Function at 0x140001778
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x200]
sub rsp, 0x300
mov rax, qword [0x140007040]
xor rax, rsp
mov qword [rbp + 0x1f0], rax
mov r12, r8
and qword [rbp - 0x50], 0
and qword [rbp - 0x30], 0
mov r8d, edx
mov rdx, rcx
lea rcx, [rbp - 0x60]
call fcn.140001044
test al, al
jne 0x1400017cb
xor dil, dil
jmp 0x140001a12
mov ecx, 0x100
mov rax, qword [0x140007870]
cmp qword [rbp - 0x50], 0
je 0x1400017ef
mov edx, 0x400000
call qword [0x1400043e8]
mov r14, qword [rbp - 0x50]
jmp 0x1400017fe
mov edx, 8
call qword [0x1400043e8]
lea r14, [rbp - 0x48]
mov r15d, dword [rbp - 0x38]
mov edx, 1
lea ecx, [rdx + 0x1f]
mov rax, qword [0x140007870]
call qword [0x1400043e8]
xor esi, esi
xor edi, edi
mov eax, esi
inc esi
cmp eax, 3
jg 0x1400018e3
xor edi, edi
and qword [rsp + 0x38], rdi
lea rax, [rbp - 0x20]
mov qword [rsp + 0x30], rax
mov rcx, qword [rbp - 0x30]
mov qword [rsp + 0x28], rcx
and dword [rsp + 0x20], edi
mov r9d, r15d
mov r8, r14
mov rdx, qword [rbp - 0x58]
mov rcx, qword [rbp - 0x60]
mov rax, qword [0x140007888]
call qword [0x1400043e8]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
jne 0x1400018e3
mov edi, 0x806d0005
test eax, eax
je 0x1400018e3
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
cmp edi, 0x80190191
je 0x1400018de
cmp edi, 0x80190194
je 0x1400018d7
lea eax, [rdi + 0x7ff3d103]
cmp eax, 2
jbe 0x14000181b
cmp edi, 0x800c2ee2
je 0x14000181b
cmp edi, 0x80190198
je 0x14000181b
cmp edi, 0x801901f4
je 0x14000181b
lea eax, [rdi + 0x7fe6fe0a]
cmp eax, 2
jbe 0x14000181b
jmp 0x1400018e3
mov edi, 0x806d0005
jmp 0x1400018e3
mov edi, 0xe0b40100
mov dword [rbp - 0x70], edi
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
jne 0x140001911
lea rcx, [rbp - 0x20]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rsi, rax
mov qword [rbp - 0x68], rax
test rax, rax
je 0x140001a4a
mov rbx, rax
jmp 0x140001919
xor esi, esi
mov qword [rbp - 0x68], rsi
xor ebx, ebx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
mov dword [rsp + 0x58], edi
xor edx, edx
lea r14d, [rdx + 4]
mov r9d, r14d
lea r8, [rsp + 0x58]
lea rcx, [rsp + 0x68]
call fcn.140002904
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_VariantInit]
mov edi, eax
mov r9d, r14d
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x68]
test eax, eax
jne 0x14000196e
and dword [rsp + 0x60], eax
lea r8, [rsp + 0x60]
jmp 0x14000199b
lea eax, [rdi*2 + 2]
mov dword [rsp + 0x50], eax
lea r8, [rsp + 0x50]
call fcn.140002904
lea rax, [rdi + 1]
lea r9, [rbx + rax*2]
sub r9, rbx
mov r8, rbx
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x68]
call fcn.140002904
nop
mov r8, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x68]
sub r8, rbx
and qword [rsp + 0x20], 0
lea r9, [rbp - 0x78]
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne dil
test rbx, rbx
je 0x140001a08
mov rdx, qword [rsp + 0x78]
sub rdx, rbx
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400019ff
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400019ff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.14000309c
nop
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov al, dil
mov rcx, qword [rbp + 0x1f0]
xor rcx, rsp
call fcn.140003050
add rsp, 0x300
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x8007000e
call fcn.140002e94
int3