Function at 0x140016f40
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xfb0]
mov eax, 0x10b0
call fcn.1400c1a10
sub rsp, rax
xor r13d, r13d
mov r12, rdx
mov r14, rcx
mov word [rbp + 0x1000], r13w
mov rcx, r12
mov dword [rsp + 0x60], r13d
lea rdx, [rsp + 0x68]
mov dword [rbp + 0x1008], r13d
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], r13
call fcn.1400034c0
mov rsi, rax
test rax, rax
je 0x140017653
mov rcx, rax
call fcn.140001e50
mov r15, rax
test rax, rax
je 0x140017653
movabs rax, 0xa5b89f0b6b8c1503
mov ecx, r13d
mov qword [rbp - 0x80], rax
movabs rax, 0x7c7a43d5f57f66fd
mov qword [rbp - 0x78], rax
movabs rax, 0x7f94d6a806b4fd82
mov qword [rbp - 0x70], rax
movabs rax, 0xe66fa662a0d8dcc4
mov qword [rbp - 0x68], rax
movabs rax, 0xdca5399fbc6b2615
mov qword [rsp + 0x40], rax
movabs rax, 0x487ce5435af5d366
mov qword [rsp + 0x48], rax
movabs rax, 0xf07f8dd69a06e6fd
mov qword [rsp + 0x50], rax
movabs rax, 0x6fe606a6fda0eadc
mov qword [rsp + 0x58], rax
movzx eax, word [rsp + rcx*2 + 0x40]
mov rdi, rcx
rol ax, 8
mov word [rsp + rcx*2 + 0x40], ax
and edi, 3
jne 0x1400170ca
mov eax, dword [rsp + 0x42]
bswap eax
mov dword [rsp + 0x42], eax
movzx eax, word [rsp + rcx*2 + 0x42]
lea rdx, [rcx + 1]
rol ax, 8
mov word [rsp + rcx*2 + 0x42], ax
and edx, 3
jne 0x14001712e
mov eax, dword [rsp + 0x42]
bswap eax
mov dword [rsp + 0x42], eax
movzx eax, word [rsp + rcx*2 + 0x44]
lea r8, [rcx - 2]
rol ax, 8
mov word [rsp + rcx*2 + 0x44], ax
and r8d, 3
jne 0x140017159
mov eax, dword [rsp + 0x42]
bswap eax
mov dword [rsp + 0x42], eax
movzx eax, word [rsp + rcx*2 + 0x46]
lea r9, [rcx - 1]
rol ax, 8
mov word [rsp + rcx*2 + 0x46], ax
and r9d, 3
jne 0x140017185
mov eax, dword [rsp + 0x42]
bswap eax
mov dword [rsp + 0x42], eax
jmp 0x140017195
cmp rcx, 4
jne 0x140017054
mov eax, dword [rsp + 0x4a]
lea rdx, [rcx + 1]
bswap eax
mov dword [rsp + 0x4a], eax
lea r8, [rcx - 2]
movzx eax, word [rsp + rcx*2 + 0x42]
lea r9, [rcx - 1]
rol ax, 8
and edx, 3
mov word [rsp + rcx*2 + 0x42], ax
and r8d, 3
movzx eax, word [rsp + rcx*2 + 0x44]
and r9d, 3
rol ax, 8
mov word [rsp + rcx*2 + 0x44], ax
movzx eax, word [rsp + rcx*2 + 0x46]
rol ax, 8
mov word [rsp + rcx*2 + 0x46], ax
movzx eax, word [rsp + rcx*2 + 0x48]
rol ax, 8
mov word [rsp + rcx*2 + 0x48], ax
jmp 0x1400171c3
cmp rcx, 3
jne 0x140017079
mov eax, dword [rsp + 0x4a]
lea r8, [rcx - 2]
bswap eax
mov dword [rsp + 0x4a], eax
movzx eax, word [rsp + rcx*2 + 0x44]
rol ax, 8
mov word [rsp + rcx*2 + 0x44], ax
and r8d, ecx
jmp 0x14001716d
cmp rcx, 2
jne 0x14001709f
mov eax, dword [rsp + 0x4a]
bswap eax
mov dword [rsp + 0x4a], eax
movzx eax, word [rsp + rcx*2 + 0x46]
lea r9, [rcx - 1]
rol ax, 8
mov word [rsp + rcx*2 + 0x46], ax
and r9d, 3
jmp 0x140017195
cmp rcx, 1
jne 0x140017195
mov eax, dword [rsp + 0x4a]
bswap eax
mov dword [rsp + 0x4a], eax
movzx eax, word [rsp + rcx*2 + 0x48]
rol ax, 8
mov word [rsp + rcx*2 + 0x48], ax
test rdi, rdi
jne 0x1400171b4
mov eax, dword [rsp + 0x42]
bswap eax
mov dword [rsp + 0x42], eax
jmp 0x1400171c3
test rcx, rcx
jne 0x1400171c3
mov eax, dword [rsp + 0x4a]
bswap eax
mov dword [rsp + 0x4a], eax
movzx eax, word [rsp + rcx*2 + 0x4a]
rol ax, 8
mov word [rsp + rcx*2 + 0x4a], ax
test rdx, rdx
jne 0x1400171e2
mov eax, dword [rsp + 0x42]
bswap eax
mov dword [rsp + 0x42], eax
jmp 0x1400171f2
cmp rcx, 0xffffffffffffffff
jne 0x1400171f2
mov eax, dword [rsp + 0x4a]
bswap eax
mov dword [rsp + 0x4a], eax
movzx eax, word [rsp + rcx*2 + 0x4c]
rol ax, 8
mov word [rsp + rcx*2 + 0x4c], ax
test r8, r8
jne 0x140017211
mov eax, dword [rsp + 0x42]
bswap eax
mov dword [rsp + 0x42], eax
jmp 0x140017221
cmp rcx, 0xfffffffffffffffe
jne 0x140017221
mov eax, dword [rsp + 0x4a]
bswap eax
mov dword [rsp + 0x4a], eax
movzx eax, word [rsp + rcx*2 + 0x4e]
rol ax, 8
mov word [rsp + rcx*2 + 0x4e], ax
test r9, r9
jne 0x140017240
mov eax, dword [rsp + 0x42]
bswap eax
mov dword [rsp + 0x42], eax
jmp 0x140017250
cmp rcx, 0xfffffffffffffffd
jne 0x140017250
mov eax, dword [rsp + 0x4a]
bswap eax
mov dword [rsp + 0x4a], eax
add rcx, 8
cmp rcx, 8
jb 0x140017030
movdqa xmm0, xmmword [rbp - 0x80]
mov rax, r13
pxor xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
movzx ecx, word [rsp + rax*2 + 0x50]
mov rdi, rax
rol cx, 8
mov word [rsp + rax*2 + 0x50], cx
and edi, 3
jne 0x14001730c
mov ecx, dword [rsp + 0x52]
bswap ecx
mov dword [rsp + 0x52], ecx
movzx ecx, word [rsp + rax*2 + 0x52]
lea rdx, [rax + 1]
rol cx, 8
mov word [rsp + rax*2 + 0x52], cx
and edx, 3
jne 0x140017370
mov ecx, dword [rsp + 0x52]
bswap ecx
mov dword [rsp + 0x52], ecx
movzx ecx, word [rsp + rax*2 + 0x54]
lea r8, [rax - 2]
rol cx, 8
mov word [rsp + rax*2 + 0x54], cx
and r8d, 3
jne 0x14001739b
mov ecx, dword [rsp + 0x52]
bswap ecx
mov dword [rsp + 0x52], ecx
movzx ecx, word [rsp + rax*2 + 0x56]
lea r9, [rax - 1]
rol cx, 8
mov word [rsp + rax*2 + 0x56], cx
and r9d, 3
jne 0x1400173c7
mov ecx, dword [rsp + 0x52]
bswap ecx
mov dword [rsp + 0x52], ecx
jmp 0x1400173d7
cmp rax, 4
jne 0x140017296
mov ecx, dword [rsp + 0x5a]
lea rdx, [rax + 1]
bswap ecx
mov dword [rsp + 0x5a], ecx
lea r8, [rax - 2]
movzx ecx, word [rsp + rax*2 + 0x52]
lea r9, [rax - 1]
rol cx, 8
and edx, 3
mov word [rsp + rax*2 + 0x52], cx
and r8d, 3
movzx ecx, word [rsp + rax*2 + 0x54]
and r9d, 3
rol cx, 8
mov word [rsp + rax*2 + 0x54], cx
movzx ecx, word [rsp + rax*2 + 0x56]
rol cx, 8
mov word [rsp + rax*2 + 0x56], cx
movzx ecx, word [rsp + rax*2 + 0x58]
rol cx, 8
mov word [rsp + rax*2 + 0x58], cx
jmp 0x140017405
cmp rax, 3
jne 0x1400172bb
mov ecx, dword [rsp + 0x5a]
lea r8, [rax - 2]
bswap ecx
mov dword [rsp + 0x5a], ecx
movzx ecx, word [rsp + rax*2 + 0x54]
rol cx, 8
mov word [rsp + rax*2 + 0x54], cx
and r8d, eax
jmp 0x1400173af
cmp rax, 2
jne 0x1400172e1
mov ecx, dword [rsp + 0x5a]
bswap ecx
mov dword [rsp + 0x5a], ecx
movzx ecx, word [rsp + rax*2 + 0x56]
lea r9, [rax - 1]
rol cx, 8
mov word [rsp + rax*2 + 0x56], cx
and r9d, 3
jmp 0x1400173d7
cmp rax, 1
jne 0x1400173d7
mov ecx, dword [rsp + 0x5a]
bswap ecx
mov dword [rsp + 0x5a], ecx
movzx ecx, word [rsp + rax*2 + 0x58]
rol cx, 8
mov word [rsp + rax*2 + 0x58], cx
test rdi, rdi
jne 0x1400173f6
mov ecx, dword [rsp + 0x52]
bswap ecx
mov dword [rsp + 0x52], ecx
jmp 0x140017405
test rax, rax
jne 0x140017405
mov ecx, dword [rsp + 0x5a]
bswap ecx
mov dword [rsp + 0x5a], ecx
movzx ecx, word [rsp + rax*2 + 0x5a]
rol cx, 8
mov word [rsp + rax*2 + 0x5a], cx
test rdx, rdx
jne 0x140017424
mov ecx, dword [rsp + 0x52]
bswap ecx
mov dword [rsp + 0x52], ecx
jmp 0x140017434
cmp rax, 0xffffffffffffffff
jne 0x140017434
mov ecx, dword [rsp + 0x5a]
bswap ecx
mov dword [rsp + 0x5a], ecx
movzx ecx, word [rsp + rax*2 + 0x5c]
rol cx, 8
mov word [rsp + rax*2 + 0x5c], cx
test r8, r8
jne 0x140017453
mov ecx, dword [rsp + 0x52]
bswap ecx
mov dword [rsp + 0x52], ecx
jmp 0x140017463
cmp rax, 0xfffffffffffffffe
jne 0x140017463
mov ecx, dword [rsp + 0x5a]
bswap ecx
mov dword [rsp + 0x5a], ecx
movzx ecx, word [rsp + rax*2 + 0x5e]
rol cx, 8
mov word [rsp + rax*2 + 0x5e], cx
test r9, r9
jne 0x140017482
mov ecx, dword [rsp + 0x52]
bswap ecx
mov dword [rsp + 0x52], ecx
jmp 0x140017492
cmp rax, 0xfffffffffffffffd
jne 0x140017492
mov ecx, dword [rsp + 0x5a]
bswap ecx
mov dword [rsp + 0x5a], ecx
add rax, 8
cmp rax, 8
jb 0x140017272
movdqa xmm0, xmmword [rsp + 0x50]
lea rax, [rbp + 0x1008]
pxor xmm0, xmmword [rbp - 0x70]
lea r9, [rbp + 0x1002]
mov qword [rsp + 0x28], rax
lea r8, [rbp + 0x1000]
lea rax, [rsp + 0x60]
movdqa xmmword [rsp + 0x50], xmm0
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov rcx, r15
call fcn.140001c00
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax]
mov ecx, dword [rcx + rax]
cmp dword [0x140144de0], ecx
jle 0x140017551
lea rcx, [0x140144de0]
call fcn.1400a3b68
cmp dword [0x140144de0], 0xffffffff
jne 0x140017551
lea rcx, [0x1400c1ec0]
mov qword [0x140144de8], r13
mov qword [0x140144df0], r13
mov qword [0x140144df8], r13
call fcn.1400a362c
lea rcx, [0x140144de0]
call fcn.1400a3b08
mov ebx, dword [rbp + 0x1008]
lea rcx, [rbp - 0x5f]
mov edi, dword [rsp + 0x60]
xor edx, edx
mov r8d, 0x100f
call fcn.1400a5760
mov byte [rbp - 0x60], 0xb
test r14, r14
jne 0x14001757a
mov rax, r13
jmp 0x140017587
mov edx, select
mov rcx, r14
call fcn.1400aa3e0
mov r9, rax
lea rcx, [rbp - 0x50]
mov r8, r14
mov edx, select
call fcn.1400b4b68
mov r9, qword [0x140144df0]
lea rdx, [rbp - 0x60]
mov rcx, qword [0x140144de8]
mov r8d, 0x1010
mov dword [rbp - 0x40], edi
mov dword [rbp - 0x3c], ebx
call fcn.14001dbb0
test al, al
je 0x140017653
mov r9, qword [0x140144df0]
lea rdx, [rbp - 0x60]
mov rcx, qword [0x140144de8]
call fcn.14001df00
test al, al
je 0x140017653
cmp qword [rbp - 0x58], 0xffffffffffffffff
je 0x140017653
mov r9, qword [0x140144df0]
lea r8, [rsp + 0x70]
mov rcx, qword [0x140144de8]
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x20], r13
call fcn.14001e1c0
test al, al
je 0x140017653
mov qword [rsp + 0x30], r13
xor r9d, r9d
mov dword [rsp + 0x28], pe_nt_image_headers64
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140017670
mov rcx, qword [rsp + 0x68]
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor al, al
mov rbx, qword [rsp + 0x10f0]
add rsp, 0x10b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r8d, dword [rsp + 0x70]
xor r9d, r9d
mov rdx, qword [rsp + 0x68]
mov rcx, rdi
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rsp + 0x68]
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov al, 1
jmp 0x140017655