Function at 0x140004330
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
movaps xmm0, xmmword [rdx]
mov rdi, rcx
mov rax, qword [0x1400b6968]
movaps xmmword [rsp + 0x30], xmm0
psrldq xmm0, 8
movq rbx, xmm0
mov qword [rsp + 0x60], rbx
test rax, rax
jne 0x140004382
xor r8d, r8d
lea ecx, [rax + 1]
mov edx, 0x100000
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov qword [0x1400b6968], rax
lea r8, [rbx + 1]
xor edx, edx
mov qword [rsp + 0x58], r8
mov rcx, rax
add r8, r8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r9, qword [rsp + 0x30]
lea rdx, [rbx*2 + 2]
xor ebp, ebp
mov qword [rsp + 0x68], rax
mov rsi, rax
cmp rax, r9
je 0x140004421
test rdx, rdx
je 0x140004421
mov r8, rdx
mov r11d, ebp
shr r8, 3
test r8, r8
je 0x1400043f1
mov r10, r9
mov rcx, rax
sub r10, rax
mov r11, r8
nop word [rax + rax]
mov rax, qword [r10 + rcx]
mov qword [rcx], rax
lea rcx, [rcx + 8]
sub r8, 1
jne 0x1400043e0
lea rax, [r11*8]
cmp rax, rdx
jae 0x140004421
sub r9, rsi
lea rcx, [rsi + rax]
sub rdx, rax
nop dword [rax + rax]
movzx eax, byte [rcx + r9]
mov byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x140004410
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x40]
call fcn.140010cd0
cmp byte [rdi + 0x40], bpl
je 0x140004448
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140011540
jmp 0x14000458c
mov r11, qword [rsp + 0x48]
mov r10, qword [rsp + 0x50]
test r11, r11
jne 0x14000445c
mov rbx, rbp
jmp 0x1400044c8
lea r8, [r10 - 1]
add r8, r11
lea rax, [r10 - 1]
cmp r11, 2
jbe 0x140004485
cmp byte [r10], 0xef
jne 0x140004485
cmp byte [r10 + 1], 0xbb
jne 0x140004485
cmp byte [r10 + 2], 0xbf
jne 0x140004485
add rax, 3
mov rbx, rbp
cmp rax, r8
je 0x1400044c8
nop dword [rax]
movzx ecx, byte [rax + 1]
inc rax
inc rbx
cmp cl, 0x7f
jbe 0x1400044c3
mov edx, ecx
and edx, 0xf0
sub edx, 0xe0
je 0x1400044bf
cmp edx, 0x10
je 0x1400044b9
inc rax
jmp 0x1400044c3
add rax, 3
jmp 0x1400044c3
add rax, 2
cmp rax, r8
jne 0x140004490
mov rax, qword [rdi + 0x18]
cmp rax, 1
jne 0x1400044fa
mov rcx, qword [rdi]
lea r9, [0x1400b6970]
mov r8d, r11d
mov qword [rsp + 0x20], rbp
mov rdx, r10
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, rbx
mov rcx, rdi
call fcn.140004a30
jmp 0x140004570
mov rcx, rdi
test rax, rax
jne 0x14000452b
mov rdx, rbx
call fcn.140004a30
mov r8d, dword [rsp + 0x48]
lea r9, [0x1400b6970]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rdi]
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x140004570
mov rbx, qword [rdi + 0x10]
xor r8d, r8d
shr rbx, 1
mov rdx, rbx
call fcn.140004c50
mov r8d, dword [rsp + 0x48]
lea r9, [0x1400b6970]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rdi]
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [rdi + 0x10]
mov r8b, 1
and edx, 1
mov rcx, rdi
add rdx, rbx
call fcn.140004c50
cmp dword [rdi + 0x4c], ebp
je 0x14000458c
movzx edx, word [0x1400b6a08]
mov rcx, qword [rdi]
mov word [rdi + 0x42], dx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dword [rdi + 0x4c], ebp
mov r8, qword [rsp + 0x50]
xor edx, edx
mov rcx, qword [0x1400b6960]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x1400b6968]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea r11, [rsp + 0x70]
mov rax, rdi
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret