Function at 0x140005f50
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x6d0
mov rax, qword [0x14000f010]
xor rax, rsp
mov qword [rsp + 0x6c0], rax
xor esi, esi
mov r14, r8
cmp dword [rcx + 8], 0xffffffff
mov ebp, edx
mov rdi, rcx
je 0x140005fd6
mov qword [rsp + 0x708], r15
mov r15, qword [rcx]
test r15, r15
je 0x140005fce
mov rbx, qword [r15 + 0x80]
test rbx, rbx
je 0x140005fce
mov rcx, qword [rbx]
test rcx, rcx
je 0x140005faa
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx], rsi
cmp dword [rbx + 0x64], esi
je 0x140005fbb
lea rcx, [rbx + 8]
call fcn.140003a10
mov rcx, rbx
mov dword [rbx + 0x64], esi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [r15 + 0x80], rsi
mov r15, qword [rsp + 0x708]
mov rbx, qword [rdi]
mov dword [rdi + 8], 0xffffffff
cmp ebp, dword [rbx + 8]
jl 0x140006008
mov eax, 0x10000
mov rcx, qword [rsp + 0x6c0]
xor rcx, rsp
call fcn.1400081a0
add rsp, 0x6d0
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
cmp ebp, dword [rbx + 0x14]
jge 0x14000603c
test rbx, rbx
je 0x14000603c
mov eax, dword [rbx + 0x28]
lea r8, [rbx + 0x7c]
lea rdx, [rbx + 0x2c]
mov dword [rbx + 0x18], eax
xor r9d, r9d
mov dword [rbx + 0x14], esi
mov rcx, rbx
mov dword [rsp + 0x20], esi
call fcn.1400049a0
mov ecx, esi
test eax, eax
sete cl
mov dword [rbx + 0x1c], ecx
mov rbx, qword [rdi]
cmp dword [rbx + 0x14], ebp
jge 0x140006095
test rbx, rbx
je 0x14000608d
cmp dword [rbx + 0x1c], esi
je 0x14000608d
mov edx, dword [rbx + 0x14]
inc edx
cmp edx, dword [rbx + 8]
je 0x14000608d
mov ecx, dword [rbx + 0x54]
lea r8, [rbx + 0x7c]
add ecx, dword [rbx + 0x50]
xor r9d, r9d
mov eax, dword [rbx + 0x4c]
add eax, 0x2e
mov dword [rbx + 0x14], edx
add ecx, eax
mov dword [rsp + 0x20], esi
add dword [rbx + 0x18], ecx
lea rdx, [rbx + 0x2c]
mov rcx, rbx
call fcn.1400049a0
mov ecx, esi
test eax, eax
sete cl
mov dword [rbx + 0x1c], ecx
mov rbx, qword [rdi]
cmp dword [rbx + 0x14], ebp
jl 0x140006044
lea r8, [rsp + 0x60]
mov edx, ebp
mov rcx, rdi
call fcn.140005680
test byte [rsp + 0x26c], 0x10
movzx eax, word [r14]
je 0x1400060e4
cmp ax, 0x2f
je 0x1400060d2
cmp ax, 0x5c
je 0x1400060d2
test ax, ax
je 0x1400060cb
cmp word [r14 + 2], 0x3a
je 0x1400060d2
lea rsi, [rdi + 0x250]
mov rdx, r14
mov rcx, rsi
call fcn.140005de0
xor eax, eax
jmp 0x140005fea
mov r9, r14
mov rcx, r14
test ax, ax
je 0x140006111
nop
cmp ax, 0x2f
je 0x140006102
cmp ax, 0x5c
je 0x140006102
add rcx, 2
jmp 0x140006109
lea r9, [rcx + 2]
mov rcx, r9
movzx eax, word [rcx]
test ax, ax
jne 0x1400060f0
lea rdx, [rsp + 0x2a0]
mov rcx, r14
sub rdx, r14
nop
movzx eax, word [rcx]
mov word [rdx + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x140006120
cmp r9, r14
jne 0x14000613f
mov word [rsp + 0x2a0], si
jmp 0x140006183
mov rax, r9
sub rax, r14
sar rax, 1
add rax, rax
cmp rax, 0x208
jae 0x140006332
mov word [rsp + rax + 0x2a0], si
movzx eax, word [rsp + 0x2a0]
cmp ax, 0x2f
je 0x1400061b1
cmp ax, 0x5c
je 0x1400061b1
test ax, ax
je 0x140006183
cmp word [rsp + 0x2a2], 0x3a
je 0x1400061b1
mov qword [rsp + 0x20], r9
lea rbx, [rdi + 0x250]
mov r8, rbx
lea r9, [rsp + 0x2a0]
lea rdx, str._s_s_s
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x1400061d1
lea r8, [rsp + 0x2a0]
lea rdx, str._s_s
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rbx, rsi
lea rdx, [rsp + 0x2a0]
mov rcx, rbx
call fcn.140005de0
mov eax, dword [rsp + 0x26c]
lea rcx, [rsp + 0x4b0]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x140006225
mov eax, 0x200
jmp 0x140005fea
mov rdx, qword [rdi + 0x240]
mov rcx, qword [rdi]
call fcn.1400050b0
cmp qword [rdi + 0x248], rsi
jne 0x14000624e
mov ecx, 0x4000
call fcn.1400084cc
mov qword [rdi + 0x248], rax
mov ebp, esi
mov rdx, qword [rdi + 0x248]
lea r9, [rsp + 0x50]
mov rcx, qword [rdi]
mov r8d, 0x4000
call fcn.140005300
mov ebx, eax
cmp eax, 0xffffff96
je 0x1400062d7
test eax, eax
js 0x1400062a6
jle 0x14000629b
mov rdx, qword [rdi + 0x248]
lea r9, [rsp + 0x290]
mov r8d, eax
mov qword [rsp + 0x20], rsi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400062ad
cmp byte [rsp + 0x50], sil
jne 0x1400062b4
test ebx, ebx
jne 0x140006250
mov ebp, 0x5000000
jmp 0x1400062dc
mov ebp, 0x400
jmp 0x1400062dc
lea r9, [rsp + 0x280]
mov rcx, r14
lea r8, [rsp + 0x270]
lea rdx, [rsp + 0x278]
call qword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x1400062dc
mov ebp, 0x1000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rdi]
test rdi, rdi
je 0x14000632b
mov rbx, qword [rdi + 0x80]
test rbx, rbx
je 0x14000632b
mov rcx, qword [rbx]
test rcx, rcx
je 0x140006307
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx], rsi
cmp dword [rbx + 0x64], esi
je 0x140006318
lea rcx, [rbx + 8]
call fcn.140003a10
mov rcx, rbx
mov dword [rbx + 0x64], esi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x80], rsi
mov eax, ebp
jmp 0x140005fea
call fcn.140008338
int3