Function at 0x1400314b0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push r13
push r14
push r15
sub rsp, 0x6b0
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x10], 0xfffffffffffffffe
mov qword [rbp + 0x6b0], rbx
mov qword [rbp + 0x6b8], rsi
mov rax, qword [0x140078790]
xor rax, rbp
mov qword [rbp + 0x660], rax
mov rsi, rdx
mov r15, rcx
or r14, 0xffffffffffffffff
cmp qword [rcx + 8], r14
je 0x140031819
xor r13d, r13d
mov dword [rbp], r13d
cmp word [rdx + 5], r13w
je 0x140031819
mov ebx, r13d
mov qword [rbp + 8], rbx
cmp byte [rdx + 4], 0x54
jne 0x140031565
movzx ecx, word [rdx + 5]
lea eax, [r14 + 0x19]
cmp cx, ax
jae 0x14003152f
movzx eax, cx
mov edi, eax
lea rax, [rdx + 7]
neg cx
sbb rdx, rdx
and rdx, rax
mov r8d, edi
lea rsi, [0x14007a9d8]
mov rcx, rsi
call fcn.1400346b0
cmp rdi, 0x19
jae 0x14003155f
mov byte [rdi + rsi], r13b
jmp 0x140031803
call fcn.1400335b0
int3
mov al, byte [rdx + 4]
sub al, 0x44
cmp al, 1
jbe 0x14003169a
cmp byte [rdx + 4], 0x55
jne 0x140031803
movzx ecx, word [rdx + 5]
lea eax, [rcx + 1]
cmp eax, 0x400
ja 0x1400315c6
inc rcx
call fcn.140011244
test al, al
je 0x1400315c6
movzx eax, word [rsi + 5]
inc rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1400315b0
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.140033c40
sub rsp, rcx
lea rdi, [rsp + 0x40]
jmp 0x1400315ed
movzx ecx, word [rsi + 5]
inc ecx
add rcx, 0x10
call fcn.140037abc
test rax, rax
jne 0x1400315df
mov rdi, r13
jmp 0x1400315ed
mov qword [rax], r13
mov rbx, rax
mov qword [rbp + 8], rax
lea rdi, [rax + 0x10]
test rdi, rdi
je 0x140031803
movzx ecx, word [rsi + 5]
mov r8d, ecx
lea rax, [rsi + 7]
neg cx
sbb rdx, rdx
and rdx, rax
mov rcx, rdi
call fcn.1400346b0
movzx eax, word [rsi + 5]
mov byte [rax + rdi], r13b
mov esi, 0x320
mov r8d, esi
xor edx, edx
lea rcx, [rbp + 0x340]
call fcn.140034b00
mov dword [rsp + 0x28], 0x190
lea rax, [rbp + 0x340]
mov qword [rsp + 0x20], rax
mov r9d, r14d
mov r8, rdi
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r8d, esi
xor edx, edx
lea rcx, [rbp + 0x20]
call fcn.140034b00
lea rax, [rbp + 0x340]
mov qword [rsp + 0x28], rax
lea rsi, [0x14007a9d8]
mov qword [rsp + 0x20], rsi
lea r9, str._S__s_r_n
mov r8, r14
mov edx, 0x190
lea rcx, [rbp + 0x20]
call fcn.140032298
jmp 0x1400317c9
movzx ecx, word [rdx + 5]
lea eax, [rcx + 1]
cmp eax, 0x400
ja 0x1400316e4
inc rcx
call fcn.140011244
test al, al
je 0x1400316e4
movzx eax, word [rsi + 5]
inc rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1400316ce
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.140033c40
sub rsp, rcx
lea r14, [rsp + 0x40]
jmp 0x14003170b
movzx ecx, word [rsi + 5]
inc ecx
add rcx, 0x10
call fcn.140037abc
test rax, rax
jne 0x1400316fd
mov r14, r13
jmp 0x14003170b
mov qword [rax], r13
mov rbx, rax
mov qword [rbp + 8], rax
lea r14, [rax + 0x10]
test r14, r14
je 0x140031803
movzx ecx, word [rsi + 5]
mov r8d, ecx
lea rax, [rsi + 7]
neg cx
sbb rdx, rdx
and rdx, rax
mov rcx, r14
call fcn.1400346b0
movzx eax, word [rsi + 5]
mov byte [rax + r14], r13b
lea rax, str.ERR
lea rdi, [0x14004e958]
cmp byte [rsi + 4], 0x45
cmove rdi, rax
mov esi, 0x320
mov r8d, esi
xor edx, edx
lea rcx, [rbp + 0x340]
call fcn.140034b00
mov dword [rsp + 0x28], 0x190
lea rax, [rbp + 0x340]
mov qword [rsp + 0x20], rax
or r9d, 0xffffffff
mov r8, r14
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r8d, esi
xor edx, edx
lea rcx, [rbp + 0x20]
call fcn.140034b00
mov qword [rsp + 0x30], r14
lea rsi, [0x14007a9d8]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
lea r9, str._ls_S__S_r_n
or r8, 0xffffffffffffffff
mov edx, 0x190
lea rcx, [rbp + 0x20]
call fcn.140032298
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, qword [r15 + 8]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea rcx, [rbp + 0x20]
call fcn.140037f9c
mov qword [rsp + 0x20], r13
lea r9, [rbp]
lea r8d, [rax + rax]
lea rdx, [rbp + 0x20]
mov rcx, qword [r15 + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
jmp 0x140031814
mov rcx, rbx
mov rbx, qword [rbx]
mov qword [rbp + 8], rbx
call fcn.140037ab4
test rbx, rbx
jne 0x140031805
mov rcx, qword [rbp + 0x660]
xor rcx, rbp
call fcn.140033cb0
mov rbx, qword [rbp + 0x6b0]
mov rsi, qword [rbp + 0x6b8]
lea rsp, [rbp + 0x670]
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret