Function at 0x14001f100
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x320]
sub rsp, 0x420
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x460], rbx
mov rsi, rdx
mov rbx, rcx
xor r14d, r14d
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], r14
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.140008548
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x78]
mov qword [rbp - 0x70], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x78], r14
mov byte [rsp + 0x78], r14b
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rsi
lea rcx, [rsp + 0x78]
call fcn.14000ca10
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x78]
call fcn.14001e7d0
cmp qword [rsp + 0x48], r14
jne 0x14001f1ba
lea rcx, [rsp + 0x40]
call fcn.140007610
mov rcx, qword [rsp + 0x40]
call fcn.1400eb7f4
nop
mov rcx, rsi
call fcn.14000c7e0
xor al, al
jmp 0x14001f7cd
lea rcx, [rbx + 8]
cmp qword [rcx + 0x18], 0x10
jb 0x14001f1c8
mov rcx, qword [rcx]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x14001f196
imul eax, dword [rsp + 0x48], 0x134
add eax, 4
mov dword [rsp + 0x50], eax
mov dword [rbp + 0x378], r14d
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x378]
mov eax, 4
mov dword [rbp + 0x370], eax
mov r8d, eax
lea rdx, [rsp + 0x50]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rcx, [rbp + 0x220]
call fcn.140014f90
lea r12, [rbx + 0x28]
cmp qword [r12 + 0x18], 0x10
jb 0x14001f250
mov rdx, qword [r12]
jmp 0x14001f253
mov rdx, r12
lea rcx, [rbp + 0x220]
call fcn.140014fd0
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x54], eax
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14001f79b
nop dword [rax + rax]
xor edx, edx
mov r8d, 0x134
lea rcx, [rbp - 0x20]
call fcn.14011d670
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], r14
mov qword [rbp - 0x38], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x40], r14
mov byte [rbp - 0x50], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbx + 0x10]
lea rcx, [rbp - 0x50]
call fcn.14000ca10
lea rdx, [rbp - 0x68]
lea rcx, [rbp - 0x50]
call fcn.14001ed80
test al, al
jne 0x14001f328
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x14001f6f3
mov rax, qword [rbp - 0x58]
sub rax, rcx
cmp rax, 0x1000
jb 0x14001f31e
test cl, 0x1f
jne 0x14001f716
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14001f710
sub rcx, rax
cmp rcx, 8
jb 0x14001f70a
cmp rcx, 0x27
ja 0x14001f704
mov rcx, rax
call fcn.1400eb7f4
jmp 0x14001f6f3
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x58]
call fcn.14001ef20
nop
lea rax, [rsp + 0x58]
cmp qword [rsp + 0x70], 0x10
cmovae rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14001f3c4
test rax, rax
je 0x14001f371
cmp rcx, 0x29
ja 0x14001f371
mov r8, rcx
mov rdx, rax
lea rcx, [rbp + 0xe8]
call fcn.14011c9b0
jmp 0x14001f3c4
xor edx, edx
mov qword [rbp + 0xe8], rdx
mov qword [rbp + 0xf0], rdx
mov qword [rbp + 0xf8], rdx
mov qword [rbp + 0x100], rdx
mov qword [rbp + 0x108], rdx
mov byte [rbp + 0x110], dl
test rax, rax
jne 0x14001f3ae
call fcn.140129180
mov dword [rax], reloc.WLDAP32.dll_Ordinal_22
jmp 0x14001f3bf
cmp rcx, 0x29
jbe 0x14001f3c4
call fcn.140129180
mov dword [rax], Ordinal_35
call fcn.140128fd4
lea rcx, [rbp + 0x120]
call fcn.140014f90
cmp qword [r12 + 0x18], 0x10
jb 0x14001f3de
mov rdx, qword [r12]
jmp 0x14001f3e1
mov rdx, r12
lea rcx, [rbp + 0x120]
call fcn.140014fd0
mov r14, qword [rbp - 0x60]
mov rsi, qword [rbp - 0x68]
sub r14, rsi
mov r8d, r14d
mov rdx, rsi
lea rcx, [rbp + 0x120]
call fcn.1400150c0
test al, al
jne 0x14001f4ce
mov rax, qword [rsp + 0x70]
cmp rax, 0x10
jb 0x14001f462
inc rax
mov rcx, qword [rsp + 0x58]
cmp rax, 0x1000
jb 0x14001f45d
test cl, 0x1f
jne 0x14001f72e
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14001f728
sub rcx, rax
cmp rcx, 8
jb 0x14001f722
cmp rcx, 0x27
ja 0x14001f71c
mov rcx, rax
call fcn.1400eb7f4
mov qword [rsp + 0x70], reloc.WS2_32.dll_ntohs
xor r14d, r14d
mov qword [rsp + 0x68], r14
mov byte [rsp + 0x58], r14b
test rsi, rsi
je 0x14001f6f3
mov rax, qword [rbp - 0x58]
sub rax, rsi
cmp rax, 0x1000
jb 0x14001f4c1
test sil, 0x1f
jne 0x14001f746
mov rax, qword [rsi - 8]
cmp rax, rsi
jae 0x14001f740
sub rsi, rax
cmp rsi, 8
jb 0x14001f73a
cmp rsi, 0x27
ja 0x14001f734
mov rsi, rax
mov rcx, rsi
call fcn.1400eb7f4
jmp 0x14001f6f3
mov rax, qword [rbp + 0x368]
mov r8, qword [rax + 0x10]
inc r8d
mov r9, qword [rbx + 0x20]
sub r9, r8
lea rdx, [rsp + 0x78]
lea rcx, [rbx + 0x10]
call fcn.14001d670
nop
lea rdx, [rsp + 0x78]
cmp qword [rbp - 0x70], 0x10
cmovae rdx, qword [rsp + 0x78]
mov r8, qword [rbp - 0x78]
lea rcx, [rbp - 0x18]
call fcn.14011c9b0
mov r15d, dword [rsp + 0x54]
mov dword [rbp - 0x20], r15d
mov dword [rbp - 0x1c], r14d
mov r8d, 0x134
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x220]
call fcn.1400150c0
test al, al
jne 0x14001f656
mov rax, qword [rbp - 0x70]
cmp rax, 0x10
jb 0x14001f589
inc rax
mov rcx, qword [rsp + 0x78]
cmp rax, 0x1000
jb 0x14001f584
test cl, 0x1f
jne 0x14001f75e
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14001f758
sub rcx, rax
cmp rcx, 8
jb 0x14001f752
cmp rcx, 0x27
ja 0x14001f74c
mov rcx, rax
call fcn.1400eb7f4
mov qword [rbp - 0x70], reloc.WS2_32.dll_ntohs
xor r14d, r14d
mov qword [rbp - 0x78], r14
mov byte [rsp + 0x78], r14b
mov rax, qword [rsp + 0x70]
cmp rax, 0x10
jb 0x14001f5ed
inc rax
mov rcx, qword [rsp + 0x58]
cmp rax, 0x1000
jb 0x14001f5e8
test cl, 0x1f
jne 0x14001f776
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14001f770
sub rcx, rax
cmp rcx, 8
jb 0x14001f76a
cmp rcx, 0x27
ja 0x14001f764
mov rcx, rax
call fcn.1400eb7f4
mov qword [rsp + 0x70], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x68], r14
mov byte [rsp + 0x58], 0
test rsi, rsi
je 0x14001f6f3
mov rax, qword [rbp - 0x58]
sub rax, rsi
cmp rax, 0x1000
jb 0x14001f649
test sil, 0x1f
jne 0x14001f78e
mov rax, qword [rsi - 8]
cmp rax, rsi
jae 0x14001f788
sub rsi, rax
cmp rsi, 8
jb 0x14001f782
cmp rsi, 0x27
ja 0x14001f77c
mov rsi, rax
mov rcx, rsi
call fcn.1400eb7f4
jmp 0x14001f6f3
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rbp + 0x370]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x378]
mov r8d, 0x134
lea rdx, [rbp - 0x20]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
add dword [rbp + 0x370], 0x134
xor r9d, r9d
xor r8d, r8d
mov edx, r15d
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x378]
mov r8d, r14d
mov rdx, rsi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
add r15d, r14d
mov dword [rsp + 0x54], r15d
lea rcx, [rsp + 0x78]
call fcn.14000c7e0
nop
lea rcx, [rsp + 0x58]
call fcn.14000c7e0
nop
lea rcx, [rbp - 0x68]
call fcn.14000e7b0
xor r14d, r14d
mov rbx, qword [rbx]
cmp rbx, rdi
je 0x14001f794
jmp 0x14001f280
call fcn.140128ff4
int3
call fcn.140128ff4
int3
call fcn.140128ff4
int3
call fcn.140128ff4
nop
call fcn.140128ff4
int3
call fcn.140128ff4
int3
call fcn.140128ff4
int3
call fcn.140128ff4
nop
call fcn.140128ff4
int3
call fcn.140128ff4
int3
call fcn.140128ff4
int3
call fcn.140128ff4
nop
call fcn.140128ff4
int3
call fcn.140128ff4
int3
call fcn.140128ff4
int3
call fcn.140128ff4
nop
call fcn.140128ff4
int3
call fcn.140128ff4
int3
call fcn.140128ff4
int3
call fcn.140128ff4
nop
call fcn.140128ff4
int3
call fcn.140128ff4
int3
call fcn.140128ff4
int3
call fcn.140128ff4
int3
mov rsi, qword [rbp + 0x368]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x40]
call fcn.140007610
mov edx, 1
lea r8d, [rdx + 0x2f]
mov rcx, qword [rsp + 0x40]
call fcn.14000ce04
nop
mov rcx, rsi
call fcn.14000c7e0
mov al, 1
mov rbx, qword [rsp + 0x460]
add rsp, 0x420
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret