Function at 0x14005d490
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x88
mov edi, dword [rcx + 0xa34]
mov rsi, rcx
test edi, edi
jne 0x14005d4b3
mov al, 1
add rsp, 0x88
pop rdi
pop rsi
ret
mov qword [rsp + 0xa8], rbx
mov rbx, qword [rcx + 0x270]
mov qword [rsp + 0xb0], rbp
xor ebp, ebp
mov qword [rsp + 0x80], r14
cmp byte [rcx + 0x299], bpl
jne 0x14005d536
mov rcx, qword [rcx + 0x38]
lea r9, [rsp + 0xa0]
mov r8d, edi
mov dword [rsp + 0xa0], ebp
mov rdx, rbx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14005d512
cmp dword [rsp + 0xa0], edi
je 0x14005d853
xor al, al
mov rbp, qword [rsp + 0xb0]
mov rbx, qword [rsp + 0xa8]
mov r14, qword [rsp + 0x80]
add rsp, 0x88
pop rdi
pop rsi
ret
mov r14d, reloc.WSOCK32.dll_recv
nop dword [rax]
movzx eax, byte [rsp + 0x33]
lea rcx, [rsp + 0x33]
mov word [rsp + 0x30], 0xfefe
movzx edx, byte [rbx]
cmp dl, r14b
mov byte [rsp + 0x32], dl
cmove eax, r14d
mov byte [rsp + 0x33], al
lea rax, [rsp + 0x34]
cmove rcx, rax
movzx eax, byte [rbx + 1]
mov byte [rcx], al
inc rcx
cmp al, r14b
jne 0x14005d580
mov byte [rcx], r14b
inc rcx
movzx eax, byte [rbx + 2]
mov byte [rcx], al
inc rcx
cmp al, r14b
jne 0x14005d594
mov byte [rcx], r14b
inc rcx
movzx eax, byte [rbx + 3]
mov byte [rcx], al
inc rcx
cmp al, r14b
jne 0x14005d5a8
mov byte [rcx], r14b
inc rcx
movzx eax, byte [rbx + 4]
mov byte [rcx], al
inc rcx
cmp al, r14b
jne 0x14005d5bc
mov byte [rcx], r14b
inc rcx
movzx eax, byte [rbx + 5]
mov byte [rcx], al
inc rcx
cmp al, r14b
jne 0x14005d5d0
mov byte [rcx], r14b
inc rcx
movzx eax, byte [rbx + 6]
mov byte [rcx], al
inc rcx
cmp al, r14b
jne 0x14005d5e4
mov byte [rcx], r14b
inc rcx
movzx eax, byte [rbx + 7]
mov byte [rcx], al
inc rcx
cmp al, r14b
jne 0x14005d5f8
mov byte [rcx], r14b
inc rcx
movzx eax, byte [rbx + 8]
mov byte [rcx], al
inc rcx
cmp al, r14b
jne 0x14005d60c
mov byte [rcx], r14b
inc rcx
movzx eax, byte [rbx + 9]
mov byte [rcx], al
inc rcx
cmp al, r14b
jne 0x14005d620
mov byte [rcx], r14b
inc rcx
movzx eax, byte [rbx + 0xa]
mov byte [rcx], al
inc rcx
cmp al, r14b
jne 0x14005d634
mov byte [rcx], r14b
inc rcx
movzx eax, byte [rbx + 0xb]
mov byte [rcx], al
inc rcx
cmp al, r14b
jne 0x14005d648
mov byte [rcx], r14b
inc rcx
movzx eax, byte [rbx + 0xc]
mov byte [rcx], al
inc rcx
cmp al, r14b
jne 0x14005d65c
mov byte [rcx], r14b
inc rcx
movzx eax, byte [rbx + 0xd]
mov byte [rcx], al
inc rcx
cmp al, r14b
jne 0x14005d670
mov byte [rcx], r14b
inc rcx
movzx eax, byte [rbx + 0xe]
mov byte [rcx], al
inc rcx
cmp al, r14b
jne 0x14005d684
mov byte [rcx], r14b
inc rcx
movzx eax, byte [rbx + 0xf]
mov byte [rcx], al
inc rcx
cmp al, r14b
jne 0x14005d698
mov byte [rcx], r14b
inc rcx
movzx eax, byte [rbx + 0x10]
mov byte [rcx], al
inc rcx
cmp al, r14b
jne 0x14005d6ac
mov byte [rcx], r14b
inc rcx
movzx eax, byte [rbx + 0x11]
mov byte [rcx], al
inc rcx
cmp al, r14b
jne 0x14005d6c0
mov byte [rcx], r14b
inc rcx
movzx eax, byte [rbx + 0x12]
mov byte [rcx], al
inc rcx
cmp al, r14b
jne 0x14005d6d4
mov byte [rcx], r14b
inc rcx
movzx eax, byte [rbx + 0x13]
mov byte [rcx], al
inc rcx
cmp al, r14b
jne 0x14005d6e8
mov byte [rcx], r14b
inc rcx
movzx eax, byte [rbx + 0x14]
mov byte [rcx], al
inc rcx
cmp al, r14b
jne 0x14005d6fc
mov byte [rcx], r14b
inc rcx
movzx eax, byte [rbx + 0x15]
mov byte [rcx], al
inc rcx
cmp al, r14b
jne 0x14005d710
mov byte [rcx], r14b
inc rcx
movzx eax, byte [rbx + 0x16]
mov byte [rcx], al
inc rcx
cmp al, r14b
jne 0x14005d724
mov byte [rcx], r14b
inc rcx
movzx eax, byte [rbx + 0x17]
mov byte [rcx], al
inc rcx
cmp al, r14b
jne 0x14005d738
mov byte [rcx], r14b
inc rcx
movzx eax, byte [rbx + 0x18]
mov byte [rcx], al
inc rcx
cmp al, r14b
jne 0x14005d74c
mov byte [rcx], r14b
inc rcx
movzx eax, byte [rbx + 0x19]
mov byte [rcx], al
inc rcx
cmp al, r14b
jne 0x14005d760
mov byte [rcx], r14b
inc rcx
movzx eax, byte [rbx + 0x1a]
mov byte [rcx], al
inc rcx
cmp al, r14b
jne 0x14005d774
mov byte [rcx], r14b
inc rcx
movzx eax, byte [rbx + 0x1b]
mov byte [rcx], al
inc rcx
cmp al, r14b
jne 0x14005d788
mov byte [rcx], r14b
inc rcx
movzx eax, byte [rbx + 0x1c]
mov byte [rcx], al
inc rcx
cmp al, r14b
jne 0x14005d79c
mov byte [rcx], r14b
inc rcx
movzx eax, byte [rbx + 0x1d]
mov byte [rcx], al
inc rcx
cmp al, r14b
jne 0x14005d7b0
mov byte [rcx], r14b
inc rcx
movzx eax, byte [rbx + 0x1e]
mov byte [rcx], al
inc rcx
cmp al, r14b
jne 0x14005d7c4
mov byte [rcx], r14b
inc rcx
movzx eax, byte [rbx + 0x1f]
mov byte [rcx], al
inc rcx
cmp al, r14b
jne 0x14005d7d8
mov byte [rcx], r14b
inc rcx
movzx eax, byte [rbx + 0x20]
mov byte [rcx], al
inc rcx
cmp al, r14b
jne 0x14005d7ec
mov byte [rcx], r14b
inc rcx
add dword [rsi + 0xa34], 0xffffffdf
lea rdi, [rcx + 2]
mov word [rcx], 0xa500
lea rax, [rsp + 0x30]
mov rcx, qword [rsi + 0x38]
lea r9, [rsp + 0xa0]
mov byte [rdi], 0xa5
lea rdx, [rsp + 0x30]
sub edi, eax
mov dword [rsp + 0xa0], ebp
inc edi
mov qword [rsp + 0x20], rbp
mov r8d, edi
add rbx, 0x21
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14005d512
cmp dword [rsp + 0xa0], edi
jne 0x14005d512
cmp dword [rsi + 0xa34], ebp
ja 0x14005d540
mov dword [rsi + 0xa34], ebp
mov al, 1
jmp 0x14005d514