Function at 0x14005bb90
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x3d0
mov rax, qword [0x140074010]
xor rax, rsp
mov qword [rsp + 0x3c0], rax
xor esi, esi
mov r14, r8
cmp dword [rcx + 8], 0xffffffff
mov ebp, edx
mov rdi, rcx
je 0x14005bc16
mov qword [rsp + 0x408], r15
mov r15, qword [rcx]
test r15, r15
je 0x14005bc0e
mov rbx, qword [r15 + 0x80]
test rbx, rbx
je 0x14005bc0e
mov rcx, qword [rbx]
test rcx, rcx
je 0x14005bbea
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx], rsi
cmp dword [rbx + 0x64], esi
je 0x14005bbfb
lea rcx, [rbx + 8]
call fcn.140059700
mov rcx, rbx
mov dword [rbx + 0x64], esi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [r15 + 0x80], rsi
mov r15, qword [rsp + 0x408]
mov rbx, qword [rdi]
mov dword [rdi + 8], 0xffffffff
cmp ebp, dword [rbx + 8]
jl 0x14005bc48
mov eax, 0x10000
mov rcx, qword [rsp + 0x3c0]
xor rcx, rsp
call fcn.14005c2f0
add rsp, 0x3d0
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
cmp ebp, dword [rbx + 0x14]
jge 0x14005bc7c
test rbx, rbx
je 0x14005bc7c
mov eax, dword [rbx + 0x28]
lea r8, [rbx + 0x7c]
lea rdx, [rbx + 0x2c]
mov dword [rbx + 0x18], eax
xor r9d, r9d
mov dword [rbx + 0x14], esi
mov rcx, rbx
mov dword [rsp + 0x20], esi
call fcn.14005a610
mov ecx, esi
test eax, eax
sete cl
mov dword [rbx + 0x1c], ecx
mov rbx, qword [rdi]
cmp dword [rbx + 0x14], ebp
jge 0x14005bcd5
test rbx, rbx
je 0x14005bccd
cmp dword [rbx + 0x1c], esi
je 0x14005bccd
mov edx, dword [rbx + 0x14]
inc edx
cmp edx, dword [rbx + 8]
je 0x14005bccd
mov ecx, dword [rbx + 0x54]
lea r8, [rbx + 0x7c]
add ecx, dword [rbx + 0x50]
xor r9d, r9d
mov eax, dword [rbx + 0x4c]
add eax, 0x2e
mov dword [rbx + 0x14], edx
add ecx, eax
mov dword [rsp + 0x20], esi
add dword [rbx + 0x18], ecx
lea rdx, [rbx + 0x2c]
mov rcx, rbx
call fcn.14005a610
mov ecx, esi
test eax, eax
sete cl
mov dword [rbx + 0x1c], ecx
mov rbx, qword [rdi]
cmp dword [rbx + 0x14], ebp
jl 0x14005bc84
lea r8, [rsp + 0x60]
mov edx, ebp
mov rcx, rdi
call fcn.14005b2f0
test byte [rsp + 0x168], 0x10
movzx eax, byte [r14]
je 0x14005bd1e
cmp al, 0x2f
je 0x14005bd0c
cmp al, 0x5c
je 0x14005bd0c
test al, al
je 0x14005bd05
cmp byte [r14 + 1], 0x3a
je 0x14005bd0c
lea rsi, [rdi + 0x150]
mov rdx, r14
mov rcx, rsi
call fcn.14005ba30
xor eax, eax
jmp 0x14005bc2a
mov r9, r14
mov rcx, r14
test al, al
je 0x14005bd43
cmp al, 0x2f
je 0x14005bd35
cmp al, 0x5c
je 0x14005bd35
inc rcx
jmp 0x14005bd3c
lea r9, [rcx + 1]
mov rcx, r9
movzx eax, byte [rcx]
test al, al
jne 0x14005bd28
lea rdx, [rsp + 0x1a0]
mov rcx, r14
sub rdx, r14
movzx eax, byte [rcx]
mov byte [rcx + rdx], al
lea rcx, [rcx + 1]
test al, al
jne 0x14005bd51
cmp r9, r14
jne 0x14005bd6e
mov byte [rsp + 0x1a0], sil
jmp 0x14005bda6
mov rax, r9
sub rax, r14
cmp rax, 0x104
jae 0x14005bf62
mov byte [rsp + rax + 0x1a0], sil
movzx eax, byte [rsp + 0x1a0]
cmp al, 0x2f
je 0x14005bdd4
cmp al, 0x5c
je 0x14005bdd4
test al, al
je 0x14005bda6
cmp byte [rsp + 0x1a1], 0x3a
je 0x14005bdd4
mov qword [rsp + 0x20], r9
lea rbx, [rdi + 0x150]
mov r8, rbx
lea r9, [rsp + 0x1a0]
lea rdx, str._s_s_s
lea rcx, [rsp + 0x2b0]
call qword [sym.imp.USER32.dll_wsprintfA]
jmp 0x14005bdf4
lea r8, [rsp + 0x1a0]
lea rdx, str._s_s
lea rcx, [rsp + 0x2b0]
call qword [sym.imp.USER32.dll_wsprintfA]
mov rbx, rsi
lea rdx, [rsp + 0x1a0]
mov rcx, rbx
call fcn.14005ba30
mov eax, dword [rsp + 0x168]
lea rcx, [rsp + 0x2b0]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x14005be48
mov eax, 0x200
jmp 0x14005bc2a
mov rdx, qword [rdi + 0x140]
mov rcx, qword [rdi]
call fcn.14005ad20
cmp qword [rdi + 0x148], rsi
jne 0x14005be71
mov ecx, 0x4000
call fcn.14005ca98
mov qword [rdi + 0x148], rax
mov ebp, esi
nop dword [rax]
nop word [rax + rax]
mov rdx, qword [rdi + 0x148]
lea r9, [rsp + 0x50]
mov rcx, qword [rdi]
mov r8d, 0x4000
call fcn.14005af70
mov ebx, eax
cmp eax, 0xffffff96
je 0x14005bf07
test eax, eax
js 0x14005bed6
jle 0x14005becb
mov rdx, qword [rdi + 0x148]
lea r9, [rsp + 0x190]
mov r8d, eax
mov qword [rsp + 0x20], rsi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14005bedd
cmp byte [rsp + 0x50], sil
jne 0x14005bee4
test ebx, ebx
jne 0x14005be80
mov ebp, 0x5000000
jmp 0x14005bf0c
mov ebp, 0x400
jmp 0x14005bf0c
lea r9, [rsp + 0x17c]
mov rcx, r14
lea r8, [rsp + 0x16c]
lea rdx, [rsp + 0x174]
call qword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x14005bf0c
mov ebp, 0x1000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rdi]
test rdi, rdi
je 0x14005bf5b
mov rbx, qword [rdi + 0x80]
test rbx, rbx
je 0x14005bf5b
mov rcx, qword [rbx]
test rcx, rcx
je 0x14005bf37
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx], rsi
cmp dword [rbx + 0x64], esi
je 0x14005bf48
lea rcx, [rbx + 8]
call fcn.140059700
mov rcx, rbx
mov dword [rbx + 0x64], esi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x80], rsi
mov eax, ebp
jmp 0x14005bc2a
call fcn.14005c490
int3