Function at 0x1801422f0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x10], edx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x3f]
sub rsp, 0x100
mov rbx, qword [0x18017bd70]
mov rdi, rcx
test rbx, rbx
jne 0x180142407
call qword [sym.imp.KERNEL32.dll_GetLastError]
movdqa xmm0, xmmword [0x180161e30]
lea rdx, [rsp + 0x40]
movdqa xmm1, xmmword [0x180161a20]
lea rcx, [rbp - 0x31]
mov ebx, eax
mov dword [rbp - 0x51], 0x2c85aac7
movabs rax, 0x587f9cbbfb40fa25
mov dword [rbp - 0x4d], 0xd976
mov qword [rbp - 0x49], rax
movabs rax, 0x4cd26b1c7cbe127c
mov qword [rbp - 0x41], rax
movabs rax, 0x595121b5db376926
movdqu xmmword [rsp + 0x40], xmm0
mov qword [rbp - 0x39], rax
movdqa xmm0, xmmword [0x180161e10]
movdqu xmmword [rbp - 0x71], xmm1
movdqu xmmword [rbp - 0x61], xmm0
call fcn.18000cfc0
lea r8, [rbp + 7]
movups xmm2, xmmword [rax]
movups xmmword [rbp + 7], xmm2
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp + 0x17], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rbp + 0x27], xmm1
mov ecx, dword [rax + 0x30]
mov dword [rbp + 0x37], ecx
movzx ecx, word [rax + 0x34]
mov word [rbp + 0x3b], cx
movzx eax, byte [rax + 0x36]
mov byte [rbp + 0x3d], al
mov r9d, ebx
lea rcx, [0x18017bd90]
mov edx, 0x100000
call fcn.1800010e0
mov rcx, qword [0x18017bd78]
lea r9, [0x18017bd80]
xor esi, esi
mov dword [0x18017bd84], eax
mov r8d, eax
mov qword [rsp + 0x20], rsi
lea rdx, [0x18017bd90]
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
jmp 0x180142855
mov rax, qword [rcx + 0x30]
lea r8, [0x18015f0c8]
mov rcx, rbx
mov edx, 0x65
call rax
mov rsi, rax
test rax, rax
jne 0x1801424c7
call qword [sym.imp.KERNEL32.dll_GetLastError]
movdqa xmm0, xmmword [0x180161940]
mov ebx, eax
movdqa xmm1, xmmword [str.c_]
movabs rax, 0x587f9cbbfb40fa25
mov qword [rbp - 0x51], rax
movabs rax, 0x4cd26b1c7cbe127c
mov qword [rbp - 0x49], rax
movabs rax, 0x595121b5db376926
movdqu xmmword [rsp + 0x40], xmm0
movdqa xmm0, xmmword [0x180160710]
lea rdx, [rsp + 0x40]
mov qword [rbp - 0x41], rax
lea rcx, [rbp + 7]
movdqu xmmword [rbp - 0x61], xmm0
movdqu xmmword [rbp - 0x71], xmm1
call fcn.180005380
lea r8, [rbp - 0x31]
movups xmm2, xmmword [rax]
movups xmmword [rbp - 0x31], xmm2
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp - 0x21], xmm0
movsd xmm1, qword [rax + 0x20]
movsd qword [rbp - 0x11], xmm1
mov ecx, dword [rax + 0x28]
mov dword [rbp - 9], ecx
movzx ecx, word [rax + 0x2c]
mov word [rbp - 5], cx
movzx eax, byte [rax + 0x2e]
mov byte [rbp - 3], al
jmp 0x1801423c1
mov rax, qword [rdi + 0x28]
mov rdx, rsi
mov rcx, rbx
call rax
mov rcx, rax
test rax, rax
jne 0x18014252c
call qword [sym.imp.KERNEL32.dll_GetLastError]
movdqa xmm0, xmmword [0x180160f70]
mov ebx, eax
movdqa xmm1, xmmword [0x180161980]
movabs rax, 0xfb15fb380cc1731b
mov qword [rbp - 0x51], rax
movabs rax, 0xbb5a1d781d4a125a
mov qword [rbp - 0x49], rax
movabs rax, 0x7285971b45817a6c
movdqu xmmword [rsp + 0x40], xmm0
movdqa xmm0, xmmword [0x180160680]
jmp 0x180142474
mov rax, qword [rdi + 0x50]
mov qword [rsp + 0x120], r12
call rax
mov r12, rax
test rax, rax
jne 0x1801425e5
call qword [sym.imp.KERNEL32.dll_GetLastError]
movdqa xmm0, xmmword [0x180160d60]
lea rdx, [rsp + 0x40]
movdqa xmm1, xmmword [0x180161980]
lea rcx, [rbp + 7]
mov ebx, eax
movabs rax, 0xfb15fb380cc1731b
mov qword [rbp - 0x51], rax
movabs rax, 0xbb5a1d781d4a125a
mov qword [rbp - 0x49], rax
movabs rax, 0x7285971b45817a6c
movdqu xmmword [rsp + 0x40], xmm0
mov qword [rbp - 0x41], rax
movdqa xmm0, xmmword [0x180160680]
movdqu xmmword [rbp - 0x71], xmm1
movdqu xmmword [rbp - 0x61], xmm0
call fcn.180005380
lea r8, [rbp - 0x31]
movups xmm2, xmmword [rax]
movups xmmword [rbp - 0x31], xmm2
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp - 0x21], xmm0
movsd xmm1, qword [rax + 0x20]
movsd qword [rbp - 0x11], xmm1
mov ecx, dword [rax + 0x28]
mov dword [rbp - 9], ecx
movzx ecx, word [rax + 0x2c]
mov word [rbp - 5], cx
movzx eax, byte [rax + 0x2e]
mov byte [rbp - 3], al
jmp 0x18014269c
mov rax, qword [rdi + 0x38]
mov rdx, rsi
mov rcx, rbx
call rax
mov ebx, eax
test eax, eax
jne 0x1801426e2
call qword [sym.imp.KERNEL32.dll_GetLastError]
movdqa xmm0, xmmword [0x1801616b0]
lea rdx, [rsp + 0x40]
movdqa xmm1, xmmword [0x180161320]
lea rcx, [rbp - 0x31]
mov ebx, eax
mov word [rbp - 0x51], 0x78ec
xor eax, eax
mov dword [rbp - 0x4f], eax
mov word [rbp - 0x4b], ax
movabs rax, 0xa7ec59b91e41e411
mov qword [rbp - 0x49], rax
movabs rax, 0xf17459dab03b690a
mov qword [rbp - 0x41], rax
movabs rax, 0xe81b951a5cb892cb
movdqu xmmword [rsp + 0x40], xmm0
mov qword [rbp - 0x39], rax
movdqa xmm0, xmmword [0x180162260]
movdqu xmmword [rbp - 0x71], xmm1
movdqu xmmword [rbp - 0x61], xmm0
call fcn.18000d3f0
lea r8, [rbp + 7]
movups xmm2, xmmword [rax]
movups xmmword [rbp + 7], xmm2
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp + 0x17], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rbp + 0x27], xmm1
movzx ecx, word [rax + 0x30]
mov word [rbp + 0x37], cx
movzx eax, byte [rax + 0x32]
mov byte [rbp + 0x39], al
mov r9d, ebx
lea rcx, [0x18017bd90]
mov edx, 0x100000
call fcn.1800010e0
mov rcx, qword [0x18017bd78]
lea r9, [0x18017bd80]
xor esi, esi
mov dword [0x18017bd84], eax
mov r8d, eax
mov qword [rsp + 0x20], rsi
lea rdx, [0x18017bd90]
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
jmp 0x18014284d
mov rax, qword [rdi + 0x90]
xor esi, esi
mov rcx, qword [rbp + 0x7f]
xor r9d, r9d
mov qword [rsp + 0x30], rsi
mov edx, 0x40000000
mov dword [rsp + 0x28], pe_nt_image_headers64
lea r8d, [rsi + 1]
mov qword [rsp + 0x130], r14
mov dword [rsp + 0x20], 2
call rax
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x18014283b
mov r10, qword [rdi + 0xa0]
lea r9, [rbp + 0x67]
mov r8d, ebx
mov dword [rbp + 0x67], esi
mov rdx, r12
mov qword [rsp + 0x20], rsi
mov rcx, rax
call r10
mov rcx, r14
mov ebx, eax
call qword [rdi + 0xa8]
test ebx, ebx
jne 0x18014283b
call qword [sym.imp.KERNEL32.dll_GetLastError]
movdqa xmm0, xmmword [0x1801616b0]
lea rdx, [rsp + 0x40]
movdqa xmm1, xmmword [0x180161320]
lea rcx, [rbp - 0x31]
mov ebx, eax
mov word [rbp - 0x51], 0x78ec
xor eax, eax
mov dword [rbp - 0x4f], eax
mov word [rbp - 0x4b], ax
movabs rax, 0xa7ec59b91e41e411
mov qword [rbp - 0x49], rax
movabs rax, 0xf17459dab03b690a
mov qword [rbp - 0x41], rax
movabs rax, 0xe81b951a5cb892cb
movdqu xmmword [rsp + 0x40], xmm0
mov qword [rbp - 0x39], rax
movdqa xmm0, xmmword [0x180162260]
movdqu xmmword [rbp - 0x71], xmm1
movdqu xmmword [rbp - 0x61], xmm0
call fcn.18000d3f0
mov r9d, ebx
lea r8, [rbp + 7]
mov edx, 0x100000
movups xmm2, xmmword [rax]
movups xmmword [rbp + 7], xmm2
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp + 0x17], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rbp + 0x27], xmm1
movzx ecx, word [rax + 0x30]
mov word [rbp + 0x37], cx
lea rcx, [0x18017bd90]
movzx eax, byte [rax + 0x32]
mov byte [rbp + 0x39], al
call fcn.1800010e0
mov rcx, qword [0x18017bd78]
lea r9, [0x18017bd80]
mov r8d, eax
mov dword [0x18017bd84], eax
lea rdx, [0x18017bd90]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
jmp 0x180142845
mov rax, qword [rdi + 0x40]
mov rcx, qword [rbp + 0x7f]
call rax
mov r14, qword [rsp + 0x130]
mov r12, qword [rsp + 0x120]
mov rbx, qword [rsp + 0x138]
add rsp, 0x100
pop rdi
pop rsi
pop rbp
ret