Function at 0x1400825f0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push r12
sub rsp, 0x50
mov ebp, r8d
mov r12, rdx
mov rsi, rcx
test rdx, rdx
jne 0x140082616
xor eax, eax
add rsp, 0x50
pop r12
pop rsi
pop rbp
ret
mov rcx, rdx
mov qword [rsp + 0x38], r14
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r14, rax
test rax, rax
jne 0x14008263a
mov r14, qword [rsp + 0x38]
add rsp, 0x50
pop r12
pop rsi
pop rbp
ret
mov ecx, dword [rax]
mov edx, dword [rax + 0x20]
mov qword [rsp + 0x70], rbx
add rcx, rax
lea rax, [rcx + rdx*4]
mov ecx, dword [r14 + 4]
mov qword [rsp + 0x20], rax
movzx eax, word [r14 + 0xe]
imul eax, ecx
add eax, 0x1f
cdq
and edx, 0x1f
lea ebx, [rdx + rax]
lea eax, [rcx + rcx*2]
lea eax, [rax*8 + 0x31f]
sar ebx, 5
cdq
shl ebx, 2
and edx, 0x1f
add eax, edx
sar eax, 5
shl eax, 2
mov dword [rsp + 0x88], eax
test ebx, ebx
jle 0x1400829b2
test eax, eax
jle 0x1400829b2
mov qword [rsp + 0x48], rdi
movsxd rdi, eax
mov ecx, 0x40
mov rdx, rdi
mov qword [rsp + 0x30], r15
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r15, rax
test rax, rax
jne 0x1400826d5
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor eax, eax
jmp 0x140082768
mov rdx, rdi
mov ecx, 0x40
mov qword [rsp + 0x40], r13
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r13, rax
test rax, rax
je 0x140082734
lea rdx, [0x140183390]
mov rcx, rsi
call fcn.1400fafe4
mov rsi, rax
test rax, rax
jne 0x140082785
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor eax, eax
mov r13, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov r15, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x38]
add rsp, 0x50
pop r12
pop rsi
pop rbp
ret
mov rcx, rax
cmp ebp, 1
jne 0x1400828a1
lea rdx, [0x14018a290]
call fcn.1400fe6b4
lea r8, [0x14018a240]
lea rdx, [0x14018a258]
mov rcx, rsi
call fcn.1400fe6b4
mov r9d, dword [r14 + 8]
mov r8d, dword [r14 + 4]
lea rdx, [0x14018a260]
mov rcx, rsi
call fcn.1400fe6b4
lea rdx, [0x14018a294]
mov rcx, rsi
call fcn.1400fe6b4
mov eax, dword [r14 + 8]
xor ebp, ebp
test eax, eax
jle 0x14008294f
movsxd rcx, ebx
xor r12d, r12d
mov qword [rsp + 0x28], rcx
sub eax, ebp
mov r8, rcx
dec eax
movsxd rdx, eax
imul rdx, rcx
mov rcx, r15
add rdx, qword [rsp + 0x20]
call fcn.1400fb0e0
mov r9d, dword [rsp + 0x88]
mov r8, r14
mov rdx, r13
mov rcx, r15
call fcn.140081a10
mov ebx, r12d
cmp dword [r14 + 4], ebx
jle 0x14008287a
mov rdi, r15
nop
movzx r8d, byte [rdi]
lea rdx, [0x14018a268]
mov rcx, rsi
call fcn.1400fe6b4
test ebx, ebx
jle 0x14008286a
mov eax, ebx
and eax, 0x8000000f
jge 0x140082857
dec eax
or eax, 0xfffffff0
inc eax
test eax, eax
jne 0x14008286a
lea rdx, [0x14018a26c]
mov rcx, rsi
call fcn.1400fe6b4
inc ebx
inc rdi
cmp ebx, dword [r14 + 4]
jl 0x140082830
cmp ebx, 0x10
jge 0x140082889
lea rdx, [0x14018a26c]
mov rcx, rsi
call fcn.1400fe6b4
mov eax, dword [r14 + 8]
mov rcx, qword [rsp + 0x28]
inc ebp
cmp ebp, eax
jl 0x1400827f2
jmp 0x14008294a
lea rdx, [0x14018a29c]
call fcn.1400fe6b4
lea r8, [0x14018a240]
lea rdx, [0x14018a258]
mov rcx, rsi
call fcn.1400fe6b4
mov r9d, dword [r14 + 8]
mov r8d, dword [r14 + 4]
lea rdx, [0x14018a260]
mov rcx, rsi
call fcn.1400fe6b4
lea rdx, [0x14018a294]
mov rcx, rsi
call fcn.1400fe6b4
mov eax, dword [r14 + 8]
xor edi, edi
test eax, eax
jle 0x14008294f
mov r12d, dword [rsp + 0x88]
movsxd rbx, ebx
nop
sub eax, edi
mov r8, rbx
mov rcx, r15
dec eax
movsxd rdx, eax
imul rdx, rbx
add rdx, qword [rsp + 0x20]
call fcn.1400fb0e0
mov r9d, r12d
mov r8, r14
mov rdx, r13
mov rcx, r15
call fcn.140081a10
movsxd r8, dword [r14 + 4]
mov r9, rsi
mov edx, 1
mov rcx, r15
call fcn.1400faf54
mov eax, dword [r14 + 8]
inc edi
cmp edi, eax
jl 0x140082900
mov r12, qword [rsp + 0x78]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, rsi
call fcn.1400fa904
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, 1
jmp 0x140082763
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor eax, eax
jmp 0x140082772