Function at 0x140019780
Capabilities:
Write file on windows

Disassembly:
push rdi
push r14
sub rsp, 0x6c8
mov rax, qword [0x1400ab2b8]
xor rax, rsp
mov qword [rsp + 0x6b0], rax
cmp dword [rcx + 8], 0xffffffff
mov r14, r8
mov rdi, rcx
je 0x1400197b1
mov rcx, qword [rcx]
call fcn.140018da0
mov rcx, qword [rdi]
mov dword [rdi + 8], 0xffffffff
cmp dword [rcx + 8], 0
jg 0x1400197cb
mov eax, 0x10000
jmp 0x140019a00
cmp dword [rcx + 0x14], 0
mov qword [rsp + 0x6c0], rsi
jle 0x1400197de
call fcn.140018590
mov rax, qword [rdi]
xor esi, esi
mov qword [rsp + 0x6e8], rbx
cmp dword [rax + 0x14], esi
jge 0x140019844
mov rbx, qword [rdi]
test rbx, rbx
je 0x14001983c
cmp dword [rbx + 0x1c], esi
je 0x14001983c
mov edx, dword [rbx + 0x14]
inc edx
cmp edx, dword [rbx + 8]
je 0x14001983c
mov ecx, dword [rbx + 0x54]
lea r8, [rbx + 0x7c]
add ecx, dword [rbx + 0x50]
xor r9d, r9d
mov eax, dword [rbx + 0x4c]
add eax, 0x2e
mov dword [rbx + 0x14], edx
add ecx, eax
mov dword [rsp + 0x20], esi
add dword [rbx + 0x18], ecx
lea rdx, [rbx + 0x2c]
mov rcx, rbx
call fcn.140018310
mov ecx, esi
test eax, eax
sete cl
mov dword [rbx + 0x1c], ecx
mov rax, qword [rdi]
cmp dword [rax + 0x14], esi
jl 0x1400197f0
lea r8, [rsp + 0x60]
xor edx, edx
mov rcx, rdi
call fcn.140018fe0
test byte [rsp + 0x26c], 0x10
movzx eax, word [r14]
je 0x1400198a1
cmp ax, 0x2f
je 0x140019890
cmp ax, 0x5c
je 0x140019890
test ax, ax
je 0x14001987a
cmp word [r14 + 2], 0x3a
je 0x140019890
lea rcx, [rdi + 0x250]
mov rdx, r14
call fcn.140019610
xor eax, eax
jmp 0x1400199f0
xor ecx, ecx
mov rdx, r14
call fcn.140019610
xor eax, eax
jmp 0x1400199f0
mov r9, r14
mov rcx, r14
test ax, ax
je 0x1400198cd
nop dword [rax]
cmp ax, 0x2f
je 0x1400198bc
cmp ax, 0x5c
jne 0x1400198c0
lea r9, [rcx + 2]
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x1400198b0
lea rdx, [rsp + 0x290]
mov rcx, r14
sub rdx, r14
nop dword [rax + rax]
movzx eax, word [rcx]
mov word [rdx + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x1400198e0
cmp r9, r14
jne 0x1400198ff
mov word [rsp + 0x290], si
jmp 0x140019943
mov rax, r9
sub rax, r14
sar rax, 1
add rax, rax
cmp rax, 0x208
jae 0x140019af1
mov word [rsp + rax + 0x290], si
movzx eax, word [rsp + 0x290]
cmp ax, 0x2f
je 0x140019975
cmp ax, 0x5c
je 0x140019975
test ax, ax
je 0x140019943
cmp word [rsp + 0x292], 0x3a
je 0x140019975
mov qword [rsp + 0x20], r9
lea r8, [rdi + 0x250]
lea r9, [rsp + 0x290]
lea rdx, str._s_s_s
lea rcx, [rsp + 0x4a0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rdi + 0x250]
jmp 0x140019994
lea r8, [rsp + 0x290]
lea rdx, str._s_s
lea rcx, [rsp + 0x4a0]
call qword [sym.imp.USER32.dll_wsprintfW]
xor ecx, ecx
lea rdx, [rsp + 0x290]
call fcn.140019610
mov eax, dword [rsp + 0x26c]
lea rcx, [rsp + 0x4a0]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
mov qword [rsp + 0x6f8], rbp
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x140019a1b
mov eax, 0x200
mov rbp, qword [rsp + 0x6f8]
mov rbx, qword [rsp + 0x6e8]
mov rsi, qword [rsp + 0x6c0]
mov rcx, qword [rsp + 0x6b0]
xor rcx, rsp
call fcn.140034240
add rsp, 0x6c8
pop r14
pop rdi
ret
mov rdx, qword [rdi + 0x240]
mov rcx, qword [rdi]
call fcn.140018830
cmp qword [rdi + 0x248], rsi
jne 0x140019a50
mov ecx, 0x4000
call fcn.1400348c0
mov qword [rdi + 0x248], rax
nop dword [rax]
nop dword [rax + rax]
mov rdx, qword [rdi + 0x248]
lea r9, [rsp + 0x50]
mov rcx, qword [rdi]
mov r8d, 0x4000
call fcn.140018a50
mov ebx, eax
cmp eax, 0xffffff96
je 0x140019ad4
test eax, eax
js 0x140019aa3
jle 0x140019a98
mov rdx, qword [rdi + 0x248]
lea r9, [rsp + 0x54]
mov r8d, eax
mov qword [rsp + 0x20], rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140019aaa
cmp byte [rsp + 0x50], sil
jne 0x140019ab1
test ebx, ebx
jne 0x140019a50
mov esi, 0x5000000
jmp 0x140019ad9
mov esi, 0x400
jmp 0x140019ad9
lea r9, [rsp + 0x280]
mov rcx, rbp
lea r8, [rsp + 0x270]
lea rdx, [rsp + 0x278]
call qword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x140019ad9
mov esi, 0x1000
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi]
call fcn.140018da0
mov eax, esi
jmp 0x1400199e8
call fcn.1400349d0
int3