Function at 0x1400165a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
mov r13, rdx
mov r14, rcx
xor ebp, ebp
mov qword [rsp + 0xc0], rbp
lea edx, [rbp + 1]
lea ecx, [rbp + 0xa]
call fcn.1402deebc
add rax, 8
mov qword [rsp + 0xc0], rax
mov rax, qword [r13]
mov edx, dword [rax - 8]
lea rcx, [rsp + 0xc0]
call fcn.14001e440
mov rdx, qword [r13]
mov eax, dword [rdx - 8]
add eax, eax
movsxd r8, eax
mov rcx, qword [rsp + 0xc0]
call fcn.1402d15b0
lea rdx, [rsp + 0xc0]
lea rcx, [0x140653440]
call fcn.140023830
lea rax, vtable.SFile.0
mov qword [rsp + 0x40], rax
lea edx, [rbp + 1]
lea ecx, [rbp + 0xa]
call fcn.1402deebc
add rax, 8
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rbp
lea edx, [rbp + 1]
lea ecx, [rbp + 0xa]
call fcn.1402deebc
mov qword [rsp + 0x38], rax
lea rdi, [rax + 8]
lea edx, [rbp + 1]
lea ecx, [rbp + 0xa]
call fcn.1402deebc
mov qword [rsp + 0x30], rax
lea rsi, [rax + 8]
lea edx, [rbp + 1]
lea ecx, [rbp + 0xa]
call fcn.1402deebc
mov qword [rsp + 0xc8], rax
lea rbx, [rax + 8]
mov r15d, ebp
mov r8d, 0x1001
mov rdx, qword [r14]
lea rcx, [rsp + 0x40]
call fcn.14001e170
xor r12d, r12d
mov rbp, qword [rsp + 0x48]
mov r9d, dword [0x140653440]
test r9d, r9d
je 0x140016788
xor r14d, r14d
nop word [rax + rax]
mov r8, qword [0x140653448]
mov rax, qword [r8 + r14 + 0x20]
cmp dword [rax - 8], 0
je 0x140016778
mov r8, qword [r8 + r14 + 0x28]
cmp dword [r8 - 8], 0
je 0x140016778
sub r8, rax
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140016704
add rax, 2
test ecx, ecx
jne 0x1400166f0
test edx, edx
je 0x140016778
test r15d, r15d
je 0x140016734
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0xb8]
mov r8d, 6
lea rdx, str._FKNL_
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rax, qword [0x140653448]
mov rcx, qword [r14 + rax + 0x20]
call fcn.14001f7c0
mov r8d, dword [0x1406533e4]
test r8d, r8d
je 0x14001676e
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0xc0]
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
inc r15d
mov r9d, dword [0x140653440]
inc r12d
add r14, 0x48
cmp r12d, r9d
jb 0x1400166c0
xor r15d, r15d
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0xb8]
lea r8d, [r15 + 0xd]
lea rdx, str._BEGINCHINOW_
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor r12d, r12d
mov r9d, dword [0x140653440]
test r9d, r9d
je 0x140016898
xor r14d, r14d
nop dword [rax]
nop word [rax + rax]
mov r8, qword [0x140653448]
mov rax, qword [r8 + r14 + 0x20]
cmp dword [rax - 8], 0
je 0x140016888
mov r8, qword [r8 + r14 + 0x28]
cmp dword [r8 - 8], 0
je 0x140016888
sub r8, rax
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140016814
add rax, 2
test ecx, ecx
jne 0x140016800
test edx, edx
je 0x140016888
test r15d, r15d
je 0x140016844
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0xb8]
mov r8d, 6
lea rdx, str._FKNL_
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rax, qword [0x140653448]
mov rcx, qword [r14 + rax + 0x28]
call fcn.14001f7c0
mov r8d, dword [0x1406533e4]
test r8d, r8d
je 0x14001687e
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0xc0]
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
inc r15d
mov r9d, dword [0x140653440]
inc r12d
add r14, 0x48
cmp r12d, r9d
jb 0x1400167d0
test rbp, rbp
je 0x1400168a8
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebp, ebp
test rbx, rbx
je 0x1400168ba
mov rcx, qword [rsp + 0xc8]
call fcn.1402d83b4
test rsi, rsi
je 0x1400168c9
mov rcx, qword [rsp + 0x30]
call fcn.1402d83b4
test rdi, rdi
je 0x1400168d8
mov rcx, qword [rsp + 0x38]
call fcn.1402d83b4
test rbp, rbp
je 0x1400168e6
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400168fa
add rcx, 0xfffffffffffffff8
call fcn.1402d83b4
nop
mov rcx, qword [rsp + 0xb0]
mov rcx, qword [rcx]
test rcx, rcx
je 0x140016914
add rcx, 0xfffffffffffffff8
call fcn.1402d83b4
nop
mov rcx, qword [r13]
test rcx, rcx
je 0x140016926
add rcx, 0xfffffffffffffff8
call fcn.1402d83b4
mov eax, 1
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret