Function at 0x140026280
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x3c0
mov rax, qword [0x1400f5608]
xor rax, rsp
mov qword [rsp + 0x3b0], rax
mov r13d, dword [rsp + 0x410]
mov r15d, r9d
mov r14, r8
mov ebp, edx
mov rdi, rcx
lea eax, [r13 - 1]
cmp eax, 2
ja 0x14002672c
mov eax, dword [rcx + 8]
cmp r13d, 3
jne 0x1400263e7
cmp edx, eax
je 0x14002638f
cmp eax, 0xffffffff
je 0x1400262ed
mov rcx, qword [rcx]
call fcn.140028fa0
mov rcx, qword [rdi]
mov dword [rdi + 8], 0xffffffff
cmp ebp, dword [rcx + 8]
jge 0x14002672c
cmp dword [rcx + 0x14], ebp
jle 0x140026310
call fcn.140029040
mov rcx, qword [rdi]
cmp dword [rcx + 0x14], ebp
jge 0x140026380
mov rbx, rcx
xor esi, esi
mov rcx, rbx
test rbx, rbx
je 0x140026378
cmp dword [rbx + 0x1c], esi
je 0x140026378
mov edx, dword [rbx + 0x14]
inc edx
cmp edx, dword [rbx + 8]
je 0x140026378
mov ecx, dword [rbx + 0x54]
lea r8, [rbx + 0x7c]
add ecx, dword [rbx + 0x50]
xor r9d, r9d
mov eax, dword [rbx + 0x4c]
mov dword [rsp + 0x40], esi
add eax, 0x2e
add ecx, eax
mov qword [rsp + 0x38], rsi
add dword [rbx + 0x18], ecx
mov rcx, rbx
mov dword [rbx + 0x14], edx
lea rdx, [rbx + 0x2c]
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
call fcn.140029c10
mov ecx, esi
test eax, eax
sete cl
mov dword [rbx + 0x1c], ecx
mov rcx, qword [rdi]
mov rbx, rcx
cmp dword [rcx + 0x14], ebp
jl 0x140026317
mov rdx, qword [rdi + 0x140]
call fcn.1400290a0
mov dword [rdi + 8], ebp
mov rcx, qword [rdi]
lea r9, [rsp + 0x50]
mov r8d, r15d
mov rdx, r14
call fcn.1400295e0
mov ebx, eax
test eax, eax
jg 0x1400263b7
mov rcx, qword [rdi]
call fcn.140028fa0
mov dword [rdi + 8], 0xffffffff
cmp byte [rsp + 0x50], 0
jne 0x140026518
test ebx, ebx
jle 0x1400263d0
mov eax, 0x600
jmp 0x140026731
mov eax, 0x1000
cmp ebx, 0xffffff96
mov esi, 0x5000000
cmove esi, eax
mov eax, esi
jmp 0x140026731
cmp eax, 0xffffffff
je 0x1400263f4
mov rcx, qword [rcx]
call fcn.140028fa0
mov rbx, qword [rdi]
mov dword [rdi + 8], 0xffffffff
cmp ebp, dword [rbx + 8]
jge 0x14002672c
xor esi, esi
cmp dword [rbx + 0x14], ebp
jle 0x140026455
test rbx, rbx
je 0x140026452
mov eax, dword [rbx + 0x28]
lea r8, [rbx + 0x7c]
mov dword [rsp + 0x40], esi
lea rdx, [rbx + 0x2c]
mov qword [rsp + 0x38], rsi
xor r9d, r9d
mov dword [rsp + 0x30], esi
mov rcx, rbx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
mov dword [rbx + 0x18], eax
mov dword [rbx + 0x14], esi
call fcn.140029c10
mov ecx, esi
test eax, eax
sete cl
mov dword [rbx + 0x1c], ecx
mov rbx, qword [rdi]
cmp dword [rbx + 0x14], ebp
jge 0x1400264c0
mov rax, rbx
test rbx, rbx
je 0x1400264b8
cmp dword [rbx + 0x1c], esi
je 0x1400264b8
mov edx, dword [rbx + 0x14]
inc edx
cmp edx, dword [rbx + 8]
je 0x1400264b8
mov ecx, dword [rbx + 0x54]
lea r8, [rbx + 0x7c]
add ecx, dword [rbx + 0x50]
xor r9d, r9d
mov eax, dword [rbx + 0x4c]
mov dword [rsp + 0x40], esi
add eax, 0x2e
add ecx, eax
mov qword [rsp + 0x38], rsi
add dword [rbx + 0x18], ecx
mov rcx, rbx
mov dword [rbx + 0x14], edx
lea rdx, [rbx + 0x2c]
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
call fcn.140029c10
test eax, eax
mov ecx, esi
sete cl
mov dword [rbx + 0x1c], ecx
mov rax, qword [rdi]
mov rbx, rax
cmp dword [rax + 0x14], ebp
jl 0x140026457
lea r8, [rsp + 0x60]
mov edx, ebp
mov rcx, rdi
call fcn.1400257b0
mov eax, dword [rsp + 0x168]
shr eax, 4
test al, 1
je 0x14002651f
cmp r13d, 1
je 0x140026518
movzx eax, byte [r14]
cmp al, 0x2f
je 0x1400264fe
cmp al, 0x5c
je 0x1400264fe
test al, al
je 0x1400264fa
cmp byte [r14 + 1], 0x3a
je 0x1400264fe
xor cl, cl
jmp 0x140026500
mov cl, 1
test cl, cl
lea rax, [rdi + 0x150]
mov rdx, r14
cmove rsi, rax
mov rcx, rsi
call fcn.1400255f0
xor eax, eax
jmp 0x140026731
mov byte [rsp + 0x2a0], sil
cmp r13d, 1
je 0x140026647
movzx eax, byte [r14]
mov rbx, r14
mov rcx, r14
test al, al
je 0x140026557
nop
cmp al, 0x2f
je 0x140026548
cmp al, 0x5c
jne 0x14002654c
lea rbx, [rcx + 1]
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x140026540
mov r8d, 0x104
lea rcx, [rsp + 0x190]
mov rdx, r14
call fcn.140095500
cmp rbx, r14
jne 0x14002657c
mov byte [rsp + 0x190], sil
jmp 0x1400265b4
mov rax, rbx
sub rax, r14
cmp rax, 0x104
jae 0x14002675d
mov byte [rsp + rax + 0x190], sil
movzx eax, byte [rsp + 0x190]
cmp al, 0x2f
je 0x1400265e1
cmp al, 0x5c
je 0x1400265e1
test al, al
je 0x1400265b4
cmp byte [rsp + 0x191], 0x3a
je 0x1400265e1
lea rbp, [rdi + 0x150]
mov qword [rsp + 0x20], rbx
mov r8, rbp
lea r9, [rsp + 0x190]
lea rdx, str._s_s_s
lea rcx, [rsp + 0x2a0]
call fcn.14002a510
jmp 0x140026603
mov r9, rbx
lea r8, [rsp + 0x190]
lea rdx, str._s_s
lea rcx, [rsp + 0x2a0]
call fcn.14002a510
mov rbp, rsi
lea rdx, [rsp + 0x190]
mov rcx, rbp
call fcn.1400255f0
mov eax, dword [rsp + 0x168]
lea rcx, [rsp + 0x2a0]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r14, rax
cmp r14, 0xffffffffffffffff
jne 0x140026657
mov eax, 0x200
jmp 0x140026731
mov rdx, qword [rdi + 0x140]
mov rcx, qword [rdi]
call fcn.1400290a0
cmp qword [rdi + 0x148], rsi
jne 0x140026680
mov ecx, 0x4000
call fcn.14008bb1c
mov qword [rdi + 0x148], rax
mov rdx, qword [rdi + 0x148]
lea r9, [rsp + 0x50]
mov rcx, qword [rdi]
mov r8d, 0x4000
call fcn.1400295e0
mov ebx, eax
cmp eax, 0xffffff96
je 0x14002670c
test eax, eax
js 0x1400266d3
jle 0x1400266c8
mov rdx, qword [rdi + 0x148]
lea r9, [rsp + 0x54]
mov r8d, eax
mov qword [rsp + 0x20], rsi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400266da
cmp byte [rsp + 0x50], sil
jne 0x1400266e1
test ebx, ebx
jne 0x140026680
mov esi, 0x5000000
jmp 0x140026711
mov esi, 0x400
jmp 0x140026711
mov rcx, qword [rdi]
call fcn.140028fa0
lea r9, [rsp + 0x17c]
mov rcx, r14
lea r8, [rsp + 0x16c]
lea rdx, [rsp + 0x174]
call qword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x140026719
mov esi, 0x1000
mov rcx, qword [rdi]
call fcn.140028fa0
cmp r13d, 1
je 0x140026728
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x140026731
mov eax, 0x10000
mov rcx, qword [rsp + 0x3b0]
xor rcx, rsp
call fcn.14008bad0
lea r11, [rsp + 0x3c0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
call fcn.14008bc2c
int3