Function at 0x1400034d0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xe8
mov rbp, rcx
mov ecx, 0x15d200
mov r12, rdx
mov edi, r8d
mov r13, r9
lea rsi, [rsp + 0x70]
lea r14, [rsp + 0x60]
call fcn.14010ab80
mov r8d, 0x15d200
lea rdx, [0x140111600]
mov rcx, rax
mov rbx, rax
call sub.msvcrt.dll_memcpy
xor eax, eax
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], 0
mov word [rsp + 0x70], ax
test dil, dil
je 0x1400035f8
mov rdx, r13
mov rcx, r14
call fcn.1400f5b70
mov rcx, qword [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400038d0
mov qword [rsp + 0x20], 0
mov r8d, 0x15d200
mov rdx, rbx
mov rcx, rax
lea r9, [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
test eax, eax
je 0x1400038c0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 1
mov rcx, qword [rsp + 0x60]
cmp rcx, rsi
je 0x1400035d2
mov rax, qword [rsp + 0x70]
lea rdx, [rax + rax + 2]
call fcn.14010ab40
mov edx, 0x15d200
mov rcx, rbx
call fcn.14010ab40
mov eax, edi
add rsp, 0xe8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rdi, qword [r12 + 8]
mov r13, qword [r12]
lea rax, [rsp + 0xa0]
lea r12, [rsp + 0xb0]
mov qword [rsp + 0x58], rax
mov rax, r12
mov qword [rsp + 0xa0], r12
mov r8, rdi
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0xc0], rdi
cmp rdi, 7
ja 0x1400038e8
xor edx, edx
test rdi, rdi
je 0x140003664
nop dword [rax]
movsx cx, byte [r13 + rdx]
mov word [rax + rdx*2], cx
add rdx, 1
cmp rdi, rdx
jne 0x140003650
xor r11d, r11d
mov qword [rsp + 0xa8], r8
lea r15, [0x1401115a6]
lea r13, [rsp + 0x90]
mov word [rax + r8*2], r11w
mov rcx, r15
call sub.msvcrt.dll_wcslen
mov r8, qword [rbp + 8]
mov qword [rsp + 0x80], r13
mov qword [rsp + 0x88], 0
mov rdi, rax
mov rax, qword [rbp]
lea rbp, [rsp + 0x80]
lea rdx, [rdi + r8]
mov rcx, rbp
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x48], rax
xor eax, eax
mov word [rsp + 0x90], ax
call fcn.1400f5930
movabs rax, 0x1fffffffffffffff
mov r8, qword [rsp + 0x50]
sub rax, qword [rsp + 0x88]
cmp rax, r8
jb 0x140003c44
mov rdx, qword [rsp + 0x48]
mov rcx, rbp
call fcn.1400f5ae0
movabs rax, 0x1fffffffffffffff
sub rax, qword [rsp + 0x88]
cmp rax, rdi
jb 0x140003c55
mov r8, rdi
mov rdx, r15
mov rcx, rbp
call fcn.1400f5ae0
mov rdx, qword [rsp + 0x88]
mov r8, qword [rsp + 0xa8]
mov r9, qword [rsp + 0x80]
lea rax, [rdx + r8]
cmp r9, r13
je 0x140003928
cmp qword [rsp + 0x90], rax
jae 0x140003776
cmp qword [rsp + 0xa0], r12
je 0x140003ad0
mov rcx, qword [rsp + 0xb0]
cmp rcx, rax
jae 0x140003950
movabs rax, 0x1fffffffffffffff
mov rcx, qword [rsp + 0xa0]
sub rax, rdx
cmp rax, r8
jb 0x140003c06
mov rdx, rcx
mov rcx, rbp
call fcn.1400f5ae0
lea r8, [rsp + 0xd0]
lea rcx, [rax + 0x10]
mov qword [rsp + 0xc0], r8
mov rdx, qword [rax]
cmp rdx, rcx
je 0x140003a68
mov qword [rsp + 0xc0], rdx
mov rdx, qword [rax + 0x10]
mov qword [rsp + 0xd0], rdx
mov rdx, qword [rax + 8]
xor r9d, r9d
mov qword [rax], rcx
mov qword [rsp + 0xc8], rdx
mov qword [rax + 8], 0
mov word [rax + 0x10], r9w
mov rcx, qword [rsp + 0x60]
mov r9, rcx
cmp rcx, rsi
je 0x140003a38
mov rdx, qword [rsp + 0xc0]
mov rax, qword [rsp + 0xc8]
cmp rdx, r8
je 0x1400039c8
movq xmm0, rax
mov qword [rsp + 0x60], rdx
mov rax, qword [rsp + 0x70]
movhps xmm0, qword [rsp + 0xd0]
movups xmmword [rsp + 0x68], xmm0
test rcx, rcx
je 0x140003875
mov qword [rsp + 0xc0], rcx
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xc8], 0
xor eax, eax
mov word [rcx], ax
cmp rcx, r8
je 0x140003875
mov rax, qword [rsp + 0xd0]
lea rdx, [rax + rax + 2]
call fcn.14010ab40
mov rcx, qword [rsp + 0x80]
cmp rcx, r13
je 0x140003894
mov rax, qword [rsp + 0x90]
lea rdx, [rax + rax + 2]
call fcn.14010ab40
mov rcx, qword [rsp + 0xa0]
cmp rcx, r12
je 0x140003544
mov rax, qword [rsp + 0xb0]
lea rdx, [rax + rax + 2]
call fcn.14010ab40
jmp 0x140003544
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
jmp 0x1400035b9
mov rcx, qword [rsp + 0x60]
xor edi, edi
cmp rcx, rsi
jne 0x1400035c3
jmp 0x1400035d2
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0xc0]
xor r8d, r8d
call fcn.1400f5ca0
mov r8, qword [rsp + 0xc0]
mov qword [rsp + 0xa0], rax
xor edx, edx
mov qword [rsp + 0xb0], r8
test rdi, rdi
jne 0x140003650
jmp 0x140003664
cmp rax, 7
jbe 0x140003776
cmp qword [rsp + 0xa0], r12
jne 0x140003765
mov rcx, r12
jmp 0x140003794
mov qword [rsp + 0x20], rdx
mov rcx, qword [rsp + 0x58]
xor r8d, r8d
xor edx, edx
call fcn.1400f07f0
lea r8, [rsp + 0xd0]
lea r9, [rax + 0x10]
mov qword [rsp + 0xc0], r8
mov rdx, qword [rax]
cmp rdx, r9
je 0x140003ada
mov qword [rsp + 0xc0], rdx
mov rdx, qword [rax + 0x10]
mov qword [rsp + 0xd0], rdx
mov rdx, qword [rax + 8]
xor r10d, r10d
mov qword [rax], r9
mov qword [rsp + 0xc8], rdx
mov qword [rax + 8], 0
mov word [rax + 0x10], r10w
jmp 0x1400037f2
mov rax, qword [rsp + 0xc8]
nop dword [rax]
test rax, rax
je 0x140003a20
cmp rax, 1
je 0x140003b1e
lea r10, [rax + rax]
cmp r10d, 8
jae 0x140003b2f
test r10b, 4
jne 0x140003bac
test r10d, r10d
je 0x140003a20
movzx eax, byte [rsp + 0xd0]
mov byte [r9], al
test r10b, 2
jne 0x140003bdd
mov r9, qword [rsp + 0x60]
mov rax, qword [rsp + 0xc8]
mov rdx, qword [rsp + 0xc0]
nop
xor ecx, ecx
mov qword [rsp + 0x68], rax
mov word [r9 + rax*2], cx
mov rcx, rdx
jmp 0x14000384d
mov rdx, qword [rsp + 0xc0]
cmp rdx, r8
je 0x1400039bc
movdqu xmm0, xmmword [rsp + 0xc8]
mov qword [rsp + 0x60], rdx
movups xmmword [rsp + 0x68], xmm0
jmp 0x140003875
mov rdx, qword [rax + 8]
mov r10, r8
lea r9, [rdx + rdx + 2]
mov rdx, rcx
cmp r9d, 8
jae 0x140003aab
xor r11d, r11d
test r9b, 4
je 0x140003a92
mov r11d, dword [rdx]
mov dword [r10], r11d
mov r11d, 4
and r9d, 2
je 0x1400037d3
movzx edx, word [rdx + r11]
mov word [r10 + r11], dx
jmp 0x1400037d3
mov r11d, r9d
xor edx, edx
and r11d, 0xfffffff8
mov r10d, edx
add edx, 8
mov rdi, qword [rcx + r10]
mov qword [r8 + r10], rdi
cmp edx, r11d
jb 0x140003ab4
lea r10, [r8 + rdx]
add rdx, rcx
jmp 0x140003a7d
mov ecx, 7
jmp 0x14000376d
mov rdx, qword [rax + 8]
mov r10, r8
lea rcx, [rdx + rdx + 2]
mov rdx, r9
cmp ecx, 8
jae 0x140003b84
xor r11d, r11d
test cl, 4
je 0x140003b06
mov r11d, dword [rdx]
mov dword [r10], r11d
mov r11d, 4
and ecx, 2
je 0x140003998
movzx edx, word [rdx + r11]
mov word [r10 + r11], dx
jmp 0x140003998
movzx ecx, word [rsp + 0xd0]
mov word [r9], cx
jmp 0x140003a20
mov rax, qword [rsp + 0xd0]
lea rcx, [r9 + 8]
mov r11, r8
and rcx, 0xfffffffffffffff8
mov qword [r9], rax
mov eax, r10d
mov rdx, qword [r8 + rax - 8]
mov qword [r9 + rax - 8], rdx
sub r9, rcx
lea eax, [r10 + r9]
sub r11, r9
and eax, 0xfffffff8
cmp eax, 8
jb 0x140003a09
and eax, 0xfffffff8
xor edx, edx
mov r9d, edx
add edx, 8
mov r10, qword [r11 + r9]
mov qword [rcx + r9], r10
cmp edx, eax
jb 0x140003b6d
jmp 0x140003a09
mov r11d, ecx
xor edx, edx
and r11d, 0xfffffff8
mov r10d, edx
add edx, 8
mov rdi, qword [r9 + r10]
mov qword [r8 + r10], rdi
cmp edx, r11d
jb 0x140003b8d
lea r10, [r8 + rdx]
add rdx, r9
jmp 0x140003af2
mov eax, dword [rsp + 0xd0]
mov dword [r9], eax
mov eax, r10d
mov edx, dword [r8 + rax - 4]
mov dword [r9 + rax - 4], edx
mov r9, qword [rsp + 0x60]
mov rax, qword [rsp + 0xc8]
mov rdx, qword [rsp + 0xc0]
jmp 0x140003a20
mov eax, r10d
movzx edx, word [r8 + rax - 2]
mov word [r9 + rax - 2], dx
mov r9, qword [rsp + 0x60]
mov rax, qword [rsp + 0xc8]
mov rdx, qword [rsp + 0xc0]
jmp 0x140003a20
lea rcx, [0x1401115aa]
call fcn.14010c0a0
mov rcx, rbp
mov rsi, rax
call fcn.1400f07d0
mov rcx, qword [rsp + 0x58]
call fcn.1400f07d0
mov rcx, r14
call fcn.1400f07d0
mov rcx, rbx
mov edx, 0x15d200
call fcn.14010ab40
mov rcx, rsi
call fcn.14001bb40
lea rcx, [0x1401115aa]
call fcn.14010c0a0
mov rsi, rax
jmp 0x140003c27
lea rcx, [0x1401115aa]
call fcn.14010c0a0
jmp 0x140003c12