Function at 0x1400736f0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
lea rbp, [rsp - 0x498]
sub rsp, 0x598
xor edx, edx
mov rsi, rcx
call fcn.140024c30
mov edx, eax
shr edx, 0x1f
test dl, dl
jne 0x140073a67
mov rcx, rsi
mov byte [rsi + 0x289], 1
call fcn.140024080
mov ecx, eax
shr ecx, 0x1f
test cl, cl
jne 0x140073a67
mov rcx, qword [rsi + 0x10]
mov edx, 3
mov qword [rsp + 0x5b0], rbx
mov qword [rsp + 0x5c0], rdi
mov qword [rsp + 0x590], r14
mov rax, qword [rcx]
call qword [rax + 0x40]
lea rdi, str.Unnamed
mov r14d, 0x538
test rax, rax
lea rcx, [rsp + 0x50]
mov r8d, r14d
cmovne rdi, rax
xor edx, edx
call fcn.1400ba240
mov eax, 0xffffff00
mov dword [rsp + 0x50], 0x200538
mov word [rbp - 0x78], ax
xor ebx, ebx
mov eax, 4
mov dword [rbp - 0x72], 0x147
mov word [rbp - 0x6e], ax
mov edx, 1
movabs rax, 0x656c6163532525
mov dword [rbp - 0x76], edx
mov qword [rbp - 0x6b], rax
mov eax, dword [rsi + 0x250]
add eax, eax
mov byte [rbp - 0x6c], 6
mov dword [rbp + 8], eax
mov rax, 0xffffffffffffffff
mov dword [rbp - 0x4a], edx
mov word [rbp - 0x46], bx
mov byte [rbp - 0x44], 3
mov dword [rbp - 0x43], 0x636573
inc rax
cmp byte [rdi + rax], bl
jne 0x1400737e0
lea rcx, [rbp + 0x4f]
mov byte [rbp + 0x4e], al
sub rcx, rdi
movzx eax, byte [rdi]
mov byte [rcx + rdi], al
lea rdi, [rdi + 1]
test al, al
jne 0x1400737f2
mov rcx, qword [rsi + 0x10]
mov word [rbp + 0xb0], dx
mov word [rbp + 0xd8], dx
mov word [rbp + 0x100], dx
mov word [rbp + 0x128], dx
mov word [rbp + 0x150], dx
mov word [rbp + 0x178], dx
mov word [rbp + 0x1a0], dx
mov word [rbp + 0x1c8], dx
mov word [rbp + 0x1f0], dx
mov word [rbp + 0x218], dx
lea rdx, [rsp + 0x30]
mov qword [rbp + 0x240], 0xffffffffffffffff
mov byte [rbp + 0x484], bl
mov dword [rsp + 0x30], 0x7f0000
mov word [rsp + 0x34], 0x3c7f
mov byte [rsp + 0x36], bl
mov dword [rsp + 0x38], ebx
mov word [rsp + 0x3c], bx
mov byte [rsp + 0x3e], bl
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x48], ebx
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rdi, qword [rsp + 0x5c0]
cmp byte [rsp + 0x30], bl
je 0x1400738cb
mov eax, dword [rsp + 0x40]
lea edx, [rax + rax]
mov eax, dword [rsp + 0x44]
lea r8d, [rax + rax]
cmp byte [rsp + 0x3c], bl
je 0x1400738c3
cmp byte [rsp + 0x3d], bl
setne al
inc al
mov byte [rbp + 0x484], al
jmp 0x1400738d8
mov byte [rbp + 0x484], bl
jmp 0x1400738d8
mov r8d, dword [rbp + 0x244]
mov edx, dword [rbp + 0x240]
mov eax, dword [str.Linear]
lea r9, [rbp + 0x4b8]
mov ecx, dword [rsi + 0x260]
ror word [rsp + 0x50], 8
ror word [rsp + 0x52], 8
ror word [rbp - 0x78], 8
ror word [rbp - 0x6e], 8
ror word [rbp + 0xb0], 8
ror word [rbp + 0xd8], 8
ror word [rbp + 0x100], 8
ror word [rbp + 0x128], 8
ror word [rbp + 0x150], 8
ror word [rbp + 0x178], 8
ror word [rbp + 0x1a0], 8
ror word [rbp + 0x1c8], 8
ror word [rbp + 0x1f0], 8
ror word [rbp + 0x218], 8
mov dword [rbp + 0x357], eax
movzx eax, word [0x1401476a4]
mov word [rbp + 0x35b], ax
movzx eax, byte [0x1401476a6]
mov byte [rbp + 0x35d], al
mov eax, dword [rbp - 0x76]
bswap eax
mov dword [rbp - 0x76], eax
mov eax, dword [rbp - 0x72]
bswap eax
mov dword [rbp - 0x72], eax
mov eax, dword [rbp - 0x4a]
bswap eax
mov dword [rbp - 0x4a], eax
mov eax, dword [rbp + 8]
bswap eax
mov dword [rbp + 8], eax
mov eax, ecx
bswap eax
bswap edx
mov dword [rbp + 0x34c], eax
mov eax, 0xf4240
mov dword [rbp + 0x240], edx
xor edx, edx
div ecx
mov rcx, qword [rsi + 0x38]
lea rdx, [rsp + 0x50]
bswap eax
bswap r8d
mov dword [rbp + 0x350], eax
mov eax, 0x1000
mov dword [rbp + 0x244], r8d
mov r8d, r14d
mov word [rbp + 0x354], ax
mov byte [rbp + 0x356], 6
mov qword [rbp + 0x47c], 0xffffffffffffffff
mov byte [rbp + 0x485], bl
mov dword [rbp + 0x4b8], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
call fcn.1400246e0
mov ecx, eax
shr ecx, 0x1f
test cl, cl
jne 0x140073a57
mov rcx, qword [rsi + 0x38]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov eax, dword [rsi + 0x250]
lea r9, [rbp + 0x4b8]
mov rcx, qword [rsi + 0x38]
lea rdx, [rsp + 0x50]
add eax, eax
mov dword [rbp + 0x4b8], ebx
bswap eax
mov r8d, r14d
mov dword [rbp + 8], eax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
mov rbx, qword [rsp + 0x5b0]
mov r14, qword [rsp + 0x590]
add rsp, 0x598
pop rsi
pop rbp
ret