Function at 0x14011b8fc
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rbx, rcx
xor r12d, r12d
lea rcx, [0x140044be8]
mov r15, rdx
mov edi, r12d
lea esi, [r12 + 1]
call fcn.140129990
mov dword [rsp + 0x70], r12d
test rbx, rbx
jne 0x14011b989
lea r9d, [r12 + 0x57]
mov esi, r12d
mov edi, r9d
mov rcx, qword [0x140154018]
lea rax, [0x140154018]
cmp rcx, rax
je 0x14011bb40
test byte [rcx + 0x1c], 8
je 0x14011bb40
lea edx, [rbx + 0x65]
lea rax, [0x140044c18]
mov rcx, qword [rcx + 0x10]
lea r8, [0x140044c38]
mov qword [rsp + 0x20], rax
call fcn.14011834c
jmp 0x14011bb40
test r15, r15
jne 0x14011b9c6
lea r9d, [r15 + 0x57]
mov esi, r12d
mov edi, r9d
mov rcx, qword [0x140154018]
lea rax, [0x140154018]
cmp rcx, rax
je 0x14011bb40
test byte [rcx + 0x1c], 8
je 0x14011bb40
lea edx, [r15 + 0x66]
lea rax, [0x140044798]
jmp 0x14011b96f
mov qword [rsp + 0x30], r12
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rbx
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 2
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_CreateFileW]
or rbx, 0xffffffffffffffff
mov r14, rax
cmp rax, rbx
jne 0x14011ba43
mov esi, r12d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov edi, eax
mov rcx, qword [0x140154018]
lea rax, [0x140154018]
cmp rcx, rax
je 0x14011bb40
test byte [rcx + 0x1c], 8
je 0x14011bb40
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov rcx, qword [0x140154018]
lea edx, [rbx + 0x68]
mov r9d, eax
lea rax, [0x140043d40]
jmp 0x14011b96f
lea rdx, str.__xml_version_1.0__encoding_UTF_16___
mov rbp, rbx
inc rbp
cmp word [rdx + rbp*2], r12w
jne 0x14011ba4d
add ebp, ebp
lea r9, [rsp + 0x70]
mov rcx, rax
mov r8d, ebp
mov qword [rsp + 0x20], r12
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_WriteFile]
test eax, eax
je 0x14011badd
cmp dword [rsp + 0x70], ebp
jne 0x14011badd
inc rbx
cmp word [r15 + rbx*2], r12w
jne 0x14011ba79
add ebx, ebx
lea r9, [rsp + 0x70]
mov rdx, r15
mov rcx, r14
mov r8d, ebx
mov qword [rsp + 0x20], r12
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_WriteFile]
test eax, eax
je 0x14011baac
cmp dword [rsp + 0x70], ebx
je 0x14011bb32
mov esi, r12d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov edi, eax
mov rcx, qword [0x140154018]
lea rax, [0x140154018]
cmp rcx, rax
je 0x14011bb32
test byte [rcx + 0x1c], 8
je 0x14011bb32
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov edx, 0x69
jmp 0x14011bb0c
mov esi, r12d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov edi, eax
mov rcx, qword [0x140154018]
lea rax, [0x140154018]
cmp rcx, rax
je 0x14011bb32
test byte [rcx + 0x1c], 8
je 0x14011bb32
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov edx, 0x68
mov rcx, qword [0x140154018]
mov r9d, eax
lea rax, [0x140043d40]
mov rcx, qword [rcx + 0x10]
lea r8, [0x140044c38]
mov qword [rsp + 0x20], rax
call fcn.14011834c
test r14, r14
je 0x14011bb40
mov rcx, r14
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
lea rcx, [0x140044be8]
call fcn.1401299d0
mov ecx, edi
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetLastError]
lea r11, [rsp + 0x40]
mov eax, esi
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret