Function at 0x14007f640
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x750
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x134
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x778]
mov rax, qword [0x1401a7008]
xor rax, rbp
mov qword [rbp + 0x708], rax
lea rcx, [0x1401b90af]
call fcn.14007a304
mov rax, qword [rbp + 0x730]
add rax, 0x430
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
add rax, 0x19c
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x738]
add rax, 0x38
mov qword [rbp + 0x68], rax
lea rax, [0x1401aab30]
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x98], 0
mov dword [rbp + 0xd4], 0x100000
mov byte [rbp + 0x454], 0
mov rax, qword [rbp + 8]
movzx eax, word [rax + 0x58]
imul rax, rax, 0x30
mov r8, rax
xor edx, edx
mov rcx, qword [0x1401aa780]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [0x1401aa6f0], rax
cmp qword [0x1401aa6f0], 0
jne 0x14007f752
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, [rbp + 0x68]
mov r8d, eax
mov edx, 0xc0054001
lea rcx, [rbp + 0x220]
call fcn.14007907b
movzx eax, al
test eax, eax
je 0x14007f749
lea rdx, [rbp + 0x220]
mov ecx, 0xc0054023
call fcn.14007826b
mov byte [rbp + 0x454], 1
jmp 0x14007f78f
mov rax, qword [rbp + 8]
movzx eax, byte [rax + 8]
cmp eax, 0xc
je 0x14007f778
mov rax, qword [rbp + 8]
movzx eax, byte [rax + 8]
cmp eax, 0xd
je 0x14007f778
mov dword [rbp + 0x704], 0
jmp 0x14007f782
mov dword [rbp + 0x704], 1
movzx eax, byte [rbp + 0x704]
mov byte [0x1401aa77e], al
movzx eax, byte [rbp + 0x454]
test eax, eax
jne 0x14007f7ec
movzx eax, byte [0x1401aa77e]
test eax, eax
je 0x14007f7ec
mov eax, dword [rbp + 0xd4]
mov r8d, eax
xor edx, edx
mov rcx, qword [0x1401aa780]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbp + 0x98], rax
cmp qword [rbp + 0x98], 0
je 0x14007f7d0
jmp 0x14007f7ec
xor edx, edx
mov eax, dword [rbp + 0xd4]
mov ecx, 2
div ecx
mov dword [rbp + 0xd4], eax
xor eax, eax
cmp eax, 1
jne 0x14007f7a5
mov rax, qword [0x1401aa6f0]
mov qword [rbp + 0x48], rax
mov eax, 1
mov word [rbp + 0x434], ax
jmp 0x14007f82e
movzx eax, word [rbp + 0x434]
inc ax
mov word [rbp + 0x434], ax
mov rax, qword [rbp + 0x28]
add rax, 0x30
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x48]
add rax, 0x30
mov qword [rbp + 0x48], rax
movzx eax, byte [rbp + 0x454]
test eax, eax
jne 0x14007fbb2
movzx eax, word [rbp + 0x434]
mov rcx, qword [rbp + 8]
movzx ecx, word [rcx + 0x58]
cmp eax, ecx
jg 0x14007fbb2
mov edx, 0x40
lea rcx, [rbp + 0x180]
call fcn.14007a30e
test eax, eax
je 0x14007f8fc
mov rax, qword [rbp + 0x28]
add rax, 0xc
mov r8d, 0x40
lea rdx, [rbp + 0x180]
mov rcx, rax
call qword [sym.imp.USER32.dll_OemToCharBuffW]
mov rax, qword [rbp + 0x730]
mov dword [rax + 0xc], reloc.WS2_32.dll_send
lea rax, [rbp + 0x180]
mov qword [rbp + 0x478], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbp + 0x730]
add rcx, 0x230
lea r9, [rbp + 0x478]
mov r8d, eax
mov edx, 0xc0054003
call fcn.14007907b
movzx eax, al
test eax, eax
je 0x14007f8f0
mov rax, qword [rbp + 0x730]
add rax, 0x230
mov rdx, rax
mov ecx, 0xc0054023
call fcn.14007826b
mov byte [rbp + 0x454], 1
jmp 0x14007fbb2
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x4000100
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 2
mov edx, 0xc0000000
lea rcx, [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp + 0xb8], rax
cmp qword [rbp + 0xb8], 0xffffffffffffffff
jne 0x14007f9b2
lea rax, [rbp + 0x180]
mov qword [rbp + 0x498], rax
mov rax, qword [rbp + 0x730]
mov dword [rax + 0xc], reloc.WS2_32.dll_send
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbp + 0x730]
add rcx, 0x230
lea r9, [rbp + 0x498]
mov r8d, eax
mov edx, 0xc0054002
call fcn.14007907b
movzx eax, al
test eax, eax
je 0x14007f9a6
mov rax, qword [rbp + 0x730]
add rax, 0x230
mov rdx, rax
mov ecx, 0xc0054023
call fcn.14007826b
mov byte [rbp + 0x454], 1
jmp 0x14007fbb2
mov rcx, qword [rbp + 0xb8]
call fcn.140077839
mov rcx, qword [rbp + 0x28]
mov dword [rcx + 4], eax
mov rdi, qword [rbp + 0x48]
mov rsi, qword [rbp + 0x28]
mov ecx, 0x30
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rbp + 8]
movzx eax, byte [rax + 8]
cmp eax, 9
jg 0x14007f9e6
jmp 0x14007f805
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0xb8]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rax, qword [rbp + 0x28]
mov eax, dword [rax + 8]
mov dword [rbp + 0xf4], eax
cmp dword [rbp + 0xf4], 0
je 0x14007fbad
mov eax, dword [rbp + 0xd4]
cmp dword [rbp + 0xf4], eax
jbe 0x14007fa31
mov eax, dword [rbp + 0xd4]
mov dword [rbp + 0x704], eax
jmp 0x14007fa3d
mov eax, dword [rbp + 0xf4]
mov dword [rbp + 0x704], eax
mov eax, dword [rbp + 0x704]
mov dword [rbp + 0x134], eax
xor r8d, r8d
mov edx, dword [rbp + 0x134]
mov rcx, qword [rbp + 0x98]
call fcn.140077bae
mov byte [rbp + 0x454], al
movzx eax, byte [rbp + 0x454]
test eax, eax
je 0x14007fa74
jmp 0x14007fbad
movzx eax, byte [0x1401aa77f]
test eax, eax
je 0x14007fa9a
movsxd rax, dword [rbp + 0x134]
mov rcx, qword [0x1401aa6d0]
add rcx, rax
mov rax, rcx
mov qword [0x1401aa6d0], rax
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x114]
mov r8d, dword [rbp + 0x134]
mov rdx, qword [rbp + 0x98]
mov rcx, qword [rbp + 0xb8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rbp + 0x154], eax
cmp dword [rbp + 0x154], 0
je 0x14007fae6
mov eax, dword [rbp + 0x114]
cmp dword [rbp + 0x134], eax
je 0x14007fb7f
mov rax, qword [rbp + 0x28]
add rax, 0xc
mov r8d, 0x40
lea rdx, [rbp + 0x180]
mov rcx, rax
call qword [sym.imp.USER32.dll_OemToCharBuffW]
mov rax, qword [rbp + 0x730]
mov dword [rax + 0xc], reloc.WS2_32.dll_send
lea rax, [rbp + 0x180]
mov qword [rbp + 0x4b8], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbp + 0x730]
add rcx, 0x230
lea r9, [rbp + 0x4b8]
mov r8d, eax
mov edx, 0xc0054005
call fcn.14007907b
movzx eax, al
test eax, eax
je 0x14007fb69
mov rax, qword [rbp + 0x730]
add rax, 0x230
mov rdx, rax
mov ecx, 0xc0054023
call fcn.14007826b
mov byte [rbp + 0x454], 1
mov rcx, qword [rbp + 0xb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14007fbad
mov eax, dword [rbp + 0x134]
mov ecx, dword [rbp + 0xf4]
sub ecx, eax
mov eax, ecx
mov dword [rbp + 0xf4], eax
movzx eax, byte [rbp + 0x454]
test eax, eax
jne 0x14007fbad
cmp dword [rbp + 0xf4], 0
jne 0x14007fa15
jmp 0x14007f805
cmp qword [rbp + 0x98], 0
je 0x14007fbd2
mov r8, qword [rbp + 0x98]
xor edx, edx
mov rcx, qword [0x1401aa780]
call qword [sym.imp.KERNEL32.dll_HeapFree]
movzx eax, byte [rbp + 0x454]
test eax, eax
je 0x14007fc71
mov rax, qword [rbp + 8]
add rax, 0x19c
mov qword [rbp + 0x28], rax
mov eax, 1
mov word [rbp + 0x434], ax
jmp 0x14007fc1a
movzx eax, word [rbp + 0x434]
inc ax
mov word [rbp + 0x434], ax
mov rax, qword [rbp + 0x28]
add rax, 0x30
mov qword [rbp + 0x28], rax
movzx eax, word [rbp + 0x434]
mov rcx, qword [rbp + 8]
movzx ecx, word [rcx + 0x58]
cmp eax, ecx
jg 0x14007fc44
mov rax, qword [rbp + 0x28]
cmp dword [rax + 4], 0
je 0x14007fc42
mov rax, qword [rbp + 0x28]
mov dword [rax + 4], 0
jmp 0x14007fbfd
cmp qword [0x1401aa6f0], 0
je 0x14007fc64
mov r8, qword [0x1401aa6f0]
xor edx, edx
mov rcx, qword [0x1401aa780]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [0x1401aa6f0], 0
jmp 0x14007fc80
mov rax, qword [rbp + 8]
movzx eax, word [rax + 0x58]
mov word [0x1401aa77a], ax
movzx eax, byte [rbp + 0x454]
mov edi, eax
lea rcx, [rbp - 0x40]
lea rdx, [0x140171430]
call fcn.140079a35
mov eax, edi
mov rcx, qword [rbp + 0x708]
xor rcx, rbp
call fcn.140078919
lea rsp, [rbp + 0x710]
pop rdi
pop rsi
pop rbp
ret