Function at 0x14004e270
Capabilities:
Write file on windows

Disassembly:
push rdi
push r14
sub rsp, 0x38
lea r14, [0x14013fbf0]
mov rdi, rcx
mov rdx, r14
call fcn.140024c30
mov edx, eax
shr edx, 0x1f
test dl, dl
jne 0x14004e655
mov rax, qword [rdi + 0x20]
lea rcx, [rdi + 0x28]
mov qword [rsp + 0x60], rbp
mov edx, 2
mov qword [rsp + 0x30], rsi
cmp dword [rax + 0x40], 1
sete al
mov byte [rdi + 0x2b0], al
call fcn.140025da0
xor ebp, ebp
mov qword [rsp + 0x50], rbx
mov edx, ebp
lea r9, [0x14013fc10]
mov r8, rax
movzx ecx, word [r8 + rdx*2]
cmp cx, word [r9 + rdx*2]
jne 0x14004e302
movzx eax, word [r8 + rdx*2 + 2]
cmp ax, word [r9 + rdx*2 + 2]
jne 0x14004e302
add rdx, 2
cmp rdx, 0x10
jne 0x14004e2d3
mov dword [rdi + 0x2b4], ebp
jmp 0x14004e57f
mov edx, 2
lea rcx, [rdi + 0x28]
call fcn.140025da0
lea r8, [0x14013fc30]
mov rdx, rbp
nop word [rax + rax]
movzx ecx, word [rax + rdx*2]
cmp cx, word [r8 + rdx*2]
jne 0x14004e351
movzx ecx, word [rax + rdx*2 + 2]
cmp cx, word [r8 + rdx*2 + 2]
jne 0x14004e351
add rdx, 2
cmp rdx, 0x10
jne 0x14004e320
mov dword [rdi + 0x2b4], 1
jmp 0x14004e57f
mov edx, 2
lea rcx, [rdi + 0x28]
call fcn.140025da0
mov rbx, 0xffffffffffffffff
lea r9, [0x14013fc50]
mov rdx, rbx
mov r8, rax
nop dword [rax]
nop word [rax + rax]
movzx ecx, word [r8 + rdx*2 + 2]
cmp cx, word [r9 + rdx*2 + 2]
jne 0x14004e3a8
add rdx, 2
cmp rdx, 0xf
je 0x14004e481
movzx eax, word [r8 + rdx*2]
cmp ax, word [r9 + rdx*2]
je 0x14004e380
mov edx, 2
lea rcx, [rdi + 0x28]
call fcn.140025da0
mov r8, rax
lea r9, [0x14013fc70]
mov rdx, rbx
nop dword [rax]
nop word [rax + rax]
movzx ecx, word [r8 + rdx*2 + 2]
cmp cx, word [r9 + rdx*2 + 2]
jne 0x14004e3f8
add rdx, 2
cmp rdx, 0xf
je 0x14004e490
movzx eax, word [r8 + rdx*2]
cmp ax, word [r9 + rdx*2]
je 0x14004e3d0
mov edx, 2
lea rcx, [rdi + 0x28]
call fcn.140025da0
mov rdx, rax
lea r8, [0x14013fc90]
movzx ecx, word [rdx + rbx*2 + 2]
cmp cx, word [r8 + rbx*2 + 2]
jne 0x14004e432
add rbx, 2
cmp rbx, 0xf
je 0x14004e49f
movzx eax, word [rdx + rbx*2]
cmp ax, word [r8 + rbx*2]
je 0x14004e410
mov edx, 2
lea rcx, [rdi + 0x28]
call fcn.140025da0
lea r8, [0x14013fcb0]
mov rdx, rbp
nop word [rax + rax]
movzx ecx, word [rax + rdx*2]
cmp cx, word [r8 + rdx*2]
jne 0x14004e4ae
movzx ecx, word [rax + rdx*2 + 2]
cmp cx, word [r8 + rdx*2 + 2]
jne 0x14004e4ae
add rdx, 2
cmp rdx, 0x10
jne 0x14004e450
mov dword [rdi + 0x2b4], 5
jmp 0x14004e57f
mov dword [rdi + 0x2b4], 2
jmp 0x14004e57f
mov dword [rdi + 0x2b4], 3
jmp 0x14004e57f
mov dword [rdi + 0x2b4], 4
jmp 0x14004e57f
mov edx, 2
lea rcx, [rdi + 0x28]
call fcn.140025da0
lea r8, [0x14013fcd0]
mov rdx, rbp
nop word [rax + rax]
movzx ecx, word [rax + rdx*2]
cmp cx, word [r8 + rdx*2]
jne 0x14004e501
movzx ecx, word [rax + rdx*2 + 2]
cmp cx, word [r8 + rdx*2 + 2]
jne 0x14004e501
add rdx, 2
cmp rdx, 0x10
jne 0x14004e4d0
mov dword [rdi + 0x2b4], 6
jmp 0x14004e57f
mov edx, 2
lea rcx, [rdi + 0x28]
call fcn.140025da0
mov rdx, rbp
movzx ecx, word [rax + rdx*2]
cmp cx, word [r14 + rdx*2]
jne 0x14004e540
movzx ecx, word [rax + rdx*2 + 2]
cmp cx, word [r14 + rdx*2 + 2]
jne 0x14004e540
add rdx, 2
cmp rdx, 0x10
jne 0x14004e512
mov dword [rdi + 0x2b4], 7
jmp 0x14004e57f
mov edx, 2
lea rcx, [rdi + 0x28]
call fcn.140025da0
mov rdx, rbp
lea r8, str.AMR_DTX
nop dword [rax + rax]
movzx ecx, word [rax + rdx*2]
inc rdx
cmp cx, word [r8 + rdx*2 - 2]
jne 0x14004e641
cmp rdx, 8
jne 0x14004e560
mov dword [rdi + 0x2b4], edx
mov edx, ebp
mov dword [rdi + 0x538], ebp
cmp byte [rdi + 0x2b0], dl
lea rcx, [rdi + 0x298]
setne dl
call fcn.14002d100
mov ecx, eax
shr ecx, 0x1f
test cl, cl
jne 0x14004e646
cmp dword [rdi + 0x260], 0x1f40
mov rbx, rbp
je 0x14004e5f2
mov ecx, 0x178
call fcn.1400b6058
test rax, rax
je 0x14004e5dd
mov edx, 0x1f40
mov r8d, 5
mov rcx, rax
call fcn.14002a530
mov rbx, rax
mov rdx, rbx
mov rcx, rdi
call fcn.140025eb0
mov dword [rdi + 0x260], 0x1f40
cmp byte [rdi + 0x2b0], bpl
jne 0x14004e620
mov rcx, qword [rdi + 0x38]
lea r9, [rsp + 0x58]
mov r8d, 6
mov dword [rsp + 0x58], ebp
lea rdx, [0x14013fa30]
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call fcn.1400246e0
mov edi, eax
test rbx, rbx
je 0x14004e63d
mov r8, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [r8]
mov eax, edi
jmp 0x14004e646
mov eax, 0x8004020b
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x30]
add rsp, 0x38
pop r14
pop rdi
ret