Function at 0x140003a20
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [0x14001d010]
xor rax, rsp
mov qword [rbp + 0x90], rax
mov rdi, r8
lea rcx, [0x14001d9d8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rbx, [0x14001d9b0]
cmp qword [0x14001d9c8], 8
cmovae rbx, qword [0x14001d9b0]
lea rcx, [0x14001d9d8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor esi, esi
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x70], 0xf
lea r8d, [rsi + 0x12]
lea rdx, str.NSudo.String.Links
lea rcx, [rsp + 0x78]
call fcn.140005370
lea rax, [rsp + 0x78]
mov qword [rsp + 0x50], rax
lea r8, [rsp + 0x78]
lea rdx, [rbp + 0x18]
lea rcx, [0x14001d0a0]
call fcn.140005660
mov rdx, qword [rax]
add rdx, 0x40
lea rcx, [rbp + 0x28]
call fcn.140005090
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x140003b18
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003b13
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003fe9
call fcn.14000afec
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x70], 0xf
mov byte [rsp + 0x78], 0
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x50], 0xf
mov r8d, 0xe
lea rdx, str.NSudo.LogoText
lea rcx, [rbp - 0x68]
call fcn.140005370
lea rax, [rbp - 0x68]
mov qword [rsp + 0x50], rax
lea r8, [rbp - 0x68]
lea rdx, [rbp + 0x18]
lea rcx, [0x14001d0a0]
call fcn.140005660
mov rdx, qword [rax]
add rdx, 0x40
lea rcx, [rbp - 0x28]
call fcn.140005090
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x140003bb8
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003bb3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003fef
call fcn.14000afec
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x50], 0xf
mov byte [rbp - 0x68], 0
mov r8, rdi
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 8]
call fcn.140005530
nop
lea r9, [rbp + 0x28]
mov r8, rax
lea rcx, [rsp + 0x58]
call fcn.140005eb0
nop
mov rdx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x70]
mov rax, r8
sub rax, rdx
cmp rax, 2
jb 0x140003c2b
lea rcx, [rdx + 2]
mov qword [rsp + 0x68], rcx
lea rax, [rsp + 0x58]
cmp r8, 8
cmovae rax, qword [rsp + 0x58]
mov dword [rax + rdx*2], 0xa000d
mov word [rax + rcx*2], si
lea rax, [rsp + 0x58]
jmp 0x140003c4a
mov qword [rsp + 0x20], 2
lea r9, [0x140017d0c]
mov edx, 2
lea rcx, [rsp + 0x58]
call fcn.140006a20
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rsi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
mov rax, r8
sub rax, rdx
cmp rax, 2
jb 0x140003cb9
lea rcx, [rdx + 2]
mov qword [rsp + 0x40], rcx
lea rax, [rsp + 0x30]
cmp r8, 8
cmovae rax, qword [rsp + 0x30]
mov dword [rax + rdx*2], 0xa000d
mov word [rax + rcx*2], si
lea rax, [rsp + 0x30]
jmp 0x140003cd8
mov qword [rsp + 0x20], 2
lea r9, [0x140017d0c]
mov edx, 2
lea rcx, [rsp + 0x30]
call fcn.140006a20
mov qword [rbp - 0x48], rsi
mov qword [rbp - 0x38], rsi
mov qword [rbp - 0x30], rsi
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x38], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov r8, rbx
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x70]
call fcn.140005530
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x140003d53
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003d4e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003ff5
call fcn.14000afec
mov qword [rbp - 0x38], rsi
mov qword [rbp - 0x30], 7
mov word [rbp - 0x48], si
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x140003da5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003da0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003ffb
call fcn.14000afec
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], si
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x140003dfa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003df5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004001
call fcn.14000afec
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], si
mov rdx, qword [rbp + 0x10]
cmp rdx, 8
jb 0x140003e4d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003e48
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004007
call fcn.14000afec
mov qword [rbp + 8], rsi
mov qword [rbp + 0x10], 7
mov word [rbp - 8], si
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x140003e9d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003e98
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000400d
call fcn.14000afec
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x10], 7
mov word [rbp - 0x28], si
mov rdx, qword [rbp + 0x40]
cmp rdx, 8
jb 0x140003eed
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003ee8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004013
call fcn.14000afec
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x50]
call fcn.14000a2e0
mov dword [rbp + 0x48], esi
mov ebx, dword [rbp + 0x60]
lea rdi, [rbp + 0x50]
cmp qword [rbp + 0x68], 0x10
cmovae rdi, qword [rbp + 0x50]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0x48]
mov r8d, ebx
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rbp + 0x68]
cmp rdx, 0x10
jb 0x140003f6c
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003f67
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004019
call fcn.14000afec
mov qword [rbp + 0x60], rsi
mov qword [rbp + 0x68], 0xf
mov byte [rbp + 0x50], 0
mov rdx, qword [rbp + 0x88]
cmp rdx, 8
jb 0x140003fbb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003fb6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003fe3
call fcn.14000afec
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.14000ac70
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.14000ed30
int3
call fcn.14000ed30
nop
call fcn.14000ed30
nop
call fcn.14000ed30
nop
call fcn.14000ed30
nop
call fcn.14000ed30
nop
call fcn.14000ed30
nop
call fcn.14000ed30
nop
call fcn.14000ed30
int3
call fcn.14000ed30
int3