Function at 0x14000be70
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x10c8
call fcn.1400186ac
sub rsp, rax
mov r12d, dword [rsp + 0x1130]
mov r13, qword [0x14003da78]
mov rax, qword [r13]
xor rax, rsp
mov qword [rsp + 0x10c0], rax
mov qword [rsp + 0x40], 0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x1080], xmm0
movaps xmmword [rsp + 0x1090], xmm0
movaps xmmword [rsp + 0x10a0], xmm0
movaps xmmword [rsp + 0x10b0], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x70], xmm0
test r9, r9
je 0x14000c132
mov rax, qword [rsp + 0x1138]
test rax, rax
je 0x14000c132
mov dword [rax], 0
test r12d, r12d
je 0x14000c14b
mov rsi, r9
mov rdi, r8
mov rbx, rcx
mov r14d, r12d
shl r14, 3
xor r15d, r15d
nop dword [rax]
lea rcx, [rsp + r15]
add rcx, 0x1080
lea rdx, [rdi + r15]
call fcn.14000b590
test eax, eax
jne 0x14000c177
add r15, 8
cmp r14, r15
jne 0x14000bf20
lea rax, str.signature_block
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r12d
lea rbp, [rsp + 0x1080]
mov qword [rsp + 0x20], rbp
lea rdx, [rsp + 0x40]
lea r8, [rsp + 0x80]
mov rcx, rbx
mov r9d, 0x14
call fcn.14000b770
mov edi, 0xffffffff
test eax, eax
jne 0x14000c1a1
cmp r12d, 2
mov r13d, 1
cmovae r13d, r12d
lea r14, [rsp + 0x60]
lea r15, [rsp + 0x40]
nop word cs:[rax + rax]
lea rax, str.signature_algorithm_ID
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rbp
mov rcx, rbx
mov rdx, r15
lea r8, [rsp + 0x80]
mov r9d, 4
call fcn.14000b770
test eax, eax
jne 0x14000c1f8
lea rax, [0x14003fdbe]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rbp
mov rcx, rbx
mov rdx, r15
mov r8, r14
mov r9d, 4
call fcn.14000b770
test eax, eax
jne 0x14000c1f8
mov ecx, dword [r14]
call qword [sym.imp.WS2_32.dll_ntohl]
mov dword [r14], eax
cmp eax, 0x801
jae 0x14000c201
mov r8d, eax
mov rcx, rbx
mov rdx, r15
call fcn.14000d9b0
test eax, eax
jne 0x14000c21a
add r14, 4
dec r13
jne 0x14000bfb0
mov rax, qword [rsp + 0x40]
cmp rax, qword [rbx + 8]
jae 0x14000c0c2
cmp r12d, 2
mov r13d, 1
cmovae r13d, r12d
lea r14, [rsp + 0x80]
lea r8, [rsp + 0x40]
mov r9d, 0x1000
mov rcx, rbx
mov rdx, r14
call fcn.14000d970
mov ebp, eax
xor r15d, r15d
mov rcx, qword [rsp + r15*8 + 0x1080]
mov rdx, r14
mov r8d, ebp
call sub.nss3.dll_VFY_Update
test eax, eax
jne 0x14000c233
inc r15
cmp r13, r15
jne 0x14000c08f
mov rax, qword [rsp + 0x40]
cmp rax, qword [rbx + 8]
lea r8, [rsp + 0x40]
jb 0x14000c079
cmp r12d, 2
mov r14d, 1
cmovae r14d, r12d
xor r15d, r15d
lea rbx, [rsp + 0x48]
mov r13, qword [0x14003da78]
mov rbp, qword [rsp + 0x1138]
xor edi, edi
mov rax, qword [rsi + r15*8]
test rax, rax
je 0x14000c264
mov rcx, qword [rsp + r15*8 + 0x1080]
test rcx, rcx
je 0x14000c264
mov edx, dword [rsp + r15*4 + 0x60]
mov dword [rsp + 0x58], edx
mov qword [rsp + 0x50], rax
mov rdx, rbx
call sub.nss3.dll_VFY_EndWithSignature
test eax, eax
jne 0x14000c264
inc dword [rbp]
inc r15
cmp r14, r15
jne 0x14000c0e9
jmp 0x14000c1a1
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str.ERROR:_Invalid_parameter_specified._n
mov edx, 0x24
jmp 0x14000c18e
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str.ERROR:_There_must_be_at_least_one_signature._n
mov edx, 0x2d
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov edi, 0xffffffff
jmp 0x14000c1ca
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str.ERROR:_Could_not_initialize_signature_handle._n
mov edx, 0x2e
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov edi, 0xffffffff
test r12d, r12d
je 0x14000c1ca
mov esi, r12d
xor ebx, ebx
nop dword [rax + rax]
mov rcx, qword [rsp + rbx*8 + 0x1080]
mov edx, 1
call sub.nss3.dll_VFY_DestroyContext
inc rbx
cmp rsi, rbx
jne 0x14000c1b0
mov rax, qword [rsp + 0x10c0]
xor rax, rsp
mov rcx, qword [r13]
cmp rcx, rax
jne 0x14000c280
mov eax, edi
add rsp, 0x10c8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r13, qword [0x14003da78]
jmp 0x14000c1a1
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str.ERROR:_Embedded_signature_length_is_too_large._n
mov edx, 0x2f
jmp 0x14000c24a
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str.ERROR:_Could_not_seek_past_signature._n
mov edx, 0x26
jmp 0x14000c24a
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str.ERROR:_Error_updating_verify_context_with_data_block._n
mov edx, 0x36
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov r13, qword [0x14003da78]
jmp 0x14000c1a1
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str.ERROR:_Error_verifying_signature._n
mov edx, 0x22
jmp 0x14000c18e
call fcn.140018700
int3