Function at 0x140101130
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov bl, r9b
mov r15, r8
mov r13, rdx
mov r12, rcx
mov rcx, qword [0x14017a048]
lea rdi, [0x14017a048]
cmp rcx, rdi
je 0x14010118e
test byte [rcx + 0x1c], 1
je 0x14010118e
cmp byte [rcx + 0x19], 4
jb 0x14010118e
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401614b8]
mov edx, 0x5f
call fcn.140004b70
mov rcx, qword [0x14017a048]
or qword [rbp - 0x10], 0xffffffffffffffff
xor r14d, r14d
mov qword [rbp + 0x50], r14
mov esi, r14d
mov dword [rbp + 0x48], r14d
mov byte [rbp + 0x40], r14b
mov qword [rbp - 8], r14
test r12, r12
jne 0x1401011cd
lea r8, str.wszSrcFile
mov edx, 0x926
lea rcx, str.base_stor_blbengine_blbengutils_blbfsutils.cpp
call fcn.1400876c8
mov rcx, qword [0x14017a048]
test r13, r13
jne 0x1401011f1
lea r8, str.wszDstFile
mov edx, 0x927
lea rcx, str.base_stor_blbengine_blbengutils_blbfsutils.cpp
call fcn.1400876c8
mov rcx, qword [0x14017a048]
cmp rcx, rdi
je 0x14010121f
test byte [rcx + 0x1c], 1
je 0x14010121f
cmp byte [rcx + 0x19], 4
jb 0x14010121f
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401614b8]
mov edx, 0x60
mov qword [rsp + 0x20], r13
mov r9, r12
call fcn.140005d24
test r15, r15
je 0x14010122b
mov dil, 1
test bl, bl
jne 0x14010122e
mov dil, r14b
test r15, r15
je 0x14010123a
test bl, bl
jne 0x14010123a
mov r14b, 1
test dil, dil
je 0x140101253
xor edx, edx
mov rcx, r15
call fcn.1400fdb78
mov ebx, eax
test eax, eax
js 0x1401012e5
lea r8, [rbp - 8]
mov rcx, r12
lea rdx, [rbp + 0x50]
call fcn.1401370e8
mov ebx, eax
test eax, eax
jns 0x1401012b7
mov rcx, qword [0x14017a048]
lea r14, [0x14017a048]
cmp rcx, r14
je 0x1401012b1
test byte [rcx + 0x1c], 1
je 0x1401012b1
cmp byte [rcx + 0x19], 2
jb 0x1401012b1
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401614b8]
mov edx, 0x61
mov dword [rsp + 0x20], eax
mov r9, r12
call fcn.140005ca0
mov rsi, qword [rbp + 0x50]
mov rcx, qword [0x14017a048]
jmp 0x1401012f3
mov rsi, qword [rbp + 0x50]
jmp 0x1401012f3
test dil, dil
je 0x1401012c4
mov rcx, r15
call fcn.1400fdd24
test r14b, r14b
je 0x140101363
xor edx, edx
mov rcx, r15
call fcn.1400fdb78
mov ebx, eax
test eax, eax
jns 0x140101363
mov rsi, qword [rbp + 0x50]
mov rcx, qword [0x14017a048]
lea r14, [0x14017a048]
test r15, r15
je 0x140101307
mov rcx, r15
call fcn.1400fdd24
mov rcx, qword [0x14017a048]
test rsi, rsi
je 0x140101322
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rcx, qword [0x14017a048]
cmp rcx, r14
je 0x140101348
test byte [rcx + 0x1c], 1
je 0x140101348
cmp byte [rcx + 0x19], 4
jb 0x140101348
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401614b8]
mov edx, 0x67
call fcn.140004b70
mov eax, ebx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rax, [rbp - 0x10]
mov r9d, 2
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov byte [rsp + 0x30], sil
mov edx, 0xc0000000
mov rcx, r13
mov dword [rsp + 0x20], 0x80
call fcn.14008c638
mov rsi, qword [rbp + 0x50]
xor ecx, ecx
mov ebx, eax
test eax, eax
jns 0x1401013ea
mov rcx, qword [0x14017a048]
lea rdx, [0x14017a048]
cmp rcx, rdx
je 0x1401013dd
test byte [rcx + 0x1c], 1
je 0x1401013dd
cmp byte [rcx + 0x19], 2
jb 0x1401013dd
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401614b8]
mov edx, 0x62
mov dword [rsp + 0x20], eax
mov r9, r13
call fcn.140005ca0
mov rcx, qword [0x14017a048]
mov rdi, qword [rbp - 0x10]
mov r12b, byte [rbp + 0x40]
jmp 0x140101594
mov r12b, 1
test r14b, r14b
je 0x1401013fc
mov rcx, r15
call fcn.1400fdd24
xor ecx, ecx
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], cx
jne 0x140101400
mov rdi, qword [rbp - 0x10]
lea r14d, [rax*2 + 2]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x48]
mov r8d, r14d
mov rcx, rdi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop dword [rax + rax]
test eax, eax
jne 0x14010149d
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x14017a048]
lea rdx, [0x14017a048]
cmp rcx, rdx
je 0x140101594
test byte [rcx + 0x1c], r12b
je 0x140101594
cmp byte [rcx + 0x19], 2
jb 0x140101594
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401614b8]
mov edx, 0x63
mov dword [rsp + 0x20], ebx
mov r9, r13
call fcn.140005ca0
jmp 0x14010158d
mov eax, dword [rbp + 0x48]
cmp eax, r14d
je 0x1401014f6
mov rcx, qword [0x14017a048]
lea rdx, [0x14017a048]
cmp rcx, rdx
je 0x1401014ec
test byte [rcx + 0x1c], r12b
je 0x1401014ec
cmp byte [rcx + 0x19], 2
jb 0x1401014ec
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401614b8]
mov edx, 0x64
mov dword [rsp + 0x28], r14d
mov r9, r13
mov dword [rsp + 0x20], eax
call fcn.140010964
mov rcx, qword [0x14017a048]
mov ebx, 0x8007045d
jmp 0x140101594
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
nop dword [rax + rax]
xor r14d, r14d
test eax, eax
jne 0x140101577
call qword [sym.imp.ntdll.dll_RtlGetLastNtStatus]
nop dword [rax + rax]
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x14017a048]
lea rdx, [0x14017a048]
cmp rcx, rdx
je 0x140101594
test byte [rcx + 0x1c], r12b
je 0x140101594
cmp byte [rcx + 0x19], 2
jb 0x140101594
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401614b8]
mov edx, 0x65
mov dword [rsp + 0x28], r14d
mov r9, r13
mov dword [rsp + 0x20], ebx
call fcn.1400b2e80
jmp 0x14010158d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
or rdi, 0xffffffffffffffff
mov r12b, r14b
mov rcx, qword [0x14017a048]
cmp rdi, 0xffffffffffffffff
je 0x1401015b0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, qword [0x14017a048]
test r12b, r12b
je 0x1401012ec
xor r8d, r8d
xor edx, edx
mov rcx, r13
call fcn.14008c9d0
test eax, eax
jns 0x1401012e5
mov rcx, qword [0x14017a048]
lea r14, [0x14017a048]
cmp rcx, r14
je 0x1401012f3
test byte [rcx + 0x1c], 1
je 0x1401012f3
cmp byte [rcx + 0x19], 3
jb 0x1401012f3
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401614b8]
mov edx, 0x66
mov dword [rsp + 0x20], ebx
mov r9, r13
call fcn.140005ca0
jmp 0x1401012a8