Function at 0x140052ad0
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
xor ebx, ebx
mov r15, rcx
mov ecx, 0xffff
mov esi, r8d
mov rdi, rdx
mov byte [rbp + 0x50], 0x2c
mov word [rbp - 0x28], bx
mov word [rbp - 0x24], bx
cmp dword [rdx + 4], ecx
jge 0x140052b11
movzx eax, word [rdx + 4]
mov word [rbp - 0x2c], ax
jmp 0x140052b15
mov word [rbp - 0x2c], cx
cmp dword [rdx + 8], ecx
jge 0x140052b24
movzx eax, word [rdx + 8]
mov word [rbp - 0x30], ax
jmp 0x140052b28
mov word [rbp - 0x30], cx
test r8d, r8d
mov eax, 0x80
mov edx, ebx
cmove edx, eax
mov eax, r9d
mov r13d, 1
neg eax
mov r9, r15
mov r8d, r13d
sbb cl, cl
dec dl
and cl, 0x40
add dl, cl
lea rcx, [rbp + 0x50]
add dl, byte [rdi + 0xe]
mov byte [rbp + 0x48], dl
mov edx, r13d
call fcn.1400faf54
mov r14d, 2
lea rcx, [rbp - 0x28]
mov r8d, r14d
mov r9, r15
mov edx, r13d
call fcn.1400faf54
lea rcx, [rbp - 0x24]
mov r9, r15
mov r8d, r14d
mov edx, r13d
call fcn.1400faf54
lea rcx, [rbp - 0x2c]
mov r9, r15
mov r8d, r14d
mov edx, r13d
call fcn.1400faf54
lea rcx, [rbp - 0x30]
mov r9, r15
mov r8d, r14d
mov edx, r13d
call fcn.1400faf54
lea rcx, [rbp + 0x48]
mov r9, r15
mov r8d, r13d
mov edx, r13d
call fcn.1400faf54
test esi, esi
jne 0x140052c64
mov eax, dword [rdi + 0x20]
test eax, eax
jne 0x140052bdd
movzx ecx, byte [rdi + 0xe]
mov eax, r13d
shl eax, cl
test eax, eax
je 0x140052c22
lea rsi, [rdi + 0x29]
mov r14d, eax
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rsi + 1]
lea rcx, [rbp - 0x20]
mov r9, r15
mov byte [rbp - 0x20], al
movzx eax, byte [rsi]
mov r8d, 3
mov byte [rbp - 0x1f], al
movzx eax, byte [rsi - 1]
mov rdx, r13
mov byte [rbp - 0x1e], al
call fcn.1400faf54
lea rsi, [rsi + 4]
dec r14
jne 0x140052bf0
mov esi, dword [rdi + 0x20]
test esi, esi
je 0x140052c64
movzx ecx, byte [rdi + 0xe]
mov eax, r13d
mov word [rbp - 0x20], bx
shl eax, cl
mov byte [rbp - 0x1e], bl
cmp esi, eax
jae 0x140052c64
nop dword [rax]
lea rcx, [rbp - 0x20]
mov r9, r15
mov r8d, 3
mov rdx, r13
call fcn.1400faf54
movzx ecx, byte [rdi + 0xe]
mov eax, r13d
shl eax, cl
inc esi
cmp esi, eax
jb 0x140052c40
movzx edx, word [rbp - 0x30]
movzx eax, word [rbp - 0x2c]
mov ecx, 0x40
imul rdx, rax
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r14, rax
mov qword [rbp - 0x18], rax
test rax, rax
jne 0x140052c96
add rsp, 0x60
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rcx, rax
mov qword [rsp + 0xa0], r12
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r12, rax
mov eax, dword [rdi + 0x20]
test eax, eax
jne 0x140052cba
movzx ecx, byte [rdi + 0xe]
mov eax, r13d
shl eax, cl
mov esi, eax
movzx eax, word [rdi + 0xe]
add rsi, 0xa
imul eax, dword [rdi + 4]
lea rsi, [rdi + rsi*4]
add eax, 0x1f
cdq
and edx, 0x1f
add eax, edx
sar eax, 5
shl eax, 2
movsxd r13, eax
cmp dword [rbp + 0x58], ebx
je 0x140052e01
movzx edx, word [rbp - 0x30]
mov ecx, 0x40
shl rdx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rbp - 0x10], rax
test rax, rax
jne 0x140052d1c
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
jmp 0x140052e93
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
movzx ecx, word [rbp - 0x30]
mov edx, ebx
mov r8, rax
cmp bx, cx
jae 0x140052d52
nop dword [rax]
nop word [rax + rax]
mov ecx, edx
add edx, 8
mov dword [rax + rcx*4], ebx
movzx ecx, word [rbp - 0x30]
inc ebx
cmp edx, ecx
jb 0x140052d40
mov edx, 4
cmp dx, cx
jae 0x140052d73
nop dword [rax]
mov eax, edx
add edx, 8
mov dword [r8 + rax*4], ebx
movzx ecx, word [rbp - 0x30]
inc ebx
cmp edx, ecx
jb 0x140052d60
mov eax, 2
mov edx, eax
cmp ax, cx
jae 0x140052d93
nop
mov eax, edx
add edx, 4
mov dword [r8 + rax*4], ebx
movzx ecx, word [rbp - 0x30]
inc ebx
cmp edx, ecx
jb 0x140052d80
mov eax, 1
mov edx, eax
cmp ax, cx
jae 0x140052db5
nop
mov eax, edx
add edx, 2
mov dword [r8 + rax*4], ebx
movzx ecx, word [rbp - 0x30]
inc ebx
mov eax, ecx
cmp edx, ecx
jb 0x140052da0
movzx ebx, cx
test ebx, ebx
je 0x140052deb
lea r14, [r8 + rbx*4]
movzx eax, word [rdi + 0xe]
mov r8d, dword [r14 - 4]
movzx r9d, word [rbp - 0x2c]
lea r14, [r14 - 4]
mov rdx, rsi
mov rcx, r12
mov dword [rsp + 0x20], eax
call fcn.140052420
add rsi, r13
dec ebx
jne 0x140052dc0
mov r14, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x140052e34
movzx ebx, word [rbp - 0x30]
test ebx, ebx
je 0x140052e34
nop dword [rax]
movzx eax, word [rdi + 0xe]
movzx r9d, word [rbp - 0x2c]
dec ebx
mov r8d, ebx
mov rdx, rsi
mov rcx, r12
mov dword [rsp + 0x20], eax
call fcn.140052420
add rsi, r13
test ebx, ebx
jne 0x140052e10
movzx eax, word [rdi + 0xe]
cmp ax, 1
jne 0x140052e47
mov dword [rbp - 0x1c], 2
jmp 0x140052e4d
movzx eax, ax
mov dword [rbp - 0x1c], eax
mov eax, 1
lea rcx, [rbp - 0x1c]
mov r9, r15
mov r8d, eax
mov edx, eax
call fcn.1400faf54
movzx r8d, word [rbp - 0x30]
movzx edx, word [rbp - 0x2c]
mov r9d, dword [rbp - 0x1c]
mov rcx, r12
mov qword [rsp + 0x20], r15
call fcn.140052eb0
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, ebx
mov r12, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret