Function at 0x140002b70
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov r12, rdx
mov rdi, rcx
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov ecx, 0x14b4c4b8
mov r14, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r15, qword [sym.imp.KERNEL32.dll_CreateFileW]
lea r13, [rsp + 0x6c]
jmp 0x140002bc6
mov ecx, 0x9ed938f6
nop word cs:[rax + rax]
nop
cmp eax, 0xa
cmovl ecx, edx
cmp ecx, 0xfa83644
jg 0x140002c20
cmp ecx, 0xb05d5f3e
jg 0x140002c90
cmp ecx, 0x92ac9057
jg 0x140002d1f
cmp ecx, 0x8dc71ede
jle 0x140002e08
cmp ecx, 0x8dc71edf
je 0x140002fee
cmp ecx, 0x92161f79
jne 0x140003207
mov ecx, 0x255e67cd
xor ebx, ebx
jmp 0x140002bc6
cmp ecx, 0x2e809d04
jg 0x140002ce0
cmp ecx, 0x244f5cd6
jg 0x140002d77
cmp ecx, 0x196be5c1
jg 0x140002e32
cmp ecx, 0xfa83645
je 0x140003010
cmp ecx, 0x14b4c4b8
jne 0x140002bc6
mov ecx, dword [0x140038af8]
mov eax, dword [0x140038afc]
lea esi, [rcx - 1]
imul esi, ecx
mov edx, 0x5f9b1d33
mov ecx, 0x5f9b1d33
test sil, 1
je 0x140002bc0
jmp 0x140002baf
cmp ecx, 0xbb083c
jg 0x140002dac
cmp ecx, 0xc94814a0
jg 0x140002e81
cmp ecx, 0xb05d5f3f
je 0x140003038
cmp ecx, 0xc7b87ca5
jne 0x140002bc6
cmp byte [rsp + 0x3f], 0
mov ecx, 0x84cb63a7
jne 0x140002bc6
mov ecx, 0x80c8e29c
jmp 0x140002bc6
cmp ecx, 0x50e33f80
jg 0x140002dda
cmp ecx, 0x35ea72cb
jg 0x140002ea8
cmp ecx, 0x2e809d05
je 0x140003073
cmp ecx, 0x351a5ec8
jne 0x140002bc6
mov ecx, 0x255e67cd
mov ebx, 1
jmp 0x140002bc6
cmp ecx, 0xa7c5b55b
jg 0x140002ed7
cmp ecx, 0x92ac9058
je 0x1400030a3
cmp ecx, 0x9ed938f6
jne 0x140002bc6
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
mov rcx, r12
mov edx, 0x40000000
xor r8d, r8d
xor r9d, r9d
call r15
mov ecx, 0x5f9b1d33
jmp 0x140002bc6
cmp ecx, 0x2906ca9f
jg 0x140002ef9
cmp ecx, 0x244f5cd7
je 0x1400030ad
cmp ecx, 0x255e67cd
jne 0x140002bc6
mov rax, qword [rsp + 0x60]
mov ecx, 0x2906caa0
mov ebp, ebx
jmp 0x140002bc6
cmp ecx, 0xc0b5b8f
jg 0x140002f3c
cmp ecx, 0xbb083d
je 0x1400030dd
cmp ecx, 0x64c9487
jne 0x140002bc6
mov ecx, 0x35ea72cc
jmp 0x140002bc6
cmp ecx, 0x5bc794e2
jg 0x140002f6e
cmp ecx, 0x50e33f81
je 0x1400030e7
cmp ecx, 0x5130e244
jne 0x140002bc6
mov ecx, 0xfa83645
jmp 0x140002bc6
cmp ecx, 0x80c8e29c
je 0x140003117
cmp ecx, 0x84cb63a7
jne 0x140002bc6
mov rcx, qword [rsp + 0x40]
call r14
mov ecx, 0x92161f79
jmp 0x140002bc6
cmp ecx, 0x196be5c2
je 0x140003129
cmp ecx, 0x1bb37116
jne 0x140002bc6
mov rdx, qword [rdi + 8]
mov rcx, qword [rsp + 0x40]
mov r8d, dword [rsp + 0x50]
mov qword [rsp + 0x20], 0
mov r9, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0x84cb63a7
test eax, eax
je 0x140002bc6
mov ecx, 0x244f5cd7
jmp 0x140002bc6
cmp ecx, 0xc94814a1
je 0x140003133
cmp ecx, 0xeebde171
jne 0x140002bc6
mov rax, qword [rsp + 0x48]
mov ecx, 0xb05d5f3f
jmp 0x140002bc6
cmp ecx, 0x35ea72cc
je 0x14000313f
cmp ecx, 0x38d67f2a
jne 0x140002bc6
mov eax, dword [rsp + 0x54]
cmp eax, dword [rsp + 0x58]
setne byte [rsp + 0x3f]
mov ecx, 0xc7b87ca5
jmp 0x140002bc6
cmp ecx, 0xa7c5b55c
je 0x140003167
cmp ecx, 0xa9e820b7
jne 0x140002bc6
mov ecx, 0x8dc71edf
jmp 0x140002bc6
cmp ecx, 0x2906caa0
je 0x140003171
cmp ecx, 0x294d6b5a
jne 0x140002bc6
mov ecx, dword [0x140038af8]
mov eax, dword [0x140038afc]
lea esi, [rcx - 1]
imul esi, ecx
mov edx, 0x50e33f81
mov ecx, 0x50e33f81
test sil, 1
je 0x140002bc0
jmp 0x14000310d
cmp ecx, 0xc0b5b90
je 0x1400031a5
cmp ecx, 0xe73576b
jne 0x140002bc6
cmp byte [rsp + 0x3e], 0
mov ecx, 0x294d6b5a
jne 0x140002bc6
mov ecx, 0xc0b5b90
jmp 0x140002bc6
cmp ecx, 0x5bc794e3
je 0x1400031cd
cmp ecx, 0x5f9b1d33
jne 0x140002bc6
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
mov rcx, r12
mov edx, 0x40000000
xor r8d, r8d
xor r9d, r9d
call r15
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
cmp rax, 0xffffffffffffffff
sete byte [rsp + 0x3e]
mov ecx, dword [0x140038af8]
mov eax, dword [0x140038afc]
lea esi, [rcx - 1]
imul esi, ecx
mov edx, 0x196be5c2
mov ecx, 0x196be5c2
test sil, 1
je 0x140002bc0
jmp 0x140002baf
mov dword [rsp + 0x6c], 0
mov qword [rsp + 0x48], rdi
mov rax, qword [rsp + 0x48]
mov eax, dword [rax]
mov dword [rsp + 0x50], eax
mov ecx, 0x1bb37116
jmp 0x140002bc6
mov ecx, dword [0x140038af8]
mov eax, dword [0x140038afc]
lea esi, [rcx - 1]
imul esi, ecx
mov edx, 0x351a5ec8
mov ecx, 0x351a5ec8
test sil, 1
je 0x140002bc0
jmp 0x140003099
mov eax, dword [rsp + 0x6c]
mov dword [rsp + 0x54], eax
mov rax, qword [rsp + 0x48]
mov eax, dword [rax]
mov dword [rsp + 0x58], eax
mov ecx, dword [0x140038af8]
mov eax, dword [0x140038afc]
lea esi, [rcx - 1]
imul esi, ecx
mov edx, 0xa7c5b55c
mov ecx, 0xa7c5b55c
test sil, 1
je 0x140002bc0
jmp 0x1400030d3
mov ecx, dword [0x140038af8]
mov eax, dword [0x140038afc]
lea esi, [rcx - 1]
imul esi, ecx
mov edx, 0xfa83645
mov ecx, 0xfa83645
test sil, 1
je 0x140002bc0
mov ecx, 0x5130e244
jmp 0x140002bc0
mov ecx, 0x50e33f81
jmp 0x140002bc6
mov ecx, dword [0x140038af8]
mov eax, dword [0x140038afc]
lea esi, [rcx - 1]
imul esi, ecx
mov edx, 0xb05d5f3f
mov ecx, 0xb05d5f3f
test sil, 1
je 0x140002bc0
mov ecx, 0xeebde171
jmp 0x140002bc0
mov ecx, 0x5bc794e3
jmp 0x140002bc6
mov ecx, dword [0x140038af8]
mov eax, dword [0x140038afc]
lea esi, [rcx - 1]
imul esi, ecx
mov edx, 0xc94814a1
mov ecx, 0xc94814a1
test sil, 1
je 0x140002bc0
mov ecx, 0x92ac9058
jmp 0x140002bc0
mov rcx, qword [rsp + 0x40]
call r14
mov ecx, 0x2e809d05
jmp 0x140002bc6
mov ecx, 0xe73576b
jmp 0x140002bc6
mov ecx, 0x2906caa0
xor ebp, ebp
jmp 0x140002bc6
mov ecx, dword [0x140038af8]
mov eax, dword [0x140038afc]
lea esi, [rcx - 1]
imul esi, ecx
mov edx, 0x8f6b4bdf
mov ecx, 0x8f6b4bdf
test sil, 1
je 0x140002bc0
jmp 0x14000319b
mov ecx, 0x38d67f2a
jmp 0x140002bc6
mov dword [rsp + 0x5c], ebp
mov ecx, dword [0x140038af8]
mov eax, dword [0x140038afc]
lea esi, [rcx - 1]
imul esi, ecx
mov edx, 0x35ea72cc
mov ecx, 0x35ea72cc
test sil, 1
je 0x140002bc0
mov ecx, 0x64c9487
jmp 0x140002bc0
mov ecx, dword [0x140038af8]
mov eax, dword [0x140038afc]
lea esi, [rcx - 1]
imul esi, ecx
mov edx, 0x5bc794e3
mov ecx, 0x5bc794e3
test sil, 1
je 0x140002bc0
jmp 0x1400031fd
mov qword [rsp + 0x60], r13
mov rax, qword [rsp + 0x60]
mov ecx, dword [0x140038af8]
mov eax, dword [0x140038afc]
lea esi, [rcx - 1]
imul esi, ecx
mov edx, 0xa9e820b7
mov ecx, 0xa9e820b7
test sil, 1
je 0x140002bc0
mov ecx, 0xbb083d
jmp 0x140002bc0
cmp ecx, 0x8f6b4bdf
jne 0x140002bc6
mov esi, dword [rsp + 0x5c]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140009010
mov eax, esi
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret