Function at 0x140001be4
Capabilities:
Write file on windows

Disassembly:
mov rcx, rsi
call rdi
mov dword [rsp + 0x48], ebx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x38]
mov r8d, 4
lea rdx, [rsp + 0x30]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000354d
cmp dword [rsp + 0x38], 4
jne 0x140003559
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x38]
mov r8d, dword [rsp + 0x30]
mov rdx, r12
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000356a
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 0x38], eax
jne 0x140003576
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14001b170]
call qword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
je 0x140003587
call fcn.140001050
test eax, eax
js 0x140003593
call qword [sym.imp.ole32.dll_CoUninitialize]
nop
test r15d, r15d
je 0x140001193
mov rcx, r12
call fcn.1400011b0
mov dword [rsp + 0x70], ebx
cmp dword [rsp + 0x48], ebx
jne 0x1400035a1
cmp dword [rsp + 0x58], ebx
je 0x1400035ed
jmp 0x1400035ca
mov eax, ebx
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.140001030
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x110
mov qword [r11 - 0x98], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov r13, rcx
xor ebx, ebx
mov dword [rsp + 0x78], ebx
mov qword [r11 - 0xb8], rbx
lea edx, [rbx + 2]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x140003409
mov dword [0x14001b018], ebx
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x58], ebx
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x50]
call fcn.140001da0
nop
mov r12, qword [rax]
mov r15d, 0x80040111
lea rdi, [0x14001b090]
mov qword [rsp + 0x90], rdi
mov rcx, qword [0x14001b168]
mov rdx, qword [0x14001b160]
mov rax, qword [rdi]
test rax, rax
je 0x14000346e
cmp qword [rax], rdx
jne 0x14000345d
cmp qword [rax + 8], rcx
jne 0x14000345d
mov ecx, 0x18
call fcn.140001a70
mov rsi, rax
test rax, rax
je 0x140003417
lea rax, [0x1400118d0]
mov qword [rsi], rax
mov r14d, 1
mov dword [rsi + 8], r14d
mov qword [rsi + 0x10], rdi
jmp 0x140001cd7
test rsi, rsi
je 0x140003426
mov rax, qword [rsi]
mov rdi, qword [rax]
mov rcx, rdi
call qword [0x140011568]
nop
jmp 0x14000342f
jmp 0x140001cf9
test r15d, r15d
js 0x14000347a
mov rax, qword [rsp + 0x88]
cmp qword [rax], rbx
je 0x140001d13
mov dword [rax + 8], r14d
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x48], ebx
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x40]
call fcn.140001da0
nop
mov r8, qword [rax]
mov edx, r14d
xor ecx, ecx
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
js 0x140003486
mov rax, qword [rsp + 0x98]
cmp qword [rax], rbx
je 0x140001d56
mov dword [rax + 8], r14d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
mov r8, qword [rsp + 0x50]
lea rdx, [0x1400117e0]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ole32.dll_CoMarshalInterface]
test eax, eax
js 0x140003491
cmp dword [rsp + 0x58], ebx
je 0x140002bfb
mov rsi, qword [rsp + 0x50]
test rsi, rsi
jne 0x14000349f
jmp 0x140002bf7
mov rcx, rsi
call rdi
mov dword [rsp + 0x58], ebx
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsi]
mov rdi, qword [rax + 0x60]
mov rcx, rdi
call qword [0x140011568]
nop
jmp 0x1400034b6
test eax, eax
js 0x1400034cd
mov eax, dword [rsp + 0xc0]
mov dword [rsp + 0x30], eax
mov ecx, eax
call fcn.1400023d8
mov r12, rax
mov qword [rsp + 0x68], rax
mov r15d, ebx
mov dword [rsp + 0x70], ebx
test rax, rax
je 0x140002c4d
mov r15d, r14d
mov dword [rsp + 0x70], r14d
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsi]
mov rdi, qword [rax + 0x28]
mov rcx, rdi
call qword [0x140011568]
nop
jmp 0x1400034db
test eax, eax
js 0x140003517
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 0x34], eax
jne 0x140003525
cmp dword [rsp + 0x48], ebx
je 0x1400010ee
mov rsi, qword [rsp + 0x40]
test rsi, rsi
jne 0x140003536
jmp 0x1400010ea
mov ecx, eax
call fcn.140009954
nop
jmp 0x140001c3f
mov rsi, rbx
mov r14d, 1
jmp 0x140001cd7
mov r15d, 0x8007000e
jmp 0x14000347a
mov r8, r12
lea rdx, [0x1400117e0]
mov rcx, rsi
call rdi
mov r15d, eax
mov rax, qword [rsi]
mov rdi, qword [rax + 0x10]
mov rcx, rdi
call qword [0x140011568]
mov rcx, rsi
call rdi
nop
jmp 0x140001cf6
add rdi, 0x18
mov qword [rsp + 0x90], rdi
jmp 0x140001c87
mov r14d, 1
jmp 0x140001cf9
mov ecx, r15d
call fcn.140009954
nop
jmp 0x140003485
nop
mov ecx, eax
call fcn.140009954
nop
jmp 0x140003490
nop
mov ecx, eax
call fcn.140009954
nop
jmp 0x140001d81
mov rax, qword [rsi]
mov rdi, qword [rax + 0x10]
mov rcx, rdi
call qword [0x140011568]
nop
jmp 0x140002bf2
mov r8d, r14d
lea rdx, [rsp + 0xb0]
mov rcx, rsi
call rdi
nop
jmp 0x140002c17
mov ecx, eax
call fcn.140009954
nop
jmp 0x140002c1f
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call rdi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsi]
mov rdi, qword [rax + 0x18]
mov rcx, rdi
call qword [0x140011568]
lea r9, [rsp + 0x34]
mov r8d, dword [rsp + 0x30]
mov rdx, r12
mov rcx, rsi
call rdi
nop
jmp 0x140002c69
mov ecx, eax
call fcn.140009954
nop
jmp 0x140002c71
mov ecx, 0x80004005
call fcn.140009954
nop
jmp 0x140002c7f
mov rax, qword [rsi]
mov rdi, qword [rax + 0x10]
mov rcx, rdi
call qword [0x140011568]
nop
jmp 0x1400010e5
call fcn.140009a74
nop
jmp 0x140001114
mov ecx, 0x80004005
call fcn.140009954
nop
jmp 0x14000111f
call fcn.140009a74
nop
jmp 0x140001142
mov ecx, 0x80004005
call fcn.140009954
nop
jmp 0x140001150
call fcn.140009a74
nop
jmp 0x14000116e
mov ecx, eax
call fcn.140009954
nop
jmp 0x14000117b
mov rsi, qword [rsp + 0x40]
test rsi, rsi
je 0x1400035c0
mov rax, qword [rsi]
mov rdi, qword [rax + 0x10]
mov rcx, rdi
call qword [0x140011568]
mov rcx, rsi
call rdi
mov dword [rsp + 0x48], ebx
jmp 0x14000119d
mov rsi, qword [rsp + 0x50]
test rsi, rsi
je 0x1400035e9
mov rax, qword [rsi]
mov rdi, qword [rax + 0x10]
mov rcx, rdi
call qword [0x140011568]
mov rcx, rsi
call rdi
mov dword [rsp + 0x58], ebx
jmp 0x1400035f3
test byte [rsp + 0x78], 2
je 0x1400012c6
call fcn.14000b850
nop
jmp 0x1400012c6