Function at 0x14001d420
Capabilities:
Write file on windows

Disassembly:
push rdi
push r14
sub rsp, 0x6c8
mov rax, qword [0x1400b0178]
xor rax, rsp
mov qword [rsp + 0x6b0], rax
cmp dword [rcx + 8], 0xffffffff
mov r14, r8
mov rdi, rcx
je 0x14001d451
mov rcx, qword [rcx]
call fcn.14001c9c0
mov rcx, qword [rdi]
mov dword [rdi + 8], 0xffffffff
cmp dword [rcx + 8], 0
jg 0x14001d46b
mov eax, 0x10000
jmp 0x14001d6a0
cmp dword [rcx + 0x14], 0
mov qword [rsp + 0x6c0], rsi
jle 0x14001d47e
call fcn.14001c110
mov rax, qword [rdi]
xor esi, esi
mov qword [rsp + 0x6e8], rbx
cmp dword [rax + 0x14], esi
jge 0x14001d4e4
mov rbx, qword [rdi]
test rbx, rbx
je 0x14001d4dc
cmp dword [rbx + 0x1c], esi
je 0x14001d4dc
mov edx, dword [rbx + 0x14]
inc edx
cmp edx, dword [rbx + 8]
je 0x14001d4dc
mov ecx, dword [rbx + 0x54]
lea r8, [rbx + 0x7c]
add ecx, dword [rbx + 0x50]
xor r9d, r9d
mov eax, dword [rbx + 0x4c]
add eax, 0x2e
mov dword [rbx + 0x14], edx
add ecx, eax
mov dword [rsp + 0x20], esi
add dword [rbx + 0x18], ecx
lea rdx, [rbx + 0x2c]
mov rcx, rbx
call fcn.14001bc80
mov ecx, esi
test eax, eax
sete cl
mov dword [rbx + 0x1c], ecx
mov rax, qword [rdi]
cmp dword [rax + 0x14], esi
jl 0x14001d490
lea r8, [rsp + 0x60]
xor edx, edx
mov rcx, rdi
call fcn.14001cc00
test byte [rsp + 0x26c], 0x10
movzx eax, word [r14]
je 0x14001d541
cmp ax, 0x2f
je 0x14001d530
cmp ax, 0x5c
je 0x14001d530
test ax, ax
je 0x14001d51a
cmp word [r14 + 2], 0x3a
je 0x14001d530
lea rcx, [rdi + 0x250]
mov rdx, r14
call fcn.14001d2b0
xor eax, eax
jmp 0x14001d690
xor ecx, ecx
mov rdx, r14
call fcn.14001d2b0
xor eax, eax
jmp 0x14001d690
mov r9, r14
mov rcx, r14
test ax, ax
je 0x14001d56d
nop dword [rax]
cmp ax, 0x2f
je 0x14001d55c
cmp ax, 0x5c
jne 0x14001d560
lea r9, [rcx + 2]
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x14001d550
lea rdx, [rsp + 0x290]
mov rcx, r14
sub rdx, r14
nop dword [rax + rax]
movzx eax, word [rcx]
mov word [rdx + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x14001d580
cmp r9, r14
jne 0x14001d59f
mov word [rsp + 0x290], si
jmp 0x14001d5e3
mov rax, r9
sub rax, r14
sar rax, 1
add rax, rax
cmp rax, 0x208
jae 0x14001d791
mov word [rsp + rax + 0x290], si
movzx eax, word [rsp + 0x290]
cmp ax, 0x2f
je 0x14001d615
cmp ax, 0x5c
je 0x14001d615
test ax, ax
je 0x14001d5e3
cmp word [rsp + 0x292], 0x3a
je 0x14001d615
mov qword [rsp + 0x20], r9
lea r8, [rdi + 0x250]
lea r9, [rsp + 0x290]
lea rdx, str._s_s_s
lea rcx, [rsp + 0x4a0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rdi + 0x250]
jmp 0x14001d634
lea r8, [rsp + 0x290]
lea rdx, str._s_s
lea rcx, [rsp + 0x4a0]
call qword [sym.imp.USER32.dll_wsprintfW]
xor ecx, ecx
lea rdx, [rsp + 0x290]
call fcn.14001d2b0
mov eax, dword [rsp + 0x26c]
lea rcx, [rsp + 0x4a0]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
mov qword [rsp + 0x6f8], rbp
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x14001d6bb
mov eax, 0x200
mov rbp, qword [rsp + 0x6f8]
mov rbx, qword [rsp + 0x6e8]
mov rsi, qword [rsp + 0x6c0]
mov rcx, qword [rsp + 0x6b0]
xor rcx, rsp
call fcn.140037e50
add rsp, 0x6c8
pop r14
pop rdi
ret
mov rdx, qword [rdi + 0x240]
mov rcx, qword [rdi]
call fcn.14001c430
cmp qword [rdi + 0x248], rsi
jne 0x14001d6f0
mov ecx, 0x4000
call fcn.1400384d0
mov qword [rdi + 0x248], rax
nop dword [rax]
nop dword [rax + rax]
mov rdx, qword [rdi + 0x248]
lea r9, [rsp + 0x50]
mov rcx, qword [rdi]
mov r8d, 0x4000
call fcn.14001c660
mov ebx, eax
cmp eax, 0xffffff96
je 0x14001d774
test eax, eax
js 0x14001d743
jle 0x14001d738
mov rdx, qword [rdi + 0x248]
lea r9, [rsp + 0x54]
mov r8d, eax
mov qword [rsp + 0x20], rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14001d74a
cmp byte [rsp + 0x50], sil
jne 0x14001d751
test ebx, ebx
jne 0x14001d6f0
mov esi, 0x5000000
jmp 0x14001d779
mov esi, 0x400
jmp 0x14001d779
lea r9, [rsp + 0x280]
mov rcx, rbp
lea r8, [rsp + 0x270]
lea rdx, [rsp + 0x278]
call qword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x14001d779
mov esi, 0x1000
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi]
call fcn.14001c9c0
mov eax, esi
jmp 0x14001d688
call fcn.1400385e0
int3