Function at 0x180141e70
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r14
lea rbp, [rsp - 0x2f]
sub rsp, 0xc0
mov rbx, r9
mov r12, r8
mov rdi, rdx
mov rsi, rcx
test r9, r9
jne 0x180141ea1
xor r14d, r14d
mov ecx, r14d
jmp 0x180141eb9
mov rax, qword [rcx + 0xf0]
mov rcx, rbx
call rax
xor r14d, r14d
cmp eax, 0xffffffff
mov ecx, r14d
setne cl
test ecx, ecx
jne 0x180141f81
movdqa xmm0, xmmword [0x1801613c0]
lea rdx, [rbp - 0x61]
movdqa xmm1, xmmword [0x180162220]
lea rcx, [rbp + 7]
movabs rax, 0x53a4a43623c65917
mov dword [rbp - 0x41], 0xc59f9d8f
mov qword [rbp - 0x39], rax
movabs rax, 0x168ea840b0d322fa
mov qword [rbp - 0x31], rax
movabs rax, 0x50ec4ddbeb1a236c
mov qword [rbp - 0x29], rax
movdqu xmmword [rbp - 0x61], xmm0
mov dword [rbp - 0x3d], 0x548006
movdqu xmmword [rbp - 0x51], xmm1
call fcn.18000d7e0
mov r9, rbx
lea r8, [rbp - 0x21]
mov edx, 0x100000
lea rcx, [0x18017bd90]
movups xmm2, xmmword [rax]
movups xmmword [rbp - 0x21], xmm2
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp - 0x11], xmm0
movsd xmm1, qword [rax + 0x20]
movsd qword [rbp - 1], xmm1
call fcn.1800010e0
mov rcx, qword [0x18017bd78]
lea r9, [0x18017bd80]
mov r8d, eax
mov dword [0x18017bd84], eax
lea rdx, [0x18017bd90]
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
jmp 0x1801422c7
mov rax, qword [rsi + 0x138]
xor r9d, r9d
mov r8, qword [rdi]
mov rdx, qword [rdi + 8]
mov qword [rsp + 0xf8], r15
lea ecx, [r9 + 5]
call rax
mov r15, rax
test rax, rax
jne 0x180142054
movdqa xmm0, xmmword [0x1801613b0]
lea rdx, [rbp - 0x61]
movabs rax, 0x53a4a43623c65917
mov dword [rbp - 0x51], 0x72bcd75d
mov qword [rbp - 0x49], rax
lea rcx, [rbp - 0x21]
movabs rax, 0x168ea840b0d322fa
mov dword [rbp - 0x4d], 0xb27428
mov qword [rbp - 0x41], rax
movabs rax, 0x50ec4ddbeb1a236c
mov qword [rbp - 0x39], rax
movdqu xmmword [rbp - 0x61], xmm0
call fcn.18000da30
lea r8, [rbp + 7]
mov edx, 0x100000
lea rcx, [0x18017bd90]
movups xmm1, xmmword [rax]
movups xmmword [rbp + 7], xmm1
movsd xmm0, qword [rax + 0x10]
movsd qword [rbp + 0x17], xmm0
call fcn.1800010e0
mov rcx, qword [0x18017bd78]
lea r9, [0x18017bd80]
mov r8d, eax
mov dword [0x18017bd84], eax
lea rdx, [0x18017bd90]
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
jmp 0x1801422bf
cmp dword [rbp + 0x7f], 0
mov rdx, rbx
mov rcx, rsi
je 0x180142067
call fcn.180144aa0
jmp 0x18014206c
call fcn.180145590
mov rcx, r15
mov edi, eax
call qword [rsi + 0x140]
test edi, edi
je 0x18014204d
mov rcx, rbx
mov qword [rsp + 0xf0], r13
call fcn.18014ad10
mov r13, rax
mov dword [rbp - 0x61], 0xfb0e710f
movabs rax, 0x7f02b73546d22d
mov dword [rbp - 0x5d], 0x367f8c2a
mov qword [rbp - 0x49], rax
lea rdx, [rbp - 0x61]
movabs rax, 0xdfd8f3cdaa3be86a
mov dword [rbp - 0x59], 0xa3b90179
mov qword [rbp - 0x41], rax
lea rcx, [rbp + 7]
movabs rax, 0x266d7feed021e814
mov dword [rbp - 0x55], 0x9e5710ff
mov qword [rbp - 0x39], rax
mov dword [rbp - 0x51], 0xabb0dfd9
mov dword [rbp - 0x4d], 0x32b39336
call fcn.18000dd90
mov rdx, 0xffffffffffffffff
movups xmm1, xmmword [rax]
movups xmmword [rbp - 0x21], xmm1
movsd xmm0, qword [rax + 0x10]
movsd qword [rbp - 0x11], xmm0
movzx eax, word [rax + 0x18]
mov word [rbp - 9], ax
mov rax, rdx
inc rax
cmp word [r13 + rax*2], 0
jne 0x180142112
lea r8, [rbp - 0x21]
mov rcx, rdx
inc rcx
cmp word [r8 + rcx*2], 0
jne 0x180142125
add rax, rcx
cmp word [r12 + rdx*2 + 2], 0
lea rdx, [rdx + 1]
jne 0x180142133
lea rdi, [rdx + 1]
add rdi, rax
lea rbx, [rdi + rdi]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x28], r13
lea r8, str._ws_ws_ws
mov r15, rax
mov r9, r12
lea rax, [rbp - 0x21]
mov rcx, r15
mov rdx, rdi
mov qword [rsp + 0x20], rax
call fcn.180001080
mov r13, qword [rsp + 0xf0]
mov edi, r14d
mov ebx, r14d
test r15, r15
jne 0x1801421a0
mov ecx, r14d
jmp 0x1801421b5
mov rax, qword [rsi + 0xf0]
mov rcx, r15
call rax
cmp eax, 0xffffffff
mov ecx, r14d
setne cl
test ecx, ecx
jne 0x1801421d0
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0x14
jl 0x180142196
jmp 0x180142280
movdqa xmm0, xmmword [0x1801610c0]
lea rdx, [rbp - 0x61]
movdqa xmm1, xmmword [0x180162070]
lea rcx, [rbp + 7]
movabs rax, 0x7f02b73546d22d
mov qword [rbp - 0x41], rax
movabs rax, 0xdfd8f3cdaa3be86a
mov qword [rbp - 0x39], rax
movabs rax, 0x266d7feed021e814
mov qword [rbp - 0x31], rax
movdqu xmmword [rbp - 0x61], xmm0
movdqu xmmword [rbp - 0x51], xmm1
call fcn.18000bce0
mov r9, r15
lea r8, [rbp - 0x21]
mov edx, 0x100000
lea rcx, [0x18017bd90]
movups xmm2, xmmword [rax]
movups xmmword [rbp - 0x21], xmm2
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp - 0x11], xmm0
movzx eax, byte [rax + 0x20]
mov byte [rbp - 1], al
call fcn.1800010e0
mov rcx, qword [0x18017bd78]
lea r9, [0x18017bd80]
mov r8d, eax
mov dword [0x18017bd84], eax
lea rdx, [0x18017bd90]
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, 1
nop dword [rax]
mov rcx, rsi
call fcn.1801428c0
mov r9, qword [rsi + 0x60]
xor edx, edx
mov r8d, eax
mov ebx, eax
lea ecx, [rdx + 1]
call r9
test rax, rax
je 0x1801422a6
xor edx, edx
mov rcx, rax
call qword [rsi + 0x58]
test ebx, ebx
jne 0x180142280
test edi, edi
jne 0x1801422b8
mov rcx, r15
call fcn.180146f60
test edi, edi
cmovne r14, r15
mov rax, r14
mov r15, qword [rsp + 0xf8]
mov rbx, qword [rsp + 0x100]
add rsp, 0xc0
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret