Function at 0x1400012e8
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
push r12
push r13
push r14
sub rsp, 0x150
mov qword [r11 - 0x88], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov r13, rcx
xor ebx, ebx
mov dword [rsp + 0x34], ebx
mov dword [rsp + 0x78], ebx
mov qword [r11 - 0xe8], rbx
lea edx, [rbx + 2]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x140003386
mov dword [0x14001a018], ebx
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x58], ebx
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x50]
call fcn.1400029e0
nop
mov r12, qword [rax]
mov r14d, 0x80040111
lea rsi, [0x14001a090]
mov qword [rsp + 0xc0], rsi
mov edx, 0x18
mov rcx, qword [0x14001a118]
mov r8, qword [0x14001a110]
mov rax, qword [rsi]
test rax, rax
je 0x140001428
cmp qword [rax], r8
jne 0x1400033a3
cmp qword [rax + 8], rcx
jne 0x1400033a3
mov qword [rsp + 0xd0], rdx
mov byte [rsp + 0xd8], bl
movaps xmm0, xmmword [rsp + 0xd0]
movdqa xmmword [rsp + 0x90], xmm0
xor ecx, ecx
call qword [0x14001a0c8]
mov rdi, rax
test rax, rax
je 0x140003393
lea rax, [0x140010770]
mov qword [rdi], rax
mov dword [rdi + 8], 1
mov qword [rdi + 0x10], rsi
jmp 0x1400013ff
test rdi, rdi
je 0x14000339b
mov rax, qword [rdi]
mov r8, r12
lea rdx, [0x1400105f8]
mov rcx, rdi
call qword [rax]
mov r14d, eax
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
jmp 0x140001428
test r14d, r14d
js 0x1400033b3
mov rax, qword [rsp + 0xb8]
cmp qword [rax], rbx
je 0x140001445
mov dword [rax + 8], 1
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x48], ebx
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x40]
call fcn.1400029e0
nop
mov r8, qword [rax]
mov edx, 1
xor ecx, ecx
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
js 0x1400033bf
mov rax, qword [rsp + 0xb0]
cmp qword [rax], rbx
je 0x14000148d
mov dword [rax + 8], 1
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
mov r8, qword [rsp + 0x50]
lea rdx, [0x1400105f8]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ole32.dll_CoMarshalInterface]
test eax, eax
js 0x1400033ca
cmp dword [rsp + 0x58], ebx
je 0x1400014d2
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400014ce
mov rax, qword [rcx]
call qword [rax + 0x10]
mov dword [rsp + 0x58], ebx
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
mov r8d, 1
lea rdx, [rsp + 0xf0]
call qword [rax + 0x60]
test eax, eax
js 0x1400033d7
mov eax, dword [rsp + 0x100]
mov dword [rsp + 0x30], eax
mov ecx, eax
call fcn.14000195c
mov rdi, rax
mov qword [rsp + 0x60], rax
mov esi, ebx
mov dword [rsp + 0x68], ebx
test rax, rax
je 0x140001521
mov esi, 1
mov dword [rsp + 0x68], esi
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
call qword [rax + 0x28]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea r9, [rsp + 0x70]
mov r8d, dword [rsp + 0x30]
mov rdx, rdi
call qword [rax + 0x18]
test eax, eax
js 0x1400033e4
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 0x70], eax
jne 0x1400033f1
cmp dword [rsp + 0x48], ebx
je 0x14000157d
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140001579
mov rax, qword [rcx]
call qword [rax + 0x10]
mov dword [rsp + 0x48], ebx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x38]
mov r8d, 4
lea rdx, [rsp + 0x30]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140003401
cmp dword [rsp + 0x38], 4
jne 0x14000340c
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x38]
mov r8d, dword [rsp + 0x30]
mov rdx, rdi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000341c
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 0x38], eax
jne 0x140003427
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14001a120]
call qword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
je 0x140003437
call fcn.140001014
test eax, eax
js 0x140003442
call qword [sym.imp.ole32.dll_CoUninitialize]
nop
test esi, esi
je 0x140001629
test rdi, rdi
je 0x140001625
mov rdx, rdi
xor ecx, ecx
call qword [0x14001a008]
mov dword [rsp + 0x68], ebx
cmp dword [rsp + 0x48], ebx
jne 0x14000344f
cmp dword [rsp + 0x58], ebx
jne 0x140003468
mov edi, dword [rsp + 0x34]
test byte [rsp + 0x78], 2
jne 0x140003481
mov eax, edi
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140001680
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret
mov ecx, eax
call fcn.140008f88
nop
jmp 0x140001348
mov rdi, rbx
jmp 0x1400013ff
mov r14d, 0x8007000e
jmp 0x1400033b3
add rsi, rdx
mov qword [rsp + 0xc0], rsi
jmp 0x140001395
mov ecx, r14d
call fcn.140008f88
nop
jmp 0x1400033be
nop
mov ecx, eax
call fcn.140008f88
nop
jmp 0x1400033c9
nop
mov ecx, eax
call fcn.140008f88
nop
jmp 0x1400014b8
mov ecx, eax
call fcn.140008f88
nop
jmp 0x1400014f3
mov ecx, eax
call fcn.140008f88
nop
jmp 0x140001555
mov ecx, 0x80004005
call fcn.140008f88
nop
jmp 0x140001563
call fcn.140009070
nop
jmp 0x1400015a3
mov ecx, 0x80004005
call fcn.140008f88
nop
jmp 0x1400015ae
call fcn.140009070
nop
jmp 0x1400015d1
mov ecx, 0x80004005
call fcn.140008f88
nop
jmp 0x1400015df
call fcn.140009070
nop
jmp 0x1400015fd
mov ecx, eax
call fcn.140008f88
nop
jmp 0x14000160a
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14000345f
mov rax, qword [rcx]
call qword [rax + 0x10]
mov dword [rsp + 0x48], ebx
jmp 0x140001633
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140003478
mov rax, qword [rcx]
call qword [rax + 0x10]
mov dword [rsp + 0x58], ebx
jmp 0x14000163d
mov rcx, qword [0x14001a9c0]
test rcx, rcx
je 0x14000164c
call rcx
nop
jmp 0x14000164c