Function at 0x14000ae90
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x6c0
mov rax, qword [0x140017058]
xor rax, rsp
mov qword [rsp + 0x6b0], rax
mov r13d, dword [rsp + 0x710]
mov r15d, r9d
mov r14, r8
mov ebp, edx
mov rdi, rcx
lea eax, [r13 - 1]
cmp eax, 2
ja 0x14000b354
mov eax, dword [rcx + 8]
cmp r13d, 3
jne 0x14000aff5
cmp edx, eax
je 0x14000af9f
cmp eax, 0xffffffff
je 0x14000aefd
mov rcx, qword [rcx]
call fcn.14000dbe0
mov rcx, qword [rdi]
mov dword [rdi + 8], 0xffffffff
cmp ebp, dword [rcx + 8]
jge 0x14000b354
cmp dword [rcx + 0x14], ebp
jle 0x14000af20
call fcn.14000dc90
mov rcx, qword [rdi]
cmp dword [rcx + 0x14], ebp
jge 0x14000af90
mov rbx, rcx
xor esi, esi
mov rcx, rbx
test rbx, rbx
je 0x14000af88
cmp dword [rbx + 0x1c], esi
je 0x14000af88
mov edx, dword [rbx + 0x14]
inc edx
cmp edx, dword [rbx + 8]
je 0x14000af88
mov ecx, dword [rbx + 0x54]
lea r8, [rbx + 0x7c]
add ecx, dword [rbx + 0x50]
xor r9d, r9d
mov eax, dword [rbx + 0x4c]
mov dword [rsp + 0x40], esi
add eax, 0x2e
add ecx, eax
mov qword [rsp + 0x38], rsi
add dword [rbx + 0x18], ecx
mov rcx, rbx
mov dword [rbx + 0x14], edx
lea rdx, [rbx + 0x2c]
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
call fcn.14000e890
mov ecx, esi
test eax, eax
sete cl
mov dword [rbx + 0x1c], ecx
mov rcx, qword [rdi]
mov rbx, rcx
cmp dword [rcx + 0x14], ebp
jl 0x14000af27
mov rdx, qword [rdi + 0x240]
call fcn.14000dcf0
mov dword [rdi + 8], ebp
mov rcx, qword [rdi]
lea r9, [rsp + 0x50]
mov r8d, r15d
mov rdx, r14
call fcn.14000e260
mov ebx, eax
test eax, eax
jg 0x14000afc7
mov rcx, qword [rdi]
call fcn.14000dbe0
mov dword [rdi + 8], 0xffffffff
cmp byte [rsp + 0x50], 0
jne 0x14000b128
test ebx, ebx
jle 0x14000afe0
mov eax, 0x600
jmp 0x14000b359
cmp ebx, 0xffffff96
mov eax, 0x5000000
mov ecx, 0x1000
cmove eax, ecx
jmp 0x14000b359
cmp eax, 0xffffffff
je 0x14000b002
mov rcx, qword [rcx]
call fcn.14000dbe0
mov rbx, qword [rdi]
mov dword [rdi + 8], 0xffffffff
cmp ebp, dword [rbx + 8]
jge 0x14000b354
xor esi, esi
cmp dword [rbx + 0x14], ebp
jle 0x14000b063
test rbx, rbx
je 0x14000b060
mov eax, dword [rbx + 0x28]
lea r8, [rbx + 0x7c]
mov dword [rsp + 0x40], esi
lea rdx, [rbx + 0x2c]
mov qword [rsp + 0x38], rsi
xor r9d, r9d
mov dword [rsp + 0x30], esi
mov rcx, rbx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
mov dword [rbx + 0x18], eax
mov dword [rbx + 0x14], esi
call fcn.14000e890
mov ecx, esi
test eax, eax
sete cl
mov dword [rbx + 0x1c], ecx
mov rbx, qword [rdi]
cmp dword [rbx + 0x14], ebp
jge 0x14000b0ce
mov rax, rbx
test rbx, rbx
je 0x14000b0c6
cmp dword [rbx + 0x1c], esi
je 0x14000b0c6
mov edx, dword [rbx + 0x14]
inc edx
cmp edx, dword [rbx + 8]
je 0x14000b0c6
mov ecx, dword [rbx + 0x54]
lea r8, [rbx + 0x7c]
add ecx, dword [rbx + 0x50]
xor r9d, r9d
mov eax, dword [rbx + 0x4c]
mov dword [rsp + 0x40], esi
add eax, 0x2e
add ecx, eax
mov qword [rsp + 0x38], rsi
add dword [rbx + 0x18], ecx
mov rcx, rbx
mov dword [rbx + 0x14], edx
lea rdx, [rbx + 0x2c]
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
call fcn.14000e890
test eax, eax
mov ecx, esi
sete cl
mov dword [rbx + 0x1c], ecx
mov rax, qword [rdi]
mov rbx, rax
cmp dword [rax + 0x14], ebp
jl 0x14000b065
lea r8, [rsp + 0x60]
mov edx, ebp
mov rcx, rdi
call fcn.14000a320
test byte [rsp + 0x26c], 0x10
je 0x14000b12f
cmp r13d, 1
je 0x14000b128
movzx eax, word [r14]
cmp ax, 0x2f
je 0x14000b10e
cmp ax, 0x5c
je 0x14000b10e
test ax, ax
je 0x14000b10a
cmp word [r14 + 2], 0x3a
je 0x14000b10e
xor cl, cl
jmp 0x14000b110
mov cl, 1
test cl, cl
lea rax, [rdi + 0x250]
mov rdx, r14
cmove rsi, rax
mov rcx, rsi
call fcn.14000a1b0
xor eax, eax
jmp 0x14000b359
cmp r13d, 1
je 0x14000b275
movzx eax, word [r14]
mov r9, r14
mov rcx, r14
test ax, ax
je 0x14000b165
cmp ax, 0x2f
je 0x14000b154
cmp ax, 0x5c
jne 0x14000b158
lea r9, [rcx + 2]
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x14000b148
lea rdx, [rsp + 0x290]
mov rcx, r14
sub rdx, r14
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rdx + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x14000b180
cmp r9, r14
jne 0x14000b19f
mov word [rsp + 0x290], si
jmp 0x14000b1e3
mov rax, r9
sub rax, r14
sar rax, 1
add rax, rax
cmp rax, 0x208
jae 0x14000b385
mov word [rsp + rax + 0x290], si
movzx eax, word [rsp + 0x290]
cmp ax, 0x2f
je 0x14000b211
cmp ax, 0x5c
je 0x14000b211
test ax, ax
je 0x14000b1e3
cmp word [rsp + 0x292], 0x3a
je 0x14000b211
mov qword [rsp + 0x20], r9
lea rbx, [rdi + 0x250]
mov r8, rbx
lea r9, [rsp + 0x290]
lea rdx, str._s_s_s
lea rcx, [rsp + 0x4a0]
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x14000b231
lea r8, [rsp + 0x290]
lea rdx, str._s_s
lea rcx, [rsp + 0x4a0]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rbx, rsi
lea rdx, [rsp + 0x290]
mov rcx, rbx
call fcn.14000a1b0
mov eax, dword [rsp + 0x26c]
lea rcx, [rsp + 0x4a0]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp r14, 0xffffffffffffffff
jne 0x14000b285
mov eax, 0x200
jmp 0x14000b359
mov rdx, qword [rdi + 0x240]
mov rcx, qword [rdi]
call fcn.14000dcf0
cmp qword [rdi + 0x248], rsi
jne 0x14000b2b0
mov ecx, 0x4000
call fcn.14000f610
mov qword [rdi + 0x248], rax
nop
mov rdx, qword [rdi + 0x248]
lea r9, [rsp + 0x50]
mov rcx, qword [rdi]
mov r8d, 0x4000
call fcn.14000e260
mov ebx, eax
cmp eax, 0xffffff96
je 0x14000b334
test eax, eax
js 0x14000b303
jle 0x14000b2f8
mov rdx, qword [rdi + 0x248]
lea r9, [rsp + 0x54]
mov r8d, eax
mov qword [rsp + 0x20], rsi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000b30a
cmp byte [rsp + 0x50], sil
jne 0x14000b311
test ebx, ebx
jne 0x14000b2b0
mov esi, 0x5000000
jmp 0x14000b339
mov esi, 0x400
jmp 0x14000b339
lea r9, [rsp + 0x280]
mov rcx, r14
lea r8, [rsp + 0x270]
lea rdx, [rsp + 0x278]
call qword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x14000b339
mov esi, 0x1000
cmp r13d, 1
je 0x14000b348
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi]
call fcn.14000dbe0
mov eax, esi
jmp 0x14000b359
mov eax, 0x10000
mov rcx, qword [rsp + 0x6b0]
xor rcx, rsp
call fcn.14000f5c0
lea r11, [rsp + 0x6c0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
call fcn.14000f720
int3