Function at 0x140039260
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x1e8
call fcn.1400035e0
sub rsp, rax
mov rax, qword [0x1401ad1c0]
mov qword [rsp + 0x190], rax
mov r8d, dword [rsp + 0x210]
mov qword [rsp + 0x1e0], rbx
mov qword [rsp + 0x1c8], rdi
mov rdi, qword [rsp + 0x218]
mov qword [rsp + 0x1b8], r13
mov ebx, r9d
mov r13d, edx
mov qword [rsp + 0x1b0], r14
mov r14, rcx
lea rdx, [rsp + 0x80]
mov r9, rdi
mov ecx, ebx
mov qword [rsp + 0x1a8], r15
call fcn.140038d70
test rax, rax
mov r15, rax
jne 0x1400392e0
mov ax, 0x1f
jmp 0x1400396b8
lea rcx, [rsp + 0x48]
mov r8, rdi
mov edx, ebx
mov qword [rsp + 0x1d0], rsi
call fcn.140033c70
xor esi, esi
mov edx, esi
lea r9, [0x1401c319c]
cmp byte [0x1401c319c], dl
je 0x14003931a
mov rax, r9
nop
inc rax
inc edx
cmp byte [rax], sil
jne 0x140039310
mov ecx, esi
cmp byte [rsp + 0x48], cl
je 0x14003933a
lea rax, [rsp + 0x48]
nop
nop
nop
inc rax
inc ecx
cmp byte [rax], sil
jne 0x140039330
lea eax, [rdx + 1]
movsxd r8, ecx
test eax, eax
lea rcx, [rsp + r8 + 0x48]
je 0x140039362
mov rdx, rcx
sub rdx, r8
lea r8, [rsp + 0x48]
sub rdx, r8
mov r8d, eax
add rdx, r9
call sub.MSVCR110.dll_memcpy
lea ecx, [r13*4 + 3]
mov eax, 0xaaaaaaab
mov qword [rsp + 0x1c0], r12
mul ecx
mov ebx, edx
xor ecx, ecx
shr ebx, 1
add ebx, 0xa
movsxd rdx, ebx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
test rax, rax
mov r12, rax
jne 0x14003939c
mov ax, reloc.WSOCK32.dll_ioctlsocket
jmp 0x1400396a8
mov eax, ebx
xor ecx, ecx
mov qword [rsp + 0x1d8], rbp
shr eax, 6
lea eax, [rbx + rax*2 + 0xa]
movsxd rdx, eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
test rax, rax
mov rbp, rax
jne 0x1400393d2
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ax, reloc.WSOCK32.dll_ioctlsocket
jmp 0x1400396a0
lea rdx, [rsp + 0x44]
mov r9d, r13d
mov r8, r14
mov rcx, r12
call fcn.140045da0
test ax, ax
je 0x1400393fc
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ax, 0xcf
jmp 0x1400396a0
cmp dword [rsp + 0x44], esi
mov r10d, esi
mov ebx, esi
jbe 0x140039469
mov r8, rbp
mov r11, r12
nop
movzx eax, byte [r11]
mov byte [r8], al
mov eax, r10d
and eax, 0x3f
cmp al, 0x3f
jne 0x140039457
mov eax, ebx
lea r9, [0x1401c31a0]
mov edx, 2
sub r9, rax
lea rcx, [rax + rbp + 1]
sub r9, rbp
nop
nop
movzx eax, byte [r9 + rcx - 1]
inc rcx
dec edx
mov byte [rcx - 1], al
jne 0x140039440
add ebx, 2
add r8, 2
inc r10d
inc r11
inc ebx
inc r8
cmp r10d, dword [rsp + 0x44]
jb 0x140039410
test r10b, 0x3f
je 0x1400394a2
mov eax, ebx
lea r8, [0x1401c31a4]
mov edx, 2
sub r8, rax
lea rcx, [rax + rbp]
sub r8, rbp
nop
nop
nop
movzx eax, byte [r8 + rcx]
inc rcx
dec edx
mov byte [rcx - 1], al
jne 0x140039490
add ebx, 2
xor r9d, r9d
mov qword [rsp + 0x30], rsi
mov edx, 0x40000000
lea r8d, [r9 + 2]
mov rcx, r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov rdi, rax
jne 0x1400394f0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ax, 0x1f
jmp 0x1400396a0
lea r9, [rsp + 0x40]
lea rdx, [0x1401c31a8]
mov r8d, 0x2b
mov rcx, rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14003951b
cmp dword [rsp + 0x40], 0x2b
je 0x14003953f
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ax, 0x21
jmp 0x1400396a0
lea r9, [rsp + 0x40]
lea rdx, [0x1401c31d4]
mov r8d, 2
mov rcx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14003951b
cmp dword [rsp + 0x40], 2
jne 0x14003951b
cmp byte [rsp + 0x48], sil
mov r8d, esi
je 0x14003958b
lea rax, [rsp + 0x48]
nop
nop
inc rax
inc r8d
cmp byte [rax], sil
jne 0x140039580
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x48]
mov rcx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [rsp + 0x40]
test eax, eax
mov ecx, esi
cmove edx, esi
cmp byte [rsp + 0x48], cl
je 0x1400395ca
lea rax, [rsp + 0x48]
nop
nop
inc rax
inc ecx
cmp byte [rax], sil
jne 0x1400395c0
cmp edx, ecx
jne 0x14003951b
mov r8d, ebx
mov rdx, rbp
mov rcx, rdi
call fcn.1400308c0
cmp eax, ebx
jne 0x14003951b
lea r9, [rsp + 0x40]
lea rdx, str.End_HL_RUS_License_________________________
mov r8d, 0x2b
mov rcx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14003951b
cmp dword [rsp + 0x40], 0x2b
jne 0x14003951b
cmp byte [0x1401c3204], sil
mov r8d, esi
je 0x14003963b
lea rax, [0x1401c3204]
nop
inc rax
inc r8d
cmp byte [rax], sil
jne 0x140039630
lea r9, [rsp + 0x40]
lea rdx, [0x1401c3208]
mov rcx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [rsp + 0x40]
test eax, eax
cmove ecx, esi
cmp byte [0x1401c320c], sil
je 0x14003967a
lea rax, [0x1401c320c]
nop
inc rax
inc esi
cmp byte [rax], 0
jne 0x140039670
cmp ecx, esi
jne 0x14003951b
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ax, ax
mov rbp, qword [rsp + 0x1d8]
mov r12, qword [rsp + 0x1c0]
mov rsi, qword [rsp + 0x1d0]
mov r15, qword [rsp + 0x1a8]
mov r14, qword [rsp + 0x1b0]
mov r13, qword [rsp + 0x1b8]
mov rdi, qword [rsp + 0x1c8]
mov rbx, qword [rsp + 0x1e0]
mov rcx, qword [rsp + 0x190]
call fcn.14006b6a0
add rsp, 0x1e8
ret