Function at 0x140001000
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov rax, qword [0x1400160c0]
xor rax, rbp
mov qword [rbp], rax
mov eax, dword [0x1400161e4]
mov ebx, dword [0x1400161e0]
lea edi, [rax - 1]
imul edi, eax
test dil, 1
sete byte [rbp - 1]
cmp ebx, 0xa
setl byte [rbp - 2]
mov dword [rbp - 0x14], r8d
mov qword [rbp - 0x38], rdx
mov qword [rbp - 0x40], rcx
mov eax, 0x21e02bae
mov r13, qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov r14, qword [sym.imp.ntoskrnl.exe_ZwWriteFile]
mov r15, qword [sym.imp.ntoskrnl.exe_ZwClose]
cmp eax, 0x19a56b5b
jle 0x1400010b3
cmp eax, 0x3fb01e77
jg 0x1400010de
cmp eax, 0x19a56b5c
je 0x140001155
cmp eax, 0x21e02bae
je 0x1400011d2
cmp eax, 0x238a1430
jne 0x14000106a
mov eax, dword [0x1400161e4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x1786187e
mov ecx, 0x9ac50d41
jmp 0x140001355
cmp eax, 0xad8da26b
jle 0x14000110d
cmp eax, 0xad8da26c
je 0x1400011f0
cmp eax, 0xc15c3aa8
je 0x14000120a
cmp eax, 0x1786187e
jne 0x14000106a
mov eax, 0x238a1430
jmp 0x14000106a
cmp eax, 0x3fb01e78
je 0x140001228
cmp eax, 0x5076a091
je 0x140001367
cmp eax, 0x7ef42f68
jne 0x14000106a
mov eax, 0x95e49b92
mov r12d, dword [rbp - 0x2c]
jmp 0x14000106a
cmp eax, 0x8eb05204
je 0x1400013cd
cmp eax, 0x95e49b92
jne 0x1400014b1
mov dword [rbp - 0x30], r12d
mov rax, qword [rbp - 0x60]
mov rax, qword [rbp - 0x58]
mov rax, qword [rbp - 0x50]
mov rax, qword [rbp - 0x48]
mov eax, dword [0x1400161e4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x1786187e
mov ecx, 0x238a1430
jmp 0x140001355
mov rax, qword [rbp - 0x28]
xor ebx, ebx
mov qword [rax], rbx
mov rax, qword [rbp - 0x10]
mov rcx, qword [rax]
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x28]
sub rsp, 0x50
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rdx
mov edx, dword [rbp - 0x14]
mov dword [rsp + 0x30], edx
mov rdx, qword [rbp - 0x38]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rax
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call r14
add rsp, 0x50
mov dword [rbp - 0x2c], eax
mov rax, qword [rbp - 0x10]
mov rcx, qword [rax]
sub rsp, 0x20
call r15
add rsp, 0x20
mov eax, dword [0x1400161e4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x5076a091
mov ecx, 0x7ef42f68
jmp 0x140001355
mov cl, byte [rbp - 1]
cmp byte [rbp - 2], 0
mov eax, 0x8eb05204
mov edx, 0x3fb01e78
cmovne eax, edx
test cl, cl
cmovne eax, edx
jmp 0x14000106a
cmp byte [rbp - 3], 0
mov eax, 0x95e49b92
mov ecx, 0xc15c3aa8
cmovne eax, ecx
mov r12d, dword [rbp - 0x18]
jmp 0x14000106a
mov eax, dword [0x1400161e4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x5076a091
mov ecx, 0x19a56b5c
jmp 0x140001355
mov eax, 0x10
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x10], rax
mov eax, 0x30
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rsi, rsp
mov eax, 0x10
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x20], rax
mov eax, 0x10
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rdi, rsp
mov eax, 0x10
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x10]
mov qword [rbp - 0x48], rax
mov rax, qword [rbp - 0x48]
mov rax, qword [rbp - 0x10]
xor ebx, ebx
mov qword [rax], rbx
mov qword [rbp - 0x50], rsi
mov rax, qword [rbp - 0x50]
mov rax, qword [rbp - 0x20]
mov qword [rbp - 0x58], rax
mov rax, qword [rbp - 0x58]
mov qword [rbp - 0x60], rdi
mov rax, qword [rbp - 0x60]
sub rsp, 0x20
mov rcx, rdi
mov rdx, qword [rbp - 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
add rsp, 0x20
mov dword [rsi], 0x30
mov qword [rsi + 8], rbx
mov dword [rsi + 0x18], 0x240
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x20], rbx
mov qword [rsi + 0x28], rbx
mov rcx, qword [rbp - 0x10]
mov r9, qword [rbp - 0x20]
sub rsp, 0x60
mov qword [rsp + 0x48], rbx
mov eax, 3
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x40], 0x20
mov dword [rsp + 0x28], 0x80
mov edx, 0x10000000
mov r8, rsi
call r13
add rsp, 0x60
mov dword [rbp - 0x18], eax
cmp dword [rbp - 0x18], 0
setns byte [rbp - 3]
mov eax, dword [0x1400161e4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x8eb05204
mov ecx, 0xad8da26c
cmove eax, ecx
cmp dword [0x1400161e0], 0xa
cmovl eax, ecx
jmp 0x14000106a
mov rax, qword [rbp - 0x28]
xor ebx, ebx
mov qword [rax], rbx
mov rax, qword [rbp - 0x10]
mov rcx, qword [rax]
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x28]
sub rsp, 0x50
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rdx
mov edx, dword [rbp - 0x14]
mov dword [rsp + 0x30], edx
mov rdx, qword [rbp - 0x38]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rax
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call r14
add rsp, 0x50
mov rax, qword [rbp - 0x10]
mov rcx, qword [rax]
sub rsp, 0x20
call r15
add rsp, 0x20
mov eax, 0x19a56b5c
jmp 0x14000106a
mov eax, 0x10
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rsi, rsp
mov eax, 0x30
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rdi, rsp
mov eax, 0x10
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov r14, r13
mov r13, rsp
mov eax, 0x10
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rbx, rsp
mov r15d, r12d
xor r12d, r12d
mov qword [rsi], r12
sub rsp, 0x20
mov rcx, rbx
mov rdx, qword [rbp - 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
add rsp, 0x20
mov dword [rdi], 0x30
mov qword [rdi + 8], r12
mov dword [rdi + 0x18], 0x240
mov qword [rdi + 0x10], rbx
mov eax, 3
mov qword [rdi + 0x20], r12
mov qword [rdi + 0x28], r12
sub rsp, 0x60
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x20], r12
mov r12d, r15d
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x40], 0x20
mov dword [rsp + 0x28], 0x80
mov rcx, rsi
mov edx, 0x10000000
mov r8, rdi
mov r9, r13
mov r13, r14
mov r14, qword [sym.imp.ntoskrnl.exe_ZwWriteFile]
mov r15, qword [sym.imp.ntoskrnl.exe_ZwClose]
call r13
add rsp, 0x60
mov eax, 0x3fb01e78
jmp 0x14000106a
cmp eax, 0x9ac50d41
jne 0x14000106a
mov esi, dword [rbp - 0x30]
mov rcx, qword [rbp]
xor rcx, rbp
sub rsp, 0x20
call fcn.140013f90
add rsp, 0x20
mov eax, esi
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret