Function at 0x1404d7eef
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
sub rbp, r12
sar ebp, cl
push rdi
neg ax
xor si, 0xf4e
push r12
inc bpl
bt rsi, rax
cdqe
push r13
clc
push r14
mov ax, si
shrd r14w, r14w, 0x89
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x100
mov rax, qword [0x1400b7288]
xor rax, rsp
shld r12d, r12d, 0x21
sub r15b, 0x7d
cmp spl, 0xe9
mov qword [rbp + 0x17], rax
rol r15b, cl
movsxd rsi, edx
setbe r14b
mov r15, r8
mov rax, rsi
cmovl r12w, bx
sar r13w, 0x16
btc r14w, r9w
mov qword [rbp - 9], rcx
mov qword [rbp - 0x11], rax
lea rcx, [0x140000000]
test r15b, 8
and eax, 0x3f
btc r12, r8
shr r13w, 0x5f
mov r13d, r9d
ror r12b, 0xbc
rcl r14w, 0x5a
lea r13, [r13 + r8]
btr r14d, 0xc6
sete r14b
mov qword [rbp - 0x21], r8
bsr r12d, r14d
rcr r12b, 0xe1
test r10, r14
mov r12, rsi
cmp r11b, 0x47
cmc
mov qword [rbp - 0x51], r13
sar r12, 6
movsx r14d, r10w
lea r14, [rax + rax*8]
lahf
mov rax, qword [rcx + r12*8 + 0xba940]
jmp 0x1404d7fd3
mov rax, qword [rax + r14*8 + 0x28]
jmp 0x1404d7fdd
mov qword [rbp - 0x49], rax
jmp 0x1404d7fe6
call qword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
sub edx, edx
movsx ecx, di
movzx cx, bpl
lea rcx, [rsp + 0x50]
jmp 0x1404d8000
mov dword [rbp - 0x59], eax
jmp 0x1404d8008
call fcn.1404a0cf3
mov rcx, qword [rsp + 0x58]
shr edi, 0x83
xor r11d, r11d
sbb bl, dil
mov dword [rbp - 0x69], r11d
cdq
sbb di, r10w
mov ebx, r11d
xor dx, 0x426f
mov dword [rbp - 0x65], ebx
mov rdi, r15
shld dx, ax, 0xe4
add dh, 0xb4
movsx edx, di
mov edx, dword [rcx + 0xc]
bswap cx
mov ecx, r11d
mov dword [rsp + 0x40], ecx
cmc
test r14, r14
mov dword [rbp - 0x55], edx
test r10, r14
cmp r15, r13
jae 0x1404d880d
mov rax, rsi
mov rsi, r15
and r15, 0x4efd3e35
sar rax, 6
sal cl, cl
mov qword [rbp - 0x19], rax
mov cl, byte [rdi]
and r15b, bpl
mov r15d, 1
clc
jmp 0x1404d8085
mov byte [rsp + 0x44], cl
test r10b, 0x21
test cx, r15w
mov dword [rsp + 0x48], r11d
jmp 0x1404d809b
cmp edx, 0xfde9
jmp 0x1404d80a6
jne 0x1404d8392
lea r15, [0x140000000]
bts si, di
neg r9
rcr rsi, 0x4a
mov edx, r11d
xchg sil, sil
mov r9, qword [r15 + rax*8 + 0xba940]
mov rsi, r11
sar ax, cl
lea rax, [r9 + r14*8]
cmp byte [rax + rsi + 0x3e], r11b
jmp 0x1404d80e0
je 0x1404d80ff
inc edx
jmp 0x1404d80ed
inc rsi
cmp rsi, 5
jmp 0x1404d80f9
jl 0x1404d80d6
test rsi, rsi
jmp 0x1404d8107
jle 0x1404d82cb
mov rax, qword [r15 + r12*8 + 0xba940]
sar r8, cl
shl r13b, 0x84
movsxd r8, r12d
mov r8, qword [rbp - 0x51]
shl r10b, cl
shld r10w, cx, 0x16
sub r8, rdi
movsx r13, si
setne r13b
movzx ecx, byte [rax + r14*8 + 0x3e]
jmp 0x1404d8149
movsx r15d, byte [rcx + r15 + 0xb7d00]
movsx r13w, r10b
inc r15d
sar r13w, cl
mov r13d, r15d
bt r10, 0xee
sub r13d, edx
xchg r10b, r10b
movsxd r10, r13d
test si, 0x2042
cmp dl, 0x43
cmp r10, r8
jmp 0x1404d817f
jg 0x1404d864f
lea rax, [rbp - 1]
bts r8d, r10d
test r8b, 0x3a
mov rdx, r11
btc cx, 0x8c
stc
test al, r13b
sub r9, rax
lea r8, [r9 + r14*8]
lea rcx, [rbp - 1]
add rcx, rdx
inc rdx
xor al, r9b
shl al, 0xcb
mov al, byte [rcx + r8 + 0x3e]
mov byte [rcx], al
jmp 0x1404d81c4
cmp rdx, rsi
jmp 0x1404d81cc
jl 0x1404d81a4
test r13d, r13d
jmp 0x1404d81da
jle 0x1404d820e
lea rcx, [rbp - 1]
adc r8w, si
test bx, sp
mov r8, r10
add rcx, rsi
movzx dx, r10b
mov rdx, rdi
call fcn.14049fd21
xor r11d, r11d
cmp spl, 0x9c
movsx rdx, cx
xadd r8w, dx
mov rdx, r11
lea r8, [0x140000000]
shl rcx, cl
mov rcx, qword [r8 + r12*8 + 0xba940]
add rcx, rdx
jmp 0x1404d822b
inc rdx
clc
mov byte [rcx + r14*8 + 0x3e], r11b
cmp rdx, rsi
jl 0x1404d821b
lea rax, [rbp - 1]
mov qword [rbp - 0x41], r11
mov qword [rbp - 0x39], rax
dec al
bt r8d, 0x76
ror dl, cl
lea r9, [rbp - 0x41]
jmp 0x1404d825b
mov eax, r11d
lea rdx, [rbp - 0x39]
cmp r15d, 4
not al
movsx r8, ax
movzx r15w, spl
lea rcx, [rsp + 0x48]
movsx r8, bp
sete al
setl r8b
inc eax
jmp 0x1404d8288
mov r8d, eax
mov r15d, eax
jmp 0x1404d8293
call fcn.1404ddab8
cmp rax, 0xffffffffffffffff
jmp 0x1404d82a1
je 0x1404d846d
lea eax, [r13 - 1]
neg r13b
clc
mov r13, qword [rbp - 0x51]
bts esi, r10d
rol si, 0x98
movsxd rsi, eax
add rsi, rdi
jmp 0x1404d82c6
jmp 0x1404d84a2
movzx eax, byte [rdi]
mov rdx, r13
shrd si, r9w, 0xa1
bts si, bx
sub rdx, rdi
bsf rsi, r13
movsx rsi, cx
movsx rsi, byte [rax + r15 + 0xb7d00]
cdqe
lea ecx, [rsi + 1]
rcl eax, 0xd2
and rax, r11
rcl ah, cl
movsxd rax, ecx
cmp rax, rdx
jmp 0x1404d8307
jg 0x1404d86cd
cmp ecx, 4
movsx bx, r9b
movsx eax, bx
mov qword [rbp - 0x31], r11
mov eax, r11d
movsxd r8, r13d
mov qword [rbp - 0x29], rdi
cwd
xchg al, r8b
sete al
cwd
movzx r9d, r14w
mov r8w, r13w
lea r9, [rbp - 0x31]
inc eax
cmovns ebx, edx
movsx r8d, si
movsx cx, dil
lea rdx, [rbp - 0x29]
jmp 0x1404d8353
mov r8d, eax
cmovle cx, r12w
movzx ebx, r12w
mov bl, ah
lea rcx, [rsp + 0x48]
movsxd rbx, edx
mov ebx, eax
jmp 0x1404d8370
call fcn.1404ddab8
cmp rax, 0xffffffffffffffff
je 0x1404d846d
add rsi, rdi
movsxd r15, ecx
mov r15d, ebx
jmp 0x1404d838d
jmp 0x1404d84a2
lea rax, [0x140000000]
cwd
and rdx, rdx
mov rdx, qword [rax + r12*8 + 0xba940]
mov cl, byte [rdx + r14*8 + 0x3d]
cmp cl, r8b
jmp 0x1404d83b3
test cl, 4
je 0x1404d8401
mov al, byte [rdx + r14*8 + 0x3e]
jmp 0x1404d83c6
and cl, 0xfb
mov byte [rbp + 7], al
jmp 0x1404d83d4
mov al, byte [rdi]
jmp 0x1404d83db
mov byte [rdx + r14*8 + 0x3d], cl
bswap rdx
movzx edx, ax
jmp 0x1404d83eb
lea rdx, [rbp + 7]
jmp 0x1404d83f4
mov byte [rbp + 8], al
jmp 0x1404d83fc
jmp 0x1404d8440
call fcn.1404a74d6
movzx ecx, byte [rdi]
cmp ch, 0xc8
stc
xor edx, edx
stc
cmp word [rax + rcx*2], dx
jmp 0x1404d8419
jge 0x1404d8476
inc rsi
clc
jmp 0x1404d8428
cmp rsi, r13
jmp 0x1404d8430
jae 0x1404d879e
mov rdx, rdi
bswap rcx
setbe r8b
mov r8d, 2
setg cl
cmovbe ecx, r12d
mov cl, dil
lea rcx, [rsp + 0x48]
jmp 0x1404d845a
call fcn.140208511
cmp eax, 0xffffffff
jmp 0x1404d8467
jne 0x1404d84a2
cmp byte [rbp - 0x71], 0
jmp 0x1404d8790
mov r8, r15
lea rcx, [rsp + 0x48]
not dx
movzx edx, r8w
bswap edx
mov rdx, rdi
jmp 0x1404d848f
call fcn.140208511
cmp eax, 0xffffffff
jmp 0x1404d849c
je 0x1404d87ed
mov ecx, dword [rbp - 0x59]
shld r8w, r8w, 0x1c
lea rax, [rbp + 0xf]
shr dil, cl
xor r9b, 0x71
sub ebx, ebx
lea r8, [rsp + 0x48]
cmp esp, r11d
movzx r9, r13w
mov qword [rsp + 0x38], rbx
sal r9b, cl
lea rdi, [rsi + 1]
rcr r9w, 0xba
mov qword [rsp + 0x30], rbx
mov r9d, r15d
clc
mov dword [rsp + 0x28], 5
clc
test r13b, r13b
xor edx, edx
jmp 0x1404d84f1
mov qword [rsp + 0x20], rax
jmp 0x1404d84fb
call fcn.1404c5cb9
mov esi, eax
cmp bl, 0xfd
cmc
test eax, eax
jmp 0x1404d850d
je 0x1404d88c9
mov rcx, qword [rbp - 0x49]
lea r9, [rsp + 0x4c]
cqo
mov r8d, eax
jmp 0x1404d852b
mov qword [rsp + 0x20], rbx
cdq
lea rdx, [rbp + 0xf]
jmp 0x1404d853a
call qword [sym.imp.KERNEL32.dll_WriteFile]
sub r11d, r11d
test eax, eax
jmp 0x1404d854a
je 0x1404d88bd
mov r15d, dword [rsp + 0x40]
ror ebx, 0x16
mov ebx, edi
cmp r8b, 0x19
test ebx, r14d
sub ebx, dword [rbp - 0x21]
stc
cmp r12b, 0x91
add ebx, r15d
cmp r10b, r12b
cmp r10b, 0x99
clc
mov dword [rbp - 0x65], ebx
cmp r13w, 0xc09
stc
cmp dword [rsp + 0x4c], esi
jmp 0x1404d8587
jb 0x1404d8784
cmp byte [rsp + 0x44], 0xa
jmp 0x1404d8597
jne 0x1404d8630
mov rcx, qword [rbp - 0x49]
movsx eax, ax
lea eax, [r11 + 0xd]
lea r9, [rsp + 0x4c]
cqo
mov r8d, 0x2d747241
cwd
mov word [rsp + 0x44], ax
lea r8d, [r11 + 1]
mov dl, dil
cmovp dx, bp
bswap rdx
mov qword [rsp + 0x20], r11
cmovge dx, bx
mov dl, 0x42
movsx edx, r12w
lea rdx, [rsp + 0x44]
jmp 0x1404d85e3
call qword [sym.imp.KERNEL32.dll_WriteFile]
sub r11d, r11d
clc
test eax, eax
jmp 0x1404d85f4
je 0x1404d87e3
cmp dword [rsp + 0x4c], 1
jb 0x1404d8784
inc r15d
jmp 0x1404d8614
inc ebx
adc sil, 0xf2
shr sil, 0x7e
mov dword [rsp + 0x40], r15d
cmp edx, 0x69d90ed0
bt rsi, r8
mov dword [rbp - 0x65], ebx
mov rsi, rdi
stc
cmc
cmp rdi, r13
jae 0x1404d8808
mov rax, qword [rbp - 0x19]
mov edx, dword [rbp - 0x55]
jmp 0x1404d864a
jmp 0x1404d8074
mov edx, r11d
stc
test r8, r8
jle 0x1404d86c0
sub rdi, rsi
xchg bh, bl
lea rbx, [0x140000000]
movsx ecx, r12w
movzx cx, r8b
mov al, byte [rdi + rsi]
xchg rcx, rcx
inc edx
and cl, r15b
add cl, r12b
bswap rcx
mov rcx, qword [rbx + r12*8 + 0xba940]
test r11b, 0x3e
add rcx, rsi
jmp 0x1404d8696
inc rsi
mov byte [rcx + r14*8 + 0x3e], al
xadd ax, ax
sal al, cl
bswap ax
movsxd rax, edx
clc
cmp rax, r8
jl 0x1404d8671
mov ebx, dword [rbp - 0x65]
test edi, 0x66a1b34
cmp bp, si
add ebx, r8d
jmp 0x1404d86c8
jmp 0x1404d877c
mov r9d, r11d
cmp r12b, r9b
stc
test rdx, rdx
jle 0x1404d877a
mov r13, qword [rbp - 0x11]
btr cx, r12w
mov r8, r11
bt cx, 0x80
rcr al, 0x63
bt cx, bp
mov r10, r13
test r14w, 0x140b
movzx r11, r9w
stc
and r13d, 0x3f
sar r10, 6
shl al, cl
shr al, cl
bt r11w, ax
lea r11, [r13*8]
add r11, r13
xchg cl, al
inc cx
mov cx, r10w
mov al, byte [r8 + rdi]
movzx rcx, cx
inc r9d
movzx cx, sil
mov rcx, qword [r15 + r10*8 + 0xba940]
cmp r15w, r11w
test bpl, 0xb
add rcx, r8
jmp 0x1404d8750
inc r8
cmc
cmp r14b, 0xf3
cmp r13w, r10w
mov byte [rcx + r11*8 + 0x3e], al
shrd ax, si, 0x89
movsxd rax, r9d
cmp rax, rdx
jmp 0x1404d8771
jl 0x1404d8728
xor r11d, r11d
add ebx, edx
mov dword [rbp - 0x65], ebx
xchg ch, cl
test sil, r8b
cmp byte [rbp - 0x71], r11b
not cl
bswap cx
setg ch
mov ecx, dword [rsp + 0x40]
jmp 0x1404d8799
jmp 0x1404d8811
mov al, byte [rdi]
movzx r8d, r11w
movsxd rcx, r13d
lea r8, [0x140000000]
movzx cx, ah
mov rcx, qword [r8 + r12*8 + 0xba940]
inc ebx
mov dword [rbp - 0x65], ebx
mov byte [rcx + r14*8 + 0x3e], al
mov rax, qword [r8 + r12*8 + 0xba940]
or byte [rax + r14*8 + 0x3d], 4
clc
cmp bx, ax
cmp byte [rbp - 0x71], dl
jmp 0x1404d87de
jmp 0x1404d8790
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x69], eax
clc
mov ecx, dword [rsp + 0x40]
test r12, r8
cmp r13b, bpl
test cl, 0x1e
cmp byte [rbp - 0x71], 0
jmp 0x1404d8803
jmp 0x1404d8811
mov ecx, dword [rsp + 0x40]
clc
cmp byte [rbp - 0x71], r11b
je 0x1404d8823
mov rax, qword [rsp + 0x50]
and dword [rax + 0x3a8], 0xfffffffd
mov rax, qword [rbp - 9]
clc
jmp 0x1404d882d
movsd xmm0, qword [rbp - 0x69]
jmp 0x1404d8838
movsd qword [rax], xmm0
cmp r15b, r13b
jmp 0x1404d8844
mov dword [rax + 8], ecx
mov rcx, qword [rbp + 0x17]
cmc
jmp 0x1404d8851
xor rcx, rsp
jmp 0x1404d8859
call fcn.14049c123
mov rbx, qword [rsp + 0x140]
sbb r12b, r8b
shrd bp, bx, 0xe9
add rsp, 0x100
movsxd r13, ebx
pop r15
cmovnp rbp, r12
movzx r13w, r12b
movsx r13, r9w
pop r14
movsx esi, sp
movsx si, r11b
cmove rbp, r9
pop r13
movzx rbp, ax
jmp 0x1404d88a4
pop r12
pop rdi
movsx rsi, r14w
not bpl
mov bp, r11w
pop rsi
movsxd rbp, r14d
pop rbp
jmp 0x1404d88bc
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x69], eax
add cl, r15b
mov ecx, dword [rsp + 0x40]
cmp byte [rbp - 0x71], bl
jmp 0x1404d8811