Function at 0x1401045a8
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov bl, r9b
mov r12, r8
mov r13, rdx
mov r15, rcx
mov rcx, qword [0x14017a048]
lea rdi, [0x14017a048]
cmp rcx, rdi
je 0x140104606
test byte [rcx + 0x1c], 1
je 0x140104606
cmp byte [rcx + 0x19], 4
jb 0x140104606
mov rcx, qword [rcx + 0x10]
lea r8, [0x140166708]
mov edx, 0x5f
call fcn.140006b98
mov rcx, qword [0x14017a048]
or qword [rbp - 0x10], 0xffffffffffffffff
xor esi, esi
mov qword [rbp + 0x50], rsi
mov r14d, esi
mov dword [rbp + 0x48], esi
mov byte [rbp + 0x40], sil
mov qword [rbp - 8], rsi
test r15, r15
jne 0x140104643
lea r8, str.wszSrcFile
mov edx, 0x926
lea rcx, str.base_stor_blbengine_blbengutils_blbfsutils.cpp
call fcn.14008ac24
mov rcx, qword [0x14017a048]
test r13, r13
jne 0x140104667
lea r8, str.wszDstFile
mov edx, 0x927
lea rcx, str.base_stor_blbengine_blbengutils_blbfsutils.cpp
call fcn.14008ac24
mov rcx, qword [0x14017a048]
cmp rcx, rdi
je 0x140104695
test byte [rcx + 0x1c], 1
je 0x140104695
cmp byte [rcx + 0x19], 4
jb 0x140104695
mov rcx, qword [rcx + 0x10]
lea r8, [0x140166708]
mov edx, 0x60
mov qword [rsp + 0x20], r13
mov r9, r15
call fcn.1400113b0
test r12, r12
je 0x140104718
test bl, bl
je 0x140104718
mov dil, 1
test dil, dil
je 0x1401046ba
xor edx, edx
mov rcx, r12
call fcn.1401029b4
mov ebx, eax
test eax, eax
js 0x140104761
lea r8, [rbp - 8]
mov rcx, r15
lea rdx, [rbp + 0x50]
call fcn.14013ce74
mov ebx, eax
test eax, eax
jns 0x140104733
mov rcx, qword [0x14017a048]
lea rsi, [0x14017a048]
cmp rcx, rsi
je 0x14010472d
test byte [rcx + 0x1c], 1
je 0x14010472d
cmp byte [rcx + 0x19], 2
jb 0x14010472d
mov rcx, qword [rcx + 0x10]
lea r8, [0x140166708]
mov edx, 0x61
mov dword [rsp + 0x20], eax
mov r9, r15
call fcn.140011330
mov r14, qword [rbp + 0x50]
mov rcx, qword [0x14017a048]
jmp 0x14010476f
mov dil, sil
test r12, r12
je 0x1401046a1
test bl, bl
jne 0x1401046a1
mov sil, 1
jmp 0x1401046ba
mov r14, qword [rbp + 0x50]
jmp 0x14010476f
test dil, dil
je 0x140104740
mov rcx, r12
call fcn.1401031a0
test sil, sil
je 0x1401047df
xor edx, edx
mov rcx, r12
call fcn.1401029b4
mov ebx, eax
test eax, eax
jns 0x1401047df
mov r14, qword [rbp + 0x50]
mov rcx, qword [0x14017a048]
lea rsi, [0x14017a048]
test r12, r12
je 0x140104783
mov rcx, r12
call fcn.1401031a0
mov rcx, qword [0x14017a048]
test r14, r14
je 0x14010479e
mov rcx, r14
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rcx, qword [0x14017a048]
cmp rcx, rsi
je 0x1401047c4
test byte [rcx + 0x1c], 1
je 0x1401047c4
cmp byte [rcx + 0x19], 4
jb 0x1401047c4
mov rcx, qword [rcx + 0x10]
lea r8, [0x140166708]
mov edx, 0x67
call fcn.140006b98
mov eax, ebx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rax, [rbp - 0x10]
mov r9d, 2
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov byte [rsp + 0x30], r14b
mov edx, 0xc0000000
mov rcx, r13
mov dword [rsp + 0x20], 0x80
call fcn.140092700
mov r14, qword [rbp + 0x50]
xor ecx, ecx
mov ebx, eax
test eax, eax
jns 0x140104866
mov rcx, qword [0x14017a048]
lea rdx, [0x14017a048]
cmp rcx, rdx
je 0x140104859
test byte [rcx + 0x1c], 1
je 0x140104859
cmp byte [rcx + 0x19], 2
jb 0x140104859
mov rcx, qword [rcx + 0x10]
lea r8, [0x140166708]
mov edx, 0x62
mov dword [rsp + 0x20], eax
mov r9, r13
call fcn.140011330
mov rcx, qword [0x14017a048]
mov rdi, qword [rbp - 0x10]
mov r15b, byte [rbp + 0x40]
jmp 0x140104a0d
mov r15b, 1
test sil, sil
je 0x140104878
mov rcx, r12
call fcn.1401031a0
xor ecx, ecx
or rax, 0xffffffffffffffff
inc rax
cmp word [r14 + rax*2], cx
jne 0x14010487c
mov rdi, qword [rbp - 0x10]
lea esi, [rax*2 + 2]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x48]
mov r8d, esi
mov rcx, rdi
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop dword [rax + rax]
test eax, eax
jne 0x14010491a
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x1401048ce
movzx ebx, ax
or ebx, 0x80070000
mov rcx, qword [0x14017a048]
lea rdx, [0x14017a048]
cmp rcx, rdx
je 0x140104a0d
test byte [rcx + 0x1c], r15b
je 0x140104a0d
cmp byte [rcx + 0x19], 2
jb 0x140104a0d
mov rcx, qword [rcx + 0x10]
lea r8, [0x140166708]
mov edx, 0x63
mov dword [rsp + 0x20], ebx
mov r9, r13
call fcn.140011330
jmp 0x140104a06
mov eax, dword [rbp + 0x48]
cmp eax, esi
je 0x140104971
mov rcx, qword [0x14017a048]
lea rdx, [0x14017a048]
cmp rcx, rdx
je 0x140104967
test byte [rcx + 0x1c], r15b
je 0x140104967
cmp byte [rcx + 0x19], 2
jb 0x140104967
mov rcx, qword [rcx + 0x10]
lea r8, [0x140166708]
mov edx, 0x64
mov dword [rsp + 0x28], esi
mov r9, r13
mov dword [rsp + 0x20], eax
call fcn.14003d0e0
mov rcx, qword [0x14017a048]
mov ebx, 0x8007045d
jmp 0x140104a0d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
nop dword [rax + rax]
xor esi, esi
test eax, eax
jne 0x1401049f0
call qword [sym.imp.ntdll.dll_RtlGetLastNtStatus]
nop dword [rax + rax]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x1401049af
movzx ebx, bx
or ebx, 0x80070000
mov rcx, qword [0x14017a048]
lea rdx, [0x14017a048]
cmp rcx, rdx
je 0x140104a0d
test byte [rcx + 0x1c], r15b
je 0x140104a0d
cmp byte [rcx + 0x19], 2
jb 0x140104a0d
mov rcx, qword [rcx + 0x10]
lea r8, [0x140166708]
mov edx, 0x65
mov dword [rsp + 0x28], esi
mov r9, r13
mov dword [rsp + 0x20], ebx
call fcn.1400ce8a4
jmp 0x140104a06
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
or rdi, 0xffffffffffffffff
mov r15b, sil
mov rcx, qword [0x14017a048]
cmp rdi, 0xffffffffffffffff
je 0x140104a29
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, qword [0x14017a048]
test r15b, r15b
je 0x140104768
xor r8d, r8d
xor edx, edx
mov rcx, r13
call fcn.140090640
test eax, eax
jns 0x140104761
mov rcx, qword [0x14017a048]
lea rsi, [0x14017a048]
cmp rcx, rsi
je 0x14010476f
test byte [rcx + 0x1c], 1
je 0x14010476f
cmp byte [rcx + 0x19], 3
jb 0x14010476f
mov rcx, qword [rcx + 0x10]
lea r8, [0x140166708]
mov edx, 0x66
mov dword [rsp + 0x20], ebx
mov r9, r13
call fcn.140011330
jmp 0x14010470f