Function at 0x14012152c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov bl, r9b
mov r15, r8
mov r13, rdx
mov r12, rcx
mov rcx, qword [0x14017d3a8]
lea rdi, [0x14017d3a8]
cmp rcx, rdi
je 0x14012158a
test byte [rcx + 0x1c], 1
je 0x14012158a
cmp byte [rcx + 0x19], 4
jb 0x14012158a
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400127c8]
mov edx, 0x5f
call fcn.14001dd24
mov rcx, qword [0x14017d3a8]
or qword [rbp - 0x10], 0xffffffffffffffff
xor r14d, r14d
xor eax, eax
mov esi, r14d
mov qword [rbp + 0x50], r14
mov dword [rbp + 0x48], r14d
mov byte [rbp + 0x40], r14b
mov qword [rbp - 8], rax
test r12, r12
jne 0x1401215cb
lea r8, [0x140012738]
lea rcx, [0x140012540]
mov edx, 0x926
call fcn.1400a8be8
mov rcx, qword [0x14017d3a8]
test r13, r13
jne 0x1401215ef
lea r8, [0x140012760]
lea rcx, [0x140012540]
mov edx, 0x927
call fcn.1400a8be8
mov rcx, qword [0x14017d3a8]
cmp rcx, rdi
je 0x14012161d
test byte [rcx + 0x1c], 1
je 0x14012161d
cmp byte [rcx + 0x19], 4
jb 0x14012161d
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400127c8]
mov edx, 0x60
mov r9, r12
mov qword [rsp + 0x20], r13
call fcn.14001ed50
test r15, r15
je 0x140121629
mov dil, 1
test bl, bl
jne 0x14012162c
mov dil, r14b
test r15, r15
je 0x140121638
test bl, bl
jne 0x140121638
mov r14b, 1
test dil, dil
je 0x140121651
xor edx, edx
mov rcx, r15
call fcn.14011e208
mov ebx, eax
test eax, eax
js 0x1401216df
lea r8, [rbp - 8]
lea rdx, [rbp + 0x50]
mov rcx, r12
call fcn.140154934
mov ebx, eax
test eax, eax
jns 0x1401216b5
mov rcx, qword [0x14017d3a8]
lea r14, [0x14017d3a8]
cmp rcx, r14
je 0x1401216af
test byte [rcx + 0x1c], 1
je 0x1401216af
cmp byte [rcx + 0x19], 2
jb 0x1401216af
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400127c8]
mov edx, 0x61
mov r9, r12
mov dword [rsp + 0x20], eax
call fcn.14001ecbc
mov rsi, qword [rbp + 0x50]
mov rcx, qword [0x14017d3a8]
jmp 0x1401216ed
mov rsi, qword [rbp + 0x50]
jmp 0x1401216ed
test dil, dil
je 0x1401216c2
mov rcx, r15
call fcn.14011e39c
test r14b, r14b
je 0x140121756
xor edx, edx
mov rcx, r15
call fcn.14011e208
mov ebx, eax
test eax, eax
jns 0x140121756
mov rsi, qword [rbp + 0x50]
mov rcx, qword [0x14017d3a8]
lea r14, [0x14017d3a8]
test r15, r15
je 0x140121701
mov rcx, r15
call fcn.14011e39c
mov rcx, qword [0x14017d3a8]
test rsi, rsi
je 0x140121716
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x14017d3a8]
cmp rcx, r14
je 0x14012173c
test byte [rcx + 0x1c], 1
je 0x14012173c
cmp byte [rcx + 0x19], 4
jb 0x14012173c
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400127c8]
mov edx, DeleteCriticalSection
call fcn.14001dd24
mov eax, ebx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rax, [rbp - 0x10]
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x30], rax
mov edx, 0xc0000000
mov rcx, r13
mov byte [rsp + 0x28], sil
mov dword [rsp + 0x20], 0x80
call fcn.1400ad8cc
mov rsi, qword [rbp + 0x50]
xor ecx, ecx
mov ebx, eax
test eax, eax
jns 0x1401217dd
mov rcx, qword [0x14017d3a8]
lea rdx, [0x14017d3a8]
cmp rcx, rdx
je 0x1401217d0
test byte [rcx + 0x1c], 1
je 0x1401217d0
cmp byte [rcx + 0x19], 2
jb 0x1401217d0
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400127c8]
mov edx, 0x62
mov r9, r13
mov dword [rsp + 0x20], eax
call fcn.14001ecbc
mov rcx, qword [0x14017d3a8]
mov rdi, qword [rbp - 0x10]
mov r12b, byte [rbp + 0x40]
jmp 0x140121963
mov r12b, 1
test r14b, r14b
je 0x1401217ef
mov rcx, r15
call fcn.14011e39c
xor ecx, ecx
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], cx
jne 0x1401217f3
mov rdi, qword [rbp - 0x10]
lea r14d, [rax*2 + 2]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x48]
mov r8d, r14d
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140121884
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x14017d3a8]
lea rdx, [0x14017d3a8]
cmp rcx, rdx
je 0x140121963
test byte [rcx + 0x1c], 1
je 0x140121963
cmp byte [rcx + 0x19], 2
jb 0x140121963
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400127c8]
mov edx, 0x63
mov r9, r13
mov dword [rsp + 0x20], ebx
call fcn.14001ecbc
jmp 0x14012195c
mov eax, dword [rbp + 0x48]
cmp eax, r14d
je 0x1401218dd
mov rcx, qword [0x14017d3a8]
lea rdx, [0x14017d3a8]
cmp rcx, rdx
je 0x1401218d3
test byte [rcx + 0x1c], 1
je 0x1401218d3
cmp byte [rcx + 0x19], 2
jb 0x1401218d3
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400127c8]
mov edx, 0x64
mov r9, r13
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], eax
call fcn.140028d10
mov rcx, qword [0x14017d3a8]
mov ebx, 0x8007045d
jmp 0x140121963
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
xor r14d, r14d
test eax, eax
jne 0x14012194c
call qword [sym.imp.ntdll.dll_RtlGetLastNtStatus]
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x14017d3a8]
lea rdx, [0x14017d3a8]
cmp rcx, rdx
je 0x140121963
test byte [rcx + 0x1c], 1
je 0x140121963
cmp byte [rcx + 0x19], 2
jb 0x140121963
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400127c8]
mov edx, 0x65
mov r9, r13
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], ebx
call fcn.1400d371c
jmp 0x14012195c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or rdi, 0xffffffffffffffff
mov r12b, r14b
mov rcx, qword [0x14017d3a8]
cmp rdi, 0xffffffffffffffff
je 0x140121979
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14017d3a8]
test r12b, r12b
je 0x1401216e6
xor r8d, r8d
xor edx, edx
mov rcx, r13
call fcn.1400adc28
test eax, eax
jns 0x1401216df
mov rcx, qword [0x14017d3a8]
lea r14, [0x14017d3a8]
cmp rcx, r14
je 0x1401216ed
test byte [rcx + 0x1c], 1
je 0x1401216ed
cmp byte [rcx + 0x19], 3
jb 0x1401216ed
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400127c8]
mov edx, DeleteCriticalSection
mov r9, r13
mov dword [rsp + 0x20], ebx
call fcn.14001ecbc
jmp 0x1401216a6