r9d
call sub.KERNEL32.dll_GetOverlappedResult
test eax, eax
je 0x14001ba34
mov r14d, dword [rbp - 0x28]
mov rcx, r12
mov rdx, r15
call fcn.14001a910
jmp 0x14001b7e6
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x26
je 0x14001ba5a
cmp eax, 0x6d
jne 0x14001bb7e
xor r14d, r14d
mov rcx, r12
mov rdx, r15
call fcn.14001a910
jmp 0x14001b7e6
xor r14d, r14d
mov rcx, r12
mov rdx, r15
call fcn.14001a910
jmp 0x14001b7e6
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x6d
jne 0x14001bb5d
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.140003430
call fcn.1400053c0
mov rcx, rax
call fcn.140005420
cmp eax, 5
jne 0x14001bb1c
lea rcx, [0x140028550]
lea rdx, [0x140028570]
call fcn.140014260
mov rcx, rax
mov rdx, rsi
call fcn.14001bc70
mov rcx, rax
call fcn.140019950
call fcn.140019cd0
mov rsi, rax
mov ecx, 0x30
call sub.gc.dll_GC_malloc
mov qword [rax + 4], 0
mov qword [rax + 0xc], 0
mov qword [rax + 0x14], 0
mov qword [rax + 0x1c], 0
mov qword [rax + 0x24], 0
mov dword [rax + 0x2c], 0
mov dword [rax], 0x43
mov qword [rax + 8], rsi
mov rcx, rax
call fcn.1400054f0
lea rcx, [0x140028380]
mov edx, eax
mov r8, rsi
call fcn.14001bea0
mov rcx, rax
call fcn.140019950
lea rcx, [0x1400282b0]
call fcn.1400073c0
mov rcx, rax
call fcn.140007430
lea rcx, [0x140028270]
call fcn.1400193d0
mov rcx, rax
call fcn.140007430
cmp eax, 5
jne 0x14001bc02
lea rcx, [0x1400282e0]
mov rdx, qword [rbp - 0x18]
call fcn.14001bc70
mov rcx, rax
call fcn.140019950
cmp eax, 0x3e4
jne 0x14001bc1c
lea rcx, [0x140028380]
lea rdx, [0x1400286b0]
call fcn.140014260
mov rsi, rax
mov ecx, 0x48
call sub.gc.dll_GC_malloc
mov qword [rax + 4], 0
mov qword [rax + 0xc], 0
mov qword [rax + 0x14], 0
mov qword [rax + 0x1c], 0
mov qword [rax + 0x24], 0
mov qword [rax + 0x2c], 0
mov qword [rax + 0x34], 0
mov dword [rax + 0x3c], 0
mov dword [rax], 0x2d
mov qword [rax + 0x40], 0
mov qword [rax + 8], rsi
mov rcx, rax
call fcn.14001c3e0
lea rcx, [0x140028340]
mov edx, eax
mov r8, qword [rbp - 0x18]
call fcn.14001bea0
mov rcx, rax
call fcn.140019950
lea rcx, [0x1400286d0]
mov edx, eax
call fcn.14001c430
mov rcx, rax
call fcn.140019950
int3