Function at 0x140030f80
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1a30]
mov eax, 0x1b30
call fcn.140022080
sub rsp, rax
mov rax, qword [0x140066360]
xor rax, rsp
mov qword [rbp + 0x1a20], rax
and dword [rsp + 0x48], 0
xor edi, edi
mov r15d, r8d
mov r14, rdx
movsxd rbx, ecx
test r8d, r8d
jne 0x140030fd2
xor eax, eax
jmp 0x140031699
test rdx, rdx
jne 0x140030ff6
call fcn.140025e94
and dword [rax], edi
call fcn.140025f04
mov dword [rax], 0x16
call fcn.140024c60
or eax, 0xffffffff
jmp 0x140031699
mov rax, rbx
mov r12, rbx
lea rcx, [0x140068690]
sar r12, 5
and eax, 0x1f
mov rcx, qword [rcx + r12*8]
mov qword [rsp + 0x50], r12
imul r13, rax, 0x58
mov sil, byte [r13 + rcx + 0x38]
add sil, sil
sar sil, 1
lea eax, [rsi - 1]
cmp al, 1
ja 0x140031032
mov eax, r15d
not eax
test al, 1
je 0x140030fd7
test byte [r13 + rcx + 8], 0x20
je 0x140031047
xor edx, edx
mov ecx, ebx
lea r8d, [rdx + 2]
call fcn.140037d1c
mov ecx, ebx
call fcn.140037bd4
test eax, eax
je 0x140031315
lea rax, [0x140068690]
mov rax, qword [rax + r12*8]
test byte [r13 + rax + 8], 0x80
je 0x140031315
call fcn.140025c84
xor ebx, ebx
lea rdx, [rsp + 0x5c]
mov rcx, qword [rax + 0xc0]
lea rax, [0x140068690]
cmp qword [rcx + 0x138], rbx
mov rcx, qword [rax + r12*8]
mov rcx, qword [r13 + rcx]
sete bl
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
test eax, eax
je 0x140031315
test ebx, ebx
je 0x1400310b5
test sil, sil
je 0x140031315
call qword [sym.imp.KERNEL32.dll_GetConsoleCP]
and dword [rsp + 0x58], edi
mov rbx, r14
mov dword [rsp + 0x5c], eax
test r15d, r15d
je 0x14003130c
test sil, sil
jne 0x14003125e
mov cl, byte [rbx]
xor eax, eax
cmp cl, 0xa
sete al
mov dword [rsp + 0x44], eax
lea rax, [0x140068690]
mov rdx, qword [rax + r12*8]
cmp dword [r13 + rdx + 0x50], 0
je 0x140031119
mov al, byte [r13 + rdx + 0x4c]
mov byte [rsp + 0x61], cl
mov r8d, 2
mov byte [rsp + 0x60], al
and dword [r13 + rdx + 0x50], 0
lea rdx, [rsp + 0x60]
jmp 0x140031162
movsx ecx, cl
call fcn.140037f7c
test eax, eax
je 0x140031159
mov rax, r15
sub rax, rbx
add rax, r14
cmp rax, 1
jle 0x1400312e2
lea rcx, [rsp + 0x40]
mov r8d, 2
mov rdx, rbx
call fcn.140038414
cmp eax, 0xffffffff
je 0x140031303
inc rbx
jmp 0x140031175
mov r8d, 1
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.140038414
cmp eax, 0xffffffff
je 0x140031303
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
mov ecx, dword [rsp + 0x5c]
lea rax, [rsp + 0x60]
lea r8, [rsp + 0x40]
mov r9d, 1
xor edx, edx
mov dword [rsp + 0x28], 5
inc rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov r12d, eax
test eax, eax
je 0x140031303
mov rcx, qword [rsp + 0x50]
and qword [rsp + 0x20], 0
lea rax, [0x140068690]
mov rcx, qword [rax + rcx*8]
lea r9, [rsp + 0x58]
lea rdx, [rsp + 0x60]
mov rcx, qword [r13 + rcx]
mov r8d, r12d
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140031621
mov edi, ebx
sub edi, r14d
add edi, dword [rsp + 0x48]
cmp dword [rsp + 0x58], r12d
jl 0x140031303
cmp dword [rsp + 0x44], 0
mov r12, qword [rsp + 0x50]
je 0x1400312d3
and qword [rsp + 0x20], 0
lea rax, [0x140068690]
mov byte [rsp + 0x60], 0xd
mov rcx, qword [rax + r12*8]
lea r9, [rsp + 0x58]
lea rdx, [rsp + 0x60]
mov rcx, qword [r13 + rcx]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140031621
cmp dword [rsp + 0x58], 1
jl 0x140031303
inc dword [rsp + 0x48]
inc edi
jmp 0x1400312d3
lea eax, [rsi - 1]
cmp al, 1
ja 0x140031283
movzx eax, word [rbx]
xor r12d, r12d
cmp ax, 0xa
mov word [rsp + 0x40], ax
sete r12b
add rbx, 2
mov dword [rsp + 0x44], r12d
jmp 0x140031288
mov r12d, dword [rsp + 0x44]
lea eax, [rsi - 1]
cmp al, 1
ja 0x1400312ce
movzx ecx, word [rsp + 0x40]
call fcn.140046454
cmp ax, word [rsp + 0x40]
jne 0x140031621
add edi, 2
test r12d, r12d
je 0x1400312ce
mov eax, 0xd
mov ecx, eax
mov word [rsp + 0x40], ax
call fcn.140046454
cmp ax, word [rsp + 0x40]
jne 0x140031621
inc edi
inc dword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
mov eax, ebx
sub eax, r14d
cmp eax, r15d
jae 0x140031303
jmp 0x1400310cf
mov al, byte [rbx]
lea rdx, [0x140068690]
inc edi
mov rcx, qword [rdx + r12*8]
mov byte [r13 + rcx + 0x4c], al
mov rax, qword [rdx + r12*8]
mov dword [r13 + rax + 0x50], 1
mov ebx, dword [rsp + 0x44]
jmp 0x140031629
mov ebx, dword [rsp + 0x44]
jmp 0x14003162d
lea rax, [0x140068690]
mov rcx, qword [rax + r12*8]
test byte [r13 + rcx + 8], 0x80
je 0x1400315fa
xor ebx, ebx
mov r12, r14
mov dword [rsp + 0x44], ebx
test sil, sil
jne 0x140031407
test r15d, r15d
je 0x140031659
lea edx, [rbx + 0xd]
mov ebx, dword [rsp + 0x48]
lea rsi, [rbp + 0x620]
xor ecx, ecx
mov eax, r12d
sub eax, r14d
cmp eax, r15d
jae 0x140031388
mov al, byte [r12]
inc r12
cmp al, 0xa
jne 0x140031377
mov byte [rsi], dl
inc ebx
inc rsi
inc rcx
inc rcx
mov byte [rsi], al
inc rsi
cmp rcx, 0x13ff
jb 0x140031357
and qword [rsp + 0x20], 0
lea rax, [rbp + 0x620]
mov r8d, esi
sub r8d, eax
mov rax, qword [rsp + 0x50]
lea rcx, [0x140068690]
mov rcx, qword [rcx + rax*8]
lea r9, [rsp + 0x4c]
lea rdx, [rbp + 0x620]
mov rcx, qword [r13 + rcx]
mov dword [rsp + 0x48], ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, dword [rsp + 0x44]
test eax, eax
je 0x140031621
add edi, dword [rsp + 0x4c]
lea rax, [rbp + 0x620]
sub rsi, rax
movsxd rax, dword [rsp + 0x4c]
cmp rax, rsi
jl 0x140031629
mov eax, r12d
mov edx, 0xd
sub eax, r14d
cmp eax, r15d
jb 0x14003134a
jmp 0x140031629
cmp sil, 2
jne 0x1400314e7
test r15d, r15d
je 0x140031659
mov edx, 0xd
mov ebx, dword [rsp + 0x48]
lea rsi, [rbp + 0x620]
xor ecx, ecx
mov eax, r12d
sub eax, r14d
cmp eax, r15d
jae 0x140031468
movzx eax, word [r12]
add r12, 2
cmp ax, 0xa
jne 0x140031454
mov word [rsi], dx
add ebx, 2
add rsi, 2
add rcx, 2
add rcx, 2
mov word [rsi], ax
add rsi, 2
cmp rcx, 0x13fe
jb 0x14003142c
and qword [rsp + 0x20], 0
lea rax, [rbp + 0x620]
mov r8d, esi
sub r8d, eax
mov rax, qword [rsp + 0x50]
lea rcx, [0x140068690]
mov rcx, qword [rcx + rax*8]
lea r9, [rsp + 0x4c]
lea rdx, [rbp + 0x620]
mov rcx, qword [r13 + rcx]
mov dword [rsp + 0x48], ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, dword [rsp + 0x44]
test eax, eax
je 0x140031621
add edi, dword [rsp + 0x4c]
lea rax, [rbp + 0x620]
sub rsi, rax
movsxd rax, dword [rsp + 0x4c]
cmp rax, rsi
jl 0x140031629
mov eax, r12d
mov edx, 0xd
sub eax, r14d
cmp eax, r15d
jb 0x14003141f
jmp 0x140031629
test r15d, r15d
je 0x140031659
mov r8d, 0xd
lea rcx, [rsp + 0x70]
xor edx, edx
mov eax, r12d
sub eax, r14d
cmp eax, r15d
jae 0x140031537
movzx eax, word [r12]
add r12, 2
cmp ax, 0xa
jne 0x140031523
mov word [rcx], r8w
add rcx, 2
add rdx, 2
add rdx, 2
mov word [rcx], ax
add rcx, 2
cmp rdx, 0x6a8
jb 0x1400314fd
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
lea rax, [rsp + 0x70]
sub ecx, eax
lea r8, [rsp + 0x70]
mov dword [rsp + 0x28], 0xd55
mov eax, ecx
mov ecx, 0xfde9
cdq
sub eax, edx
xor edx, edx
sar eax, 1
mov r9d, eax
lea rax, [rbp + 0x620]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [rsp + 0x44], eax
test eax, eax
je 0x140031621
xor esi, esi
and qword [rsp + 0x20], 0
mov r8d, eax
mov rax, qword [rsp + 0x50]
movsxd rcx, esi
lea rdx, [rbp + 0x620]
lea r9, [rsp + 0x4c]
add rdx, rcx
lea rcx, [0x140068690]
sub r8d, esi
mov rcx, qword [rcx + rax*8]
mov rcx, qword [r13 + rcx]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400315d3
add esi, dword [rsp + 0x4c]
mov eax, dword [rsp + 0x44]
cmp eax, esi
jg 0x140031588
jmp 0x1400315df
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [rsp + 0x44]
cmp eax, esi
jg 0x140031629
mov edi, r12d
mov r8d, 0xd
sub edi, r14d
cmp edi, r15d
jb 0x1400314f6
jmp 0x140031629
mov rcx, qword [r13 + rcx]
and qword [rsp + 0x20], rdi
lea r9, [rsp + 0x4c]
mov r8d, r15d
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140031621
mov edi, dword [rsp + 0x4c]
xor ebx, ebx
jmp 0x140031629
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test edi, edi
jne 0x140031693
test ebx, ebx
je 0x140031659
cmp ebx, 5
jne 0x14003164d
call fcn.140025f04
mov dword [rax], 9
call fcn.140025e94
mov dword [rax], ebx
jmp 0x140030fee
mov ecx, ebx
call fcn.140025eb4
jmp 0x140030fee
mov rax, qword [rsp + 0x50]
lea rcx, [0x140068690]
mov rax, qword [rcx + rax*8]
test byte [r13 + rax + 8], 0x40
je 0x14003167b
cmp byte [r14], 0x1a
je 0x140030fcb
call fcn.140025f04
mov dword [rax], 0x1c
call fcn.140025e94
and dword [rax], 0
jmp 0x140030fee
sub edi, dword [rsp + 0x48]
mov eax, edi
mov rcx, qword [rbp + 0x1a20]
xor rcx, rsp
call fcn.1400220e0
mov rbx, qword [rsp + 0x1b88]
add rsp, 0x1b30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret