Function at 0x1000b99b0
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x890
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov rax, qword [0x10010f190]
xor rax, rsp
mov qword [rsp + 0x880], rax
lea r14, [r11 - 0x848]
mov qword [rsp + 0x58], r14
xor edi, edi
mov r15d, 0x200
mov r13, rdi
mov qword [rsp + 0x50], rdi
lea rax, [0x100028258]
cmp rcx, rdi
cmovne rax, rcx
mov qword [r11 + 8], rax
cmp di, word [rax]
jne 0x1000b9a28
mov dword [rsp + 0x44], edi
jmp 0x1000b9edf
cmp qword [0x10011beb0], rdi
jne 0x1000b9a8a
lea rcx, [0x100028268]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp rax, rdi
je 0x1000b9a5b
lea rdx, [0x100028280]
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x10011beb0], rax
jmp 0x1000b9a62
mov rax, qword [0x10011beb0]
cmp rax, rdi
jne 0x1000b9a8a
lea rcx, [0x100028290]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x100028280]
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x10011beb0], rax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rsi, rax
cmp rax, rdi
jne 0x1000b9ac0
or r12, 0xffffffffffffffff
mov rsi, r12
xor r9d, r9d
mov edx, 0x2ff01a1
mov r8d, 0x80004003
lea rcx, [0x1000282a8]
call fcn.1000b51b8
jmp 0x1000b9ac4
or r12, 0xffffffffffffffff
mov rax, qword [0x10011beb0]
cmp rax, rdi
je 0x1000b9ad8
cmp dword [0x10011bdf0], edi
je 0x1000b9adb
mov rsi, r12
mov ebx, edi
cmp rsi, r12
je 0x1000b9c16
lea r9, [rsp + 0x8d8]
mov r8, qword [rsp + 0x8d0]
mov rdx, r15
lea rcx, [rsp + 0x80]
call rax
mov ebx, eax
mov qword [rsp + 0x48], rdi
cmp eax, r12d
jne 0x1000b9bc6
mov ecx, 0x10000
cmp r15d, ecx
jae 0x1000b9baa
lea rax, [rsp + 0x80]
cmp r14, rax
je 0x1000b9b3c
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, 0x10000
lea eax, [r15 + r15]
cmp eax, ecx
cmova eax, ecx
mov r15d, eax
lea rdx, [rax + rax]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r14, rax
mov qword [rsp + 0x58], rax
cmp rax, rdi
je 0x1000b9b90
lea r9, [rsp + 0x8d8]
mov r8, qword [rsp + 0x8d0]
mov rdx, r15
mov rcx, rax
call qword [0x10011beb0]
mov ebx, eax
mov qword [rsp + 0x48], rdi
cmp eax, r12d
mov ecx, 0x10000
je 0x1000b9b18
jmp 0x1000b9bc6
xor r9d, r9d
mov edx, 0x32701a1
xor ecx, ecx
mov r8d, 0x8007000e
call fcn.1000b51b8
mov rsi, r12
jmp 0x1000b9bc6
xor r9d, r9d
mov edx, 0x31701a1
xor ecx, ecx
mov r8d, 0x8007006f
call fcn.1000b51b8
mov rsi, r12
mov eax, edi
jmp 0x1000b9c18
cmp rsi, r12
je 0x1000b9c12
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileType]
btr eax, 0xf
cmp eax, edi
je 0x1000b9bec
cmp eax, 2
je 0x1000b9be8
mov eax, 1
jmp 0x1000b9c18
mov eax, edi
jmp 0x1000b9c18
mov r8d, 0x8000ffff
mov r9d, r8d
mov edx, 0x34001a1
xor ecx, ecx
call fcn.1000b51b8
mov rsi, r12
mov dword [0x10011bdf0], 1
mov eax, edi
jmp 0x1000b9c18
mov eax, edi
jmp 0x1000b9c18
mov eax, ebx
mov dword [rsp + 0x44], edi
cmp rsi, r12
je 0x1000b9e02
cmp eax, edi
jne 0x1000b9c73
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x44]
mov r8d, ebx
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
cmp eax, edi
jne 0x1000b9df9
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov r9d, 0x80070006
mov r8d, eax
mov edx, 0x35201a1
xor ecx, ecx
call fcn.1000b51b8
mov rsi, r12
jmp 0x1000b9df9
lea eax, [rbx + rbx + 2]
cmp eax, 0x400
ja 0x1000b9c8d
lea r13, [rsp + 0x480]
mov qword [rsp + 0x50], r13
jmp 0x1000b9cbc
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r13, rax
mov qword [rsp + 0x50], rax
cmp rax, rdi
jne 0x1000b9cbc
xor r9d, r9d
mov edx, 0x36801a1
xor ecx, ecx
mov r8d, 0x8007000e
call fcn.1000b51b8
mov rsi, r12
cmp rsi, r12
je 0x1000b9e02
mov r15d, ebx
cmp ebx, edi
je 0x1000b9d52
call qword [sym.imp.KERNEL32.dll_GetACP]
mov ecx, eax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
lea eax, [rbx + rbx + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r13
mov r9d, ebx
mov r8, r14
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov r15d, eax
cmp eax, edi
jne 0x1000b9d55
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
xor r9d, r9d
mov r8d, eax
mov edx, 0x38401a1
xor ecx, ecx
call fcn.1000b51b8
call qword [sym.imp.KERNEL32.dll_GetACP]
xor r9d, r9d
mov r8d, eax
mov edx, 0x38501a1
mov rcx, r14
call fcn.1000b51b8
xor r9d, r9d
mov r8d, ebx
mov edx, 0x38601a1
lea rcx, [0x1000282d0]
call fcn.1000b51b8
mov rsi, r12
cmp rsi, r12
je 0x1000b9e02
mov dword [rsp + 0x44], ebx
mov dword [rsp + 0x40], edi
cmp r15d, edi
jbe 0x1000b9da7
mov rdi, r13
mov r12d, dword [rsp + 0x40]
cmp byte [rdi], 0xa
jne 0x1000b9d96
mov r8d, r15d
sub r8d, r12d
mov rdx, rdi
lea rcx, [rdi + 1]
call sub.msvcrt.dll_memmove
mov byte [rdi], reloc.WLDAP32.dll_Ordinal_13
inc rdi
inc r12d
inc r15d
inc r12d
inc rdi
cmp r12d, r15d
jb 0x1000b9d73
xor edi, edi
or r12, 0xffffffffffffffff
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x48]
mov r8d, r15d
mov rdx, r13
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, edi
jne 0x1000b9df9
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov ebx, eax
xor r9d, r9d
mov r8d, eax
mov edx, 0x3ab01a1
xor ecx, ecx
call fcn.1000b51b8
cmp ebx, 0x80070006
jne 0x1000b9df9
mov rsi, r12
mov dword [0x10011bdf0], 1
cmp rsi, r12
jne 0x1000b9edf
mov esi, edi
mov dword [rsp + 0x40], edi
call qword [sym.imp.msvcrt.dll___iob_func]
test byte [rax + 0x30], 1
je 0x1000b9e24
call qword [sym.imp.msvcrt.dll___iob_func]
lea rcx, [rax + 0x30]
call qword [sym.imp.msvcrt.dll_fflush]
call qword [sym.imp.msvcrt.dll___iob_func]
test byte [rax + 0x30], 1
je 0x1000b9e57
call qword [sym.imp.msvcrt.dll___iob_func]
lea rdx, [0x100027408]
lea rcx, [rax + 0x30]
call qword [sym.imp.msvcrt.dll_fprintf]
call qword [sym.imp.msvcrt.dll___iob_func]
lea rcx, [rax + 0x30]
call qword [sym.imp.msvcrt.dll_fflush]
lea r15, [rsp + 0x8d8]
mov r12d, edi
lea rcx, [0x10003bf30]
call qword [sym.imp.msvcrt.dll_void____cdecl___unsigned_int__struct__EXCEPTION_POINTERS____ptr64____cdecl__set_se_translator_void____cdecl___unsigned_int__struct__EXCEPTION_POINTERS____ptr64__]
mov rbx, rax
mov qword [rsp + 0x70], rax
call qword [sym.imp.msvcrt.dll___iob_func]
mov r8, r15
mov rdx, qword [rsp + 0x8d0]
lea rcx, [rax + 0x30]
call qword [sym.imp.msvcrt.dll_vfwprintf]
mov dword [rsp + 0x44], eax
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_void____cdecl___unsigned_int__struct__EXCEPTION_POINTERS____ptr64____cdecl__set_se_translator_void____cdecl___unsigned_int__struct__EXCEPTION_POINTERS____ptr64__]
nop
jmp 0x1000b9eb7
mov qword [rsp + 0x48], rdi
cmp r12d, edi
je 0x1000b9edf
cmp esi, edi
jne 0x1000b9edf
call qword [sym.imp.msvcrt.dll___iob_func]
test byte [rax + 0x30], 1
je 0x1000b9edf
mov esi, 1
mov dword [rsp + 0x40], esi
jmp 0x1000b9e08
cmp r14, rdi
je 0x1000b9efa
lea rax, [rsp + 0x80]
cmp rax, r14
je 0x1000b9efa
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp r13, rdi
je 0x1000b9f15
lea rax, [rsp + 0x480]
cmp rax, r13
je 0x1000b9f15
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x880]
xor rcx, rsp
call fcn.1000ef870
add rsp, 0x890
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret