Function at 0x140005620
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x360]
sub rsp, 0x460
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rsp + 0x4b0], rbx
mov rax, qword [0x140e8b968]
xor rax, rsp
mov qword [rbp + 0x350], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
mov qword [rbp - 0x80], rcx
xor r12d, r12d
mov dword [rsp + 0x40], r12d
mov qword [rcx], r12
mov qword [rcx + 8], r12
call fcn.140006d70
mov qword [rdi], rax
mov dword [rsp + 0x40], 1
mov rcx, rbx
call fcn.140005ca0
mov r14, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140005c61
mov qword [rbp + 0x2ac], r12
mov dword [rbp + 0x2b4], r12d
mov dword [rbp + 0x290], 0x64
mov ecx, dword [0x140e8cb00]
mov dword [rbp + 0x294], ecx
mov qword [rbp + 0x298], rax
lea rax, [rbp + 0x2e0]
mov qword [rbp + 0x2a0], rax
mov dword [rbp + 0x2a8], 0x40
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rbp + 0x2ac], eax
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x320]
lea r8d, [r12 + 0x29]
lea rdx, [rbp + 0x290]
mov rcx, qword [0x140e8caf8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov qword [rbp + 0x2ac], r12
mov dword [rbp + 0x2b4], r12d
mov dword [rbp + 0x290], 0x64
mov eax, dword [0x140e8cb00]
mov dword [rbp + 0x294], eax
movsxd rax, dword [rbp + 0x31c]
add rax, r14
mov qword [rbp + 0x298], rax
lea rax, [rbp - 0x78]
mov qword [rbp + 0x2a0], rax
mov dword [rbp + 0x2a8], 0x108
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rbp + 0x2ac], eax
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x320]
lea r8d, [r12 + 0x29]
lea rdx, [rbp + 0x290]
mov rcx, qword [0x140e8caf8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [rbp + 0x1c], r12d
je 0x140005c61
mov edx, dword [rbp + 0x18]
add rdx, r14
lea rcx, [rbp + 0x328]
call fcn.1400015a0
movups xmm0, xmmword [rax]
mov ecx, dword [rax + 0x10]
mov r15d, r12d
mov dword [rsp + 0x34], r12d
movups xmmword [rsp + 0x60], xmm0
psrldq xmm0, 8
movq rax, xmm0
shr rax, 0x20
test eax, eax
mov dword [rbp + 0x320], ecx
je 0x140005c61
mov ecx, dword [rsp + 0x60]
add rcx, r14
call fcn.140001640
mov rbx, rax
mov esi, r12d
mov dword [rsp + 0x38], r12d
test rax, rax
je 0x140005bc1
nop
mov qword [rbp + 0x338], r12
mov qword [rbp + 0x340], 0xf
mov byte [rbp + 0x328], 0
mov rax, qword [0x140e9b7d8]
test rax, rax
cmove rax, rbx
mov qword [0x140e9b7d8], rax
add rax, 0x10000
cmp rbx, rax
ja 0x140005b56
mov qword [rbp + 0x2d4], r12
mov dword [rbp + 0x2dc], r12d
mov dword [rbp + 0x2b8], 0x64
mov eax, dword [0x140e8cb00]
mov dword [rbp + 0x2bc], eax
lea rax, [r14 + 2]
add rax, rbx
mov qword [rbp + 0x2c0], rax
lea rax, [rbp + 0x190]
mov qword [rbp + 0x2c8], rax
mov dword [rbp + 0x2d0], 0xff
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rbp + 0x2d4], eax
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x348]
mov r8d, 0x29
lea rdx, [rbp + 0x2b8]
mov rcx, qword [0x140e8caf8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x190]
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx - 0x10], xmm1
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x60], xmm0
mov rax, qword [rcx + 0x70]
mov qword [rdx + 0x70], rax
mov eax, dword [rcx + 0x78]
mov dword [rdx + 0x78], eax
movzx eax, word [rcx + 0x7c]
mov word [rdx + 0x7c], ax
movzx eax, byte [rcx + 0x7e]
mov byte [rdx + 0x7e], al
mov qword [rbp + 0x2a0], r12
mov qword [rbp + 0x2a8], 0xf
mov byte [rbp + 0x290], 0
lea rax, [rbp + 0x90]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140005990
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x290]
call fcn.140007b90
mov rdx, qword [rbp + 0x340]
cmp rdx, 0x10
jb 0x1400059ee
inc rdx
mov rcx, qword [rbp + 0x328]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400059e9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005c94
call fcn.14000d8b4
movups xmm0, xmmword [rbp + 0x290]
movups xmmword [rbp + 0x328], xmm0
movups xmm1, xmmword [rbp + 0x2a0]
movups xmmword [rbp + 0x338], xmm1
mov r13, qword [rdi]
mov rbx, r13
mov rdi, qword [r13 + 8]
mov r15, qword [rbp + 0x2a8]
mov r14, qword [rbp + 0x2a0]
mov r12, qword [rbp + 0x290]
cmp byte [rdi + 0x19], 0
jne 0x140005a96
nop
lea rdx, [rbp + 0x328]
cmp r15, 0x10
cmovae rdx, r12
lea rcx, [rdi + 0x20]
cmp qword [rdi + 0x38], 0x10
jb 0x140005a4e
mov rcx, qword [rdi + 0x20]
mov rsi, qword [rdi + 0x30]
mov r8, rsi
cmp r14, rsi
cmovb r8, r14
call fcn.14000f430
test eax, eax
jne 0x140005a79
cmp rsi, r14
jae 0x140005a71
mov eax, 0xffffffff
jmp 0x140005a79
xor eax, eax
cmp rsi, r14
seta al
shr eax, 0x1f
test al, al
je 0x140005a86
mov rdi, qword [rdi + 0x10]
jmp 0x140005a8c
mov rbx, rdi
mov rdi, qword [rdi]
cmp byte [rdi + 0x19], 0
je 0x140005a30
mov esi, dword [rsp + 0x38]
cmp rbx, r13
je 0x140005af2
lea rdx, [rbx + 0x20]
cmp qword [rbx + 0x38], 0x10
jb 0x140005aaa
mov rdx, qword [rbx + 0x20]
lea rcx, [rbp + 0x328]
cmp r15, 0x10
cmovae rcx, r12
mov rdi, qword [rbx + 0x30]
mov r8, r14
cmp rdi, r14
cmovb r8, rdi
call fcn.14000f430
test eax, eax
jne 0x140005ae4
cmp r14, rdi
jae 0x140005adc
mov eax, 0xffffffff
jmp 0x140005ae4
xor eax, eax
cmp r14, rdi
seta al
shr eax, 0x1f
test al, al
jne 0x140005af2
mov rdi, qword [rsp + 0x48]
jmp 0x140005b3a
lea rax, [rbp + 0x328]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, [0x140029490]
mov rdi, qword [rsp + 0x48]
mov rcx, rdi
call fcn.140001740
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.140001a40
mov rbx, qword [rsp + 0x50]
movsxd rdx, esi
mov ecx, dword [rbp + 0x320]
mov r14, qword [rsp + 0x58]
add rcx, r14
lea rax, [rcx + rdx*8]
mov qword [rbx + 0x40], rax
xor r12d, r12d
inc esi
mov dword [rsp + 0x38], esi
movsxd rax, esi
mov ecx, dword [rsp + 0x60]
lea rcx, [rcx + rax*8]
add rcx, r14
call fcn.140001640
mov rbx, rax
mov rdx, qword [rbp + 0x340]
cmp rdx, 0x10
jb 0x140005bb3
inc rdx
mov rcx, qword [rbp + 0x328]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005bae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005c8e
call fcn.14000d8b4
test rbx, rbx
jne 0x140005800
mov r15d, dword [rsp + 0x34]
inc r15d
mov dword [rsp + 0x34], r15d
mov qword [rbp + 0x2fc], r12
mov dword [rbp + 0x304], r12d
mov dword [rbp + 0x2e0], 0x64
mov eax, dword [0x140e8cb00]
mov dword [rbp + 0x2e4], eax
movsxd rax, r15d
lea rcx, [rax + rax*4]
mov eax, dword [rbp + 0x18]
lea rax, [rax + rcx*4]
add rax, r14
mov qword [rbp + 0x2e8], rax
lea rax, [rbp + 0x328]
mov qword [rbp + 0x2f0], rax
mov dword [rbp + 0x2f8], 0x14
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rbp + 0x2fc], eax
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x34c]
mov r8d, 0x29
lea rdx, [rbp + 0x2e0]
mov rcx, qword [0x140e8caf8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
movups xmm0, xmmword [rbp + 0x328]
mov ecx, dword [rbp + 0x338]
jmp 0x1400057bd
mov rax, rdi
mov rcx, qword [rbp + 0x350]
xor rcx, rsp
call fcn.14000dd00
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x460
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140011d2c
nop
call fcn.140011d2c
int3