Function at 0x140081590
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x58
xor ebx, ebx
mov r14d, r8d
mov r15, rdx
mov rsi, rcx
lea edi, [rbx + 1]
mov ebp, ebx
test rdx, rdx
jne 0x1400815c5
xor eax, eax
add rsp, 0x58
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rcx, rdx
mov qword [rsp + 0x50], r13
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r13, rax
mov qword [rsp + 0x28], rax
test rax, rax
je 0x1400815ef
cmp word [rax + 0xe], di
je 0x1400815f6
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor eax, eax
jmp 0x1400819f9
mov ecx, dword [rax]
mov edx, dword [rax + 0x20]
add rcx, rax
cmp byte [r13 + 0x2a], 0xff
lea rax, [rcx + rdx*4]
mov qword [rsp + 0x30], rax
jne 0x14008162f
cmp byte [r13 + 0x29], 0xff
jne 0x14008162f
cmp byte [r13 + 0x28], 0xff
jne 0x14008162f
cmp byte [r13 + 0x2e], bl
jne 0x14008162f
cmp byte [r13 + 0x2d], bl
jne 0x14008162f
cmp byte [r13 + 0x2c], bl
cmove edi, ebx
mov eax, dword [r13 + 4]
mov qword [rsp + 0x90], r12
add eax, 0x1f
cdq
and edx, 0x1f
lea ebx, [rdx + rax]
sar ebx, 5
shl ebx, 2
test ebx, ebx
jle 0x1400819e6
movsxd rdx, ebx
mov ecx, 0x40
mov qword [rsp + 0x38], rdx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r12, rax
mov qword [rsp + 0x20], rax
test rax, rax
je 0x1400819e6
lea rdx, [0x140183390]
mov rcx, rsi
call fcn.1400fafe4
mov rsi, rax
test rax, rax
je 0x1400819e6
movsxd r15, edi
mov rcx, rax
cmp r14d, 1
jne 0x140081875
lea rdx, [0x14018a238]
call fcn.1400fe6b4
lea r8, [0x14018a240]
lea rdx, [0x14018a258]
mov rcx, rsi
call fcn.1400fe6b4
mov r9d, dword [r13 + 8]
mov r8d, dword [r13 + 4]
lea rdx, [0x14018a260]
mov rcx, rsi
call fcn.1400fe6b4
mov eax, dword [r13 + 8]
xor ebx, ebx
mov ecx, ebx
mov dword [rsp + 0xa8], ebx
test eax, eax
jle 0x1400819a5
nop dword [rax + rax]
mov r8, qword [rsp + 0x38]
sub eax, ecx
mov rcx, r12
dec eax
movsxd rdx, eax
imul rdx, qword [rsp + 0x38]
add rdx, qword [rsp + 0x30]
call fcn.1400fb0e0
mov eax, dword [r13 + 4]
mov r12d, ebx
cdq
mov r14, rbx
and edx, 7
add eax, edx
sar eax, 3
test eax, eax
jle 0x1400817ce
nop word [rax + rax]
mov rax, qword [rsp + 0x20]
inc ebp
mov ebx, 7
movzx edi, byte [r14 + rax]
xor r13d, r13d
nop dword [rax]
nop dword [rax + rax]
bt edi, ebx
mov r8d, r13d
setb r8b
test r15, r15
je 0x14008177b
test r8d, r8d
mov eax, r13d
sete al
mov r8d, eax
lea rdx, [0x14018a268]
mov rcx, rsi
call fcn.1400fe6b4
dec ebx
cmp ebx, 0xffffffff
jg 0x140081760
mov r13, qword [rsp + 0x28]
cmp ebp, 5
jne 0x1400817b0
xor ebx, ebx
lea rdx, [0x14018a26c]
mov rcx, rsi
mov ebp, ebx
call fcn.1400fe6b4
jmp 0x1400817b2
xor ebx, ebx
mov eax, dword [r13 + 4]
inc r12d
inc r14
cdq
and edx, 7
add eax, edx
sar eax, 3
cmp r12d, eax
jl 0x140081740
mov eax, dword [r13 + 4]
and eax, 0x80000007
jge 0x1400817e0
dec eax
or eax, 0xfffffff8
inc eax
test eax, eax
je 0x14008184f
inc ebp
test eax, eax
jle 0x140081837
mov rcx, qword [rsp + 0x20]
mov ebx, 7
mov edi, eax
movzx r14d, byte [r14 + rcx]
xor r13d, r13d
nop
bt r14d, ebx
mov r8d, r13d
setb r8b
test r15, r15
je 0x14008181c
test r8d, r8d
mov eax, r13d
sete al
mov r8d, eax
lea rdx, [0x14018a268]
mov rcx, rsi
call fcn.1400fe6b4
dec ebx
dec rdi
jne 0x140081800
mov r13, qword [rsp + 0x28]
xor ebx, ebx
cmp ebp, 5
jne 0x14008184f
lea rdx, [0x14018a26c]
mov rcx, rsi
mov ebp, ebx
call fcn.1400fe6b4
mov ecx, dword [rsp + 0xa8]
mov eax, dword [r13 + 8]
mov r12, qword [rsp + 0x20]
inc ecx
mov dword [rsp + 0xa8], ecx
cmp ecx, eax
jl 0x140081700
jmp 0x1400819a5
lea rdx, [0x14018a270]
call fcn.1400fe6b4
lea r8, [0x14018a240]
lea rdx, [0x14018a258]
mov rcx, rsi
call fcn.1400fe6b4
mov r9d, dword [r13 + 8]
mov r8d, dword [r13 + 4]
lea rdx, [0x14018a260]
mov rcx, rsi
call fcn.1400fe6b4
mov eax, dword [r13 + 8]
xor r14d, r14d
mov edi, r14d
test eax, eax
jle 0x1400819a5
movaps xmmword [rsp + 0x40], xmm6
movdqa xmm6, xmmword [0x14018a280]
movsxd rbp, ebx
sub eax, edi
mov r8, rbp
mov rcx, r12
dec eax
movsxd rdx, eax
imul rdx, rbp
add rdx, qword [rsp + 0x30]
call fcn.1400fb0e0
test r15, r15
je 0x14008196f
mov r8, r14
test ebx, ebx
jle 0x140081955
cmp ebx, 0x20
jb 0x140081955
mov eax, ebx
mov edx, r14d
and eax, 0x8000001f
jge 0x140081913
dec eax
or eax, 0xffffffe0
inc eax
mov r9d, ebx
sub r9d, eax
nop dword [rax]
movsxd rax, edx
add r8, 0x20
movdqu xmm0, xmmword [rax + r12]
pandn xmm0, xmm6
movdqu xmmword [rax + r12], xmm0
lea eax, [rdx + 0x10]
add edx, 0x20
movsxd rcx, eax
movdqu xmm0, xmmword [rcx + r12]
pandn xmm0, xmm6
movdqu xmmword [rcx + r12], xmm0
cmp edx, r9d
jl 0x140081920
cmp r8, rbp
jge 0x14008196f
mov rdx, rbp
lea rcx, [r8 + r12]
sub rdx, r8
not byte [rcx]
lea rcx, [rcx + 1]
dec rdx
jne 0x140081964
mov eax, dword [r13 + 4]
mov r9, rsi
mov rcx, r12
add eax, 7
cdq
and edx, 7
add eax, edx
mov edx, 1
sar eax, 3
movsxd r8, eax
call fcn.1400faf54
mov eax, dword [r13 + 8]
inc edi
cmp edi, eax
jl 0x1400818d0
movaps xmm6, xmmword [rsp + 0x40]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, rsi
call fcn.1400fa904
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, 1
jmp 0x1400819f1
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor eax, eax
mov r12, qword [rsp + 0x90]
mov r13, qword [rsp + 0x50]
add rsp, 0x58
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret