Function at 0x140017a70
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x3d0
mov rax, qword [0x14002d010]
xor rax, rsp
mov qword [rsp + 0x3c0], rax
cmp dword [rcx + 8], 0xffffffff
mov rsi, r8
mov r14d, edx
mov rdi, rcx
je 0x140017aa5
mov rcx, qword [rcx]
call fcn.140017150
mov rax, qword [rdi]
mov dword [rdi + 8], 0xffffffff
cmp r14d, dword [rax + 8]
jl 0x140017abf
mov eax, 0x10000
jmp 0x140017bba
mov qword [rsp + 0x3f8], rbx
mov qword [rsp + 0x408], rbp
xor ebp, ebp
cmp dword [rax + 0x14], r14d
jle 0x140017b10
mov rbx, rax
test rax, rax
je 0x140017b0c
mov eax, dword [rax + 0x28]
lea r8, [rbx + 0x7c]
lea rdx, [rbx + 0x2c]
mov dword [rbx + 0x18], eax
xor r9d, r9d
mov dword [rbx + 0x14], ebp
mov rcx, rbx
mov dword [rsp + 0x20], ebp
call fcn.1400164b0
test eax, eax
mov ecx, ebp
sete cl
mov dword [rbx + 0x1c], ecx
mov rax, qword [rdi]
cmp dword [rax + 0x14], r14d
jge 0x140017b67
mov rbx, rax
test rax, rax
je 0x140017b61
cmp dword [rax + 0x1c], ebp
je 0x140017b61
mov edx, dword [rax + 0x14]
inc edx
cmp edx, dword [rax + 8]
je 0x140017b61
mov ecx, dword [rax + 0x54]
lea r8, [rbx + 0x7c]
add ecx, dword [rax + 0x50]
xor r9d, r9d
mov eax, dword [rax + 0x4c]
add eax, 0x2e
mov dword [rbx + 0x14], edx
add ecx, eax
mov dword [rsp + 0x20], ebp
add dword [rbx + 0x18], ecx
lea rdx, [rbx + 0x2c]
mov rcx, rbx
call fcn.1400164b0
test eax, eax
mov ecx, ebp
sete cl
mov dword [rbx + 0x1c], ecx
mov rax, qword [rdi]
cmp dword [rax + 0x14], r14d
jl 0x140017b12
lea r8, [rsp + 0x60]
mov edx, r14d
mov rcx, rdi
call fcn.140017200
test byte [rsp + 0x168], 0x10
movzx eax, byte [rsi]
je 0x140017bd6
cmp al, 0x2f
je 0x140017b9d
cmp al, 0x5c
je 0x140017b9d
test al, al
je 0x140017b96
cmp byte [rsi + 1], 0x3a
je 0x140017b9d
lea rbp, [rdi + 0x150]
mov rdx, rsi
mov rcx, rbp
call fcn.140017910
xor eax, eax
mov rbx, qword [rsp + 0x3f8]
mov rbp, qword [rsp + 0x408]
mov rcx, qword [rsp + 0x3c0]
xor rcx, rsp
call fcn.140017fd0
add rsp, 0x3d0
pop r14
pop rdi
pop rsi
ret
mov r9, rsi
mov rcx, rsi
test al, al
je 0x140017bf7
cmp al, 0x2f
je 0x140017be8
cmp al, 0x5c
jne 0x140017bec
lea r9, [rcx + 1]
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x140017be0
lea rdx, [rsp + 0x1a0]
mov rcx, rsi
sub rdx, rsi
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x140017c10
cmp r9, rsi
jne 0x140017c2d
mov byte [rsp + 0x1a0], bpl
jmp 0x140017c65
mov rax, r9
sub rax, rsi
cmp rax, 0x104
jae 0x140017de8
mov byte [rsp + rax + 0x1a0], bpl
movzx eax, byte [rsp + 0x1a0]
cmp al, 0x2f
je 0x140017c93
cmp al, 0x5c
je 0x140017c93
test al, al
je 0x140017c65
cmp byte [rsp + 0x1a1], 0x3a
je 0x140017c93
mov qword [rsp + 0x20], r9
lea rbx, [rdi + 0x150]
mov r8, rbx
lea r9, [rsp + 0x1a0]
lea rdx, str._s_s_s
lea rcx, [rsp + 0x2b0]
call qword [sym.imp.USER32.dll_wsprintfA]
jmp 0x140017cb3
lea r8, [rsp + 0x1a0]
lea rdx, str._s_s
lea rcx, [rsp + 0x2b0]
call qword [sym.imp.USER32.dll_wsprintfA]
mov rbx, rbp
lea rdx, [rsp + 0x1a0]
mov rcx, rbx
call fcn.140017910
mov eax, dword [rsp + 0x168]
lea rcx, [rsp + 0x2b0]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140017d07
mov eax, 0x200
jmp 0x140017baa
mov rdx, qword [rdi + 0x140]
mov rcx, qword [rdi]
call fcn.140016bb0
cmp qword [rdi + 0x148], rbp
jne 0x140017d30
mov ecx, 0x4000
call fcn.1400188cc
mov qword [rdi + 0x148], rax
mov rdx, qword [rdi + 0x148]
lea r9, [rsp + 0x50]
mov rcx, qword [rdi]
mov r8d, 0x4000
call fcn.140016dd0
mov ebx, eax
cmp eax, 0xffffff96
je 0x140017dcb
test eax, eax
js 0x140017d86
jle 0x140017d7b
mov rdx, qword [rdi + 0x148]
lea r9, [rsp + 0x190]
mov r8d, eax
mov qword [rsp + 0x20], rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140017d8d
cmp byte [rsp + 0x50], bpl
jne 0x140017d94
test ebx, ebx
jne 0x140017d30
mov ebx, 0x5000000
jmp 0x140017dd0
mov ebx, 0x400
jmp 0x140017dd0
lea r9, [rsp + 0x17c]
mov rcx, rsi
lea r8, [rsp + 0x16c]
lea rdx, [rsp + 0x174]
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi]
call fcn.140017150
jmp 0x140017ba8
mov ebx, 0x1000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi]
call fcn.140017150
mov eax, ebx
jmp 0x140017baa
call fcn.140018738
int3