Function at 0x140101968
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov bl, r9b
mov r12, r8
mov r13, rdx
mov r15, rcx
mov rcx, qword [0x140173048]
lea rdi, [0x140173048]
cmp rcx, rdi
je 0x1401019c6
test byte [rcx + 0x1c], 1
je 0x1401019c6
cmp byte [rcx + 0x19], 4
jb 0x1401019c6
mov rcx, qword [rcx + 0x10]
lea r8, [0x14015eef8]
mov edx, 0x5f
call fcn.14000c328
mov rcx, qword [0x140173048]
or qword [rbp - 0x10], 0xffffffffffffffff
xor esi, esi
mov qword [rbp + 0x50], rsi
mov r14d, esi
mov dword [rbp + 0x48], esi
mov byte [rbp + 0x40], sil
mov qword [rbp - 8], rsi
test r15, r15
jne 0x140101a03
lea r8, str.wszSrcFile
mov edx, 0x926
lea rcx, str.base_stor_blbengine_blbengutils_blbfsutils.cpp
call fcn.1400906e0
mov rcx, qword [0x140173048]
test r13, r13
jne 0x140101a27
lea r8, str.wszDstFile
mov edx, 0x927
lea rcx, str.base_stor_blbengine_blbengutils_blbfsutils.cpp
call fcn.1400906e0
mov rcx, qword [0x140173048]
cmp rcx, rdi
je 0x140101a55
test byte [rcx + 0x1c], 1
je 0x140101a55
cmp byte [rcx + 0x19], 4
jb 0x140101a55
mov rcx, qword [rcx + 0x10]
lea r8, [0x14015eef8]
mov edx, 0x60
mov qword [rsp + 0x20], r13
mov r9, r15
call fcn.140015238
test r12, r12
je 0x140101ad8
test bl, bl
je 0x140101ad8
mov dil, 1
test dil, dil
je 0x140101a7a
xor edx, edx
mov rcx, r12
call fcn.1400ffdd4
mov ebx, eax
test eax, eax
js 0x140101b21
lea r8, [rbp - 8]
mov rcx, r15
lea rdx, [rbp + 0x50]
call fcn.1401374ac
mov ebx, eax
test eax, eax
jns 0x140101af3
mov rcx, qword [0x140173048]
lea rsi, [0x140173048]
cmp rcx, rsi
je 0x140101aed
test byte [rcx + 0x1c], 1
je 0x140101aed
cmp byte [rcx + 0x19], 2
jb 0x140101aed
mov rcx, qword [rcx + 0x10]
lea r8, [0x14015eef8]
mov edx, 0x61
mov dword [rsp + 0x20], eax
mov r9, r15
call fcn.1400151b8
mov r14, qword [rbp + 0x50]
mov rcx, qword [0x140173048]
jmp 0x140101b2f
mov dil, sil
test r12, r12
je 0x140101a61
test bl, bl
jne 0x140101a61
mov sil, 1
jmp 0x140101a7a
mov r14, qword [rbp + 0x50]
jmp 0x140101b2f
test dil, dil
je 0x140101b00
mov rcx, r12
call fcn.1401005a4
test sil, sil
je 0x140101b9f
xor edx, edx
mov rcx, r12
call fcn.1400ffdd4
mov ebx, eax
test eax, eax
jns 0x140101b9f
mov r14, qword [rbp + 0x50]
mov rcx, qword [0x140173048]
lea rsi, [0x140173048]
test r12, r12
je 0x140101b43
mov rcx, r12
call fcn.1401005a4
mov rcx, qword [0x140173048]
test r14, r14
je 0x140101b5e
mov rcx, r14
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rcx, qword [0x140173048]
cmp rcx, rsi
je 0x140101b84
test byte [rcx + 0x1c], 1
je 0x140101b84
cmp byte [rcx + 0x19], 4
jb 0x140101b84
mov rcx, qword [rcx + 0x10]
lea r8, [0x14015eef8]
mov edx, 0x67
call fcn.14000c328
mov eax, ebx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rax, [rbp - 0x10]
mov r9d, 2
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov byte [rsp + 0x30], r14b
mov edx, 0xc0000000
mov rcx, r13
mov dword [rsp + 0x20], 0x80
call fcn.1400980b4
mov r14, qword [rbp + 0x50]
xor ecx, ecx
mov ebx, eax
test eax, eax
jns 0x140101c26
mov rcx, qword [0x140173048]
lea rdx, [0x140173048]
cmp rcx, rdx
je 0x140101c19
test byte [rcx + 0x1c], 1
je 0x140101c19
cmp byte [rcx + 0x19], 2
jb 0x140101c19
mov rcx, qword [rcx + 0x10]
lea r8, [0x14015eef8]
mov edx, 0x62
mov dword [rsp + 0x20], eax
mov r9, r13
call fcn.1400151b8
mov rcx, qword [0x140173048]
mov rdi, qword [rbp - 0x10]
mov r15b, byte [rbp + 0x40]
jmp 0x140101dcd
mov r15b, 1
test sil, sil
je 0x140101c38
mov rcx, r12
call fcn.1401005a4
xor ecx, ecx
or rax, 0xffffffffffffffff
inc rax
cmp word [r14 + rax*2], cx
jne 0x140101c3c
mov rdi, qword [rbp - 0x10]
lea esi, [rax*2 + 2]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x48]
mov r8d, esi
mov rcx, rdi
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop dword [rax + rax]
test eax, eax
jne 0x140101cda
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x140101c8e
movzx ebx, ax
or ebx, 0x80070000
mov rcx, qword [0x140173048]
lea rdx, [0x140173048]
cmp rcx, rdx
je 0x140101dcd
test byte [rcx + 0x1c], r15b
je 0x140101dcd
cmp byte [rcx + 0x19], 2
jb 0x140101dcd
mov rcx, qword [rcx + 0x10]
lea r8, [0x14015eef8]
mov edx, 0x63
mov dword [rsp + 0x20], ebx
mov r9, r13
call fcn.1400151b8
jmp 0x140101dc6
mov eax, dword [rbp + 0x48]
cmp eax, esi
je 0x140101d31
mov rcx, qword [0x140173048]
lea rdx, [0x140173048]
cmp rcx, rdx
je 0x140101d27
test byte [rcx + 0x1c], r15b
je 0x140101d27
cmp byte [rcx + 0x19], 2
jb 0x140101d27
mov rcx, qword [rcx + 0x10]
lea r8, [0x14015eef8]
mov edx, 0x64
mov dword [rsp + 0x28], esi
mov r9, r13
mov dword [rsp + 0x20], eax
call fcn.14003fe80
mov rcx, qword [0x140173048]
mov ebx, 0x8007045d
jmp 0x140101dcd
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
nop dword [rax + rax]
xor esi, esi
test eax, eax
jne 0x140101db0
call qword [sym.imp.ntdll.dll_RtlGetLastNtStatus]
nop dword [rax + rax]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x140101d6f
movzx ebx, bx
or ebx, 0x80070000
mov rcx, qword [0x140173048]
lea rdx, [0x140173048]
cmp rcx, rdx
je 0x140101dcd
test byte [rcx + 0x1c], r15b
je 0x140101dcd
cmp byte [rcx + 0x19], 2
jb 0x140101dcd
mov rcx, qword [rcx + 0x10]
lea r8, [0x14015eef8]
mov edx, 0x65
mov dword [rsp + 0x28], esi
mov r9, r13
mov dword [rsp + 0x20], ebx
call fcn.1400d15fc
jmp 0x140101dc6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
or rdi, 0xffffffffffffffff
mov r15b, sil
mov rcx, qword [0x140173048]
cmp rdi, 0xffffffffffffffff
je 0x140101de9
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, qword [0x140173048]
test r15b, r15b
je 0x140101b28
xor r8d, r8d
xor edx, edx
mov rcx, r13
call fcn.1400960a8
test eax, eax
jns 0x140101b21
mov rcx, qword [0x140173048]
lea rsi, [0x140173048]
cmp rcx, rsi
je 0x140101b2f
test byte [rcx + 0x1c], 1
je 0x140101b2f
cmp byte [rcx + 0x19], 3
jb 0x140101b2f
mov rcx, qword [rcx + 0x10]
lea r8, [0x14015eef8]
mov edx, 0x66
mov dword [rsp + 0x20], ebx
mov r9, r13
call fcn.1400151b8
jmp 0x140101acf