Function at 0x1402d1de0
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov r14, r9
mov r15, r8
mov r13, rdx
mov rsi, rcx
mov r12, qword [rbp + 0x70]
mov rax, qword [0x14035bae8]
xor rax, rbp
mov qword [rbp], rax
mov eax, 0x8063bc14
lea rbx, [rbp - 8]
jmp 0x1402d1e30
mov rax, qword [rbp - 0x28]
mov eax, 0x91aa62e7
nop word [rax + rax]
cmp eax, 0x4d60ba1
jg 0x1402d1e70
cmp eax, 0xafc518eb
jle 0x1402d1ec0
cmp eax, 0xf555989d
jg 0x1402d1f33
cmp eax, 0xafc518ec
je 0x1402d1fb5
cmp eax, 0xd055c7ba
jne 0x1402d1e30
mov rax, qword [rbp - 0x20]
mov qword [rbp - 0x38], rax
mov eax, 0x4ac26985
jmp 0x1402d1e30
cmp eax, 0x3b3e2909
jle 0x1402d1f00
cmp eax, 0x4ac26984
jg 0x1402d1f6c
cmp eax, 0x3b3e290a
je 0x1402d2020
cmp eax, 0x41bbc01f
jne 0x1402d1e30
test r12, r12
mov dword [rbp - 0x14], edi
mov eax, 0xab01692f
mov ecx, 0xf555989e
cmovne eax, ecx
cmp dword [rbp - 0x14], 0
mov ecx, 0xab01692f
cmovs eax, ecx
jmp 0x1402d1e30
cmp eax, 0xab01692e
jle 0x1402d1f8c
cmp eax, 0xab01692f
je 0x1402d2039
cmp eax, 0xab762387
jne 0x1402d1e30
mov rax, qword [rbp - 0x40]
mov edi, dword [rax]
mov eax, 0x41bbc01f
jmp 0x1402d1e30
cmp eax, 0x4d60ba2
je 0x1402d1e1e
cmp eax, 0x259098aa
je 0x1402d2047
cmp eax, 0x3184ffad
jne 0x1402d1e30
cmp dword [rbp - 0x10], 0
setns byte [rbp - 9]
mov eax, 0x3b3e290a
jmp 0x1402d1e30
cmp eax, 0xf555989e
je 0x1402d205c
cmp eax, 0x419b2ee
jne 0x1402d1e30
sub rsp, 0x20
mov rcx, rsi
xor edx, edx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
add rsp, 0x20
mov dword [rbp - 0x10], eax
mov eax, 0x3184ffad
jmp 0x1402d1e30
cmp eax, 0x4ac26985
je 0x1402d2072
cmp eax, 0x79d9324b
jne 0x1402d1e30
mov eax, 0xab01692f
jmp 0x1402d1e30
cmp eax, 0x8063bc14
jne 0x1402d2084
mov eax, select
call fcn.1402e5fd0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x20], rax
mov eax, 0xafc518ec
jmp 0x1402d1e30
mov qword [rbp - 0x28], rbx
mov rax, qword [rbp - 0x28]
mov qword [rbp - 8], r15
mov rax, qword [rbp - 0x20]
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x30]
mov rax, qword [rbp - 0x20]
sub rsp, 0x50
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
add rsp, 0x50
mov edi, eax
cmp eax, 0x103
mov eax, 0x41bbc01f
mov ecx, 0x419b2ee
cmove eax, ecx
jmp 0x1402d1e30
cmp byte [rbp - 9], 0
mov eax, 0x41bbc01f
mov ecx, 0xd055c7ba
cmovne eax, ecx
mov edi, dword [rbp - 0x10]
jmp 0x1402d1e30
mov rax, qword [rbp - 0x30]
mov eax, 0x4d60ba2
jmp 0x1402d1e30
mov rax, qword [rbp - 0x48]
mov rax, qword [rax]
mov qword [r12], rax
mov eax, 0x79d9324b
jmp 0x1402d1e30
mov rax, qword [rbp - 0x20]
add rax, 8
mov qword [rbp - 0x48], rax
mov eax, 0x259098aa
jmp 0x1402d1e30
mov rax, qword [rbp - 0x38]
mov qword [rbp - 0x40], rax
mov eax, 0xab762387
jmp 0x1402d1e30
cmp eax, 0x91aa62e7
jne 0x1402d1e30
mov esi, dword [rbp - 0x14]
mov rcx, qword [rbp]
xor rcx, rbp
sub rsp, 0x20
call fcn.1402e6030
add rsp, 0x20
mov eax, esi
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret