Function at 0x10010e6fc
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov r13, r8
mov rbp, rdx
mov rsi, rcx
mov rcx, qword [0x1001653b8]
lea rdi, [0x1001653b8]
cmp rcx, rdi
je 0x10010e74f
test byte [rcx + 0x1c], 1
je 0x10010e74f
cmp byte [rcx + 0x19], 4
jb 0x10010e74f
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002f60]
mov edx, 0x60
call fcn.10001c854
mov rcx, qword [0x1001653b8]
or qword [rsp + 0xa0], 0xffffffffffffffff
xor r12d, r12d
xor eax, eax
and dword [rsp + 0x90], r12d
xor r14b, r14b
mov qword [rsp + 0x98], r12
mov qword [rsp + 0x40], rax
test rsi, rsi
jne 0x10010e799
lea r8, [0x1000126d0]
lea rcx, [0x100012468]
mov edx, 0x947
call fcn.10009a050
mov rcx, qword [0x1001653b8]
test rbp, rbp
jne 0x10010e7bd
lea r8, [0x1000126e0]
lea rcx, [0x100012468]
mov edx, 0x948
call fcn.10009a050
mov rcx, qword [0x1001653b8]
cmp rcx, rdi
je 0x10010e7eb
test byte [rcx + 0x1c], 1
je 0x10010e7eb
cmp byte [rcx + 0x19], 4
jb 0x10010e7eb
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002f60]
mov edx, 0x61
mov r9, rsi
mov qword [rsp + 0x20], rbp
call fcn.10001df74
test r13, r13
je 0x10010e875
xor edx, edx
mov rcx, r13
mov dil, 1
call fcn.10010b1d8
mov ebx, eax
test eax, eax
jns 0x10010e878
mov rcx, qword [0x1001653b8]
lea rdi, [0x1001653b8]
test r13, r13
je 0x10010e829
mov rcx, r13
call fcn.10010b368
mov rcx, qword [0x1001653b8]
test r12, r12
je 0x10010e83e
mov rcx, r12
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x1001653b8]
cmp rcx, rdi
je 0x10010e864
test byte [rcx + 0x1c], 1
je 0x10010e864
cmp byte [rcx + 0x19], 4
jb 0x10010e864
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002f60]
mov edx, 0x68
call fcn.10001c854
mov eax, ebx
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
xor dil, dil
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x98]
mov rcx, rsi
call fcn.100134868
mov ebx, eax
test eax, eax
jns 0x10010e8ef
mov rcx, qword [0x1001653b8]
lea rdi, [0x1001653b8]
cmp rcx, rdi
je 0x10010e8e2
test byte [rcx + 0x1c], 1
je 0x10010e8e2
cmp byte [rcx + 0x19], 2
jb 0x10010e8e2
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002f60]
mov edx, 0x62
mov r9, rsi
mov dword [rsp + 0x20], eax
call fcn.10001ddb0
mov r12, qword [rsp + 0x98]
mov rcx, qword [0x1001653b8]
jmp 0x10010e815
mov r12, qword [rsp + 0x98]
jmp 0x10010e815
test dil, dil
je 0x10010e8fc
mov rcx, r13
call fcn.10010b368
lea rax, [rsp + 0xa0]
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x30], r12b
and qword [rsp + 0x28], r12
mov edx, 0xc0000000
mov rcx, rbp
mov dword [rsp + 0x20], 0x80
call fcn.10009daf8
mov r12, qword [rsp + 0x98]
mov ebx, eax
test eax, eax
jns 0x10010e994
mov rcx, qword [0x1001653b8]
lea rdx, [0x1001653b8]
cmp rcx, rdx
je 0x10010e987
test byte [rcx + 0x1c], 1
je 0x10010e987
cmp byte [rcx + 0x19], 2
jb 0x10010e987
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002f60]
mov edx, 0x63
mov r9, rbp
mov dword [rsp + 0x20], eax
call fcn.10001ddb0
mov rdi, qword [rsp + 0xa0]
jmp 0x10010eb06
mov rdi, qword [rsp + 0xa0]
jmp 0x10010eb0d
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r12
and qword [rsp + 0x20], rax
repne scasw ax, word [rdi]
mov rdi, qword [rsp + 0xa0]
not rcx
lea r9, [rsp + 0x90]
mov rdx, r12
lea esi, [rcx + rcx]
mov rcx, rdi
mov r14b, 1
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10010ea31
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x1001653b8]
lea rdx, [0x1001653b8]
cmp rcx, rdx
je 0x10010eb0d
test byte [rcx + 0x1c], r14b
je 0x10010eb0d
cmp byte [rcx + 0x19], 2
jb 0x10010eb0d
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002f60]
mov edx, 0x64
mov r9, rbp
mov dword [rsp + 0x20], ebx
call fcn.10001ddb0
jmp 0x10010eb06
mov eax, dword [rsp + 0x90]
cmp eax, esi
je 0x10010ea8c
mov rcx, qword [0x1001653b8]
lea rdx, [0x1001653b8]
cmp rcx, rdx
je 0x10010ea82
test byte [rcx + 0x1c], 1
je 0x10010ea82
cmp byte [rcx + 0x19], 2
jb 0x10010ea82
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002f60]
mov edx, 0x65
mov r9, rbp
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], eax
call fcn.10001e4b0
mov rcx, qword [0x1001653b8]
mov ebx, 0x8007045d
jmp 0x10010eb0d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
jne 0x10010eaf6
call qword [sym.imp.ntdll.dll_RtlGetLastNtStatus]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x1001653b8]
lea rdx, [0x1001653b8]
cmp rcx, rdx
je 0x10010eb0d
test byte [rcx + 0x1c], 1
je 0x10010eb0d
cmp byte [rcx + 0x19], 2
jb 0x10010eb0d
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002f60]
mov edx, 0x66
mov r9, rbp
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], ebx
call fcn.10001e4b0
jmp 0x10010eb06
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or rdi, 0xffffffffffffffff
xor r14b, r14b
mov rcx, qword [0x1001653b8]
cmp rdi, 0xffffffffffffffff
je 0x10010eb23
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x1001653b8]
test r14b, r14b
je 0x10010e80e
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call fcn.10009de6c
test eax, eax
jns 0x10010e807
mov rcx, qword [0x1001653b8]
lea rdi, [0x1001653b8]
cmp rcx, rdi
je 0x10010e815
test byte [rcx + 0x1c], 1
je 0x10010e815
cmp byte [rcx + 0x19], 3
jb 0x10010e815
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002f60]
mov edx, 0x67
mov r9, rbp
mov dword [rsp + 0x20], ebx
call fcn.10001ddb0
jmp 0x10010e8d6