Function at 0x14000e2e8
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xff0]
mov eax, 0x10f0
call fcn.14003a3b0
sub rsp, rax
mov rax, qword [0x140054040]
xor rax, rsp
mov qword [rbp + 0xfe0], rax
mov rbx, r8
mov r12, rdx
mov r14, rcx
mov qword [rsp + 0x70], rcx
xor edi, edi
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x34], edi
mov qword [rsp + 0x48], rdi
mov sil, dil
mov byte [rsp + 0x30], dil
mov word [rbp - 0x70], di
xor edx, edx
mov r8d, 0x1046
lea rcx, [rbp - 0x6e]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x78]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov rcx, qword [r14 + 0x26c0]
mov rax, qword [rcx]
lea r8, [rsp + 0x48]
mov rdx, rbx
mov rax, qword [rax + 0x80]
call qword [case.0x140033a70.0]
mov ebx, eax
test eax, eax
js 0x14000e79f
lea r8, [rsp + 0x38]
lea edx, [rdi + 1]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.OLEAUT32.dll_SafeArrayLock]
mov ebx, eax
test eax, eax
js 0x14000e79f
lea r8, [rsp + 0x34]
lea edx, [rdi + 1]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
mov ebx, eax
test eax, eax
js 0x14000e79f
mov r13d, dword [rsp + 0x38]
jmp 0x14000e756
mov dword [rsp + 0x58], r13d
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.OLEAUT32.dll_SafeArrayPutElement]
mov ebx, eax
test eax, eax
js 0x14000e751
mov eax, 3
cmp ax, word [rsp + 0x78]
jne 0x14000e751
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x31]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x70]
mov edx, dword [rbp - 0x80]
mov r8d, edx
mov rcx, r14
call fcn.14000cf2c
test al, al
je 0x14000e753
mov rcx, qword [r14 + 0x26c0]
mov rax, qword [rcx]
lea r8, [rsp + 0x50]
mov edx, dword [rbp - 0x80]
mov rax, qword [rax + 0x88]
call qword [case.0x140033a70.0]
mov ebx, eax
test eax, eax
js 0x14000e751
test sil, sil
jne 0x14000e498
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x60]
mov r8d, SafeArrayRedim
lea rdx, str._t_t_t_breadcrumbs__r_n
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000e7f3
mov byte [rsp + 0x30], 1
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x64]
mov r8d, 0x1e
lea rdx, str._t_t_t_t_url_href
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000e7fa
lea r15, [rbp - 0x70]
lea rdx, [rbp - 0x70]
mov r8d, edi
movzx eax, word [rbp - 0x70]
cmp di, ax
je 0x14000e5d6
mov rsi, rdi
mov r14d, edi
cmp ax, 0x3e
ja 0x14000e5a1
movabs rcx, 0x500000c400000000
bt rcx, rax
jae 0x14000e5a1
test r8d, r8d
je 0x14000e51c
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x3c]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000e7fa
movzx ecx, word [r15]
sub ecx, 0x22
je 0x14000e569
sub ecx, 4
je 0x14000e55a
sub ecx, 1
je 0x14000e551
sub ecx, 0x15
je 0x14000e542
cmp ecx, 2
jne 0x14000e576
lea rsi, str.gt_
jmp 0x14000e549
lea rsi, str.lt_
mov r14d, 8
jmp 0x14000e576
lea rsi, str.apos_
jmp 0x14000e570
lea rsi, str.amp_
mov r14d, 0xa
jmp 0x14000e576
lea rsi, str.quot_
mov r14d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x3c]
mov r8d, r14d
mov rdx, rsi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000e7fa
mov r8d, 0xfffffffe
lea rdx, [r15 + 2]
add r15, 2
add r8d, 2
movzx eax, word [r15]
cmp di, ax
jne 0x14000e4d8
test r8d, r8d
je 0x14000e5d6
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x3c]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000e7fa
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x68]
mov r8d, 4
lea rdx, [0x1400429b4]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000e7fa
mov r15, qword [rsp + 0x50]
test r15, r15
je 0x14000e71d
mov r8d, edi
movzx eax, word [r15]
cmp di, ax
je 0x14000e71d
mov rdx, r15
mov rsi, rdi
mov r14d, edi
cmp ax, 0x3e
ja 0x14000e6e8
movabs rcx, 0x500000c400000000
bt rcx, rax
jae 0x14000e6e8
test r8d, r8d
je 0x14000e663
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x40]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000e7fa
movzx ecx, word [r15]
sub ecx, 0x22
je 0x14000e6b0
sub ecx, 4
je 0x14000e6a1
sub ecx, 1
je 0x14000e698
sub ecx, 0x15
je 0x14000e689
cmp ecx, 2
jne 0x14000e6bd
lea rsi, str.gt_
jmp 0x14000e690
lea rsi, str.lt_
mov r14d, 8
jmp 0x14000e6bd
lea rsi, str.apos_
jmp 0x14000e6b7
lea rsi, str.amp_
mov r14d, 0xa
jmp 0x14000e6bd
lea rsi, str.quot_
mov r14d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x40]
mov r8d, r14d
mov rdx, rsi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000e7fa
mov r8d, 0xfffffffe
lea rdx, [r15 + 2]
add r15, 2
add r8d, 2
movzx eax, word [r15]
cmp di, ax
jne 0x14000e61f
test r8d, r8d
je 0x14000e71d
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x40]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000e7fa
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x5c]
mov r8d, reloc.OLEAUT32.dll_SafeArrayGetDim
lea rdx, str.__url__r_n
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000e7fa
mov sil, byte [rsp + 0x30]
mov r14, qword [rsp + 0x70]
jmp 0x14000e753
mov ebx, edi
inc r13d
mov eax, dword [rsp + 0x34]
dec eax
cmp r13d, eax
jle 0x14000e3d5
mov r14d, 0x80004005
mov sil, byte [rsp + 0x30]
test ebx, ebx
js 0x14000e79f
test sil, sil
je 0x14000e79f
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x5c]
mov r8d, SafeArrayRedim
lea rdx, str._t_t_t__breadcrumbs__r_n
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
cmove ebx, r14d
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14000e7af
call qword [sym.imp.OLEAUT32.dll_SafeArrayRedim]
test ebx, ebx
jns 0x14000e7b8
test sil, sil
jne 0x14000e7bb
mov dil, 1
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov al, dil
mov rcx, qword [rbp + 0xfe0]
xor rcx, rsp
call fcn.140038c60
mov rbx, qword [rsp + 0x1148]
add rsp, 0x10f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ebx, 0x80004005
jmp 0x14000e79f
mov r14d, 0x80004005
mov ebx, r14d
jmp 0x14000e76b