Function at 0x1400d67d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x6b0
mov rax, qword [0x1401e61d8]
xor rax, rsp
mov qword [rsp + ATL::CSimpleStringT<char,1>::operator+=], rax
mov ebp, dword [rsp + 0x6f0]
mov esi, r9d
mov r14, r8
mov edi, edx
mov rbx, rcx
lea eax, [rbp - 1]
cmp eax, 2
ja 0x1400d6b93
mov eax, dword [rcx + 8]
cmp ebp, 3
jne 0x1400d68cc
cmp edx, eax
je 0x1400d6876
cmp eax, 0xffffffff
je 0x1400d6832
mov rcx, qword [rcx]
call fcn.1400d98a0
mov rcx, qword [rbx]
mov dword [rbx + 8], 0xffffffff
cmp edi, dword [rcx + 8]
jge 0x1400d6b93
cmp dword [rcx + 0x14], edi
jle 0x1400d6855
call fcn.1400d9b20
mov rcx, qword [rbx]
cmp dword [rcx + 0x14], edi
jge 0x1400d6867
mov rcx, qword [rbx]
call fcn.1400d9b80
mov rcx, qword [rbx]
cmp dword [rcx + 0x14], edi
jl 0x1400d6857
mov rdx, qword [rbx + 0x240]
call fcn.1400d9d30
mov dword [rbx + 8], edi
mov rcx, qword [rbx]
lea r9, [rsp + 0x40]
mov r8d, esi
mov rdx, r14
call fcn.1400da0f0
mov edi, eax
test eax, eax
jg 0x1400d689e
mov rcx, qword [rbx]
call fcn.1400d98a0
mov dword [rbx + 8], 0xffffffff
cmp byte [rsp + 0x40], 0
jne 0x1400d6971
test edi, edi
jle 0x1400d68b7
mov eax, 0x600
jmp 0x1400d6b98
cmp edi, 0xffffff96
mov eax, 0x5000000
mov ecx, 0x1000
cmove eax, ecx
jmp 0x1400d6b98
cmp eax, 0xffffffff
je 0x1400d68d9
mov rcx, qword [rcx]
call fcn.1400d98a0
mov rax, qword [rbx]
mov dword [rbx + 8], 0xffffffff
cmp edi, dword [rax + 8]
jge 0x1400d6b93
cmp dword [rax + 0x14], edi
jle 0x1400d68ff
mov rcx, rax
call fcn.1400d9b20
mov rax, qword [rbx]
cmp dword [rax + 0x14], edi
jge 0x1400d6911
mov rcx, qword [rbx]
call fcn.1400d9b80
mov rax, qword [rbx]
cmp dword [rax + 0x14], edi
jl 0x1400d6901
lea r8, [rsp + 0x50]
mov edx, edi
mov rcx, rbx
call fcn.1400d5dc0
test byte [rsp + 0x25c], 0x10
je 0x1400d6978
cmp ebp, 1
je 0x1400d6971
movzx eax, word [r14]
cmp ax, 0x2f
je 0x1400d6965
cmp ax, 0x5c
je 0x1400d6965
test ax, ax
je 0x1400d694c
cmp word [r14 + 2], 0x3a
je 0x1400d6965
lea rsi, [rbx + 0x250]
mov rdx, r14
mov rcx, rsi
call fcn.1400d58c0
xor eax, eax
jmp 0x1400d6b98
xor esi, esi
mov rdx, r14
mov ecx, esi
call fcn.1400d58c0
xor eax, eax
jmp 0x1400d6b98
xor esi, esi
cmp ebp, 1
je 0x1400d6ab5
movzx eax, word [r14]
mov r9, r14
mov rcx, r14
test ax, ax
je 0x1400d69af
cmp ax, 0x2f
je 0x1400d699e
cmp ax, 0x5c
jne 0x1400d69a2
lea r9, [rcx + 2]
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x1400d6992
lea rdx, [rsp + 0x280]
mov rcx, r14
sub rdx, r14
nop dword [rax]
movzx eax, word [rcx]
mov word [rdx + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x1400d69c0
cmp r9, r14
jne 0x1400d69df
mov word [rsp + 0x280], si
jmp 0x1400d6a23
mov rax, r9
sub rax, r14
sar rax, 1
add rax, rax
cmp rax, 0x208
jae 0x1400d6bc0
mov word [rsp + rax + 0x280], si
movzx eax, word [rsp + 0x280]
cmp ax, 0x2f
je 0x1400d6a51
cmp ax, 0x5c
je 0x1400d6a51
test ax, ax
je 0x1400d6a23
cmp word [rsp + 0x282], 0x3a
je 0x1400d6a51
mov qword [rsp + 0x20], r9
lea rdi, [rbx + 0x250]
mov r8, rdi
lea r9, [rsp + 0x280]
lea rdx, str._s_s_s
lea rcx, [rsp + 0x490]
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x1400d6a71
lea r8, [rsp + 0x280]
lea rdx, str._s_s
lea rcx, [rsp + 0x490]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdi, rsi
lea rdx, [rsp + 0x280]
mov rcx, rdi
call fcn.1400d58c0
mov eax, dword [rsp + 0x25c]
lea rcx, [rsp + 0x490]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp r14, 0xffffffffffffffff
jne 0x1400d6ac5
mov eax, 0x200
jmp 0x1400d6b98
mov rdx, qword [rbx + 0x240]
mov rcx, qword [rbx]
call fcn.1400d9d30
cmp qword [rbx + 0x248], rsi
jne 0x1400d6af0
mov ecx, 0x4000
call sub.mfc140u.dll_operator
mov qword [rbx + 0x248], rax
nop
mov rdx, qword [rbx + 0x248]
lea r9, [rsp + 0x40]
mov rcx, qword [rbx]
mov r8d, 0x4000
call fcn.1400da0f0
mov edi, eax
cmp eax, 0xffffff96
je 0x1400d6b74
test eax, eax
js 0x1400d6b43
jle 0x1400d6b38
mov rdx, qword [rbx + 0x248]
lea r9, [rsp + 0x44]
mov r8d, eax
mov qword [rsp + 0x20], rsi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400d6b4a
cmp byte [rsp + 0x40], sil
jne 0x1400d6b51
test edi, edi
jne 0x1400d6af0
mov esi, 0x5000000
jmp 0x1400d6b79
mov esi, 0x400
jmp 0x1400d6b79
lea r9, [rsp + 0x270]
mov rcx, r14
lea r8, [rsp + 0x260]
lea rdx, [rsp + 0x268]
call qword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x1400d6b79
mov esi, 0x1000
cmp ebp, 1
je 0x1400d6b87
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx]
call fcn.1400d98a0
mov eax, esi
jmp 0x1400d6b98
mov eax, 0x10000
mov rcx, qword [rsp + 0x6a0]
xor rcx, rsp
call fcn.140113c40
lea r11, [rsp + 0x6b0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.14011450c
int3