Function at 0x140005370
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov esi, ecx
mov byte [rsp + 0x30], 0x27
mov ecx, 0xfffffff4
call fcn.140054fc8
mov rdi, rax
mov rcx, rax
mov edx, 1
xor r8d, r8d
call sub.KERNEL32.dll_SetHandleInformation
mov dword [rsp + 0x2c], 0
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x30]
lea r9, [rsp + 0x2c]
mov rcx, rdi
mov r8d, 1
call sub.KERNEL32.dll_WriteFile
cmp dword [rsp + 0x2c], 0
je 0x1400053d2
test eax, eax
jne 0x1400053d7
call sub.KERNEL32.dll_GetLastError
lea eax, [rsi - 7]
cmp eax, 0x14
ja case.0x1400053f1.14
lea rcx, [0x140074690]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
lea rcx, [0x14008da08]
call fcn.140005240
jmp 0x140005580
lea rcx, [0x14008da18]
call fcn.140005240
jmp 0x140005580
lea rcx, [0x14008da68]
call fcn.140005240
jmp 0x140005580
lea rcx, [0x14008da48]
call fcn.140005240
jmp 0x140005580
lea rcx, [0x14008da78]
call fcn.140005240
jmp 0x140005580
lea rcx, [0x14008da38]
call fcn.140005240
jmp 0x140005580
lea rcx, [0x14008da58]
call fcn.140005240
jmp 0x140005580
test esi, esi
jle 0x14000550e
cmp esi, 0x1f
ja 0x14000551c
movzx edi, sil
shr edi, 4
and esi, 0xf
lea rcx, [0x14008d9e0]
call fcn.140005240
lea rbx, str.0123456789abcdefghijklmnopqrstuvwxyz
movzx eax, byte [rdi + rbx]
mov byte [rsp + 0x30], al
mov ecx, 0xfffffff4
call fcn.140054fc8
mov rdi, rax
mov rcx, rax
mov edx, 1
xor r8d, r8d
call sub.KERNEL32.dll_SetHandleInformation
mov dword [rsp + 0x2c], 0
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x30]
lea r9, [rsp + 0x2c]
mov rcx, rdi
mov r8d, 1
call sub.KERNEL32.dll_WriteFile
cmp dword [rsp + 0x2c], 0
je 0x1400054f1
test eax, eax
jne 0x1400054f6
call sub.KERNEL32.dll_GetLastError
movzx eax, byte [rsi + rbx]
mov byte [rsp + 0x30], al
jmp 0x14000552a
lea rcx, [0x14008da28]
call fcn.140005240
jmp 0x140005580
lea rcx, str.x00
call fcn.140005240
jmp 0x140005580
cmp esi, 0x7f
ja 0x1400055e7
mov byte [rsp + 0x30], sil
mov ecx, 0xfffffff4
call fcn.140054fc8
mov rsi, rax
mov rcx, rax
mov edx, 1
xor r8d, r8d
call sub.KERNEL32.dll_SetHandleInformation
mov dword [rsp + 0x2c], 0
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x30]
lea r9, [rsp + 0x2c]
mov rcx, rsi
mov r8d, 1
call sub.KERNEL32.dll_WriteFile
cmp dword [rsp + 0x2c], 0
je 0x14000557b
test eax, eax
jne 0x140005580
call sub.KERNEL32.dll_GetLastError
mov byte [rsp + 0x30], 0x27
mov ecx, 0xfffffff4
call fcn.140054fc8
mov rsi, rax
mov rcx, rax
mov edx, 1
xor r8d, r8d
call sub.KERNEL32.dll_SetHandleInformation
mov dword [rsp + 0x2c], 0
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x30]
lea r9, [rsp + 0x2c]
mov rcx, rsi
mov r8d, 1
call sub.KERNEL32.dll_WriteFile
cmp dword [rsp + 0x2c], 0
je 0x1400055d6
test eax, eax
jne 0x1400055db
call sub.KERNEL32.dll_GetLastError
nop
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
cmp esi, 0x7ff
ja 0x140005602
mov ecx, esi
shr ecx, 6
or cl, 0xc0
mov ebx, 2
xor eax, eax
xor edx, edx
jmp 0x14000566c
mov eax, esi
and eax, 0xfffff800
cmp eax, 0xd800
mov ecx, 0xfffd
mov eax, esi
cmove eax, ecx
cmp esi, 0x110000
cmovae eax, ecx
mov ecx, eax
cmp esi, 0xffff
ja 0x140005643
shr ecx, 0xc
or cl, 0xe0
mov esi, eax
shr esi, 6
and al, 0x3f
or al, 0x80
mov ebx, 3
xor edx, edx
jmp 0x14000566c
shr ecx, 0x12
or cl, 0xf0
mov esi, eax
shr esi, 0xc
mov r8d, eax
shr r8d, 6
and r8b, 0x3f
or r8b, 0x80
and al, 0x3f
mov edx, eax
or dl, 0x80
mov ebx, 4
mov eax, r8d
and sil, 0x3f
or sil, 0x80
mov byte [rsp + 0x30], cl
mov byte [rsp + 0x31], sil
mov byte [rsp + 0x32], al
mov byte [rsp + 0x33], dl
mov ecx, 0xfffffff4
call fcn.140054fc8
mov rsi, rax
xor r14d, r14d
mov rcx, rax
mov edx, 1
xor r8d, r8d
call sub.KERNEL32.dll_SetHandleInformation
mov dword [rsp + 0x2c], 0
mov ebp, 0x40000000
lea rdi, [rsp + 0x2c]
nop word [rax + rax]
mov r8d, ebx
sub r8d, r14d
cmp r8d, 0x40000000
cmovge r8d, ebp
lea rdx, [rsp + r14]
add rdx, 0x30
mov qword [rsp + 0x20], 0
mov rcx, rsi
mov r9, rdi
call sub.KERNEL32.dll_WriteFile
mov ecx, dword [rsp + 0x2c]
test rcx, rcx
je 0x14000557b
test eax, eax
je 0x14000557b
add r14, rcx
cmp r14, rbx
jl 0x1400056c0
jmp 0x140005580