Function at 0x140001000
Capabilities:
Accept command line arguments
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x24]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rsi, rax
mov eax, dword [rsp + 0x24]
cmp eax, 2
jge 0x140001058
jmp 0x140001082
mov rdi, rsi
lea ecx, [rax - 1]
mov dword [rsp + 0x24], ecx
add rdi, 8
mov rsi, rdi
cmp eax, 2
mov eax, ecx
jle 0x140001082
lea rdi, [rsi + 8]
mov rcx, qword [rsi + 8]
cmp word [rcx], 0x2d
jne 0x140001087
cmp word [rcx + 2], 0x6c
jne 0x140001082
cmp word [rcx + 4], 0
jne 0x140001040
lea ecx, [rax - 1]
mov dword [rsp + 0x24], ecx
cmp eax, 2
mov eax, ecx
ja 0x140001043
call fcn.1400016a0
cmp eax, 3
jne 0x140001082
lea rdx, [rsp + 0x28]
mov r8d, 0xa
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstoll]
test rax, rax
jle 0x14000164c
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 0x16
je 0x14000164c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 0x22
je 0x14000164c
mov rax, qword [rsp + 0x28]
movzx eax, word [rax]
cmp ax, 0x47
je 0x1400010e7
cmp ax, 0x4d
je 0x1400010ed
cmp ax, 0x4b
jne 0x1400010f1
shl rbx, 0xa
jmp 0x1400010f1
shl rbx, 0x1e
jmp 0x1400010f1
shl rbx, 0x14
cmp rbx, 0x8fffff
jle 0x140001663
movabs rax, 0xfffffffe01
cmp rbx, rax
jae 0x14000167a
mov r14, rbx
shr r14, 9
cmp rbx, 0x10400000
jae 0x140001147
lea eax, [rbx - 0x4000]
shr eax, 9
lea rcx, [rax - 1]
sub eax, 0xffffff80
imul r15, rax, 0xfe03f81
shr r15, 0x23
mov r12d, 1
jmp 0x1400011ef
mov rax, rbx
shr rax, 0x21
jne 0x14000117a
lea rax, [rbx - 0x4000]
shr rax, 9
lea rcx, [rax - 1]
add eax, 0x200
mov r15d, 0xff803fe1
imul r15, rax
shr r15, 0x29
mov r12d, 4
jmp 0x1400011ef
mov rax, rbx
shr rax, 0x22
jne 0x1400011ad
lea rax, [rbx - 0x4000]
shr rax, 9
lea rcx, [rax - 1]
add eax, 0x400
mov r15d, 0xffc00ffd
imul r15, rax
shr r15, 0x2a
mov r12d, 8
jmp 0x1400011ef
xor r12d, r12d
mov rax, rbx
shr rax, 0x23
setne r12b
mov edx, r12d
shl edx, 0xb
lea rcx, [rbx - 0x4000]
shr rcx, 9
add rcx, 0xffffffffffffffff
lea eax, [rdx + rcx]
add eax, 0x801
mov edi, edx
add edi, 0x801
xor edx, edx
div edi
mov r15d, eax
shl r12d, 4
add r12d, 0x10
mov edi, r12d
shl edi, 7
or edi, 1
add rcx, rdi
mov rax, rcx
shr rax, 0x20
je 0x140001211
mov rax, rcx
xor edx, edx
div rdi
mov r13, rax
jmp 0x14000121a
mov eax, ecx
xor edx, edx
div edi
mov r13d, eax
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__gmtime64]
mov edx, dword [rax + 8]
mov ecx, dword [rax + 0xc]
mov edi, dword [rax + 0x10]
mov ebp, dword [rax + 0x14]
add edi, dword [rax]
shl edi, 8
shl edx, 8
add edx, dword [rax + 4]
add ecx, edi
add ecx, 0x100
lea eax, [rbp + rdx + 0x76c]
mov word [0x140005240], 0x5aeb
mov byte [0x140005242], 0x90
movabs rdx, 0x312e344e4957534d
mov qword [0x140005243], rdx
mov word [0x14000524b], 0x200
mov byte [0x14000524d], r12b
mov word [0x14000524e], 0x20
mov byte [0x140005250], 2
movabs rdx, 0x90000f800000000
mov qword [0x140005251], rdx
mov word [0x140005259], 0x200
mov byte [0x14000525f], 0
mov dword [0x14000525b], 0
mov byte [0x140005260], r14b
mov rdx, rbx
shr rdx, 0x11
mov byte [0x140005261], dl
mov rdx, rbx
shr rdx, 0x19
mov byte [0x140005262], dl
shr rbx, 0x21
mov byte [0x140005263], bl
mov rbx, r13
mov byte [0x140005264], bl
mov byte [0x140005265], bh
mov rdx, r13
shr rdx, 0x10
mov byte [0x140005266], dl
mov rdx, r13
shr rdx, 0x18
mov byte [0x140005267], dl
mov dword [0x140005268], 0
movabs rdx, 0x6000100000002
mov qword [0x14000526c], rdx
mov byte [0x140005280], 0x80
mov byte [0x140005282], 0x29
mov byte [0x140005283], cl
mov byte [0x140005284], ch
mov byte [0x140005285], al
mov byte [0x140005286], ah
movabs rax, 0x445241434453
mov qword [0x140005287], rax
mov dword [0x14000528e], 0
movabs rax, 0x2020203233544146
mov qword [0x140005292], rax
mov word [0x14000543e], 0xaa55
lea edi, [r14 - 0x20]
mov eax, edi
sub eax, r13d
sub eax, r13d
mov dword [0x140005040], 0x41615252
mov dword [0x140005224], 0x61417272
mov byte [0x140005228], al
mov byte [0x140005229], ah
mov ecx, eax
shr ecx, 0x10
mov byte [0x14000522a], cl
shr eax, 0x18
mov byte [0x14000522b], al
mov dword [0x14000522c], 3
mov dword [0x14000523c], 0xaa550000
movabs rax, 0xfffffff0ffffff8
mov qword [0x140005440], rax
mov dword [0x140005448], 0xfffffff
mov rcx, qword [rsi + 0x10]
lea rdx, [0x140003082]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
test rax, rax
je 0x1400015d0
mov rbx, rax
lea rcx, [0x140005240]
mov edx, 1
mov r8d, 0x200
mov r9, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rax, 0x200
jne 0x140001566
lea rcx, [0x140005040]
mov edx, 1
mov r8d, 0x200
mov r9, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rax, 0x200
jne 0x140001566
lea r14, [0x140005650]
mov r8d, 0x40000
mov rcx, r14
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov edx, 1
mov r8d, 0x800
mov rcx, r14
mov r9, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rax, 0x800
jne 0x14000161b
lea rcx, [0x140005240]
mov edx, 1
mov r8d, 0x200
mov r9, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rax, 0x200
jne 0x140001566
lea rdx, [0x140005040]
mov rcx, rbx
call fcn.140001820
test eax, eax
jne 0x14000159a
mov edx, 0x18
mov rcx, rbx
call fcn.1400018a0
test eax, eax
jne 0x14000159a
lea rdx, [0x140005440]
mov rcx, rbx
call fcn.140001820
test eax, eax
jne 0x14000159a
lea r14d, [r15 - 1]
mov rcx, rbx
mov rdx, r14
call fcn.1400018a0
test eax, eax
jne 0x14000159a
lea rdx, [0x140005440]
mov rcx, rbx
call fcn.140001820
test eax, eax
jne 0x14000159a
mov rcx, rbx
mov rdx, r14
call fcn.1400018a0
test eax, eax
jne 0x14000159a
add r15d, r15d
sub edi, r15d
movsxd rdx, edi
mov rcx, rbx
call fcn.1400018a0
test eax, eax
jne 0x14000159a
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
jmp 0x14000160a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
mov rdi, rax
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.Failed_to_write_sector_of__d_bytes:__s_n
mov rcx, rax
mov r8d, 0x200
mov r9, rdi
call fcn.1400017d0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wunlink]
mov rsi, qword [rsi + 0x10]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.File__S_was_not_created._n
mov rcx, rax
mov r8, rsi
call fcn.1400017d0
jmp 0x140001605
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
mov rdi, rax
mov rsi, qword [rsi + 0x10]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.Could_not_create_file__S:__s_n
mov rcx, rax
mov r8, rsi
mov r9, rdi
call fcn.1400017d0
mov eax, 1
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
mov rdi, rax
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.Failed_to_write__d_bytes:__s_n
mov rcx, rax
mov r8d, 0x800
jmp 0x140001592
mov rsi, qword [rdi]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.Invalid_argument_size__S_n_n
jmp 0x14000168f
mov rsi, qword [rdi]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.Invalid_argument:_size__S_is_too_small._n_n
jmp 0x14000168f
mov rsi, qword [rdi]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.Invalid_argument:_size__S_is_too_large._n_n
mov rcx, rax
mov r8, rsi
call fcn.1400017d0
call fcn.1400016a0
int3