Function at 0x1400c7d50
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x6c0
mov rax, qword [0x140304f48]
xor rax, rsp
mov qword [rsp + 0x6b0], rax
mov r13d, dword [rsp + 0x710]
mov r15d, r9d
mov r14, r8
mov ebp, edx
mov rsi, rcx
lea eax, [r13 - 1]
cmp eax, 2
ja 0x1400c821c
mov eax, dword [rcx + 8]
cmp r13d, 3
jne 0x1400c7eb7
cmp edx, eax
je 0x1400c7e5f
cmp eax, 0xffffffff
je 0x1400c7dbd
mov rcx, qword [rcx]
call fcn.1400caaf0
mov rcx, qword [rsi]
mov dword [rsi + 8], 0xffffffff
cmp ebp, dword [rcx + 8]
jge 0x1400c821c
cmp dword [rcx + 0x14], ebp
jle 0x1400c7de0
call fcn.1400caba0
mov rcx, qword [rsi]
cmp dword [rcx + 0x14], ebp
jge 0x1400c7e50
mov rbx, rcx
xor edi, edi
mov rcx, rbx
test rbx, rbx
je 0x1400c7e48
cmp dword [rbx + 0x1c], edi
je 0x1400c7e48
mov edx, dword [rbx + 0x14]
inc edx
cmp edx, dword [rbx + 8]
je 0x1400c7e48
mov ecx, dword [rbx + 0x54]
lea r8, [rbx + 0x7c]
add ecx, dword [rbx + 0x50]
xor r9d, r9d
mov eax, dword [rbx + 0x4c]
mov dword [rsp + 0x40], edi
add eax, 0x2e
add ecx, eax
mov qword [rsp + 0x38], rdi
add dword [rbx + 0x18], ecx
mov rcx, rbx
mov dword [rbx + 0x14], edx
lea rdx, [rbx + 0x2c]
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
call fcn.1400cb770
mov ecx, edi
test eax, eax
sete cl
mov dword [rbx + 0x1c], ecx
mov rcx, qword [rsi]
mov rbx, rcx
cmp dword [rcx + 0x14], ebp
jl 0x1400c7de7
mov rdx, qword [rsi + 0x240]
call fcn.1400cac00
mov dword [rsi + 8], ebp
mov rcx, qword [rsi]
lea r9, [rsp + 0x50]
mov r8d, r15d
mov rdx, r14
call fcn.1400cb140
mov ebx, eax
test eax, eax
jg 0x1400c7e87
mov rcx, qword [rsi]
call fcn.1400caaf0
mov dword [rsi + 8], 0xffffffff
cmp byte [rsp + 0x50], 0
jne 0x1400c7fee
test ebx, ebx
jle 0x1400c7ea0
mov eax, 0x600
jmp 0x1400c8221
mov eax, 0x1000
cmp ebx, 0xffffff96
mov edi, 0x5000000
cmove edi, eax
mov eax, edi
jmp 0x1400c8221
cmp eax, 0xffffffff
je 0x1400c7ec4
mov rcx, qword [rcx]
call fcn.1400caaf0
mov rbx, qword [rsi]
mov dword [rsi + 8], 0xffffffff
cmp ebp, dword [rbx + 8]
jge 0x1400c821c
xor edi, edi
cmp dword [rbx + 0x14], ebp
jle 0x1400c7f25
test rbx, rbx
je 0x1400c7f22
mov eax, dword [rbx + 0x28]
lea r8, [rbx + 0x7c]
mov dword [rsp + 0x40], edi
lea rdx, [rbx + 0x2c]
mov qword [rsp + 0x38], rdi
xor r9d, r9d
mov dword [rsp + 0x30], edi
mov rcx, rbx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
mov dword [rbx + 0x18], eax
mov dword [rbx + 0x14], edi
call fcn.1400cb770
mov ecx, edi
test eax, eax
sete cl
mov dword [rbx + 0x1c], ecx
mov rbx, qword [rsi]
cmp dword [rbx + 0x14], ebp
jge 0x1400c7f90
mov rax, rbx
test rbx, rbx
je 0x1400c7f88
cmp dword [rbx + 0x1c], edi
je 0x1400c7f88
mov edx, dword [rbx + 0x14]
inc edx
cmp edx, dword [rbx + 8]
je 0x1400c7f88
mov ecx, dword [rbx + 0x54]
lea r8, [rbx + 0x7c]
add ecx, dword [rbx + 0x50]
xor r9d, r9d
mov eax, dword [rbx + 0x4c]
mov dword [rsp + 0x40], edi
add eax, 0x2e
add ecx, eax
mov qword [rsp + 0x38], rdi
add dword [rbx + 0x18], ecx
mov rcx, rbx
mov dword [rbx + 0x14], edx
lea rdx, [rbx + 0x2c]
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
call fcn.1400cb770
test eax, eax
mov ecx, edi
sete cl
mov dword [rbx + 0x1c], ecx
mov rax, qword [rsi]
mov rbx, rax
cmp dword [rax + 0x14], ebp
jl 0x1400c7f27
lea r8, [rsp + 0x60]
mov edx, ebp
mov rcx, rsi
call fcn.1400c71e0
mov eax, dword [rsp + 0x26c]
shr eax, 4
test al, 1
je 0x1400c7ff5
cmp r13d, 1
je 0x1400c7fee
movzx eax, word [r14]
cmp ax, 0x2f
je 0x1400c7fd4
cmp ax, 0x5c
je 0x1400c7fd4
test ax, ax
je 0x1400c7fd0
cmp word [r14 + 2], 0x3a
je 0x1400c7fd4
xor cl, cl
jmp 0x1400c7fd6
mov cl, 1
test cl, cl
lea rax, [rsi + 0x250]
mov rdx, r14
cmove rdi, rax
mov rcx, rdi
call fcn.1400c7000
xor eax, eax
jmp 0x1400c8221
mov word [rsp + 0x4a0], di
cmp r13d, 1
je 0x1400c8130
movzx eax, word [r14]
mov rbx, r14
mov rcx, r14
test ax, ax
je 0x1400c8033
cmp ax, 0x2f
je 0x1400c8022
cmp ax, 0x5c
jne 0x1400c8026
lea rbx, [rcx + 2]
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x1400c8016
mov r8d, 0x104
lea rcx, [rsp + 0x290]
mov rdx, r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
cmp rbx, r14
jne 0x1400c8059
mov word [rsp + 0x290], di
jmp 0x1400c809d
mov rax, rbx
sub rax, r14
sar rax, 1
add rax, rax
cmp rax, 0x208
jae 0x1400c824d
mov word [rsp + rax + 0x290], di
movzx eax, word [rsp + 0x290]
cmp ax, 0x2f
je 0x1400c80ca
cmp ax, 0x5c
je 0x1400c80ca
test ax, ax
je 0x1400c809d
cmp word [rsp + 0x292], 0x3a
je 0x1400c80ca
lea rbp, [rsi + 0x250]
mov qword [rsp + 0x20], rbx
mov r8, rbp
lea r9, [rsp + 0x290]
lea rdx, str._s_s_s
lea rcx, [rsp + 0x4a0]
call fcn.1400ca970
jmp 0x1400c80ec
mov r9, rbx
lea r8, [rsp + 0x290]
lea rdx, str._s_s
lea rcx, [rsp + 0x4a0]
call fcn.1400ca970
mov rbp, rdi
lea rdx, [rsp + 0x290]
mov rcx, rbp
call fcn.1400c7000
mov eax, dword [rsp + 0x26c]
lea rcx, [rsp + 0x4a0]
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp r14, 0xffffffffffffffff
jne 0x1400c8140
mov eax, 0x200
jmp 0x1400c8221
mov rdx, qword [rsi + 0x240]
mov rcx, qword [rsi]
call fcn.1400cac00
cmp qword [rsi + 0x248], rdi
jne 0x1400c8170
mov ecx, 0x4000
call fcn.1401801d0
mov qword [rsi + 0x248], rax
nop dword [rax]
mov rdx, qword [rsi + 0x248]
lea r9, [rsp + 0x50]
mov rcx, qword [rsi]
mov r8d, 0x4000
call fcn.1400cb140
mov ebx, eax
cmp eax, 0xffffff96
je 0x1400c81fc
test eax, eax
js 0x1400c81c3
jle 0x1400c81b8
mov rdx, qword [rsi + 0x248]
lea r9, [rsp + 0x54]
mov r8d, eax
mov qword [rsp + 0x20], rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400c81ca
cmp byte [rsp + 0x50], dil
jne 0x1400c81d1
test ebx, ebx
jne 0x1400c8170
mov edi, 0x5000000
jmp 0x1400c8201
mov edi, 0x400
jmp 0x1400c8201
mov rcx, qword [rsi]
call fcn.1400caaf0
lea r9, [rsp + 0x280]
mov rcx, r14
lea r8, [rsp + 0x270]
lea rdx, [rsp + 0x278]
call qword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x1400c8209
mov edi, 0x1000
mov rcx, qword [rsi]
call fcn.1400caaf0
cmp r13d, 1
je 0x1400c8218
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x1400c8221
mov eax, 0x10000
mov rcx, qword [rsp + 0x6b0]
xor rcx, rsp
call fcn.140180070
lea r11, [rsp + 0x6c0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
call fcn.140180358
int3