Function at 0x1400fa1e8
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov bl, r9b
mov r12, r8
mov r13, rdx
mov r15, rcx
mov rcx, qword [0x14016a048]
lea rdi, [0x14016a048]
cmp rcx, rdi
je 0x1400fa246
test byte [rcx + 0x1c], 1
je 0x1400fa246
cmp byte [rcx + 0x19], 4
jb 0x1400fa246
mov rcx, qword [rcx + 0x10]
lea r8, [0x140156858]
mov edx, 0x5f
call fcn.14000c0e8
mov rcx, qword [0x14016a048]
or qword [rbp - 0x10], 0xffffffffffffffff
xor esi, esi
mov qword [rbp + 0x50], rsi
mov r14d, esi
mov dword [rbp + 0x48], esi
mov byte [rbp + 0x40], sil
mov qword [rbp - 8], rsi
test r15, r15
jne 0x1400fa283
lea r8, str.wszSrcFile
mov edx, 0x926
lea rcx, str.base_stor_blbengine_blbengutils_blbfsutils.cpp
call fcn.140088f60
mov rcx, qword [0x14016a048]
test r13, r13
jne 0x1400fa2a7
lea r8, str.wszDstFile
mov edx, 0x927
lea rcx, str.base_stor_blbengine_blbengutils_blbfsutils.cpp
call fcn.140088f60
mov rcx, qword [0x14016a048]
cmp rcx, rdi
je 0x1400fa2d5
test byte [rcx + 0x1c], 1
je 0x1400fa2d5
cmp byte [rcx + 0x19], 4
jb 0x1400fa2d5
mov rcx, qword [rcx + 0x10]
lea r8, [0x140156858]
mov edx, 0x60
mov qword [rsp + 0x20], r13
mov r9, r15
call fcn.140014ff8
test r12, r12
je 0x1400fa358
test bl, bl
je 0x1400fa358
mov dil, 1
test dil, dil
je 0x1400fa2fa
xor edx, edx
mov rcx, r12
call fcn.1400f8654
mov ebx, eax
test eax, eax
js 0x1400fa3a1
lea r8, [rbp - 8]
mov rcx, r15
lea rdx, [rbp + 0x50]
call fcn.14012fd2c
mov ebx, eax
test eax, eax
jns 0x1400fa373
mov rcx, qword [0x14016a048]
lea rsi, [0x14016a048]
cmp rcx, rsi
je 0x1400fa36d
test byte [rcx + 0x1c], 1
je 0x1400fa36d
cmp byte [rcx + 0x19], 2
jb 0x1400fa36d
mov rcx, qword [rcx + 0x10]
lea r8, [0x140156858]
mov edx, 0x61
mov dword [rsp + 0x20], eax
mov r9, r15
call fcn.140014f78
mov r14, qword [rbp + 0x50]
mov rcx, qword [0x14016a048]
jmp 0x1400fa3af
mov dil, sil
test r12, r12
je 0x1400fa2e1
test bl, bl
jne 0x1400fa2e1
mov sil, 1
jmp 0x1400fa2fa
mov r14, qword [rbp + 0x50]
jmp 0x1400fa3af
test dil, dil
je 0x1400fa380
mov rcx, r12
call fcn.1400f8e24
test sil, sil
je 0x1400fa41f
xor edx, edx
mov rcx, r12
call fcn.1400f8654
mov ebx, eax
test eax, eax
jns 0x1400fa41f
mov r14, qword [rbp + 0x50]
mov rcx, qword [0x14016a048]
lea rsi, [0x14016a048]
test r12, r12
je 0x1400fa3c3
mov rcx, r12
call fcn.1400f8e24
mov rcx, qword [0x14016a048]
test r14, r14
je 0x1400fa3de
mov rcx, r14
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rcx, qword [0x14016a048]
cmp rcx, rsi
je 0x1400fa404
test byte [rcx + 0x1c], 1
je 0x1400fa404
cmp byte [rcx + 0x19], 4
jb 0x1400fa404
mov rcx, qword [rcx + 0x10]
lea r8, [0x140156858]
mov edx, 0x67
call fcn.14000c0e8
mov eax, ebx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rax, [rbp - 0x10]
mov r9d, 2
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov byte [rsp + 0x30], r14b
mov edx, 0xc0000000
mov rcx, r13
mov dword [rsp + 0x20], 0x80
call fcn.140090934
mov r14, qword [rbp + 0x50]
xor ecx, ecx
mov ebx, eax
test eax, eax
jns 0x1400fa4a6
mov rcx, qword [0x14016a048]
lea rdx, [0x14016a048]
cmp rcx, rdx
je 0x1400fa499
test byte [rcx + 0x1c], 1
je 0x1400fa499
cmp byte [rcx + 0x19], 2
jb 0x1400fa499
mov rcx, qword [rcx + 0x10]
lea r8, [0x140156858]
mov edx, 0x62
mov dword [rsp + 0x20], eax
mov r9, r13
call fcn.140014f78
mov rcx, qword [0x14016a048]
mov rdi, qword [rbp - 0x10]
mov r15b, byte [rbp + 0x40]
jmp 0x1400fa64d
mov r15b, 1
test sil, sil
je 0x1400fa4b8
mov rcx, r12
call fcn.1400f8e24
xor ecx, ecx
or rax, 0xffffffffffffffff
inc rax
cmp word [r14 + rax*2], cx
jne 0x1400fa4bc
mov rdi, qword [rbp - 0x10]
lea esi, [rax*2 + 2]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x48]
mov r8d, esi
mov rcx, rdi
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop dword [rax + rax]
test eax, eax
jne 0x1400fa55a
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x1400fa50e
movzx ebx, ax
or ebx, 0x80070000
mov rcx, qword [0x14016a048]
lea rdx, [0x14016a048]
cmp rcx, rdx
je 0x1400fa64d
test byte [rcx + 0x1c], r15b
je 0x1400fa64d
cmp byte [rcx + 0x19], 2
jb 0x1400fa64d
mov rcx, qword [rcx + 0x10]
lea r8, [0x140156858]
mov edx, 0x63
mov dword [rsp + 0x20], ebx
mov r9, r13
call fcn.140014f78
jmp 0x1400fa646
mov eax, dword [rbp + 0x48]
cmp eax, esi
je 0x1400fa5b1
mov rcx, qword [0x14016a048]
lea rdx, [0x14016a048]
cmp rcx, rdx
je 0x1400fa5a7
test byte [rcx + 0x1c], r15b
je 0x1400fa5a7
cmp byte [rcx + 0x19], 2
jb 0x1400fa5a7
mov rcx, qword [rcx + 0x10]
lea r8, [0x140156858]
mov edx, 0x64
mov dword [rsp + 0x28], esi
mov r9, r13
mov dword [rsp + 0x20], eax
call fcn.14003fc40
mov rcx, qword [0x14016a048]
mov ebx, 0x8007045d
jmp 0x1400fa64d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
nop dword [rax + rax]
xor esi, esi
test eax, eax
jne 0x1400fa630
call qword [sym.imp.ntdll.dll_RtlGetLastNtStatus]
nop dword [rax + rax]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x1400fa5ef
movzx ebx, bx
or ebx, 0x80070000
mov rcx, qword [0x14016a048]
lea rdx, [0x14016a048]
cmp rcx, rdx
je 0x1400fa64d
test byte [rcx + 0x1c], r15b
je 0x1400fa64d
cmp byte [rcx + 0x19], 2
jb 0x1400fa64d
mov rcx, qword [rcx + 0x10]
lea r8, [0x140156858]
mov edx, 0x65
mov dword [rsp + 0x28], esi
mov r9, r13
mov dword [rsp + 0x20], ebx
call fcn.1400c9e7c
jmp 0x1400fa646
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
or rdi, 0xffffffffffffffff
mov r15b, sil
mov rcx, qword [0x14016a048]
cmp rdi, 0xffffffffffffffff
je 0x1400fa669
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, qword [0x14016a048]
test r15b, r15b
je 0x1400fa3a8
xor r8d, r8d
xor edx, edx
mov rcx, r13
call fcn.14008e928
test eax, eax
jns 0x1400fa3a1
mov rcx, qword [0x14016a048]
lea rsi, [0x14016a048]
cmp rcx, rsi
je 0x1400fa3af
test byte [rcx + 0x1c], 1
je 0x1400fa3af
cmp byte [rcx + 0x19], 3
jb 0x1400fa3af
mov rcx, qword [rcx + 0x10]
lea r8, [0x140156858]
mov edx, 0x66
mov dword [rsp + 0x20], ebx
mov r9, r13
call fcn.140014f78
jmp 0x1400fa34f