Function at 0x14000bdd8
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov eax, dword [rcx + 0x3c0]
xor r15d, r15d
mov esi, r9d
lea r12d, [r15 + 1]
mov r13d, r8d
mov r14, rdx
cmp eax, r12d
mov rbx, rcx
mov ebp, r15d
mov dword [rcx + 0x5c], r15d
jne 0x14000be17
mov dword [rcx + 0x58], r15d
jmp 0x14000be37
cmp eax, 2
je 0x14000be33
cmp r8d, 4
mov dword [rcx + 0x58], r12d
jne 0x14000be2a
mov dword [rcx + 0x5c], r12d
cmp eax, 3
jne 0x14000be37
mov dword [rcx + 0x5c], r12d
mov dword [rcx + 0x58], r12d
call fcn.140009894
cmp esi, 2
mov dword [rbx + 0x338], r15d
jne 0x14000be81
mov rax, qword [rbx + 0x390]
mov dword [rbx + 0x338], r12d
lea rdx, [0x14001f9c8]
mov dword [rax + 0x14], 0x8000
mov rax, qword [rbx + 0x390]
or rdi, 0xffffffffffffffff
mov dword [rax + 0x10], r12d
mov rcx, qword [rbx + 0x390]
call fcn.140007994
jmp 0x14000bef6
cmp word [r14], r15w
je 0x14000be93
xor edx, edx
mov rcx, r14
call fcn.14000661c
jmp 0x14000be9e
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp rax, 0xffffffffffffffff
mov rdi, rax
je 0x14000c093
cmp esi, r15d
jne 0x14000bef6
cmp dword [rbx + 0x58], r15d
je 0x14000bef6
cmp dword [rbx + 0x5c], r15d
mov dword [rsp + 0x88], r15d
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x88]
mov rcx, rax
je 0x14000bee3
mov r8d, 3
lea rdx, [0x140020e60]
jmp 0x14000bef0
mov r8d, 2
lea rdx, [0x140020e64]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, 0x7f02
xor ecx, ecx
mov ebp, r12d
call qword [sym.imp.USER32.dll_LoadCursorW]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
mov r8d, r13d
mov rdx, rdi
mov rcx, rbx
mov qword [0x140025850], rax
call fcn.14000c6c4
cmp dword [rsp + 0x90], r15d
mov rcx, qword [rbx + 0x350]
je 0x14000bfc9
mov r12d, 0x100c
mov r9d, 2
or r8, 0xffffffffffffffff
mov edx, r12d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rsi, rax
cmp eax, r15d
jl 0x14000c069
lea rdx, [rsp + 0x70]
mov r8d, esi
mov rcx, rbx
call fcn.140009ec8
cmp eax, r15d
je 0x14000bfac
mov rax, qword [rbx]
mov rdx, qword [rsp + 0x70]
mov r8d, esi
mov rcx, rbx
call qword [rax + 0xf0]
cmp eax, r15d
je 0x14000bfac
mov rax, qword [rbx]
mov r8, qword [rsp + 0x70]
mov r9d, r13d
mov rdx, rdi
mov rcx, rbx
call qword [rax + 0x108]
cmp eax, r15d
je 0x14000c066
mov rcx, qword [rbx + 0x350]
movsxd r8, esi
mov r9d, 2
mov edx, r12d
call qword [sym.imp.USER32.dll_SendMessageW]
mov esi, eax
jmp 0x14000bf55
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1004
call qword [sym.imp.USER32.dll_SendMessageW]
mov esi, r15d
cmp eax, r15d
mov r12, rax
jle 0x14000c069
lea rdx, [rsp + 0x70]
mov r8d, esi
mov rcx, rbx
call fcn.140009ec8
cmp eax, r15d
je 0x14000c05d
cmp dword [rbx + 0x3b8], r15d
mov rcx, qword [rbx + 0x350]
movsxd r8, esi
mov edx, 0x102c
mov r9d, 0xf000
jne 0x14000c022
mov r9d, 2
call qword [sym.imp.USER32.dll_SendMessageW]
mov rax, qword [rbx]
mov rdx, qword [rsp + 0x70]
mov r8d, esi
mov rcx, rbx
call qword [rax + 0xf0]
cmp eax, r15d
je 0x14000c05d
mov rax, qword [rbx]
mov r8, qword [rsp + 0x70]
mov r9d, r13d
mov rdx, rdi
mov rcx, rbx
call qword [rax + 0x108]
cmp eax, r15d
je 0x14000c066
add esi, ebp
cmp esi, r12d
jge 0x14000c069
jmp 0x14000bfe9
mov ebp, r15d
mov r8d, r13d
mov rdx, rdi
mov rcx, rbx
call fcn.14000c660
cmp word [r14], r15w
je 0x14000c086
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x140025850]
call qword [sym.imp.USER32.dll_SetCursor]
mov eax, ebp
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret