Function at 0x1400418d0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1401b5030]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp byte [rcx + 0xb3d], 0
mov esi, r8d
mov edi, edx
mov rbx, rcx
je 0x140041b40
cmp byte [rcx + 0xb3e], 0
je 0x14004190a
call fcn.140041b60
mov rcx, qword [rbx + 0x38]
mov byte [rbx + 0xb3c], 1
cmp edi, dword [rcx + 0x16f8]
ja 0x140041b40
mov qword [rsp + 0x90], rbp
xor ebp, ebp
cmp esi, 2
jne 0x140041954
mov rcx, qword [rbx + 0xb18]
lea r9d, [rbp + 1]
xor r8d, r8d
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x140041a27
jmp 0x140041a1b
mov rdx, qword [rcx + 0x16f0]
mov r8d, edi
call fcn.140025ac0
test esi, esi
jne 0x140041972
mov byte [rbx + 0xb3c], bpl
xor cl, cl
jmp 0x140041979
movzx ecx, byte [rbx + 0xb3c]
mov eax, dword [rbx + 0xb58]
add eax, 0x400
mov dword [rsp + 0x30], eax
test cl, cl
je 0x1400419dd
mov rcx, qword [rbx + 0x38]
mov edx, eax
call fcn.140026af0
mov rax, qword [rbx + 0x38]
lea r9, [rsp + 0x38]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x38], edi
mov r8, qword [rax + 0x16f0]
mov rcx, qword [rax + 0x16e0]
call sym.AmazonVNCViewer.exe_uncompress2
test eax, eax
je 0x1400419c7
mov byte [rbx + 0xb3e], 1
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
movzx ecx, byte [rbx + 0xb3c]
mov eax, dword [rsp + 0x30]
mov rdx, qword [rbx + 0x38]
test cl, cl
je 0x1400419ee
mov rdx, qword [rdx + 0x16e0]
jmp 0x1400419f5
mov rdx, qword [rdx + 0x16f0]
test cl, cl
mov qword [rsp + 0x20], rbp
mov rcx, qword [rbx + 0xb18]
lea r9, [rbx + 0xb24]
mov r8d, edi
cmovne r8d, eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140041a22
mov byte [rbx + 0xb3e], 1
cmp esi, 2
jne 0x140041a2c
mov rax, rdi
jmp 0x140041a32
mov eax, dword [rbx + 0xb24]
add qword [rbx + 0xb28], rax
mov rcx, rbx
mov r8, qword [rbx + 0xb28]
mov eax, ebp
mov rdx, qword [rbx + 0x40]
cmp esi, 2
cmove eax, edi
inc dword [rbx + 0xb20]
add qword [rbx + 0xb30], rax
call fcn.140040a90
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call fcn.14003dd00
cmp dword [rbx + 0xb54], 1
jne 0x140041ad3
inc dword [rbx + 0xb38]
cmp dword [rbx + 0xb38], 0xa
jle 0x140041b07
mov byte [rbx + 0x4b], 1
mov dword [rsp + 0x40], 0x507
mov dword [rsp + 0x48], ebp
cmp byte [rbx + 0x48], bpl
jne 0x140041aae
mov dword [rsp + 0x44], ebp
cmp byte [rbx + 0xb3e], bpl
je 0x140041ab6
mov dword [rsp + 0x44], 0xffffffff
mov rcx, qword [rbx + 0x38]
lea rdx, [rsp + 0x40]
xor r9d, r9d
lea r8d, [r9 + 0xc]
call fcn.140026600
mov dword [rbx + 0xb38], ebp
jmp 0x140041b07
cmp byte [rbx + 0x48], bpl
je 0x140041b07
cmp byte [rbx + 0x4b], bpl
jne 0x140041b07
mov rcx, qword [rbx + 0x38]
lea rdx, [rsp + 0x40]
mov r9b, 7
mov byte [rbx + 0x4b], 1
mov r8d, InitCommonControls
mov qword [rsp + 0x40], 0x30707
mov dword [rsp + 0x48], ebp
call fcn.1400261c0
cmp dword [rbx + 0xb54], 1
jne 0x140041b34
mov rax, qword [rbx + 0x38]
cmp byte [rax + 0x4d60], bpl
je 0x140041b34
cmp byte [rax + 0x4d61], bpl
jne 0x140041b34
mov rcx, rbx
mov dword [rax + 0x4d54], ebp
call fcn.14003dd80
mov rbp, qword [rsp + 0x90]
mov al, 1
jmp 0x140041b42
xor al, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14011b0c0
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret