Function at 0x14000b310
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x14003c008]
xor rax, rsp
mov qword [rsp + 0x68], rax
movzx eax, word [0x140040f44]
lea rdi, [0x140042ab0]
mov r14, rdx
mov word [0x14003e164], ax
mov rbp, rcx
mov r8, rcx
mov rcx, rdi
mov edx, 0x80
call fcn.140029e70
xor r15d, r15d
movzx ebx, ax
test ax, ax
jle 0x14000b9a5
lea r12, [0x1400429a0]
lea r13, [0x14003c058]
nop dword [rax + rax]
mov rcx, rbp
call fcn.14001af60
test ax, ax
je 0x14000b3df
movzx r8d, word [0x14003e1bc]
mov eax, 0x51eb851f
movzx ecx, word [0x14003e170]
imul ecx, r8d
mov word [0x14003e1b0], r8w
imul ecx
mov ecx, edx
lea rdx, [0x14003e1d0]
sar ecx, 5
mov eax, ecx
shr eax, 0x1f
add ecx, eax
add cx, word [0x14003e16c]
mov word [0x14003e174], cx
call qword [0x140041ab0]
test ax, ax
jne 0x14000b9ce
movzx eax, word [0x140042ab0]
cmp ax, 0x1a
je 0x14000b989
cmp bx, 4
jne 0x14000b40a
cmp ax, 0xd
jne 0x14000b40a
cmp word [0x140042ab2], 0xa
je 0x14000b989
add bx, 0xfffc
movsx rax, bx
cmp rax, 0x80
jae 0x14000b9e9
mov byte [rax + rdi], r15b
movsx eax, bx
inc eax
movsxd rcx, eax
cmp rcx, 0x80
jae 0x14000b9e3
mov byte [rcx + rdi], r15b
mov ebx, r15d
movzx eax, word [0x140042ab0]
movzx edi, r15w
mov dword [rsp + 0x34], r15d
movzx r9d, r15w
mov dword [rsp + 0x30], ebx
movzx esi, r15w
movzx r10d, r15w
mov r11d, r15d
test ax, ax
je 0x14000b556
lea r13, [0x140042ab0]
mov r8, r15
mov rdx, r13
nop word [rax + rax]
cmp ax, 0x5f
jne 0x14000b511
test r10w, r10w
jne 0x14000b49a
movsx eax, di
cdq
sub eax, edx
sar eax, 1
mov esi, eax
movsx eax, r9w
mov ecx, 1
cdq
sub eax, edx
sar eax, 1
cmp r9w, 0x40
jge 0x14000b4e0
cmp ax, 0x20
jle 0x14000b4c0
mov ecx, r15d
or ebx, ecx
inc r10w
jmp 0x14000b52b
cmp r15w, ax
jge 0x14000b4d8
movzx eax, ax
nop dword [rax]
add ecx, ecx
sub rax, 1
jne 0x14000b4d0
or ebx, ecx
inc r10w
jmp 0x14000b52b
sub ax, 0x20
cmp ax, 0x20
jle 0x14000b4f6
mov ecx, r15d
or r11d, ecx
inc r10w
jmp 0x14000b52b
cmp r15w, ax
jge 0x14000b508
movzx eax, ax
nop
add ecx, ecx
sub rax, 1
jne 0x14000b500
or r11d, ecx
inc r10w
jmp 0x14000b52b
movzx eax, byte [rdx]
movsx rcx, di
add di, 2
mov byte [rcx + r12], al
movzx eax, byte [r8 + r13 + 1]
mov byte [rcx + r12 + 1], al
add r9w, 2
movsx r8, r9w
movzx eax, word [r8 + r13]
lea rdx, [r8 + r13]
test ax, ax
jne 0x14000b480
mov dword [rsp + 0x34], r11d
lea r13, [0x14003c058]
mov dword [rsp + 0x30], ebx
movsx rax, di
mov word [rax + r12], r15w
test r10w, r10w
jne 0x14000b56b
movzx esi, r15w
jmp 0x14000b592
cmp r10w, 1
je 0x14000b589
mov rcx, qword [rsp + 0x30]
call fcn.14000bd70
test ax, ax
jns 0x14000b586
movzx esi, ax
jmp 0x14000b589
lea esi, [rax + 0x40]
test si, si
js 0x14000b9dc
mov rcx, r12
mov word [0x140042aa6], si
call fcn.14000bb50
test ax, ax
js 0x14000b9dc
mov word [0x140042aa0], ax
mov ecx, r15d
mov rax, r12
cmp byte [rax], r15b
jne 0x14000b5c2
cmp byte [rax + 1], r15b
je 0x14000b5ca
add rax, 2
inc ecx
jmp 0x14000b5b7
add cx, cx
movsx rax, cx
cmp byte [rax + r12 - 2], 0x2e
jne 0x14000b5f6
cmp byte [rax + r12 - 1], r15b
jne 0x14000b5f6
mov word [rax + r12 - 2], r15w
add cx, 0xfffe
mov eax, 0x8000
or word [0x140042aa6], ax
movsx rdi, cx
movsx rax, cx
mov rcx, r15
mov rbx, rdi
mov word [rax + r12], r15w
test edi, edi
jle 0x14000b61c
nop dword [rax]
not byte [rcx + r12]
inc rcx
cmp rcx, rbx
jl 0x14000b610
mov rcx, qword [r14]
lea r9, [rsp + 0x38]
mov r8d, edi
mov qword [rsp + 0x20], r15
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14000b664
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x14000b652
mov eax, eax
lea rcx, [0x140030680]
mov ecx, dword [rcx + rax*4]
jmp 0x14000b657
mov ecx, operator
mov dword [0x140042de8], ecx
mov byte [0x1400433b0], r15b
mov rcx, r15
test edi, edi
jle 0x14000b683
nop dword [rax + rax]
movzx eax, byte [rcx + r12]
not al
mov byte [rcx + r12], al
inc rcx
cmp rcx, rbx
jl 0x14000b670
cmp dword [rsp + 0x38], edi
jne 0x14000b9d5
lea rbx, [0x14003c060]
lea rsi, [0x140042a20]
mov rcx, rbx
mov rdx, rsi
movzx eax, byte [rcx]
test al, al
jne 0x14000b6ae
cmp byte [rcx + 1], r15b
je 0x14000b6c1
mov byte [rdx], al
movzx eax, byte [rcx + 1]
mov byte [rdx + 1], al
add rdx, 2
add rcx, 2
jmp 0x14000b6a1
movzx eax, byte [rcx]
mov byte [rdx], al
movzx eax, byte [rcx + 1]
lea rcx, [rsp + 0x58]
mov byte [rdx + 1], al
lea rdx, [0x140033ea4]
movzx r8d, word [0x140042aa0]
call fcn.14000bec0
cmp r15w, ax
jge 0x14000b718
lea r8, [rsp + 0x58]
movzx r9d, ax
lea rdx, [rsp + 0x49]
nop word [rax + rax]
movzx ecx, byte [r8]
lea r8, [r8 + 1]
mov byte [rdx - 1], cl
mov byte [rdx], r15b
lea rdx, [rdx + 2]
sub r9, 1
jne 0x14000b700
movsx rax, ax
lea rdx, [rsp + 0x48]
mov rcx, rsi
mov word [rsp + rax*2 + 0x48], r15w
nop word [rax + rax]
cmp byte [rcx], r15b
jne 0x14000b73b
cmp byte [rcx + 1], r15b
je 0x14000b741
add rcx, 2
jmp 0x14000b730
movzx eax, byte [rdx]
test al, al
jne 0x14000b74e
cmp byte [rdx + 1], r15b
je 0x14000b761
mov byte [rcx], al
movzx eax, byte [rdx + 1]
mov byte [rcx + 1], al
add rcx, 2
add rdx, 2
jmp 0x14000b741
mov word [rcx], r15w
mov rdx, rbx
mov rcx, rsi
nop dword [rax + rax]
cmp byte [rcx], r15b
jne 0x14000b77b
cmp byte [rcx + 1], r15b
je 0x14000b781
add rcx, 2
jmp 0x14000b770
movzx eax, byte [rdx]
test al, al
jne 0x14000b78e
cmp byte [rdx + 1], r15b
je 0x14000b7a1
mov byte [rcx], al
movzx eax, byte [rdx + 1]
mov byte [rcx + 1], al
add rcx, 2
add rdx, 2
jmp 0x14000b781
mov word [rcx], r15w
lea rdx, [0x140033ea4]
movzx r8d, word [0x140042aa6]
lea rcx, [rsp + 0x60]
call fcn.14000bec0
cmp r15w, ax
jge 0x14000b7ea
lea r8, [rsp + 0x60]
movzx r9d, ax
lea rdx, [rsp + 0x49]
movzx ecx, byte [r8]
lea r8, [r8 + 1]
mov byte [rdx - 1], cl
mov byte [rdx], r15b
lea rdx, [rdx + 2]
sub r9, 1
jne 0x14000b7d2
movsx rax, ax
lea rdx, [rsp + 0x48]
mov word [rsp + rax*2 + 0x48], r15w
mov rax, rsi
nop dword [rax]
cmp byte [rax], r15b
jne 0x14000b80b
cmp byte [rax + 1], r15b
je 0x14000b811
add rax, 2
jmp 0x14000b800
movzx ecx, byte [rdx]
test cl, cl
jne 0x14000b81e
cmp byte [rdx + 1], r15b
je 0x14000b831
mov byte [rax], cl
movzx ecx, byte [rdx + 1]
mov byte [rax + 1], cl
add rax, 2
add rdx, 2
jmp 0x14000b811
mov word [rax], r15w
mov ecx, r15d
mov rax, rsi
nop dword [rax + rax]
cmp byte [rax], r15b
jne 0x14000b84b
cmp byte [rax + 1], r15b
je 0x14000b853
add rax, 2
inc ecx
jmp 0x14000b840
add cx, cx
movsx rdi, cx
mov rcx, r15
mov rbx, rdi
test edi, edi
jle 0x14000b880
nop dword [rax]
nop dword [rax + rax]
not byte [rcx + r12 + 0x80]
inc rcx
cmp rcx, rbx
jl 0x14000b870
mov rcx, qword [r14]
lea r9, [rsp + 0x3c]
mov r8d, edi
mov qword [rsp + 0x20], r15
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14000b8c8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x14000b8b6
mov eax, eax
lea rcx, [0x140030680]
mov ecx, dword [rcx + rax*4]
jmp 0x14000b8bb
mov ecx, operator
mov dword [0x140042de8], ecx
mov byte [0x1400433b0], r15b
mov rcx, r15
test edi, edi
jle 0x14000b8e0
nop
not byte [rcx + r12 + 0x80]
inc rcx
cmp rcx, rbx
jl 0x14000b8d0
cmp dword [rsp + 0x3c], edi
jne 0x14000b9d5
mov rax, r13
mov ecx, r15d
cmp byte [rax], r15b
jne 0x14000b8fb
cmp byte [rax + 1], r15b
je 0x14000b903
add rax, 2
inc ecx
jmp 0x14000b8f0
add cx, cx
movsx rdi, cx
mov rcx, r15
mov rbx, rdi
test edi, edi
jle 0x14000b920
not byte [rcx + r13]
inc rcx
cmp rcx, rbx
jl 0x14000b914
mov rcx, qword [r14]
lea r9, [rsp + 0x40]
mov r8d, edi
mov qword [rsp + 0x20], r15
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14000b968
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x14000b956
mov eax, eax
lea rcx, [0x140030680]
mov ecx, dword [rcx + rax*4]
jmp 0x14000b95b
mov ecx, operator
mov dword [0x140042de8], ecx
mov byte [0x1400433b0], r15b
mov rcx, r15
test edi, edi
jle 0x14000b97c
nop
not byte [rcx + r13]
inc rcx
cmp rcx, rbx
jl 0x14000b970
cmp dword [rsp + 0x40], edi
jne 0x14000b9d5
lea rdi, [0x140042ab0]
mov edx, 0x80
mov r8, rbp
mov rcx, rdi
call fcn.140029e70
movzx ebx, ax
test ax, ax
jg 0x14000b380
movzx eax, r15w
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14002c160
mov rbx, qword [rsp + 0xc0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov eax, 0xfffffffc
jmp 0x14000b9a9
mov eax, 0xfffffffe
jmp 0x14000b9a9
mov eax, 0xfffffffd
jmp 0x14000b9a9
call fcn.14002c590
int3
call fcn.14002c590
int3