Function at 0x14011b75e
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0x80]
movaps xmmword [rbp], xmm6
mov rdi, r9
mov ebx, r8d
mov rsi, rdx
mov eax, dword [0x14018b9c8]
mov r8d, dword [0x14018b9c4]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete byte [rbp - 1]
cmp r8d, 0xa
setl byte [rbp - 2]
lea rax, [rcx + 0xa0]
mov qword [rbp - 0x70], rax
lea rax, [rcx + 0x50]
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x80], rcx
lea rax, [rcx + 0x18]
mov qword [rbp - 0x60], rax
mov eax, 0x9b1375d4
mov r13, qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm6, xmm6
mov r12, qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15, qword [sym.imp.KERNEL32.dll_CancelIoEx]
mov r14d, 0x360b1fbd
cmp eax, 0xded6b3c
jle 0x14011b842
cmp eax, 0x385b5268
jg 0x14011b8bc
cmp eax, 0x2917223c
jg 0x14011b93c
cmp eax, 0x1b255f0c
jg 0x14011ba74
cmp eax, 0xded6b3d
je 0x14011bc7b
cmp eax, 0x16c2880d
jne 0x14011b7ea
mov eax, dword [0x14018b9c8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x1b255f0d
mov ecx, 0xa0b7b21a
jmp 0x14011bee9
cmp eax, 0xde9ec9f8
jle 0x14011b8f2
cmp eax, 0xfb4774cc
jg 0x14011b974
cmp eax, 0xe30d437b
jg 0x14011bacb
cmp eax, 0xde9ec9f9
je 0x14011bf48
cmp eax, 0xe27ee507
jne 0x14011b7ea
mov rax, qword [rbp - 0x48]
mov rcx, qword [rax]
mov rdx, qword [rbp - 0x30]
sub rsp, 0x20
call r15
add rsp, 0x20
mov rcx, qword [rbp - 0x18]
sub rsp, 0x20
call fcn.14011c3ec
add rsp, 0x20
mov rax, qword [rbp - 0x20]
mov rcx, qword [rax]
sub rsp, 0x20
call r13
add rsp, 0x20
mov eax, 0x7a6395c
jmp 0x14011b7ea
cmp eax, 0x58dba9bc
jg 0x14011b9ec
cmp eax, 0x3d7dc4fc
jg 0x14011baff
cmp eax, 0x385b5269
je 0x14011bc99
cmp eax, 0x3c9cab06
jne 0x14011b7ea
mov eax, 0x62c08e23
jmp 0x14011b7ea
cmp eax, 0xb53d7255
jle 0x14011ba35
cmp eax, 0xd2fe14e7
jg 0x14011bb4d
cmp eax, 0xb53d7256
je 0x14011bca6
cmp eax, 0xce6e3b91
jne 0x14011b7ea
mov eax, dword [0x14018b9c8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xb53d7256
mov ecx, 0x22024675
jmp 0x14011bee9
cmp eax, 0x2c94fd7c
jg 0x14011bb78
cmp eax, 0x2917223d
je 0x14011bcd3
cmp eax, 0x2a1e2e00
jne 0x14011b7ea
mov eax, 0x9cea6938
mov dword [rbp - 0xc], 1
mov ecx, dword [rbp - 0x38]
mov dword [rbp - 0x24], ecx
jmp 0x14011b7ea
cmp eax, 0xac5ceb3
jg 0x14011bbc2
cmp eax, 0xfb4774cd
je 0x14011be2b
cmp eax, 0x7a6395c
jne 0x14011b7ea
mov rax, qword [rbp - 0x48]
mov rcx, qword [rax]
mov rdx, qword [rbp - 0x30]
sub rsp, 0x20
call r15
add rsp, 0x20
mov rcx, qword [rbp - 0x18]
sub rsp, 0x20
call fcn.14011c3ec
add rsp, 0x20
mov rax, qword [rbp - 0x20]
mov rcx, qword [rax]
sub rsp, 0x20
call r13
add rsp, 0x20
mov eax, dword [0x14018b9c8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xe27ee507
mov ecx, 0xd2fe14e8
jmp 0x14011bee9
cmp eax, 0x62c08e22
jg 0x14011bc0a
cmp eax, 0x58dba9bd
je 0x14011bd58
cmp eax, 0x5b61a1f6
jne 0x14011b7ea
mov eax, dword [rbp - 0x34]
mov dword [rbp - 0x58], eax
mov rax, qword [rbp - 0x50]
mov eax, dword [0x14018b9c8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x1b255f0d
mov ecx, 0x16c2880d
jmp 0x14011bee9
cmp eax, 0x9cea6937
jg 0x14011bc46
cmp eax, 0x98d90d3d
je 0x14011befb
cmp eax, 0x9b1375d4
jne 0x14011b7ea
mov cl, byte [rbp - 1]
cmp byte [rbp - 2], 0
mov eax, 0x2917223d
mov edx, 0xfb4774cd
cmovne eax, edx
test cl, cl
cmovne eax, edx
jmp 0x14011b7ea
cmp eax, 0x1b255f0d
je 0x14011bd8b
cmp eax, 0x22024675
jne 0x14011b7ea
mov rcx, qword [rbp - 0x18]
sub rsp, 0x20
call fcn.14011c3ec
add rsp, 0x20
mov rax, qword [rbp - 0x20]
mov rcx, qword [rax]
sub rsp, 0x20
call r13
add rsp, 0x20
mov eax, dword [0x14018b9c8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xb53d7256
mov ecx, 0x2a1e2e00
jmp 0x14011bee9
cmp eax, 0xe30d437c
je 0x14011bf11
cmp eax, 0xebfb1e93
jne 0x14011b7ea
mov eax, dword [0x14018b9c8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xd869ecce
mov ecx, 0x549e44ec
jmp 0x14011bee9
cmp eax, 0x3d7dc4fd
je 0x14011bd95
cmp eax, 0x549e44ec
jne 0x14011b7ea
sub rsp, 0x20
call r12
add rsp, 0x20
mov dword [rbp - 0x38], eax
mov eax, dword [rbp - 0x38]
cmp eax, 0x3e5
setne byte [rbp - 4]
mov eax, dword [0x14018b9c8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xd869ecce
mov ecx, 0x98d90d3d
jmp 0x14011bee9
cmp eax, 0xd2fe14e8
je 0x14011bdb3
cmp eax, 0xd869ecce
jne 0x14011b7ea
sub rsp, 0x20
call r12
add rsp, 0x20
mov eax, 0x549e44ec
jmp 0x14011b7ea
cmp eax, 0x2c94fd7d
je 0x14011bdcb
cmp eax, 0x360b1fbd
jne 0x14011b7ea
mov rcx, qword [rbp - 0x18]
sub rsp, 0x20
call fcn.14011c3ec
add rsp, 0x20
mov rax, qword [rbp - 0x20]
mov rcx, qword [rax]
sub rsp, 0x20
call r13
add rsp, 0x20
mov eax, 0x5b61a1f6
mov dword [rbp - 0x34], 0
jmp 0x14011b7ea
cmp eax, 0xac5ceb4
je 0x14011bf23
cmp eax, 0xc7303c4
jne 0x14011b7ea
mov rax, qword [rbp - 0x80]
mov edx, dword [rax + 0x20]
mov rcx, qword [rbp - 0x78]
sub rsp, 0x20
mov r8d, 1
call fcn.140118da0
add rsp, 0x20
test al, al
mov eax, 0x3d7dc4fd
mov ecx, 0x58dba9bd
cmovne eax, ecx
jmp 0x14011b7ea
cmp eax, 0x62c08e23
je 0x14011be0d
cmp eax, 0x650e7a73
jne 0x14011b7ea
cmp dword [rbp - 0x3c], 0
sete byte [rbp - 5]
mov eax, dword [0x14018b9c8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x385b5269
mov ecx, 0xac5ceb4
jmp 0x14011bee9
cmp eax, 0x9cea6938
jne 0x14011bf3b
mov eax, dword [rbp - 0xc]
mov dword [rbp - 0x3c], eax
mov eax, dword [rbp - 0x24]
mov dword [rbp - 0x54], eax
mov eax, dword [0x14018b9c8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x385b5269
mov ecx, 0x650e7a73
jmp 0x14011bee9
mov eax, dword [0x14018b9c8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x3c9cab06
mov ecx, 0x62c08e23
jmp 0x14011bee9
mov eax, dword [rbp - 0x3c]
mov eax, 0x650e7a73
jmp 0x14011b7ea
mov rcx, qword [rbp - 0x18]
sub rsp, 0x20
call fcn.14011c3ec
add rsp, 0x20
mov rax, qword [rbp - 0x20]
mov rcx, qword [rax]
sub rsp, 0x20
call r13
add rsp, 0x20
mov eax, 0x22024675
jmp 0x14011b7ea
mov eax, 0x20
call fcn.140128210
sub rsp, rax
mov r14, r15
mov r15, r12
mov r12, r13
mov r13, rsp
sub rsp, 0x20
mov rcx, qword [rbp - 0x70]
call fcn.14011c3d0
add rsp, 0x20
movups xmmword [r13 + 0x10], xmm6
movups xmmword [r13], xmm6
sub rsp, 0x20
mov rcx, qword [rbp - 0x68]
call fcn.140118cde
add rsp, 0x20
mov qword [r13 + 0x18], rax
mov rax, qword [rbp - 0x60]
mov rcx, qword [rax]
sub rsp, 0x30
mov qword [rsp + 0x20], r13
mov r13, r12
mov r12, r15
mov r15, r14
mov r14d, 0x360b1fbd
mov rdx, rsi
mov r8d, ebx
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
add rsp, 0x30
mov eax, 0xfb4774cd
jmp 0x14011b7ea
mov rax, qword [rbp - 0x48]
mov rcx, qword [rax]
mov rdx, qword [rbp - 0x30]
sub rsp, 0x20
mov r8, rdi
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
add rsp, 0x20
test eax, eax
mov eax, 0xded6b3d
mov ecx, 0x2c94fd7d
cmove eax, ecx
jmp 0x14011b7ea
mov eax, 0x16c2880d
jmp 0x14011b7ea
mov eax, dword [0x14018b9c8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xe27ee507
mov ecx, 0x7a6395c
jmp 0x14011bee9
mov eax, 0x9cea6938
mov dword [rbp - 0x24], 0x5b4
mov dword [rbp - 0xc], 1
jmp 0x14011b7ea
sub rsp, 0x20
call r12
add rsp, 0x20
mov dword [rbp - 0x24], eax
mov rcx, qword [rbp - 0x18]
sub rsp, 0x20
call fcn.14011c3ec
add rsp, 0x20
mov rax, qword [rbp - 0x20]
mov rcx, qword [rax]
sub rsp, 0x20
call r13
add rsp, 0x20
mov eax, 0x9cea6938
mov dword [rbp - 0xc], 1
jmp 0x14011b7ea
mov eax, dword [0x14018b9c8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x3c9cab06
mov ecx, 0xde9ec9f9
jmp 0x14011bee9
mov eax, 0x20
call fcn.140128210
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x70]
mov qword [rbp - 0x18], rax
mov rcx, qword [rbp - 0x18]
sub rsp, 0x20
call fcn.14011c3d0
add rsp, 0x20
mov rax, qword [rbp - 0x30]
mov qword [rbp - 0x50], rax
mov rax, qword [rbp - 0x50]
mov rax, qword [rbp - 0x50]
movups xmmword [rax + 0x10], xmm6
movups xmmword [rax], xmm6
mov rax, qword [rbp - 0x68]
mov qword [rbp - 0x78], rax
mov rcx, qword [rbp - 0x78]
sub rsp, 0x20
call fcn.140118cde
add rsp, 0x20
mov rcx, qword [rbp - 0x30]
add rcx, 0x18
mov qword [rbp - 0x20], rcx
mov rcx, qword [rbp - 0x20]
mov qword [rcx], rax
mov rax, qword [rbp - 0x60]
mov qword [rbp - 0x48], rax
mov rax, qword [rbp - 0x48]
mov rcx, qword [rax]
mov rax, qword [rbp - 0x30]
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov r8d, ebx
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
add rsp, 0x30
test eax, eax
setne byte [rbp - 3]
mov eax, dword [0x14018b9c8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x2917223d
mov ecx, 0xe30d437c
cmove eax, ecx
cmp dword [0x14018b9c4], 0xa
cmovl eax, ecx
jmp 0x14011b7ea
cmp byte [rbp - 4], 0
mov eax, 0xc7303c4
mov ecx, 0xce6e3b91
cmovne eax, ecx
jmp 0x14011b7ea
cmp byte [rbp - 3], 0
mov eax, 0xebfb1e93
cmovne eax, r14d
jmp 0x14011b7ea
cmp byte [rbp - 5], 0
mov eax, 0x5b61a1f6
cmovne eax, r14d
mov ecx, dword [rbp - 0x54]
mov dword [rbp - 0x34], ecx
jmp 0x14011b7ea
cmp eax, 0xa0b7b21a
jne 0x14011b7ea
jmp 0x14011bf59
mov eax, 0x9cea6938
mov dword [rbp - 0xc], 0
jmp 0x14011b7ea
mov eax, dword [rbp - 0x58]
movaps xmm6, xmmword [rbp]
lea rsp, [rbp + 0x18]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret