Function at 0x140002469
Capabilities:
Write file on windows

Disassembly:
jmp 0x14004c520
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
push rbp
sub rsp, 0x48
mov r12, rcx
mov r14, r8
mov rdi, rdx
xor sil, sil
test r12, r12
je 0x14004cbb4
movzx ebx, byte [r12 + 0x280]
xor eax, eax
movzx r8d, byte [r12 + 0x281]
and ebx, 0x80
mov ebp, r8d
shr ebx, 7
and ebp, 1
mov r13, qword [r12 + 0x198]
mov r15, qword [r12 + 0x238]
mov qword [r12 + 0x170], rax
mov qword [r12 + 0x1b0], rax
test r14, r14
jne 0x14004c723
mov ebx, 1
test byte [r12 + 0x27d], 4
jne 0x14004c66f
mov rdx, qword [r12 + 0x100]
test rdx, rdx
je 0x14004c5b8
cmp byte [rdx + 0x32], 0
jne 0x14004c5c6
test r12, r12
jne 0x14004ca54
jmp 0x14004ca60
mov rax, rsp
mov rcx, r13
mov rdx, qword [r12 + 0x90]
lea r9, [rsp + 0x40]
mov rbp, qword [r12 + 0x98]
sub rbp, rdx
mov r8d, ebp
mov qword [rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, eax
mov rcx, qword [r12 + 0x70]
mov esi, 0xffffffff
test ebx, ebx
mov r8, qword [r12 + 0x1c0]
cmove ebx, esi
mov edx, 0x20
and byte [r12 + 0x27d], 0xfb
mov qword [r12 + 0x80], 0
lea rdi, [rcx + r8]
mov qword [r12 + 0x88], rdi
mov qword [r12 + 0x78], rcx
mov qword [r12 + 0x98], rcx
call fcn.140003ad0
mov rdx, qword [r12 + 0x168]
add rbp, rdx
mov qword [r12 + 0x168], rbp
test r12, r12
mov qword [r12 + 0x160], rbp
jne 0x14004ca54
jmp 0x14004ca60
mov rax, rsp
mov rcx, r13
mov rdx, qword [r12 + 0x70]
lea r9, [rsp + 0x40]
mov rbp, qword [r12 + 0x80]
sub rbp, rdx
mov r8d, ebp
mov qword [rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, eax
mov edx, 0xffffffff
test ebx, ebx
mov rsi, qword [r12 + 0x70]
mov rcx, qword [r12 + 0x1c0]
cmove ebx, edx
mov rdx, qword [r12 + 0x168]
add rcx, rsi
and byte [r12 + 0x27d], 0xfb
add rdx, rbp
mov qword [r12 + 0x80], 0
mov qword [r12 + 0x88], rcx
mov qword [r12 + 0x78], rsi
mov qword [r12 + 0x168], rdx
test byte [r12 + 0x281], 0x20
je 0x14004c70d
mov qword [r12 + 0x160], rdx
test r12, r12
jne 0x14004ca54
jmp 0x14004ca60
add qword [r12 + 0x160], rbp
test r12, r12
jne 0x14004ca54
jmp 0x14004ca60
mov r11, qword [r12 + 0x80]
test r11, r11
je 0x14004c7c3
cmp rdi, r11
je 0x14004c7c3
mov rdx, qword [r12 + 0x70]
sub r11, rdx
je 0x14004c7c3
mov rax, rsp
mov rcx, r13
mov r8d, r11d
lea r9, [rsp + 0x40]
mov qword [rax + 0x20], 0
mov qword [r9 - 0x10], r11
mov qword [r9 - 8], r10
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r10, qword [rsp + 0x38]
mov r11, qword [rsp + 0x30]
test eax, eax
jne 0x14004c78c
mov ebx, 0xffffffff
test r12, r12
jne 0x14004ca54
jmp 0x14004ca60
mov rax, qword [r12 + 0x168]
movzx r8d, byte [r12 + 0x281]
add rax, r11
mov qword [r12 + 0x168], rax
test r8d, 0x20
je 0x14004c7bb
mov qword [r12 + 0x160], rax
jmp 0x14004c7c3
add qword [r12 + 0x160], r11
cmp dword [0x140191994], 0
je 0x14004c86d
test r15, r15
je 0x14004c779
test ebx, ebx
je 0x14004c7f3
cmp r15, 0xfffffffffffffffa
je 0x14004ca73
lea rax, [r15 - 1]
cmp rax, 1
jbe 0x14004c7fd
test ebp, ebp
jne 0x14004c819
jmp 0x14004c86d
lea rax, [r15 - 1]
cmp rax, 1
ja 0x14004c86d
mov sil, 1
call fcn.1400019fb
movsxd r10, eax
cmp dword [0x140191994], 0
je 0x14004c83e
test ebx, ebx
je 0x14004c83e
test ebp, ebp
je 0x14004c83e
mov eax, r10d
mov ecx, eax
mov dword [rsp + 0x30], eax
call fcn.1400041a6
mov eax, dword [rsp + 0x30]
test sil, sil
jne 0x14004c83e
test r12, r12
je 0x14004ca89
jmp 0x14004cc15
mov rcx, rdi
mov edx, r14d
mov r8d, eax
xor r9d, r9d
call fcn.14000213a
mov ebx, eax
movsxd rbx, ebx
mov edx, 0xffffffff
cmp rbx, r14
cmovne ebx, edx
test r12, r12
jne 0x14004ca54
jmp 0x14004ca60
mov ebx, 1
test r8d, 0x40
jne 0x14004c885
mov r10, qword [r12 + 0x80]
jmp 0x14004c8cc
test byte [r12 + 0x27f], 1
jne 0x14004c87b
mov r8, qword [r12 + 0x70]
mov r10, qword [r12 + 0x80]
cmp rdi, r8
je 0x14004c8a7
cmp rdi, r10
jne 0x14004c8dc
mov r11, qword [r12 + 0x1c0]
mov rsi, qword [r12 + 0x78]
mov rbp, qword [r12 + 0x1a8]
add r8, rbp
lea r9, [rsi + r11*2]
cmp r8, r9
ja 0x14004ca26
cmp rdi, r10
jne 0x14004c8dc
mov rdi, qword [r12 + 0x70]
sub r10, rdi
add r14, r10
mov rsi, qword [r12 + 0x230]
test rsi, rsi
je 0x14004c8f7
cmp r14, rsi
jbe 0x14004c97a
mov rax, r14
jmp 0x14004c908
cmp r14, 0x20000
jbe 0x14004c97a
mov rax, r14
mov esi, 0x20000
mov qword [rsp + 0x30], r14
mov rbp, rdi
mov ebx, r14d
mov r14, rdi
mov rdi, rax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp r13, rax
je 0x14004cae9
mov r10, rsp
mov rcx, r13
mov rdx, rbp
mov r8d, esi
lea r9, [rsp + 0x40]
mov qword [r10 + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
je 0x14004caa7
test rdi, rdi
je 0x14004ca9b
cmp eax, 1
jne 0x14004ca9b
mov r10d, dword [rsp + 0x40]
test r10d, r10d
ja 0x14004c919
mov r14, qword [rsp + 0x30]
mov ebx, eax
jmp 0x14004c9c2
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp r13, rax
je 0x14004cb5c
mov rax, rsp
mov rcx, r13
mov rdx, rdi
mov r8d, r14d
lea r9, [rsp + 0x40]
mov qword [rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, eax
test ebx, ebx
jne 0x14004c9c2
cmp r15, 1
je 0x14004cb46
mov ebx, 0xffffffff
test r12, r12
je 0x14004ca52
mov rdx, qword [r12 + 0x70]
add rdx, qword [r12 + 0x1c0]
mov qword [r12 + 0x88], rdx
mov rdx, r14
add rdx, qword [r12 + 0x168]
and byte [r12 + 0x27d], 0xfb
mov qword [r12 + 0x80], 0
mov qword [r12 + 0x168], rdx
test byte [r12 + 0x281], 0x20
jne 0x14004c6f7
add qword [r12 + 0x160], r14
test r12, r12
jne 0x14004ca54
jmp 0x14004ca60
or byte [r12 + 0x27d], 4
add rdi, r14
add qword [r12 + 0x88], r11
add qword [r12 + 0x160], r14
mov qword [r12 + 0x80], rdi
test r12, r12
mov qword [r12 + 0x78], rdi
je 0x14004ca60
mov qword [r12 + 0x150], 0
mov eax, ebx
add rsp, 0x48
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov sil, 1
mov r10, r13
test ebp, ebp
jne 0x14004c819
mov eax, r13d
jmp 0x14004c83e
cmp r14, 0x20000
jbe 0x14004c97a
jmp 0x14004c900
mov r14, qword [rsp + 0x30]
mov ebx, eax
jmp 0x14004c9af
mov r10d, dword [rsp + 0x40]
mov r9d, r10d
add rbp, r9
sub rdi, r9
test r12, r12
je 0x14004cac7
mov r9, qword [r12 + 0x230]
test r9, r9
jne 0x14004cacd
mov r9d, 0x20000
cmp rdi, r9
cmovbe rsi, rdi
test rdi, rdi
jne 0x14004c96c
mov r14, qword [rsp + 0x30]
mov ebx, eax
jmp 0x14004c9c2
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
jne 0x14004c92d
mov r8d, esi
mov ecx, 1
mov rdx, rbp
call fcn.1400025d6
cmp eax, 0xffffffff
je 0x14004cb22
mov r9d, eax
mov eax, 1
mov r10d, r9d
mov dword [rsp + 0x40], r10d
jmp 0x14004caaf
mov r10, rsp
mov rcx, r13
mov rdx, r14
mov r8d, ebx
lea r9, [rsp + 0x40]
mov qword [r10 + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x14004c94c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 6
jne 0x14004c9bd
xor ebx, ebx
jmp 0x14004c9c2
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
jne 0x14004c98e
mov r8d, r14d
mov ecx, 1
mov rdx, rdi
mov ebx, r14d
call fcn.1400025d6
cmp eax, 0xffffffff
je 0x14004cb90
mov ebx, 1
jmp 0x14004c9c2
mov rax, rsp
mov rcx, r13
mov rdx, rdi
mov r8d, ebx
lea r9, [rsp + 0x40]
mov qword [rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x14004c9ad
cmp dword [0x140191994], 0
jne 0x14004cc0b
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r13, rax
mov ebx, dword [0x140191994]
mov ebp, ebx
mov r15d, 1
test r14, r14
jne 0x14004cbf1
mov ebx, 1
test r12, r12
jne 0x14004ca54
jmp 0x14004ca60
test ebx, ebx
jne 0x14004c7fd
cmp r14, 0x20000
jbe 0x14004c97a
jmp 0x14004c900
call fcn.1400019fb
movsxd r13, eax
jmp 0x14004cbcb
movzx r8d, byte [r12 + 0x281]
jmp 0x14004c86d