Function at 0x1401db060
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x3b0
mov rax, qword [0x1402ded38]
xor rax, rsp
mov qword [rsp + 0x3a0], rax
cmp dword [rcx + 8], 0xffffffff
mov rsi, r8
mov ebp, edx
mov rdi, rcx
je 0x1401db093
mov rcx, qword [rcx]
call fcn.1401d64e0
mov rcx, qword [rdi]
mov dword [rdi + 8], 0xffffffff
cmp ebp, dword [rcx + 8]
jl 0x1401db0ac
mov eax, 0x10000
jmp 0x1401db390
mov qword [rsp + 0x3e8], r12
cmp ebp, dword [rcx + 0x14]
jge 0x1401db0be
call fcn.1401da560
mov rax, qword [rdi]
xor r12d, r12d
mov qword [rsp + 0x3d8], rbx
cmp dword [rax + 0x14], ebp
jge 0x1401db127
mov rbx, qword [rdi]
test rbx, rbx
je 0x1401db11f
cmp dword [rbx + 0x1c], r12d
je 0x1401db11f
mov edx, dword [rbx + 0x14]
inc edx
cmp edx, dword [rbx + 8]
je 0x1401db11f
mov ecx, dword [rbx + 0x54]
mov eax, dword [rbx + 0x4c]
mov dword [rbx + 0x14], edx
add ecx, dword [rbx + 0x50]
lea r8, [rbx + 0x7c]
lea rdx, [rbx + 0x2c]
lea ecx, [rcx + rax + 0x2e]
xor r9d, r9d
mov dword [rsp + 0x20], r12d
add dword [rbx + 0x18], ecx
mov rcx, rbx
call fcn.1401d9600
mov ecx, r12d
test eax, eax
sete cl
mov dword [rbx + 0x1c], ecx
mov rax, qword [rdi]
cmp dword [rax + 0x14], ebp
jl 0x1401db0d1
cmp ebp, 0xffffffff
jl 0x1401db13b
lea r8, [rsp + 0x50]
mov edx, ebp
mov rcx, rdi
call fcn.1401da8d0
test byte [rsp + 0x158], 0x10
movzx eax, byte [rsi]
je 0x1401db181
cmp al, 0x2f
je 0x1401db170
cmp al, 0x5c
je 0x1401db170
test al, al
je 0x1401db15a
cmp byte [rsi + 1], 0x3a
je 0x1401db170
lea rcx, [rdi + 0x150]
mov rdx, rsi
call fcn.1401d6250
xor eax, eax
jmp 0x1401db380
xor ecx, ecx
mov rdx, rsi
call fcn.1401d6250
xor eax, eax
jmp 0x1401db380
mov r9, rsi
mov rcx, rsi
test al, al
je 0x1401db1a7
nop dword [rax + rax]
cmp al, 0x2f
je 0x1401db198
cmp al, 0x5c
jne 0x1401db19c
lea r9, [rcx + 1]
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x1401db190
lea rdx, [rsp + 0x180]
mov rcx, rsi
sub rdx, rsi
nop word [rax + rax]
movzx eax, byte [rcx]
inc rcx
mov byte [rcx + rdx - 1], al
test al, al
jne 0x1401db1c0
cmp r9, rsi
jne 0x1401db1dd
mov byte [rsp + 0x180], r12b
jmp 0x1401db209
mov rax, r9
sub rax, rsi
mov byte [rsp + rax + 0x180], r12b
movzx eax, byte [rsp + 0x180]
cmp al, 0x2f
je 0x1401db23b
cmp al, 0x5c
je 0x1401db23b
test al, al
je 0x1401db209
cmp byte [rsp + 0x181], 0x3a
je 0x1401db23b
mov qword [rsp + 0x20], r9
lea r8, [rdi + 0x150]
lea rdx, str._s_s_s
lea r9, [rsp + 0x180]
lea rcx, [rsp + 0x290]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rdi + 0x150]
jmp 0x1401db25a
lea r8, [rsp + 0x180]
lea rdx, str._s_s
lea rcx, [rsp + 0x290]
call qword [sym.imp.USER32.dll_wsprintfA]
xor ecx, ecx
lea rdx, [rsp + 0x180]
call fcn.1401d6250
mov eax, dword [rsp + 0x158]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x290]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1401db2ab
mov eax, 0x200
jmp 0x1401db380
mov rdx, qword [rdi + 0x140]
mov rcx, qword [rdi]
call fcn.1401da2b0
cmp qword [rdi + 0x148], r12
jne 0x1401db2e0
mov ecx, 0x4000
call fcn.140004d5c
mov qword [rdi + 0x148], rax
nop word [rax + rax]
mov rdx, qword [rdi + 0x148]
mov rcx, qword [rdi]
lea r9, [rsp + 0x40]
mov r8d, 0x4000
call fcn.1401d9fc0
mov ebx, eax
cmp eax, 0xffffff96
je 0x1401db366
test eax, eax
js 0x1401db333
jle 0x1401db328
mov rdx, qword [rdi + 0x148]
lea r9, [rsp + 0x44]
mov r8d, eax
mov rcx, rsi
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1401db33b
cmp byte [rsp + 0x40], r12b
jne 0x1401db343
test ebx, ebx
jne 0x1401db2e0
mov r12d, 0x5000000
jmp 0x1401db36c
mov r12d, 0x400
jmp 0x1401db36c
lea r9, [rsp + 0x16c]
lea r8, [rsp + 0x15c]
lea rdx, [rsp + 0x164]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x1401db36c
mov r12d, 0x1000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi]
call fcn.1401d64e0
mov eax, r12d
mov rbx, qword [rsp + 0x3d8]
mov r12, qword [rsp + 0x3e8]
mov rcx, qword [rsp + 0x3a0]
xor rcx, rsp
call fcn.14017ae40
add rsp, 0x3b0
pop rdi
pop rsi
pop rbp
ret