Function at 0x1400531a0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x6c8
mov rax, qword [0x1402ca920]
xor rax, rsp
mov qword [rsp + 0x6b0], rax
cmp dword [rcx + 8], 0xffffffff
mov rsi, r8
mov r14d, edx
mov rdi, rcx
je 0x1400531d6
mov rcx, qword [rcx]
call fcn.140052670
mov rbx, qword [rdi]
mov dword [rdi + 8], 0xffffffff
cmp r14d, dword [rbx + 8]
jl 0x1400531f0
mov eax, 0x10000
jmp 0x1400532fd
mov qword [rsp + 0x6f8], rbp
xor ebp, ebp
cmp dword [rbx + 0x14], r14d
jle 0x140053246
mov qword [rsp + 0x6c0], r15
test rbx, rbx
je 0x14005323a
mov eax, dword [rbx + 0x28]
lea r8, [rbx + 0x7c]
lea rdx, [rbx + 0x2c]
mov dword [rbx + 0x18], eax
xor r9d, r9d
mov dword [rbx + 0x14], ebp
mov rcx, rbx
mov dword [rsp + 0x20], ebp
call fcn.1400519d0
mov ecx, ebp
test eax, eax
sete cl
mov dword [rbx + 0x1c], ecx
mov rbx, qword [rdi]
mov r15, qword [rsp + 0x6c0]
cmp dword [rbx + 0x14], r14d
jge 0x1400532a0
mov rax, rbx
test rbx, rbx
je 0x140053297
cmp dword [rbx + 0x1c], ebp
je 0x140053297
mov edx, dword [rbx + 0x14]
inc edx
cmp edx, dword [rbx + 8]
je 0x140053297
mov ecx, dword [rbx + 0x54]
lea r8, [rbx + 0x7c]
add ecx, dword [rbx + 0x50]
xor r9d, r9d
mov eax, dword [rbx + 0x4c]
add eax, 0x2e
mov dword [rbx + 0x14], edx
add ecx, eax
mov dword [rsp + 0x20], ebp
add dword [rbx + 0x18], ecx
lea rdx, [rbx + 0x2c]
mov rcx, rbx
call fcn.1400519d0
test eax, eax
mov ecx, ebp
sete cl
mov dword [rbx + 0x1c], ecx
mov rax, qword [rdi]
mov rbx, rax
cmp dword [rax + 0x14], r14d
jl 0x140053248
lea r8, [rsp + 0x60]
mov edx, r14d
mov rcx, rdi
call fcn.140052910
test byte [rsp + 0x26c], 0x10
movzx eax, word [rsi]
je 0x14005331a
cmp ax, 0x2f
je 0x1400532d9
cmp ax, 0x5c
je 0x1400532d9
test ax, ax
je 0x1400532d5
cmp word [rsi + 2], 0x3a
je 0x1400532d9
xor cl, cl
jmp 0x1400532db
mov cl, 1
test cl, cl
lea rax, [rdi + 0x250]
mov rdx, rsi
cmove rbp, rax
mov rcx, rbp
call fcn.140053030
xor eax, eax
mov rbp, qword [rsp + 0x6f8]
mov rcx, qword [rsp + 0x6b0]
xor rcx, rsp
call fcn.1401f2820
add rsp, 0x6c8
pop r14
pop rdi
pop rsi
pop rbx
ret
mov r9, rsi
mov rcx, rsi
test ax, ax
je 0x140053342
cmp ax, 0x2f
je 0x140053331
cmp ax, 0x5c
jne 0x140053335
lea r9, [rcx + 2]
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x140053325
lea rdx, [rsp + 0x290]
mov rcx, rsi
sub rdx, rsi
movzx eax, word [rcx]
mov word [rcx + rdx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x140053350
cmp r9, rsi
jne 0x14005336f
mov word [rsp + 0x290], bp
jmp 0x1400533b3
mov rax, r9
sub rax, rsi
sar rax, 1
add rax, rax
cmp rax, 0x208
jae 0x140053535
mov word [rsp + rax + 0x290], bp
movzx eax, word [rsp + 0x290]
cmp ax, 0x2f
je 0x1400533e1
cmp ax, 0x5c
je 0x1400533e1
test ax, ax
je 0x1400533b3
cmp word [rsp + 0x292], 0x3a
je 0x1400533e1
mov qword [rsp + 0x20], r9
lea rbx, [rdi + 0x250]
mov r8, rbx
lea r9, [rsp + 0x290]
lea rdx, str._s_s_s
lea rcx, [rsp + 0x4a0]
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x140053401
lea r8, [rsp + 0x290]
lea rdx, str._s_s
lea rcx, [rsp + 0x4a0]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rbx, rbp
lea rdx, [rsp + 0x290]
mov rcx, rbx
call fcn.140053030
mov eax, dword [rsp + 0x26c]
lea rcx, [rsp + 0x4a0]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140053455
mov eax, 0x200
jmp 0x1400532f5
mov rdx, qword [rdi + 0x240]
mov rcx, qword [rdi]
call fcn.1400520d0
cmp qword [rdi + 0x248], rbp
jne 0x140053480
mov ecx, 0x4000
call fcn.140054410
mov qword [rdi + 0x248], rax
nop
mov rdx, qword [rdi + 0x248]
lea r9, [rsp + 0x50]
mov rcx, qword [rdi]
mov r8d, 0x4000
call fcn.1400522f0
mov ebx, eax
cmp eax, 0xffffff96
je 0x140053518
test eax, eax
js 0x1400534d3
jle 0x1400534c8
mov rdx, qword [rdi + 0x248]
lea r9, [rsp + 0x54]
mov r8d, eax
mov qword [rsp + 0x20], rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400534da
cmp byte [rsp + 0x50], bpl
jne 0x1400534e1
test ebx, ebx
jne 0x140053480
mov ebx, 0x5000000
jmp 0x14005351d
mov ebx, 0x400
jmp 0x14005351d
lea r9, [rsp + 0x280]
mov rcx, rsi
lea r8, [rsp + 0x270]
lea rdx, [rsp + 0x278]
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi]
call fcn.140052670
jmp 0x1400532f3
mov ebx, 0x1000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi]
call fcn.140052670
mov eax, ebx
jmp 0x1400532f5
call fcn.1401f2e5c
int3