Function at 0x140055650
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x450
mov rax, qword [0x140197b10]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rdi, rcx
mov rbx, rdx
lea rcx, [rsp + 0x41]
xor edx, edx
mov r8d, 0x3ff
call fcn.14010c6c0
mov dword [rsp + 0x5c], ebx
lea rcx, [rsp + 0x6b]
mov edx, 1
mov byte [rsp + 0x40], 0xeb
mov byte [rsp + 0x41], 0x3c
mov word [rsp + 0x4e], dx
mov byte [rsp + 0x42], 0x90
mov byte [rsp + 0x50], 2
mov byte [rsp + 0x64], 0x80
mov byte [rsp + 0x66], 0x29
movabs rax, 0x312e344e4957534d
mov qword [rsp + 0x43], rax
mov eax, 0xf0
lea r15, [0x140000000]
mov word [rsp + 0x51], ax
mov byte [rsp + 0x55], al
mov eax, 0x3f
mov word [rsp + 0x58], ax
mov eax, 0xff
mov r14d, 0x200
mov word [rsp + 0x5a], ax
mov rax, qword [r15 + 0x14bf38]
mov word [rsp + 0x4b], r14w
xor r13d, r13d
shl rbx, 9
xor r8d, r8d
mov dword [rsp + 0x67], r13d
mov qword [rcx], rax
movzx eax, word [r15 + 0x14bf40]
mov word [rcx + 8], ax
movzx eax, byte [r15 + 0x14bf42]
mov byte [rcx + 0xa], al
movabs rax, 0x2020203231544146
mov byte [rsp + 0x4d], dl
mov qword [rsp + 0x76], rax
mov eax, 0xaa55
mov word [rsp + 0x56], dx
mov word [rsp + 0x23e], ax
mov eax, 0x11
mov rdx, rbx
mov rcx, rdi
mov word [rsp + 0x53], ax
call fcn.14005c450
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r8d, r14d
mov rcx, rdi
mov dword [rsp + 0x30], r13d
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
movzx r12d, word [rsp + 0x51]
movzx esi, byte [rsp + 0x50]
movzx ebp, word [rsp + 0x56]
shl r12d, 5
lea rcx, [rsp + 0x40]
add r12d, 0x1ff
xor edx, edx
mov r8d, 0x400
sar r12d, 9
call fcn.14010c6c0
movzx ebx, word [rsp + 0x4e]
sub ebx, 2
js 0x1400557f3
nop dword [rax + rax]
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x240]
mov r8d, r14d
mov rcx, rdi
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
sub ebx, 1
jns 0x1400557d0
mov dword [rsp + 0x40], 0xfffff8
test esi, esi
je 0x140055869
sub ebp, 2
nop word [rax + rax]
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r8d, r14d
mov rcx, rdi
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, ebp
test ebp, ebp
js 0x140055863
nop word [rax + rax]
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x240]
mov r8d, r14d
mov rcx, rdi
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
sub ebx, 1
jns 0x140055840
sub rsi, 1
jne 0x140055810
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x400
call fcn.14010c6c0
mov rax, qword [r15 + 0x14bf18]
lea r11, [rsp + 0x40]
mov qword [r11], rax
mov rax, qword [r15 + 0x14bf20]
lea r9, [rsp + 0x30]
mov qword [r11 + 8], rax
mov rax, qword [r15 + 0x14bf28]
lea rdx, [rsp + 0x40]
mov qword [r11 + 0x10], rax
movzx eax, word [r15 + 0x14bf30]
mov r8d, r14d
mov rcx, rdi
mov qword [rsp + 0x20], r13
mov word [r11 + 0x18], ax
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea ebx, [r12 - 2]
test ebx, ebx
js 0x140055903
nop word [rax + rax]
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x240]
mov r8d, r14d
mov rcx, rdi
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
sub ebx, 1
jns 0x1400558e0
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.14010bcc0
mov rbx, qword [rsp + 0x4a0]
add rsp, 0x450
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret