Function at 0x14000d750
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x3c0
mov rax, qword [0x140030008]
xor rax, rsp
mov qword [rsp + 0x3b0], rax
cmp dword [rcx + 8], 0xffffffff
mov rsi, r8
mov ebp, edx
mov rdi, rcx
je 0x14000d783
mov rcx, qword [rcx]
call fcn.14000cd60
mov rcx, qword [rdi]
mov dword [rdi + 8], 0xffffffff
cmp ebp, dword [rcx + 8]
jl 0x14000d79c
mov eax, 0x10000
jmp 0x14000d86b
mov qword [rsp + 0x3f8], r14
cmp ebp, dword [rcx + 0x14]
jge 0x14000d7ae
call fcn.14000c550
mov rax, qword [rdi]
xor r14d, r14d
mov qword [rsp + 0x3e8], rbx
cmp dword [rax + 0x14], ebp
jge 0x14000d818
mov rbx, qword [rdi]
test rbx, rbx
je 0x14000d810
cmp dword [rbx + 0x1c], r14d
je 0x14000d810
mov edx, dword [rbx + 0x14]
inc edx
cmp edx, dword [rbx + 8]
je 0x14000d810
mov ecx, dword [rbx + 0x54]
lea r8, [rbx + 0x7c]
add ecx, dword [rbx + 0x50]
xor r9d, r9d
mov eax, dword [rbx + 0x4c]
add eax, 0x2e
mov dword [rbx + 0x14], edx
add ecx, eax
mov dword [rsp + 0x20], r14d
add dword [rbx + 0x18], ecx
lea rdx, [rbx + 0x2c]
mov rcx, rbx
call fcn.14000c2d0
mov ecx, r14d
test eax, eax
sete cl
mov dword [rbx + 0x1c], ecx
mov rax, qword [rdi]
cmp dword [rax + 0x14], ebp
jl 0x14000d7c1
lea r8, [rsp + 0x60]
mov edx, ebp
mov rcx, rdi
call fcn.14000cf90
test byte [rsp + 0x168], 0x10
movzx eax, byte [rsi]
je 0x14000d886
cmp al, 0x2f
je 0x14000d84f
cmp al, 0x5c
je 0x14000d84f
test al, al
je 0x14000d846
cmp byte [rsi + 1], 0x3a
je 0x14000d84f
lea rcx, [rdi + 0x150]
jmp 0x14000d851
xor ecx, ecx
mov rdx, rsi
call fcn.14000d5f0
xor eax, eax
mov rbx, qword [rsp + 0x3e8]
mov r14, qword [rsp + 0x3f8]
mov rcx, qword [rsp + 0x3b0]
xor rcx, rsp
call fcn.14000e940
add rsp, 0x3c0
pop rdi
pop rsi
pop rbp
ret
mov r9, rsi
mov rcx, rsi
test al, al
je 0x14000d8a7
cmp al, 0x2f
je 0x14000d898
cmp al, 0x5c
jne 0x14000d89c
lea r9, [rcx + 1]
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x14000d890
lea rdx, [rsp + 0x190]
mov rcx, rsi
sub rdx, rsi
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x14000d8c0
cmp r9, rsi
jne 0x14000d8dd
mov byte [rsp + 0x190], r14b
jmp 0x14000d915
mov rax, r9
sub rax, rsi
cmp rax, 0x104
jae 0x14000da85
mov byte [rsp + rax + 0x190], r14b
movzx eax, byte [rsp + 0x190]
cmp al, 0x2f
je 0x14000d947
cmp al, 0x5c
je 0x14000d947
test al, al
je 0x14000d915
cmp byte [rsp + 0x191], 0x3a
je 0x14000d947
mov qword [rsp + 0x20], r9
lea r8, [rdi + 0x150]
lea r9, [rsp + 0x190]
lea rdx, str._s_s_s
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rdi + 0x150]
jmp 0x14000d966
lea r8, [rsp + 0x190]
lea rdx, str._s_s
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.USER32.dll_wsprintfA]
xor ecx, ecx
lea rdx, [rsp + 0x190]
call fcn.14000d5f0
mov eax, dword [rsp + 0x168]
lea rcx, [rsp + 0x2a0]
mov qword [rsp + 0x30], r14
xor r9d, r9d
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000d9b7
mov eax, 0x200
jmp 0x14000d85b
mov rdx, qword [rdi + 0x140]
mov rcx, qword [rdi]
call fcn.14000c7f0
cmp qword [rdi + 0x148], r14
jne 0x14000d9e0
mov ecx, 0x4000
call fcn.14000e9a8
mov qword [rdi + 0x148], rax
mov rdx, qword [rdi + 0x148]
lea r9, [rsp + 0x50]
mov rcx, qword [rdi]
mov r8d, 0x4000
call fcn.14000ca10
mov ebx, eax
cmp eax, 0xffffff96
je 0x14000da66
test eax, eax
js 0x14000da33
jle 0x14000da28
mov rdx, qword [rdi + 0x148]
lea r9, [rsp + 0x54]
mov r8d, eax
mov qword [rsp + 0x20], r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000da3b
cmp byte [rsp + 0x50], r14b
jne 0x14000da43
test ebx, ebx
jne 0x14000d9e0
mov r14d, 0x5000000
jmp 0x14000da6c
mov r14d, 0x400
jmp 0x14000da6c
lea r9, [rsp + 0x17c]
mov rcx, rsi
lea r8, [rsp + 0x16c]
lea rdx, [rsp + 0x174]
call qword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x14000da6c
mov r14d, 0x1000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi]
call fcn.14000cd60
mov eax, r14d
jmp 0x14000d85b
call fcn.14000ed94
int3