Function at 0x1400bcc80
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x6c0
mov rax, qword [0x1402ecca8]
xor rax, rsp
mov qword [rsp + 0x6b0], rax
mov r13d, dword [rsp + 0x710]
mov r15d, r9d
mov r14, r8
mov ebp, edx
mov rsi, rcx
lea eax, [r13 - 1]
cmp eax, 2
ja 0x1400bd14c
mov eax, dword [rcx + 8]
cmp r13d, 3
jne 0x1400bcde7
cmp edx, eax
je 0x1400bcd8f
cmp eax, 0xffffffff
je 0x1400bcced
mov rcx, qword [rcx]
call fcn.1400bfa20
mov rcx, qword [rsi]
mov dword [rsi + 8], 0xffffffff
cmp ebp, dword [rcx + 8]
jge 0x1400bd14c
cmp dword [rcx + 0x14], ebp
jle 0x1400bcd10
call fcn.1400bfad0
mov rcx, qword [rsi]
cmp dword [rcx + 0x14], ebp
jge 0x1400bcd80
mov rbx, rcx
xor edi, edi
mov rcx, rbx
test rbx, rbx
je 0x1400bcd78
cmp dword [rbx + 0x1c], edi
je 0x1400bcd78
mov edx, dword [rbx + 0x14]
inc edx
cmp edx, dword [rbx + 8]
je 0x1400bcd78
mov ecx, dword [rbx + 0x54]
lea r8, [rbx + 0x7c]
add ecx, dword [rbx + 0x50]
xor r9d, r9d
mov eax, dword [rbx + 0x4c]
mov dword [rsp + 0x40], edi
add eax, 0x2e
add ecx, eax
mov qword [rsp + 0x38], rdi
add dword [rbx + 0x18], ecx
mov rcx, rbx
mov dword [rbx + 0x14], edx
lea rdx, [rbx + 0x2c]
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
call fcn.1400c06a0
mov ecx, edi
test eax, eax
sete cl
mov dword [rbx + 0x1c], ecx
mov rcx, qword [rsi]
mov rbx, rcx
cmp dword [rcx + 0x14], ebp
jl 0x1400bcd17
mov rdx, qword [rsi + 0x240]
call fcn.1400bfb30
mov dword [rsi + 8], ebp
mov rcx, qword [rsi]
lea r9, [rsp + 0x50]
mov r8d, r15d
mov rdx, r14
call fcn.1400c0070
mov ebx, eax
test eax, eax
jg 0x1400bcdb7
mov rcx, qword [rsi]
call fcn.1400bfa20
mov dword [rsi + 8], 0xffffffff
cmp byte [rsp + 0x50], 0
jne 0x1400bcf1e
test ebx, ebx
jle 0x1400bcdd0
mov eax, 0x600
jmp 0x1400bd151
mov eax, 0x1000
cmp ebx, 0xffffff96
mov edi, 0x5000000
cmove edi, eax
mov eax, edi
jmp 0x1400bd151
cmp eax, 0xffffffff
je 0x1400bcdf4
mov rcx, qword [rcx]
call fcn.1400bfa20
mov rbx, qword [rsi]
mov dword [rsi + 8], 0xffffffff
cmp ebp, dword [rbx + 8]
jge 0x1400bd14c
xor edi, edi
cmp dword [rbx + 0x14], ebp
jle 0x1400bce55
test rbx, rbx
je 0x1400bce52
mov eax, dword [rbx + 0x28]
lea r8, [rbx + 0x7c]
mov dword [rsp + 0x40], edi
lea rdx, [rbx + 0x2c]
mov qword [rsp + 0x38], rdi
xor r9d, r9d
mov dword [rsp + 0x30], edi
mov rcx, rbx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
mov dword [rbx + 0x18], eax
mov dword [rbx + 0x14], edi
call fcn.1400c06a0
mov ecx, edi
test eax, eax
sete cl
mov dword [rbx + 0x1c], ecx
mov rbx, qword [rsi]
cmp dword [rbx + 0x14], ebp
jge 0x1400bcec0
mov rax, rbx
test rbx, rbx
je 0x1400bceb8
cmp dword [rbx + 0x1c], edi
je 0x1400bceb8
mov edx, dword [rbx + 0x14]
inc edx
cmp edx, dword [rbx + 8]
je 0x1400bceb8
mov ecx, dword [rbx + 0x54]
lea r8, [rbx + 0x7c]
add ecx, dword [rbx + 0x50]
xor r9d, r9d
mov eax, dword [rbx + 0x4c]
mov dword [rsp + 0x40], edi
add eax, 0x2e
add ecx, eax
mov qword [rsp + 0x38], rdi
add dword [rbx + 0x18], ecx
mov rcx, rbx
mov dword [rbx + 0x14], edx
lea rdx, [rbx + 0x2c]
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
call fcn.1400c06a0
test eax, eax
mov ecx, edi
sete cl
mov dword [rbx + 0x1c], ecx
mov rax, qword [rsi]
mov rbx, rax
cmp dword [rax + 0x14], ebp
jl 0x1400bce57
lea r8, [rsp + 0x60]
mov edx, ebp
mov rcx, rsi
call fcn.1400bc110
mov eax, dword [rsp + 0x26c]
shr eax, 4
test al, 1
je 0x1400bcf25
cmp r13d, 1
je 0x1400bcf1e
movzx eax, word [r14]
cmp ax, 0x2f
je 0x1400bcf04
cmp ax, 0x5c
je 0x1400bcf04
test ax, ax
je 0x1400bcf00
cmp word [r14 + 2], 0x3a
je 0x1400bcf04
xor cl, cl
jmp 0x1400bcf06
mov cl, 1
test cl, cl
lea rax, [rsi + 0x250]
mov rdx, r14
cmove rdi, rax
mov rcx, rdi
call fcn.1400bbf30
xor eax, eax
jmp 0x1400bd151
mov word [rsp + 0x4a0], di
cmp r13d, 1
je 0x1400bd060
movzx eax, word [r14]
mov rbx, r14
mov rcx, r14
test ax, ax
je 0x1400bcf63
cmp ax, 0x2f
je 0x1400bcf52
cmp ax, 0x5c
jne 0x1400bcf56
lea rbx, [rcx + 2]
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x1400bcf46
mov r8d, 0x104
lea rcx, [rsp + 0x290]
mov rdx, r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
cmp rbx, r14
jne 0x1400bcf89
mov word [rsp + 0x290], di
jmp 0x1400bcfcd
mov rax, rbx
sub rax, r14
sar rax, 1
add rax, rax
cmp rax, 0x208
jae 0x1400bd17d
mov word [rsp + rax + 0x290], di
movzx eax, word [rsp + 0x290]
cmp ax, 0x2f
je 0x1400bcffa
cmp ax, 0x5c
je 0x1400bcffa
test ax, ax
je 0x1400bcfcd
cmp word [rsp + 0x292], 0x3a
je 0x1400bcffa
lea rbp, [rsi + 0x250]
mov qword [rsp + 0x20], rbx
mov r8, rbp
lea r9, [rsp + 0x290]
lea rdx, str._s_s_s
lea rcx, [rsp + 0x4a0]
call fcn.1400bf8a0
jmp 0x1400bd01c
mov r9, rbx
lea r8, [rsp + 0x290]
lea rdx, str._s_s
lea rcx, [rsp + 0x4a0]
call fcn.1400bf8a0
mov rbp, rdi
lea rdx, [rsp + 0x290]
mov rcx, rbp
call fcn.1400bbf30
mov eax, dword [rsp + 0x26c]
lea rcx, [rsp + 0x4a0]
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp r14, 0xffffffffffffffff
jne 0x1400bd070
mov eax, 0x200
jmp 0x1400bd151
mov rdx, qword [rsi + 0x240]
mov rcx, qword [rsi]
call fcn.1400bfb30
cmp qword [rsi + 0x248], rdi
jne 0x1400bd0a0
mov ecx, 0x4000
call fcn.140176090
mov qword [rsi + 0x248], rax
nop dword [rax]
mov rdx, qword [rsi + 0x248]
lea r9, [rsp + 0x50]
mov rcx, qword [rsi]
mov r8d, 0x4000
call fcn.1400c0070
mov ebx, eax
cmp eax, 0xffffff96
je 0x1400bd12c
test eax, eax
js 0x1400bd0f3
jle 0x1400bd0e8
mov rdx, qword [rsi + 0x248]
lea r9, [rsp + 0x54]
mov r8d, eax
mov qword [rsp + 0x20], rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400bd0fa
cmp byte [rsp + 0x50], dil
jne 0x1400bd101
test ebx, ebx
jne 0x1400bd0a0
mov edi, 0x5000000
jmp 0x1400bd131
mov edi, 0x400
jmp 0x1400bd131
mov rcx, qword [rsi]
call fcn.1400bfa20
lea r9, [rsp + 0x280]
mov rcx, r14
lea r8, [rsp + 0x270]
lea rdx, [rsp + 0x278]
call qword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x1400bd139
mov edi, 0x1000
mov rcx, qword [rsi]
call fcn.1400bfa20
cmp r13d, 1
je 0x1400bd148
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x1400bd151
mov eax, 0x10000
mov rcx, qword [rsp + 0x6b0]
xor rcx, rsp
call fcn.140175f30
lea r11, [rsp + 0x6c0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
call fcn.140176218
int3