Function at 0x140041890
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x6c0
mov rax, qword [0x140148020]
xor rax, rsp
mov qword [rsp + 0x6b0], rax
mov r15d, dword [rsp + 0x710]
mov r12d, r9d
mov r14, r8
mov ebp, edx
mov rdi, rcx
cmp r15d, 3
je 0x140041c37
lea eax, [r15 - 1]
cmp eax, 1
ja 0x140041d44
cmp dword [rcx + 8], 0xffffffff
je 0x1400418f3
mov rcx, qword [rcx]
call fcn.140040d50
mov rbx, qword [rdi]
mov dword [rdi + 8], 0xffffffff
cmp ebp, dword [rbx + 8]
jge 0x140041d44
xor esi, esi
cmp ebp, dword [rbx + 0x14]
jge 0x14004193c
test rbx, rbx
je 0x14004193c
mov eax, dword [rbx + 0x28]
lea r8, [rbx + 0x7c]
lea rdx, [rbx + 0x2c]
mov dword [rbx + 0x18], eax
xor r9d, r9d
mov dword [rbx + 0x14], esi
mov rcx, rbx
mov dword [rsp + 0x20], esi
call fcn.14003fe50
mov ecx, esi
test eax, eax
sete cl
mov dword [rbx + 0x1c], ecx
mov rbx, qword [rdi]
cmp dword [rbx + 0x14], ebp
jge 0x140041995
test rbx, rbx
je 0x14004198d
cmp dword [rbx + 0x1c], esi
je 0x14004198d
mov edx, dword [rbx + 0x14]
inc edx
cmp edx, dword [rbx + 8]
je 0x14004198d
mov ecx, dword [rbx + 0x54]
lea r8, [rbx + 0x7c]
add ecx, dword [rbx + 0x50]
xor r9d, r9d
mov eax, dword [rbx + 0x4c]
add eax, 0x2e
mov dword [rbx + 0x14], edx
add ecx, eax
mov dword [rsp + 0x20], esi
add dword [rbx + 0x18], ecx
lea rdx, [rbx + 0x2c]
mov rcx, rbx
call fcn.14003fe50
mov ecx, esi
test eax, eax
sete cl
mov dword [rbx + 0x1c], ecx
mov rbx, qword [rdi]
cmp dword [rbx + 0x14], ebp
jl 0x140041944
lea r8, [rsp + 0x60]
mov edx, ebp
mov rcx, rdi
call fcn.140040ff0
test byte [rsp + 0x26c], 0x10
je 0x140041a11
cmp r15d, 1
je 0x1400419e3
movzx eax, word [r14]
cmp ax, 0x2f
je 0x1400419d8
cmp ax, 0x5c
je 0x1400419d8
test ax, ax
je 0x1400419d1
cmp word [r14 + 2], 0x3a
je 0x1400419d8
lea rsi, [rdi + 0x250]
mov rdx, r14
mov rcx, rsi
call fcn.140041720
xor eax, eax
mov rcx, qword [rsp + 0x6b0]
xor rcx, rsp
call fcn.1400a24f0
lea r11, [rsp + 0x6c0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
cmp r15d, 1
je 0x140041b55
movzx ecx, word [r14]
mov r9, r14
mov rax, r14
test cx, cx
je 0x140041a51
nop word [rax + rax]
cmp cx, 0x2f
je 0x140041a42
cmp cx, 0x5c
je 0x140041a42
add rax, 2
jmp 0x140041a49
lea r9, [rax + 2]
mov rax, r9
movzx ecx, word [rax]
test cx, cx
jne 0x140041a30
lea rdx, [rsp + 0x290]
mov rcx, r14
sub rdx, r14
nop
movzx eax, word [rcx]
mov word [rcx + rdx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x140041a60
cmp r9, r14
jne 0x140041a7f
mov word [rsp + 0x290], si
jmp 0x140041ac3
mov rax, r9
sub rax, r14
sar rax, 1
add rax, rax
cmp rax, 0x208
jae 0x140041d63
mov word [rsp + rax + 0x290], si
movzx eax, word [rsp + 0x290]
cmp ax, 0x2f
je 0x140041af1
cmp ax, 0x5c
je 0x140041af1
test ax, ax
je 0x140041ac3
cmp word [rsp + 0x292], 0x3a
je 0x140041af1
mov qword [rsp + 0x20], r9
lea rbx, [rdi + 0x250]
mov r8, rbx
lea r9, [rsp + 0x290]
lea rdx, str._s_s_s
lea rcx, [rsp + 0x4a0]
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x140041b11
lea r8, [rsp + 0x290]
lea rdx, str._s_s
lea rcx, [rsp + 0x4a0]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rbx, rsi
lea rdx, [rsp + 0x290]
mov rcx, rbx
call fcn.140041720
mov eax, dword [rsp + 0x26c]
lea rcx, [rsp + 0x4a0]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp r14, 0xffffffffffffffff
jne 0x140041b65
mov eax, 0x200
jmp 0x1400419e5
mov rdx, qword [rdi + 0x240]
mov rcx, qword [rdi]
call fcn.1400407b0
cmp qword [rdi + 0x248], rsi
jne 0x140041b90
mov ecx, 0x4000
call fcn.1400a2da4
mov qword [rdi + 0x248], rax
nop
mov rdx, qword [rdi + 0x248]
lea r9, [rsp + 0x50]
mov rcx, qword [rdi]
mov r8d, 0x4000
call fcn.1400409d0
mov ebx, eax
cmp eax, 0xffffff96
je 0x140041c14
test eax, eax
js 0x140041be3
jle 0x140041bd8
mov rdx, qword [rdi + 0x248]
lea r9, [rsp + 0x54]
mov r8d, eax
mov qword [rsp + 0x20], rsi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140041bea
cmp byte [rsp + 0x50], sil
jne 0x140041bf1
test ebx, ebx
jne 0x140041b90
mov esi, 0x5000000
jmp 0x140041c19
mov esi, 0x400
jmp 0x140041c19
lea r9, [rsp + 0x280]
mov rcx, r14
lea r8, [rsp + 0x270]
lea rdx, [rsp + 0x278]
call qword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x140041c19
mov esi, 0x1000
cmp r15d, 1
je 0x140041c28
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi]
call fcn.140040d50
mov eax, esi
jmp 0x1400419e5
mov eax, dword [rcx + 8]
cmp ebp, eax
je 0x140041d03
cmp eax, 0xffffffff
je 0x140041c4f
mov rcx, qword [rcx]
call fcn.140040d50
mov rbx, qword [rdi]
mov dword [rdi + 8], 0xffffffff
cmp ebp, dword [rbx + 8]
jge 0x140041d44
xor esi, esi
cmp ebp, dword [rbx + 0x14]
jge 0x140041c98
test rbx, rbx
je 0x140041c98
mov eax, dword [rbx + 0x28]
lea r8, [rbx + 0x7c]
lea rdx, [rbx + 0x2c]
mov dword [rbx + 0x18], eax
xor r9d, r9d
mov dword [rbx + 0x14], esi
mov rcx, rbx
mov dword [rsp + 0x20], esi
call fcn.14003fe50
mov ecx, esi
test eax, eax
sete cl
mov dword [rbx + 0x1c], ecx
mov rbx, qword [rdi]
cmp dword [rbx + 0x14], ebp
jge 0x140041cf1
test rbx, rbx
je 0x140041ce9
cmp dword [rbx + 0x1c], esi
je 0x140041ce9
mov edx, dword [rbx + 0x14]
inc edx
cmp edx, dword [rbx + 8]
je 0x140041ce9
mov ecx, dword [rbx + 0x54]
lea r8, [rbx + 0x7c]
add ecx, dword [rbx + 0x50]
xor r9d, r9d
mov eax, dword [rbx + 0x4c]
add eax, 0x2e
mov dword [rbx + 0x14], edx
add ecx, eax
mov dword [rsp + 0x20], esi
add dword [rbx + 0x18], ecx
lea rdx, [rbx + 0x2c]
mov rcx, rbx
call fcn.14003fe50
mov ecx, esi
test eax, eax
sete cl
mov dword [rbx + 0x1c], ecx
mov rbx, qword [rdi]
cmp dword [rbx + 0x14], ebp
jl 0x140041ca0
mov rdx, qword [rdi + 0x240]
mov rcx, rbx
call fcn.1400407b0
mov dword [rdi + 8], ebp
mov rcx, qword [rdi]
lea r9, [rsp + 0x50]
mov r8d, r12d
mov rdx, r14
call fcn.1400409d0
mov ebx, eax
test eax, eax
jg 0x140041d2b
mov rcx, qword [rdi]
call fcn.140040d50
mov dword [rdi + 8], 0xffffffff
cmp byte [rsp + 0x50], 0
jne 0x1400419e3
test ebx, ebx
jle 0x140041d4e
mov eax, 0x600
jmp 0x1400419e5
mov eax, 0x10000
jmp 0x1400419e5
cmp ebx, 0xffffff96
mov eax, 0x5000000
mov ecx, 0x1000
cmove eax, ecx
jmp 0x1400419e5
call fcn.1400a2ebc
int3