Function at 0x1400283e0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
push rbp
sub rsp, 0x228
mov rbp, rdx
mov rsi, rcx
mov qword [rsp + 0x20], rbp
mov edi, dword [rbp]
mov eax, edi
mov ebx, edi
mov edx, edi
mov rcx, rax
shr ebx, 0x12
shr edx, 7
shl rcx, 0x28
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rax
mov eax, ebx
movzx r13d, word [rsi + rax*4 + 0x82]
cmp r13d, 0xffff
je 0x140028514
movzx r15d, word [rsi + rax*4 + 0x80]
cmp r15d, edx
mov edi, edx
cmova edi, r15d
cmp edi, r13d
ja 0x140028514
mov r8d, edi
mov rbp, qword [rsi + 0x100]
mov r9d, dword [rbp + r8*4]
cmp r9d, 0xffffffff
je 0x140028509
mov r12d, r9d
mov r10, qword [rsi + 0x10]
lea r11, [r12 + r12*2]
lea r14, [r11*4]
lea r11, [r10 + r11*4]
mov r10, qword [r11 + 4]
mov rbp, r10
sar rbp, 0x17
and rbp, 0x1ffff
cmp rbp, qword [rsi + 0x70]
jae 0x140028500
mov ebp, dword [rsi + 0x28]
lea r12d, [rbp + 1]
and r12d, 0xfff
cmp r12d, dword [rsi + 0x2c]
je 0x1400284b8
mov r10, qword [rsi + 0x20]
mov dword [r10 + rbp*4], r9d
mov dword [rsi + 0x28], r12d
mov r9d, dword [r11]
cmp r9d, 0xffffffff
je 0x14002898a
mov r12d, r9d
mov r10, qword [rsi + 0x10]
lea r11, [r12 + r12*2]
lea r14, [r11*4]
lea r11, [r10 + r11*4]
mov r10, qword [r11 + 4]
mov rbp, r10
shr rbp, 0x17
and rbp, 0x1ffff
cmp rbp, qword [rsi + 0x70]
jb 0x140028498
mov rbp, qword [rsi + 0x100]
mov dword [rbp + r8*4], r9d
sub r10, rcx
jns 0x1400287fc
inc edi
cmp edi, r13d
jbe 0x140028450
nop word [rax + rax]
inc ebx
cmp ebx, 0x20
jb 0x14002841d
mov rbx, qword [rsi + 0x30]
mov edi, dword [rsp + 0x30]
mov rbp, qword [rsp + 0x20]
cmp rbx, qword [rsi + 0x68]
jb 0x1400285b5
mov rcx, qword [rsi + 0x60]
test rcx, rcx
je 0x140028739
mov rdx, qword [rsi + 0x70]
xor r8d, r8d
shl rdx, 0x17
call fcn.14004529c
mov r12, qword [rsi + 0x70]
mov edx, 1
mov r11, qword [rsi + 0x40]
mov r8d, 0x800000
lea r10, [r12 + 1]
mov r13, qword [r11 + r12*8]
mov rcx, r13
mov qword [rsi + 0x70], r10
mov qword [r11 + r12*8], 1
mov r9, qword [rsi + 0x60]
call fcn.1400454e4
mov rcx, qword [rsi + 0x60]
call fcn.14004571c
mov r12, qword [rsi + 0x30]
mov r8, qword [rsi + 0x38]
lea rdx, [r12 + 1]
mov qword [rsi + 0x30], rdx
cmp rdx, r8
jae 0x140028707
mov rax, qword [rsi + 0x40]
jmp 0x1400285ef
xor ecx, ecx
mov edx, 0x800000
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r13, rax
mov r12, qword [rsi + 0x30]
mov rcx, qword [rsi + 0x38]
lea rdx, [r12 + 1]
mov qword [rsi + 0x30], rdx
cmp rdx, rcx
jae 0x1400287ca
mov rax, qword [rsi + 0x40]
mov qword [rax + r12*8], r13
mov edx, 0x90
cmp edi, 0x90
mov ecx, dword [rsi + 0x2c]
cmovb edi, edx
shl rbx, 0x17
mov dword [rbp], edi
cmp ecx, dword [rsi + 0x28]
je 0x140028624
mov rdx, qword [rsi + 0x20]
mov ebp, dword [rdx + rcx*4]
inc ecx
and ecx, 0xfff
mov dword [rsi + 0x2c], ecx
jmp 0x14002863b
mov rbp, qword [rsi]
mov rcx, qword [rsi + 8]
lea rdx, [rbp + 1]
mov qword [rsi], rdx
cmp rdx, rcx
jae 0x140028794
mov r10d, edi
lea rdx, [rbp + rbp*2]
neg r10d
mov r8, qword [rsi + 0x10]
add r10d, 0x800000
mov ecx, r10d
mov r9d, r10d
shl rcx, 0x28
add rdi, rbx
shr r9d, 0x12
add rdi, rcx
mov qword [r8 + rdx*4 + 4], rdi
mov dword [r8 + rdx*4], 0xffffffff
shr r10d, 7
movzx ecx, word [rsi + r9*4 + 0x80]
cmp ecx, 0xffff
jne 0x1400286a9
mov word [rsi + r9*4 + 0x82], r10w
mov word [rsi + r9*4 + 0x80], r10w
mov r10d, r10d
mov rsi, qword [rsi + 0x100]
mov dword [rsi + r10*4], ebp
jmp 0x1400286f0
cmp ecx, r10d
cmovae ecx, r10d
mov word [rsi + r9*4 + 0x80], cx
movzx ecx, word [rsi + r9*4 + 0x82]
cmp ecx, r10d
cmovbe ecx, r10d
mov word [rsi + r9*4 + 0x82], cx
mov rdi, qword [rsi + 0x100]
mov r9, qword [rsi + 0x10]
mov r8d, dword [rdi + r10*4]
mov dword [r9 + rdx*4], r8d
mov rdx, qword [rsi + 0x100]
mov dword [rdx + r10*4], ebp
mov rax, rbx
add rsp, 0x228
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov r9d, 0x1000
test r8, r8
lea r10, [r8 + r8]
cmovne r9, r10
xor edx, edx
mov qword [rsi + 0x38], r9
shl r9, 3
mov rcx, qword [rsi + 0x48]
mov r8, qword [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov qword [rsi + 0x40], rax
jmp 0x1400285ef
lea r8, [0x14000a658]
lea rcx, [rsi + 0x60]
mov rdx, qword [rsi + 0x58]
call fcn.140045830
test eax, eax
je 0x14002878b
lea rdx, [0x14000a65c]
lea rcx, [rsp + 0x20]
call fcn.140041190
mov rdx, qword [rsi + 0x58]
lea rcx, [rsp + 0x20]
call fcn.1400411b0
xor ecx, ecx
lea rdx, [rsp + 0x20]
lea r8, [0x14000a678]
mov r9d, 0x10
call qword [sym.imp.USER32.dll_MessageBoxA]
int3
mov rcx, qword [rsi + 0x60]
jmp 0x140028548
mov r11d, 0x1000
test rcx, rcx
lea r10, [rcx + rcx]
cmovne r11, r10
xor edx, edx
mov rcx, qword [rsi + 0x18]
mov r8, qword [rsi + 0x10]
mov qword [rsi + 8], r11
lea r9, [r11 + r11*2]
shl r9, 2
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov qword [rsi + 0x10], rax
jmp 0x14002863b
mov r9d, 0x1000
test rcx, rcx
lea r10, [rcx + rcx]
cmovne r9, r10
xor edx, edx
mov qword [rsi + 0x38], r9
shl r9, 3
mov rcx, qword [rsi + 0x48]
mov r8, qword [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov qword [rsi + 0x40], rax
jmp 0x1400285ef
mov rcx, qword [rsi + 0x100]
mov rdx, rax
mov ebx, dword [r11]
mov rax, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x20]
mov dword [rcx + r8*4], ebx
cmp ebx, 0xffffffff
jne 0x140028887
cmp edi, r13d
jne 0x140028856
mov ecx, 0xffff
lea r8d, [rdi - 1]
mov word [rsi + rdx*4 + 0x82], cx
movsxd rbx, r8d
cmp r8d, r15d
jl 0x140028856
mov rcx, qword [rsi + 0x100]
cmp dword [rcx + rbx*4], 0xffffffff
jne 0x14002897c
dec r8d
dec rbx
cmp r8d, r15d
jge 0x140028841
cmp edi, r15d
jne 0x140028887
inc edi
mov ecx, 0xffff
mov word [rsi + rdx*4 + 0x80], cx
cmp edi, r13d
ja 0x140028887
mov rcx, qword [rsi + 0x100]
cmp dword [rcx + rdi*4], 0xffffffff
jne 0x14002896f
inc edi
cmp edi, r13d
jbe 0x140028876
movabs rdx, 0x800000000000
cmp rdx, r10
ja 0x140028927
add rax, r10
mov qword [r11 + 4], rax
mov rax, r10
sar rax, 0x28
mov edx, eax
shr edx, 0x12
mov dword [r11], 0xffffffff
shr eax, 7
movzx ecx, word [rsi + rdx*4 + 0x80]
cmp ecx, 0xffff
jne 0x1400288e6
mov word [rsi + rdx*4 + 0x82], ax
mov word [rsi + rdx*4 + 0x80], ax
mov eax, eax
mov rsi, qword [rsi + 0x100]
mov dword [rsi + rax*4], r12d
jmp 0x14002894e
cmp ecx, eax
cmovae ecx, eax
mov word [rsi + rdx*4 + 0x80], cx
movzx ecx, word [rsi + rdx*4 + 0x82]
cmp ecx, eax
cmovbe ecx, eax
mov word [rsi + rdx*4 + 0x82], cx
mov rdx, qword [rsi + 0x100]
mov rbp, qword [rsi + 0x10]
mov ebx, dword [rdx + rax*4]
mov dword [r14 + rbp], ebx
mov rsi, qword [rsi + 0x100]
mov dword [rsi + rax*4], r12d
jmp 0x14002894e
mov rax, qword [r11 + 4]
shr rax, 0x28
mov dword [rbp], eax
mov eax, dword [rsi + 0x28]
lea ecx, [rax + 1]
and ecx, 0xfff
cmp ecx, dword [rsi + 0x2c]
je 0x14002894e
mov rdx, qword [rsi + 0x20]
mov dword [rdx + rax*4], r9d
mov dword [rsi + 0x28], ecx
movabs rax, 0xffffffffff
and rax, r10
add rsp, 0x228
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov word [rsi + rdx*4 + 0x80], di
jmp 0x140028887
mov word [rsi + rdx*4 + 0x82], r8w
jmp 0x140028856
mov rbp, qword [rsi + 0x100]
mov dword [rbp + r8*4], r9d
cmp edi, r13d
jne 0x1400289d8
mov dword [rsi + rax*4 + 0x80], 0xffffffff
lea r9d, [rdi - 1]
movsxd r8, r9d
xor r13d, r13d
cmp r9d, r15d
jl 0x140028509
mov rbp, qword [rsi + 0x100]
cmp dword [rbp + r8*4], 0xffffffff
jne 0x140028a17
dec r9d
dec r8
cmp r9d, r15d
jge 0x1400289c0
jmp 0x140028509
cmp edi, r15d
jne 0x140028509
inc edi
cmp edi, r13d
ja 0x14002850b
mov rbp, qword [rsi + 0x100]
cmp dword [rbp + rdi*4], 0xffffffff
jne 0x140028a06
inc edi
cmp edi, r13d
jbe 0x1400289f3
jmp 0x14002850b
mov word [rsi + rax*4 + 0x80], di
movzx r15d, di
jmp 0x14002850b
mov word [rsi + rax*4 + 0x82], r9w
movzx r13d, r9w
mov word [rsi + rax*4 + 0x80], r15w
jmp 0x140028509