Function at 0x140156a70
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xd0
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rbp + 7], rax
mov r15, rcx
mov qword [rbp - 0x79], rcx
mov rcx, qword [rbp + 0x7f]
xor edi, edi
xor r14d, r14d
mov qword [rbp - 0x29], rcx
xor r12d, r12d
mov qword [rbp - 0x39], r9
xor ebx, ebx
mov qword [rbp - 0x41], r8
xor r13d, r13d
mov qword [rbp - 0x49], rdx
mov qword [rbp - 0x59], rdi
xorps xmm0, xmm0
mov qword [rsp + 0x30], r14
mov rax, rdx
mov qword [rbp - 0x69], r12
movups xmmword [rbp - 9], xmm0
test r15, r15
je 0x1401573a4
cmp rax, 0xffffffffffffffff
je 0x1401573a4
test r8, r8
je 0x1401573a4
test r9, r9
je 0x1401573a4
test rcx, rcx
je 0x1401573a4
mov eax, 0xffffffff
cmp qword [r15 + 0xb0], rax
ja 0x1401573a4
mov ecx, 0x100000
call fcn.140368330
mov qword [rbp - 0x61], rax
test rax, rax
jne 0x140156b38
mov rcx, rax
lea ebx, [rdi + 6]
call fcn.1403683a0
jmp 0x140156de7
mov qword [rsp + 0xc8], rsi
call fcn.1403a65c0
mov ecx, 8
mov r15, rax
call fcn.140368330
mov qword [rbp - 0x71], rax
test rax, rax
je 0x14015738e
call fcn.1403a7d60
mov rsi, rax
mov rax, qword [rbp - 0x71]
mov qword [rax], rsi
test rsi, rsi
je 0x140156b94
xor r8d, r8d
mov rdx, r15
mov rcx, rsi
call fcn.1403a75f0
mov r14d, eax
test eax, eax
jne 0x140156ba9
mov rcx, rsi
call fcn.1403a7cb0
mov rax, qword [rbp - 0x71]
mov rcx, rax
call fcn.1403683a0
mov qword [rbp - 0x71], rbx
test r14d, r14d
je 0x14015738e
mov r15, qword [rbp - 0x79]
cmp dword [r15 + 0x68], 0x14
je 0x140156bec
mov ecx, 0x100000
call fcn.140368330
mov r13, rax
test rax, rax
jne 0x140156bd1
lea ebx, [rax + 6]
mov r14, rdi
jmp 0x140156dae
lea rcx, [rbp - 0x59]
call fcn.14015ab00
mov rdi, qword [rbp - 0x59]
mov ebx, eax
test eax, eax
je 0x140156bec
mov r14, r12
jmp 0x140156dae
cmp dword [r15 + 0x6c], r12d
je 0x140156d55
mov r14, qword [r15 + 0xa8]
test r14, r14
je 0x140156d4b
cmp dword [r15 + 0xb0], 0x20
jne 0x140156d4b
mov edx, 1
lea ecx, [rdx + 7]
call fcn.140371340
mov rbx, rax
test rax, rax
jne 0x140156c34
lea ebx, [rax + 6]
mov r14, r12
jmp 0x140156dae
call fcn.14039e8e0
mov qword [rbx], rax
mov rsi, rax
test rax, rax
jne 0x140156c57
mov rcx, rbx
call fcn.1403683a0
lea ebx, [rsi + 6]
mov r14, r12
jmp 0x140156dae
mov rcx, rsi
call fcn.14039e9d0
call fcn.1403a5bd0
mov rdx, rax
mov r9, r14
lea rax, str.ABCDEFGHIJKL
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.14039fbc0
mov rcx, rsi
test eax, eax
jne 0x140156ca2
call fcn.14039e860
mov rcx, rbx
call fcn.1403683a0
mov ebx, 3
mov r14, r12
jmp 0x140156dae
mov qword [rsp + 0x30], rbx
call fcn.1403a1210
movsxd rcx, eax
cmp rcx, 0x10
jbe 0x140156cc2
mov rcx, qword [rbx]
call fcn.1403a1210
movsxd rcx, eax
jmp 0x140156cc7
mov ecx, 0x10
mov rax, 0xffffffffffffffff
xor ebx, ebx
add rcx, 0x100000
cmovb rcx, rax
call fcn.140368330
mov qword [rbp - 0x69], rax
test rax, rax
jne 0x140156cf1
lea ebx, [rax + 6]
jmp 0x140156da9
mov rcx, qword [rbp - 0x49]
lea r9, [rbp - 0x19]
mov r8d, 0x10
mov qword [rsp + 0x20], rbx
lea rdx, [rbp - 9]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140156d20
mov eax, 0xffffffff
mov dword [rbp - 0x19], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, 0xffffffff
cmp dword [rbp - 0x19], eax
jne 0x140156d55
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Unable_to_write_quarantine_file__platError:__d_
mov ecx, 3
mov r8d, eax
call fcn.140157a90
mov ebx, 0xc
jmp 0x140156da9
mov ebx, 1
mov r14, r12
jmp 0x140156dae
mov r14, qword [rbp - 0x41]
mov rcx, r14
mov rax, qword [r14 + 8]
call qword [case.0x1401cd220.0]
xor ecx, ecx
mov qword [rbp - 0x31], rax
mov rax, qword [r14 + 0x10]
xor r8d, r8d
mov dword [rbp - 0x51], ecx
xor edx, edx
mov rcx, r14
call qword [case.0x1401cd220.0]
test rax, rax
je 0x140156f25
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Unable_to_seek_object__platError:__d_
mov ecx, 3
call fcn.140157a90
mov ebx, 0xb
mov r14, qword [rsp + 0x30]
mov rcx, qword [rbp - 0x61]
call fcn.1403683a0
mov rsi, qword [rbp - 0x71]
test rsi, rsi
je 0x140156dd7
mov rdx, qword [rbp - 0x39]
xor r8d, r8d
mov rcx, qword [rsi]
call fcn.1403a7450
mov rcx, rsi
call fcn.1403683a0
mov r12, qword [rbp - 0x69]
mov r15, qword [rbp - 0x79]
mov rsi, qword [rsp + 0xc8]
cmp dword [r15 + 0x68], 0x14
je 0x140156ef2
mov rcx, r13
call fcn.1403683a0
test rdi, rdi
je 0x140156ef2
cmp qword [rdi + 0x30], 0
je 0x140156eea
mov r8, qword [rdi + 0x38]
test r8, r8
je 0x140156eea
mov rdx, qword [rdi + 0x28]
test rdx, rdx
je 0x140156eea
cmp qword [rdx], rdi
jne 0x140156eea
mov ecx, dword [rdx + 8]
lea eax, [rcx - 0x2a]
cmp eax, 0x3d
ja 0x140156e4c
movabs r9, 0x2002000088008001
bt r9, rax
jb 0x140156e5d
cmp ecx, 0x71
je 0x140156e5d
cmp ecx, 0x29a
jne 0x140156eea
mov rcx, qword [rdx + 0x10]
test rcx, rcx
je 0x140156e7a
mov rdx, rcx
mov rax, r8
mov rcx, qword [rdi + 0x40]
call qword [case.0x1401cd220.0]
mov rdx, qword [rdi + 0x28]
mov rax, qword [rdx + 0x68]
test rax, rax
je 0x140156e98
mov rcx, qword [rdi + 0x40]
mov rdx, rax
mov rax, qword [rdi + 0x38]
call qword [case.0x1401cd220.0]
mov rdx, qword [rdi + 0x28]
mov rax, qword [rdx + 0x60]
test rax, rax
je 0x140156eb6
mov rcx, qword [rdi + 0x40]
mov rdx, rax
mov rax, qword [rdi + 0x38]
call qword [case.0x1401cd220.0]
mov rdx, qword [rdi + 0x28]
mov rax, qword [rdx + 0x50]
test rax, rax
je 0x140156ed4
mov rcx, qword [rdi + 0x40]
mov rdx, rax
mov rax, qword [rdi + 0x38]
call qword [case.0x1401cd220.0]
mov rdx, qword [rdi + 0x28]
mov rcx, qword [rdi + 0x40]
mov rax, qword [rdi + 0x38]
call qword [case.0x1401cd220.0]
mov qword [rdi + 0x28], 0
mov rcx, rdi
call fcn.1403683a0
cmp dword [r15 + 0x6c], 0
je 0x140156f1e
test r14, r14
je 0x140156f16
mov rcx, qword [r14]
call fcn.14039e9d0
mov rcx, qword [r14]
call fcn.14039e860
mov rcx, r14
call fcn.1403683a0
mov rcx, r12
call fcn.1403683a0
mov eax, ebx
jmp 0x1401573a9
mov rsi, qword [rbp - 0x61]
mov r8d, 0x100000
mov rax, qword [r14 + 0x18]
mov rdx, rsi
mov rcx, r14
call qword [case.0x1401cd220.0]
mov dword [rbp - 0x4d], eax
mov ecx, eax
test eax, eax
je 0x1401571c8
lfence
mov rdi, qword [rbp - 0x59]
test ebx, ebx
jne 0x140156da9
mov rdx, qword [rbp - 0x79]
xor r15d, r15d
mov r14, rsi
mov esi, ecx
cmp byte [rdx + 0xd8], r15b
jne 0x140157210
mov eax, 0xffffffff
cmp ecx, eax
je 0x14015721a
mov eax, ecx
add r12, rax
xor eax, eax
cmp r12, qword [rbp - 0x31]
mov qword [rbp - 0x59], r12
mov r12b, 1
sete al
mov dword [rbp - 0x19], eax
nop dword [rax]
cmp byte [rdx + 0xd8], 0
jne 0x140157210
cmp dword [rdx + 0x68], 0x14
je 0x140157078
mov r15d, 0x100000
test r12b, r12b
jne 0x140157013
test rdi, rdi
je 0x140157004
test r13, r13
je 0x140157004
cmp dword [rdi + 8], 0
jne 0x140156fdc
cmp qword [rdi], 0
je 0x140157182
lea edx, [rax*4]
mov dword [rdi + 0x18], r15d
mov rcx, rdi
mov qword [rdi + 0x10], r13
call fcn.14015b910
cmp eax, 0xfffffffe
je 0x14015717b
sub r15d, dword [rdi + 0x18]
xor ebx, ebx
jmp 0x140157009
mov ebx, 1
test ebx, ebx
jne 0x140157187
jmp 0x14015706b
test rdi, rdi
je 0x140157182
test r13, r13
je 0x140157182
test ecx, ecx
je 0x140157035
mov dword [rdi + 8], ecx
mov rcx, qword [rbp - 0x61]
mov qword [rdi], rcx
jmp 0x140157045
cmp dword [rdi + 8], 0
jne 0x140157045
cmp qword [rdi], 0
je 0x140157182
lea edx, [rax*4]
mov dword [rdi + 0x18], r15d
mov rcx, rdi
mov qword [rdi + 0x10], r13
call fcn.14015b910
cmp eax, 0xfffffffe
je 0x14015717b
sub r15d, dword [rdi + 0x18]
xor ebx, ebx
mov rdx, qword [rbp - 0x79]
mov r14, r13
mov esi, r15d
xor r12b, r12b
cmp dword [rdx + 0x6c], 0
je 0x140157105
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x140157182
mov rbx, qword [rbp - 0x69]
test rbx, rbx
je 0x140157182
mov rcx, qword [rax]
lea r8, [rbp - 0x1d]
mov rdx, rbx
test r14, r14
je 0x1401570c5
mov r9, r14
mov dword [rsp + 0x20], esi
call fcn.14039fc00
test eax, eax
je 0x14015717b
mov esi, dword [rbp - 0x1d]
jmp 0x1401570ff
call fcn.14039f900
test eax, eax
je 0x14015717b
mov r9d, dword [rbp - 0x1d]
mov edx, 0x10
mov rcx, qword [rsp + 0x30]
add r9, rbx
mov r8d, edx
mov rcx, qword [rcx]
call fcn.14039e050
test eax, eax
je 0x14015717b
mov esi, dword [rbp - 0x1d]
add esi, 0x10
mov dword [rbp - 0x1d], esi
mov r14, qword [rbp - 0x69]
xor ebx, ebx
mov rcx, qword [rbp - 0x49]
lea r9, [rbp - 0x15]
mov r8d, esi
mov qword [rsp + 0x20], 0
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140157134
mov eax, 0xffffffff
mov dword [rbp - 0x15], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [rbp - 0x15]
mov ecx, 0xffffffff
mov dword [rbp - 0x51], eax
cmp eax, ecx
je 0x140156d2a
mov rax, qword [rbp - 0x71]
test rax, rax
je 0x140157163
test r14, r14
je 0x140157163
mov rcx, qword [rax]
mov rdx, r14
mov r8d, esi
call fcn.1403a7630
cmp r15d, 0x100000
jne 0x140157195
mov ecx, dword [rbp - 0x4d]
mov rdx, qword [rbp - 0x79]
mov eax, dword [rbp - 0x19]
jmp 0x140156fa0
mov ebx, 3
jmp 0x140157187
mov ebx, 1
mov eax, 0xffffffff
cmp dword [rbp - 0x51], eax
je 0x140156d2a
mov rax, qword [rbp - 0x41]
mov r8d, 0x100000
mov rsi, qword [rbp - 0x61]
mov rcx, rax
mov rdx, rsi
mov rax, qword [rax + 0x18]
call qword [case.0x1401cd220.0]
mov r12, qword [rbp - 0x59]
mov ecx, eax
mov dword [rbp - 0x4d], eax
test eax, eax
jne 0x140156f53
mov r15, qword [rbp - 0x79]
test ebx, ebx
jne 0x140156da9
mov r14, qword [rsp + 0x30]
cmp dword [r15 + 0x6c], ebx
je 0x140157351
test r14, r14
je 0x140157347
mov r12, qword [rbp - 0x69]
test r12, r12
je 0x140157347
mov rcx, qword [r14]
lea r8, [rbp - 0x21]
mov rdx, r12
call fcn.14039f900
test eax, eax
jne 0x14015722f
lea ebx, [rax + 3]
jmp 0x140156dae
mov ebx, 0x1c
jmp 0x140156da9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Unable_to_read_object__platError:__d_
jmp 0x140156d9a
mov r9d, dword [rbp - 0x21]
mov edx, 0x10
mov rcx, qword [r14]
add r9, r12
mov r8d, edx
call fcn.14039e050
test eax, eax
jne 0x140157252
lea ebx, [rax + 3]
jmp 0x140156dae
mov eax, dword [rbp - 0x21]
xor ebx, ebx
add eax, 0x10
mov dword [rbp - 0x21], eax
cmp eax, 0x10
jae 0x14015726c
mov ebx, 3
jmp 0x140156dae
mov rsi, qword [rbp - 0x49]
jbe 0x1401572b1
lea r8d, [rax - 0x10]
mov rdx, r12
mov rcx, rsi
call fcn.140155750
mov ecx, 0xffffffff
cmp eax, ecx
jne 0x1401572ae
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Unable_to_write_quarantine_file__platError:__d_
mov ecx, 3
mov r8d, eax
call fcn.140157a90
mov ebx, 0xc
jmp 0x140156dae
mov eax, dword [rbp - 0x21]
movups xmm0, xmmword [rax + r12 - 0x10]
xor r8d, r8d
xor edx, edx
mov rcx, rsi
movups xmmword [rbp - 9], xmm0
call fcn.140155ad0
test rax, rax
je 0x1401572f1
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Unable_to_seek_quarantine_file__platError:__d_
mov ecx, 3
mov r8d, eax
call fcn.140157a90
mov ebx, 0xc
jmp 0x140156dae
lea r9, [rbp - 0x11]
mov qword [rsp + 0x20], rbx
mov r8d, 0x10
lea rdx, [rbp - 9]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14015731f
mov eax, 0xffffffff
mov dword [rbp - 0x11], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, 0xffffffff
cmp dword [rbp - 0x11], eax
je 0x14015728a
mov rsi, qword [rbp - 0x71]
test rsi, rsi
je 0x140157359
mov r8d, dword [rbp - 0x21]
mov rdx, r12
mov rcx, qword [rsi]
call fcn.1403a7630
jmp 0x140157359
mov ebx, 1
jmp 0x140156dae
mov r12, qword [rbp - 0x69]
mov rsi, qword [rbp - 0x71]
mov rcx, qword [rbp - 0x49]
call fcn.140155a60
mov rcx, qword [rbp - 0x29]
xor r8d, r8d
mov rdx, qword [rbp - 0x39]
mov qword [rcx], rax
mov rcx, qword [rsi]
call fcn.1403a7450
mov rcx, rsi
call fcn.1403683a0
mov rcx, qword [rbp - 0x61]
call fcn.1403683a0
jmp 0x140156ddf
mov rcx, qword [rbp - 0x61]
mov ebx, 3
call fcn.1403683a0
mov r14, rdi
jmp 0x140156ddb
mov eax, 1
mov rcx, qword [rbp + 7]
xor rcx, rsp
call fcn.140359070
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbx
pop rbp
ret