Function at 0x140001ee8
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x1b8]
sub rsp, 0x2b0
mov rax, qword [0x140005010]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
xor eax, eax
mov dword [rbp + 0x60], 0x73366d30
mov qword [rbp + 0xca], rax
mov ebx, 1
mov dword [rbp + 0xd2], eax
xor edi, edi
mov dword [rbp + 0x64], 0x77017103
mov dword [rbp + 0x68], 0x7b1f7530
mov dword [rbp + 0x6c], 0x7f177902
lea esi, [rbx + 1]
mov dword [rbp + 0x70], 0x83e77d1b
mov dword [rbp + 0x74], 0x87da81f7
mov dword [rbp + 0x78], 0x8bb485c3
mov dword [rbp + 0x7c], 0x8fdb89d4
mov dword [rbp + 0x80], 0x93f78dfb
mov dword [rbp + 0x84], 0x97e191e6
mov dword [rbp + 0x88], 0x9bca95c8
mov dword [rbp + 0x8c], 0x9ff899ed
mov dword [rbp + 0x90], 0xa3cb9df0
mov dword [rbp + 0x94], 0xa7faa1c7
mov dword [rbp + 0x98], 0xab91a580
mov dword [rbp + 0x9c], 0xafe4a993
mov dword [rbp + 0xa0], 0xb3c0addf
mov dword [rbp + 0xa4], 0xb7f0b1c4
mov dword [rbp + 0xa8], 0xbbc9b5c7
mov dword [rbp + 0xac], 0xbff9b9cc
mov dword [rbp + 0xb0], 0xc3afbdcf
mov dword [rbp + 0xb4], 0xc7a7c1b0
mov dword [rbp + 0xb8], 0xcbabc5b6
mov dword [rbp + 0xbc], 0xcfbac9ba
mov dword [rbp + 0xc0], 0xd3b4cdfe
mov dword [rbp + 0xc4], 0xd7a2d1b1
mov word [rbp + 0xc8], 0xd5d4
mov qword [rsp + 0x60], rdi
mov rax, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x60]
mov ecx, 0x3f
mov rax, qword [rsp + 0x60]
sub dl, 0x12
mov r8b, byte [rbp + rax + 0x60]
mov al, dl
and al, r8b
sub cl, al
mov rax, qword [rsp + 0x60]
add cl, cl
add cl, dl
add cl, r8b
mov byte [rbp + rax + 0x60], cl
mov rax, qword [rsp + 0x60]
add rax, rbx
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
cmp rax, 0x76
jb 0x140002033
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x10]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rbp + 0x10]
mov dword [rbp + 0x30], 0x30
xorps xmm0, xmm0
mov qword [rbp + 0x40], rax
movdqu xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x38], rdi
mov dword [rbp + 0x48], 0x240
call qword [sym.imp.ntoskrnl.exe_KeGetCurrentIrql]
test al, al
je 0x1400020bd
mov eax, 0xc0000184
jmp 0x1400025bf
mov dword [rsp + 0x50], edi
lea r9, [rbp + 0x20]
mov qword [rsp + 0x48], rdi
lea r8, [rbp + 0x30]
mov dword [rsp + 0x40], 0x20
lea rcx, [rsp + 0x68]
mov dword [rsp + 0x38], edi
mov edx, 0x10000000
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
test eax, eax
js 0x1400025bf
mov eax, dword [0x140003b00]
movups xmm0, xmmword [0x140003af0]
mov ecx, dword [0x140005004]
mov dword [rbp + 0x100], eax
movzx eax, word [0x140003b04]
mov word [rbp + 0x104], ax
mov eax, dword [0x140003b20]
mov dword [rbp - 0x80], eax
movzx eax, word [0x140003b24]
mov word [rbp - 0x7c], ax
mov al, byte [0x140003b26]
mov byte [rbp - 0x7a], al
mov eax, dword [0x140003b40]
mov dword [rbp - 0x68], eax
movzx eax, word [0x140003b44]
mov word [rbp - 0x64], ax
mov al, byte [0x140003b46]
mov byte [rbp - 0x62], al
mov eax, dword [0x140003b60]
mov dword [rbp - 0x50], eax
mov al, byte [0x140003b64]
mov byte [rbp - 0x4c], al
mov eax, dword [0x140003b80]
mov dword [rbp - 0x38], eax
mov al, byte [0x140003b84]
mov byte [rbp - 0x34], al
mov eax, dword [0x140003ba0]
mov dword [rbp - 0x20], eax
mov al, byte [0x140003ba4]
mov byte [rbp - 0x1c], al
mov eax, dword [0x140003bd0]
mov dword [rbp + 8], eax
movzx eax, word [0x140003bd4]
mov word [rbp + 0xc], ax
mov al, byte [0x140003bd6]
mov byte [rbp + 0xe], al
movups xmm1, xmmword [0x140003bc0]
movups xmmword [rbp + 0xf0], xmm0
movups xmm0, xmmword [0x140003b10]
movups xmmword [rbp - 8], xmm1
movups xmmword [rsp + 0x70], xmm0
movups xmm0, xmmword [0x140003b30]
movups xmmword [rbp - 0x78], xmm0
movups xmm0, xmmword [0x140003b50]
movups xmmword [rbp - 0x60], xmm0
movups xmm0, xmmword [0x140003b70]
movups xmmword [rbp - 0x48], xmm0
movups xmm0, xmmword [0x140003b90]
movups xmmword [rbp - 0x30], xmm0
movups xmm0, xmmword [0x140003bb0]
movups xmmword [rbp - 0x18], xmm0
test ecx, ecx
je 0x140002459
lea r10, [0x140005090]
mov r14d, 6
mov r11d, 0x80000001
cmp ecx, ebx
jne 0x140002247
mov dword [0x140005088], edi
mov ecx, esi
mov dword [0x14000508c], edi
mov dword [0x14000ecd0], edi
mov dword [0x140005004], ecx
jmp 0x140002227
cmp ecx, esi
jne 0x140002261
mov eax, dword [section..data]
mov ecx, edi
cmp dword [0x140005088], eax
setle cl
add ecx, 3
jmp 0x14000223f
cmp ecx, 3
jne 0x14000229d
mov r8d, dword [0x14000ecd0]
mov eax, 0x51eb851f
add r8d, dword [0x140005088]
mov ecx, 0xc
add r8d, r8d
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x64
sub r8d, eax
mov dword [0x14000ecd0], r8d
jmp 0x14000223f
cmp ecx, 4
jne 0x1400022b8
mov eax, dword [0x140005088]
mov ecx, edi
cmp dword [0x14000508c], eax
setl cl
add ecx, 5
jmp 0x14000223f
cmp ecx, 5
jne 0x1400022e1
movsxd rcx, dword [0x140005088]
mov edx, dword [0x14000ecd0]
add edx, ecx
imul rcx, rcx, 0x194
mov dword [rcx + r10], edx
mov ecx, 9
jmp 0x14000223f
cmp ecx, r14d
jne 0x140002304
mov eax, dword [0x14000508c]
and eax, r11d
jge 0x1400022f8
sub eax, ebx
or eax, 0xfffffffe
add eax, ebx
neg eax
sbb ecx, ecx
add ecx, 8
jmp 0x14000223f
cmp ecx, 7
jne 0x14000233a
movsxd rax, dword [0x140005088]
movsxd rdx, dword [0x14000508c]
mov r8d, eax
sub r8d, edx
imul r8d, dword [0x14000ecd0]
imul rcx, rax, 0x64
add rcx, rdx
mov dword [r10 + rcx*4], r8d
mov ecx, 8
jmp 0x14000223f
cmp ecx, 8
jne 0x140002367
mov eax, dword [0x14000508c]
mov ecx, 4
add eax, ebx
add dword [0x14000ecd0], eax
cmp eax, dword [0x140005088]
mov dword [0x14000508c], eax
cmovl ecx, r14d
jmp 0x14000244b
cmp ecx, 9
jne 0x1400023b3
mov r9d, dword [0x14000ecd0]
mov ecx, r9d
and ecx, r11d
jge 0x140002382
sub ecx, ebx
or ecx, 0xfffffffe
add ecx, ebx
movsxd rdx, dword [0x140005088]
mov eax, r9d
imul r8, rdx, 0x194
test ecx, ecx
lea ecx, [rdx + 1]
cdq
jne 0x1400023a3
idiv ecx
add dword [r8 + r10], eax
jmp 0x1400023a9
idiv ecx
sub dword [r8 + r10], eax
mov ecx, 0xa
jmp 0x14000223f
cmp ecx, 0xa
jne 0x1400023dc
mov eax, dword [0x140005088]
mov ecx, 0xb
add eax, ebx
add dword [0x14000ecd0], eax
cmp eax, dword [section..data]
mov dword [0x140005088], eax
cmovle ecx, esi
jmp 0x14000244b
cmp ecx, 0xb
jne 0x140002410
mov edx, dword [0x14000508c]
add edx, dword [0x140005088]
imul edx, dword [0x14000ecd0]
movsxd rax, dword [section..data]
imul rcx, rax, 0x194
mov dword [rcx + r10], edx
mov ecx, 3
jmp 0x14000223f
cmp ecx, 0xc
jne 0x140002444
movsxd rax, dword [0x140005088]
movsxd rdx, dword [0x14000508c]
imul rcx, rax, 0x64
lea r8d, [rdx + rax]
imul r8d, dword [0x14000ecd0]
add rcx, rdx
mov dword [r10 + rcx*4], r8d
mov ecx, 0xd
jmp 0x14000223f
cmp ecx, 0xd
jne 0x140002451
mov ecx, edi
mov dword [0x140005004], ecx
test ecx, ecx
jne 0x140002227
mov rcx, rdi
mov al, byte [rbp + rcx + 0xf0]
mov byte [rbp + rcx + 0x60], al
add rcx, rbx
test al, al
jne 0x14000245c
lea rcx, [rbp + 0x60]
sub rcx, rbx
add rcx, rbx
cmp byte [rcx], dil
jne 0x140002475
lea r8, [rsp + 0x70]
xor edx, edx
mov al, byte [r8 + rdx]
mov byte [rcx + rdx], al
inc rdx
test al, al
jne 0x140002484
lea rcx, [rbp + 0x60]
sub rcx, rbx
add rcx, rbx
cmp byte [rcx], dil
jne 0x140002499
lea r8, [rbp - 0x78]
xor edx, edx
mov al, byte [r8 + rdx]
mov byte [rcx + rdx], al
inc rdx
test al, al
jne 0x1400024a7
lea rcx, [rbp + 0x60]
sub rcx, rbx
add rcx, rbx
cmp byte [rcx], dil
jne 0x1400024bc
lea r8, [rbp - 0x60]
xor edx, edx
mov al, byte [r8 + rdx]
mov byte [rcx + rdx], al
inc rdx
test al, al
jne 0x1400024ca
lea rcx, [rbp + 0x60]
sub rcx, rbx
add rcx, rbx
cmp byte [rcx], dil
jne 0x1400024df
lea r8, [rbp - 0x48]
xor edx, edx
mov al, byte [r8 + rdx]
mov byte [rcx + rdx], al
inc rdx
test al, al
jne 0x1400024ed
lea rcx, [rbp + 0x60]
sub rcx, rbx
add rcx, rbx
cmp byte [rcx], dil
jne 0x140002502
lea r8, [rbp - 0x30]
xor edx, edx
mov al, byte [r8 + rdx]
mov byte [rcx + rdx], al
inc rdx
test al, al
jne 0x140002510
lea rcx, [rbp + 0x60]
sub rcx, rbx
add rcx, rbx
cmp byte [rcx], dil
jne 0x140002525
lea r8, [rbp - 0x18]
xor edx, edx
mov al, byte [r8 + rdx]
mov byte [rcx + rdx], al
inc rdx
test al, al
jne 0x140002533
mov ebx, 0x84
lea rcx, [rbp + 0x110]
mov r8d, ebx
xor edx, edx
call fcn.140003640
mov r8d, ebx
lea rdx, [rbp + 0x110]
lea rcx, [rbp + 0x60]
call fcn.140001e50
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rdi
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
lea rax, [rbp + 0x110]
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rax
xor edx, edx
lea rax, [rbp + 0x20]
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwWriteFile]
mov ebx, eax
test eax, eax
js 0x1400025b2
mov ebx, edi
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.1400035b0
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret