Function at 0x14003f8d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f0]
sub rsp, 0x2f0
mov rbx, rdx
mov rax, qword [0x1401252a8]
cmp qword [rax], 0xffffffffffffffff
je 0x14003f9e9
mov rdi, qword [rdx + 0x10]
test rdi, rdi
je 0x14003f9e9
lea rdx, [0x1400d56d8]
mov rcx, rbx
call fcn.140040080
xor esi, esi
cmp rax, 0xffffffffffffffff
je 0x14003f977
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], si
lea r8, [rax + 1]
cmp rdi, r8
cmovb r8, rdi
cmp qword [rbx + 0x18], 8
jb 0x14003f954
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.140037b30
movups xmm0, xmmword [rsp + 0x60]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rsp + 0x70]
movups xmmword [rsp + 0x50], xmm1
jmp 0x14003f99f
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], si
xor r8d, r8d
lea rdx, [0x1400d56dc]
lea rcx, [rsp + 0x40]
call fcn.140037b30
nop
cmp qword [rsp + 0x50], 0
jne 0x14003fa06
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14003f9e9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003f9e4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003fd17
call fcn.140071ab4
xor al, al
mov rbx, qword [rsp + 0x338]
add rsp, 0x2f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rdx, [0x14010c3e0]
cmp qword [0x14010c3f8], 8
cmovae rdx, qword [0x14010c3e0]
mov r8, qword [0x14010c3f0]
lea rcx, [rsp + 0x40]
call fcn.140038d10
cmp qword [rsp + 0x50], 0
je 0x14003fa7c
xor edx, edx
mov r8d, 0x250
lea rcx, [rbp - 0x60]
call fcn.140074220
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
lea rdx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
setne bl
je 0x14003fa74
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
test bl, bl
jne 0x14003fccb
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp + 0x240], rax
cmp rax, 0xffffffffffffffff
je 0x14003fccb
mov dword [rbp + 0x230], esi
lea r14, [0x14010ce00]
lea rdi, [0x14010d480]
nop dword [rax + rax]
mov rdx, r14
lea rcx, [rsp + 0x60]
call fcn.140036f80
mov qword [rbp - 0x68], 0xf
mov qword [rbp - 0x70], 4
mov dword [rbp - 0x80], 0x7d64697b
mov byte [rbp - 0x7c], 0
lea rbx, [rsp + 0x60]
mov r12, qword [rsp + 0x60]
mov r13, qword [rsp + 0x78]
cmp r13, 0x10
cmovae rbx, r12
mov r15, qword [rsp + 0x70]
cmp r15, 4
jb 0x14003fc07
lea rdi, [r15 + rbx]
lea r8, [rdi - 3]
sub r8, rbx
mov edx, 0x7b
mov rcx, rbx
call fcn.140074180
mov r10, rax
test rax, rax
je 0x14003fc00
nop dword [rax]
nop word [rax + rax]
mov rcx, rsi
lea rax, [rbp - 0x80]
nop word [rax + rax]
movzx edx, byte [r10 + rcx]
inc rcx
cmp dl, byte [rax + rcx - 1]
jne 0x14003fb88
cmp rcx, 4
jne 0x14003fb70
mov eax, esi
jmp 0x14003fb8d
sbb eax, eax
or eax, 1
test eax, eax
je 0x14003fbb2
inc r10
lea r8, [rdi - 3]
sub r8, r10
mov edx, 0x7b
mov rcx, r10
call fcn.140074180
mov r10, rax
test rax, rax
jne 0x14003fb60
jmp 0x14003fc00
sub r10, rbx
cmp r10, 0xffffffffffffffff
je 0x14003fc00
mov rax, qword [0x140125308]
lea r9, [0x1401252f8]
cmp qword [0x140125310], 0x10
cmovae r9, qword [0x1401252f8]
mov qword [rsp + 0x20], rax
mov r8d, 4
mov rdx, r10
lea rcx, [rsp + 0x60]
call fcn.14003e390
mov r13, qword [rsp + 0x78]
mov r15, qword [rsp + 0x70]
mov r12, qword [rsp + 0x60]
lea rdi, [0x14010d480]
lea rdx, [rsp + 0x60]
cmp r13, 0x10
cmovae rdx, r12
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0x230]
mov r8d, r15d
mov rbx, qword [rbp + 0x240]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x14003fc70
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003fc6b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003fd11
call fcn.140071ab4
add r14, 0x20
cmp r14, rdi
jne 0x14003fae0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14003fcc4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003fcbf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003fd1d
call fcn.140071ab4
mov al, 1
jmp 0x14003f9eb
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14003f9e9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003f9e4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003fd17
jmp 0x14003f9e4
call fcn.140077e4c
int3
call fcn.140077e4c
int3
call fcn.140077e4c
int3