Function at 0x140001314
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
push r12
push r13
push r14
sub rsp, 0x130
mov qword [r11 - 0x90], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov r13, rcx
xor ebx, ebx
mov dword [rsp + 0x34], ebx
mov dword [rsp + 0x78], ebx
mov qword [r11 - 0xc8], rbx
lea edx, [rbx + 2]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x14000314b
mov dword [0x14001a010], ebx
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x58], ebx
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x50]
call fcn.140001810
nop
mov r12, qword [rax]
mov r14d, 0x80040111
lea rsi, [0x14001a090]
mov qword [rsp + 0x90], rsi
mov rcx, qword [0x14001a168]
mov rdx, qword [0x14001a160]
mov rax, qword [rsi]
test rax, rax
je 0x14000142d
cmp qword [rax], rdx
jne 0x140003168
cmp qword [rax + 8], rcx
jne 0x140003168
mov ecx, 0x18
call fcn.140001e30
mov rdi, rax
test rax, rax
je 0x140003158
lea rax, [0x140010650]
mov qword [rdi], rax
mov dword [rdi + 8], 1
mov qword [rdi + 0x10], rsi
jmp 0x140001404
test rdi, rdi
je 0x140003160
mov rax, qword [rdi]
mov r8, r12
lea rdx, [0x140010560]
mov rcx, rdi
call qword [rax]
mov r14d, eax
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
jmp 0x14000142d
test r14d, r14d
js 0x140003179
mov rax, qword [rsp + 0x88]
cmp qword [rax], rbx
je 0x14000144a
mov dword [rax + 8], 1
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x48], ebx
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x40]
call fcn.140001810
nop
mov r8, qword [rax]
mov edx, 1
xor ecx, ecx
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
js 0x140003185
mov rax, qword [rsp + 0x98]
cmp qword [rax], rbx
je 0x140001492
mov dword [rax + 8], 1
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
mov r8, qword [rsp + 0x50]
lea rdx, [0x140010560]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ole32.dll_CoMarshalInterface]
test eax, eax
js 0x140003190
cmp dword [rsp + 0x58], ebx
je 0x1400014d7
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400014d3
mov rax, qword [rcx]
call qword [rax + 0x10]
mov dword [rsp + 0x58], ebx
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
mov r8d, 1
lea rdx, [rsp + 0xd0]
call qword [rax + 0x60]
test eax, eax
js 0x14000319d
mov eax, dword [rsp + 0xe0]
mov dword [rsp + 0x30], eax
mov ecx, eax
call fcn.140002410
mov rsi, rax
mov qword [rsp + 0x60], rax
mov edi, ebx
mov dword [rsp + 0x68], ebx
test rax, rax
je 0x140001526
mov edi, 1
mov dword [rsp + 0x68], edi
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
call qword [rax + 0x28]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea r9, [rsp + 0x70]
mov r8d, dword [rsp + 0x30]
mov rdx, rsi
call qword [rax + 0x18]
test eax, eax
js 0x1400031aa
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 0x70], eax
jne 0x1400031b7
cmp dword [rsp + 0x48], ebx
je 0x140001582
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14000157e
mov rax, qword [rcx]
call qword [rax + 0x10]
mov dword [rsp + 0x48], ebx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x38]
mov r8d, 4
lea rdx, [rsp + 0x30]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400031c7
cmp dword [rsp + 0x38], 4
jne 0x1400031d2
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x38]
mov r8d, dword [rsp + 0x30]
mov rdx, rsi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400031e2
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 0x38], eax
jne 0x1400031ed
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14001a170]
call qword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
je 0x1400031fd
call section..text
test eax, eax
js 0x140003208
call qword [sym.imp.ole32.dll_CoUninitialize]
nop
test edi, edi
je 0x140001626
mov rcx, rsi
call fcn.140001094
mov dword [rsp + 0x68], ebx
cmp dword [rsp + 0x48], ebx
jne 0x140003215
cmp dword [rsp + 0x58], ebx
jne 0x14000322e
mov edi, dword [rsp + 0x34]
test byte [rsp + 0x78], 2
jne 0x140003247
mov eax, edi
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.140001680
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret
mov ecx, eax
call fcn.140008ef0
nop
jmp 0x140001374
mov rdi, rbx
jmp 0x140001404
mov r14d, 0x8007000e
jmp 0x140003179
add rsi, 0x18
mov qword [rsp + 0x90], rsi
jmp 0x1400013bc
mov ecx, r14d
call fcn.140008ef0
nop
jmp 0x140003184
nop
mov ecx, eax
call fcn.140008ef0
nop
jmp 0x14000318f
nop
mov ecx, eax
call fcn.140008ef0
nop
jmp 0x1400014bd
mov ecx, eax
call fcn.140008ef0
nop
jmp 0x1400014f8
mov ecx, eax
call fcn.140008ef0
nop
jmp 0x14000155a
mov ecx, 0x80004005
call fcn.140008ef0
nop
jmp 0x140001568
call fcn.140008fe0
nop
jmp 0x1400015a8
mov ecx, 0x80004005
call fcn.140008ef0
nop
jmp 0x1400015b3
call fcn.140008fe0
nop
jmp 0x1400015d6
mov ecx, 0x80004005
call fcn.140008ef0
nop
jmp 0x1400015e4
call fcn.140008fe0
nop
jmp 0x140001602
mov ecx, eax
call fcn.140008ef0
nop
jmp 0x14000160f
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140003225
mov rax, qword [rcx]
call qword [rax + 0x10]
mov dword [rsp + 0x48], ebx
jmp 0x140001630
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14000323e
mov rax, qword [rcx]
call qword [rax + 0x10]
mov dword [rsp + 0x58], ebx
jmp 0x14000163a
mov rcx, qword [0x14001a9e8]
test rcx, rcx
je 0x140001649
call rcx
nop
jmp 0x140001649