Function at 0x140002d34
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x110
mov qword [rax - 0x98], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x140022010]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov r13, rcx
xor ebx, ebx
mov dword [rsp + 0x68], ebx
mov qword [rsp + 0x70], rbx
lea edx, [rbx + 2]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jns 0x140002d90
mov ecx, eax
call fcn.140007fc4
mov dword [0x1400220c8], ebx
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x58], ebx
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x50]
call fcn.140004bdc
nop
mov r12, qword [rax]
mov r15d, 0x80040111
lea rdi, [0x140022050]
mov qword [rsp + 0x88], rdi
mov rcx, qword [0x140022880]
mov rdx, qword [0x140022878]
mov rax, qword [rdi]
test rax, rax
je 0x140002e7e
cmp qword [rax], rdx
jne 0x140002e6d
cmp qword [rax + 8], rcx
jne 0x140002e6d
mov ecx, 0x18
call fcn.1400051d4
mov rsi, rax
test rax, rax
je 0x140002e1f
lea rax, [0x140012c50]
mov qword [rsi], rax
mov r14d, 1
mov dword [rsi + 8], r14d
mov qword [rsi + 0x10], rdi
jmp 0x140002e28
mov rsi, rbx
mov r14d, 1
test rsi, rsi
jne 0x140002e35
mov r15d, 0x8007000e
jmp 0x140002e89
mov rax, qword [rsi]
mov rdi, qword [rax]
mov rcx, rdi
call qword [fcn.14000e680]
mov r8, r12
lea rdx, [0x1400118e0]
mov rcx, rsi
call rdi
mov r15d, eax
mov rax, qword [rsi]
mov rdi, qword [rax + 0x10]
mov rcx, rdi
call qword [fcn.14000e680]
mov rcx, rsi
call rdi
jmp 0x140002e84
add rdi, 0x18
mov qword [rsp + 0x88], rdi
jmp 0x140002dd8
mov r14d, 1
test r15d, r15d
jns 0x140002e92
mov ecx, r15d
call fcn.140007fc4
nop
mov rax, qword [rsp + 0x90]
cmp qword [rax], rbx
je 0x140002ea3
mov dword [rax + 8], r14d
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x48], ebx
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x40]
call fcn.140004bdc
nop
mov r8, qword [rax]
mov edx, r14d
xor ecx, ecx
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jns 0x140002ed9
mov ecx, eax
call fcn.140007fc4
nop
mov rax, qword [rsp + 0x98]
cmp qword [rax], rbx
je 0x140002eea
mov dword [rax + 8], r14d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
mov r8, qword [rsp + 0x50]
lea rdx, [0x1400118e0]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ole32.dll_CoMarshalInterface]
test eax, eax
jns 0x140002f18
mov ecx, eax
call fcn.140007fc4
cmp dword [rsp + 0x58], ebx
je 0x140002f41
mov rsi, qword [rsp + 0x50]
test rsi, rsi
je 0x140002f3d
mov rax, qword [rsi]
mov rdi, qword [rax + 0x10]
mov rcx, rdi
call qword [fcn.14000e680]
mov rcx, rsi
call rdi
mov dword [rsp + 0x58], ebx
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsi]
mov rdi, qword [rax + 0x60]
mov rcx, rdi
call qword [fcn.14000e680]
mov r8d, r14d
lea rdx, [rsp + 0xb0]
mov rcx, rsi
call rdi
test eax, eax
jns 0x140002f71
mov ecx, eax
call fcn.140007fc4
mov eax, dword [rsp + 0xc0]
mov dword [rsp + 0x30], eax
mov ecx, eax
call fcn.140005190
mov r12, rax
mov qword [rsp + 0x78], rax
mov r15d, ebx
mov dword [rsp + 0x80], ebx
test rax, rax
je 0x140002fa5
mov r15d, r14d
mov dword [rsp + 0x80], r14d
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsi]
mov rdi, qword [rax + 0x28]
mov rcx, rdi
call qword [fcn.14000e680]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call rdi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsi]
mov rdi, qword [rax + 0x18]
mov rcx, rdi
call qword [fcn.14000e680]
lea r9, [rsp + 0x38]
mov r8d, dword [rsp + 0x30]
mov rdx, r12
mov rcx, rsi
call rdi
test eax, eax
jns 0x140002ffa
mov ecx, eax
call fcn.140007fc4
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 0x38], eax
je 0x14000300e
mov ecx, 0x80004005
call fcn.140007fc4
cmp dword [rsp + 0x48], ebx
je 0x140003037
mov rsi, qword [rsp + 0x40]
test rsi, rsi
je 0x140003033
mov rax, qword [rsi]
mov rdi, qword [rax + 0x10]
mov rcx, rdi
call qword [fcn.14000e680]
mov rcx, rsi
call rdi
mov dword [rsp + 0x48], ebx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x34]
mov r8d, 4
lea rdx, [rsp + 0x30]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14000305e
call fcn.1400080e8
cmp dword [rsp + 0x34], 4
je 0x14000306f
mov ecx, 0x80004005
call fcn.140007fc4
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x34]
mov r8d, dword [rsp + 0x30]
mov rdx, r12
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140003093
call fcn.1400080e8
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 0x34], eax
je 0x1400030a7
mov ecx, 0x80004005
call fcn.140007fc4
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x140022888]
call qword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x1400030c6
call fcn.1400080e8
call fcn.140002c74
test eax, eax
jns 0x1400030d6
mov ecx, eax
call fcn.140007fc4
call qword [sym.imp.ole32.dll_CoUninitialize]
nop
test r15d, r15d
je 0x1400030f1
mov rcx, r12
call fcn.140005218
mov dword [rsp + 0x80], ebx
cmp dword [rsp + 0x48], ebx
je 0x14000311a
mov rsi, qword [rsp + 0x40]
test rsi, rsi
je 0x140003116
mov rax, qword [rsi]
mov rdi, qword [rax + 0x10]
mov rcx, rdi
call qword [fcn.14000e680]
mov rcx, rsi
call rdi
mov dword [rsp + 0x48], ebx
cmp dword [rsp + 0x58], ebx
je 0x140003143
mov rsi, qword [rsp + 0x50]
test rsi, rsi
je 0x14000313f
mov rax, qword [rsi]
mov rdi, qword [rax + 0x10]
mov rcx, rdi
call qword [fcn.14000e680]
mov rcx, rsi
call rdi
mov dword [rsp + 0x58], ebx
jmp 0x140003149
test byte [rsp + 0x68], 2
je 0x140003155
call fcn.14000b01c
mov eax, ebx
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.14000db20
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret