Function at 0x14023a130
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x3a0
mov r15d, dword [rsp + 0x3e0]
mov esi, r9d
mov r14, r8
mov edi, edx
mov rbx, rcx
lea eax, [r15 - 1]
cmp eax, 2
ja 0x14023a4e4
mov eax, dword [rcx + 8]
cmp r15d, 3
jne 0x14023a22b
cmp edx, eax
je 0x14023a1cf
cmp eax, 0xffffffff
je 0x14023a184
mov rcx, qword [rcx]
call fcn.14023ccd0
mov rcx, qword [rbx]
mov dword [rbx + 8], 0xffffffff
cmp edi, dword [rcx + 8]
jge 0x14023a4e4
cmp dword [rcx + 0x14], edi
jle 0x14023a1a7
call fcn.14023cd70
mov rcx, qword [rbx]
cmp dword [rcx + 0x14], edi
jge 0x14023a1c0
nop dword [rax]
mov rcx, qword [rbx]
call fcn.14023cdd0
mov rcx, qword [rbx]
cmp dword [rcx + 0x14], edi
jl 0x14023a1b0
mov rdx, qword [rbx + 0x140]
call fcn.14023ce60
mov dword [rbx + 8], edi
mov rcx, qword [rbx]
lea r9, [rsp + 0x3e0]
mov r8d, esi
mov rdx, r14
call fcn.14023d3b0
mov edi, eax
test eax, eax
jg 0x14023a1fa
mov rcx, qword [rbx]
call fcn.14023ccd0
mov dword [rbx + 8], 0xffffffff
cmp byte [rsp + 0x3e0], 0
jne 0x14023a2d2
test edi, edi
jle 0x14023a216
mov eax, 0x600
jmp 0x14023a4e9
cmp edi, 0xffffff96
mov eax, 0x5000000
mov ecx, 0x1000
cmove eax, ecx
jmp 0x14023a4e9
cmp eax, 0xffffffff
je 0x14023a238
mov rcx, qword [rcx]
call fcn.14023ccd0
mov rax, qword [rbx]
mov dword [rbx + 8], 0xffffffff
cmp edi, dword [rax + 8]
jge 0x14023a4e4
cmp dword [rax + 0x14], edi
jle 0x14023a25e
mov rcx, rax
call fcn.14023cd70
mov rax, qword [rbx]
cmp dword [rax + 0x14], edi
jge 0x14023a270
mov rcx, qword [rbx]
call fcn.14023cdd0
mov rax, qword [rbx]
cmp dword [rax + 0x14], edi
jl 0x14023a260
lea r8, [rsp + 0x160]
mov edx, edi
mov rcx, rbx
call fcn.140239650
mov eax, dword [rsp + 0x268]
shr eax, 4
test al, 1
je 0x14023a2d9
cmp r15d, 1
je 0x14023a2d2
movzx eax, byte [r14]
cmp al, 0x2f
je 0x14023a2c6
cmp al, 0x5c
je 0x14023a2c6
test al, al
je 0x14023a2ad
cmp byte [r14 + 1], 0x3a
je 0x14023a2c6
lea rsi, [rbx + 0x150]
mov rdx, r14
mov rcx, rsi
call fcn.1402394c0
xor eax, eax
jmp 0x14023a4e9
xor esi, esi
mov rdx, r14
mov ecx, esi
call fcn.1402394c0
xor eax, eax
jmp 0x14023a4e9
xor esi, esi
mov byte [rsp + 0x290], 0
cmp r15d, 1
je 0x14023a3ee
movzx eax, byte [r14]
mov rdi, r14
mov qword [rsp + 0x3c0], rbp
mov rcx, r14
test al, al
je 0x14023a31a
cmp al, 0x2f
je 0x14023a30b
cmp al, 0x5c
jne 0x14023a30f
lea rdi, [rcx + 1]
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x14023a303
mov r8d, 0x104
lea rcx, [rsp + 0x50]
mov rdx, r14
call fcn.14025996c
cmp rdi, r14
jne 0x14023a339
mov byte [rsp + 0x50], sil
jmp 0x14023a35c
mov rax, rdi
sub rax, r14
mov byte [rsp + rax + 0x50], sil
movzx eax, byte [rsp + 0x50]
cmp al, 0x2f
je 0x14023a386
cmp al, 0x5c
je 0x14023a386
test al, al
je 0x14023a35c
cmp byte [rsp + 0x51], 0x3a
je 0x14023a386
lea rbp, [rbx + 0x150]
mov qword [rsp + 0x20], rdi
mov r8, rbp
lea r9, [rsp + 0x50]
lea rdx, str._s_s_s
lea rcx, [rsp + 0x290]
call fcn.140006bc0
jmp 0x14023a3a5
mov r9, rdi
lea r8, [rsp + 0x50]
lea rdx, [0x1402b93b8]
lea rcx, [rsp + 0x290]
call fcn.140006bc0
mov rbp, rsi
lea rdx, [rsp + 0x50]
mov rcx, rbp
call fcn.1402394c0
mov eax, dword [rsp + 0x268]
lea rcx, [rsp + 0x290]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbp, qword [rsp + 0x3c0]
mov r14, rax
cmp r14, 0xffffffffffffffff
jne 0x14023a3fe
mov eax, 0x200
jmp 0x14023a4e9
mov rdx, qword [rbx + 0x140]
mov rcx, qword [rbx]
call fcn.14023ce60
cmp qword [rbx + 0x148], rsi
jne 0x14023a430
mov ecx, 0x4000
call fcn.140247068
mov qword [rbx + 0x148], rax
nop word [rax + rax]
mov rdx, qword [rbx + 0x148]
lea r9, [rsp + 0x3e0]
mov rcx, qword [rbx]
mov r8d, 0x4000
call fcn.14023d3b0
mov edi, eax
cmp eax, 0xffffff96
je 0x14023a497
test eax, eax
js 0x14023a489
jle 0x14023a47b
mov rdx, qword [rbx + 0x148]
lea r9, [rsp + 0x40]
mov r8d, eax
mov qword [rsp + 0x20], rsi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14023a490
cmp byte [rsp + 0x3e0], sil
jne 0x14023a49c
test edi, edi
jne 0x14023a430
mov esi, 0x5000000
jmp 0x14023a49c
mov esi, 0x400
jmp 0x14023a49c
mov esi, 0x1000
mov rcx, qword [rbx]
call fcn.14023ccd0
test esi, esi
jne 0x14023a4c9
lea r9, [rsp + 0x27c]
mov rcx, r14
lea r8, [rsp + 0x26c]
lea rdx, [rsp + 0x274]
call qword [sym.imp.KERNEL32.dll_SetFileTime]
cmp r15d, 1
je 0x14023a4d8
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x14023a2d2
mov eax, esi
jmp 0x14023a4e9
mov eax, 0x10000
lea r11, [rsp + 0x3a0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret