Function at 0x14000a360
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push r12
push r14
lea rbp, [rsp - 0x3f]
sub rsp, 0x98
mov rax, qword [0x14003c008]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov rsi, rcx
mov eax, 0x20
xor r12d, r12d
mov word [0x14003dfc0], ax
mov ecx, 0x100
mov word [0x14003ee6c], r12w
mov r14, rdx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [0x14003e1c8], rax
test rax, rax
jne 0x14000a3bf
lea eax, [r12 - 3]
jmp 0x14000aabb
mov qword [rsp + 0xd0], rbx
lea rcx, [0x140042920]
mov qword [rsp + 0x90], rdi
mov edx, 0x100
mov qword [rsp + 0x88], r13
mov r8, rsi
mov qword [rsp + 0x80], r15
call fcn.140029e70
test ax, ax
jle 0x14000aa97
lea r15, [0x14003dfd0]
mov ebx, 0x8000
mov edi, 0x4000
lea r13, [0x14003e050]
mov rcx, rsi
call fcn.14001af60
test ax, ax
je 0x14000a473
movzx r8d, word [0x14003e1bc]
mov eax, 0x51eb851f
movzx ecx, word [0x14003e170]
imul ecx, r8d
mov word [0x14003e1b0], r8w
imul ecx
mov ecx, edx
lea rdx, [0x14003e1d0]
sar ecx, 5
mov eax, ecx
shr eax, 0x1f
add ecx, eax
add cx, word [0x14003e16c]
mov word [0x14003e174], cx
call qword [0x140041ab0]
test ax, ax
jne 0x14000aad5
cmp word [0x140042920], 0x1a
je 0x14000aa7a
mov rdx, r15
call fcn.14000aaf0
test ax, ax
js 0x14000aae3
mov rcx, r15
mov word [0x14003e0d6], ax
call fcn.14000ac90
test ax, ax
js 0x14000aae3
mov word [0x14003e0d0], ax
mov ecx, r12d
mov rax, r15
mov dword [0x14003e0d2], 0x3fff
cmp byte [rax], r12b
jne 0x14000a4cc
cmp byte [rax + 1], r12b
je 0x14000a4d4
add rax, 2
inc ecx
jmp 0x14000a4c1
add cx, cx
movsx rax, cx
cmp byte [rax + r15 - 2], 0x21
jne 0x14000a4fb
cmp byte [rax + r15 - 1], r12b
jne 0x14000a4fb
add cx, 0xfffe
mov word [rax + r15 - 2], r12w
or word [0x14003e0d0], bx
movsx rax, cx
cmp byte [rax + r15 - 2], 0x3f
jne 0x14000a51f
cmp byte [rax + r15 - 1], r12b
jne 0x14000a51f
add cx, 0xfffe
mov word [rax + r15 - 2], r12w
or word [0x14003e0d2], di
movsx rax, cx
cmp byte [rax + r15 - 2], 0x2e
jne 0x14000a543
cmp byte [rax + r15 - 1], r12b
jne 0x14000a543
add cx, 0xfffe
mov word [rax + r15 - 2], r12w
or word [0x14003e0d6], bx
movsx rdi, cx
mov rcx, r12
mov rbx, rdi
test edi, edi
jle 0x14000a55d
not byte [rcx + r15]
inc rcx
cmp rcx, rbx
jl 0x14000a551
mov rcx, qword [r14]
lea r9, [rbp - 0x29]
mov r8d, edi
mov qword [rsp + 0x20], r12
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14000a5a4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x14000a592
mov eax, eax
lea rcx, [0x140030680]
mov ecx, dword [rcx + rax*4]
jmp 0x14000a597
mov ecx, operator
mov dword [0x140042de8], ecx
mov byte [0x1400433b0], r12b
mov rcx, r12
test edi, edi
jle 0x14000a5c3
nop dword [rax + rax]
movzx eax, byte [rcx + r15]
not al
mov byte [rcx + r15], al
inc rcx
cmp rcx, rbx
jl 0x14000a5b0
cmp dword [rbp - 0x29], edi
jne 0x14000aadc
lea rbx, [0x14003c04c]
mov rdx, r13
mov rcx, rbx
nop dword [rax]
movzx eax, byte [rcx]
test al, al
jne 0x14000a5ed
cmp byte [rcx + 1], r12b
je 0x14000a600
mov byte [rdx], al
movzx eax, byte [rcx + 1]
mov byte [rdx + 1], al
add rdx, 2
add rcx, 2
jmp 0x14000a5e0
movzx eax, byte [rcx]
mov byte [rdx], al
movzx eax, byte [rcx + 1]
lea rcx, [rbp - 9]
mov byte [rdx + 1], al
lea rdx, [0x140033ea4]
movzx r8d, word [0x14003e0d0]
call fcn.14000bec0
movsxd r9, eax
cmp r12w, r9w
jge 0x14000a657
lea rdx, [rbp - 9]
movzx r8d, r9w
lea rcx, [rbp - 0x18]
nop dword [rax]
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
mov byte [rcx - 1], al
mov byte [rcx], r12b
lea rcx, [rcx + 2]
sub r8, 1
jne 0x14000a640
movsx rax, r9w
lea rdx, [rbp - 0x19]
mov rcx, r13
mov word [rbp + rax*2 - 0x19], r12w
cmp byte [rcx], r12b
jne 0x14000a673
cmp byte [rcx + 1], r12b
je 0x14000a680
add rcx, 2
jmp 0x14000a668
movzx eax, byte [rdx]
test al, al
jne 0x14000a68d
cmp byte [rdx + 1], r12b
je 0x14000a6a0
mov byte [rcx], al
movzx eax, byte [rdx + 1]
mov byte [rcx + 1], al
add rcx, 2
add rdx, 2
jmp 0x14000a680
mov word [rcx], r12w
mov rdx, rbx
mov rcx, r13
nop word [rax + rax]
cmp byte [rcx], r12b
jne 0x14000a6bb
cmp byte [rcx + 1], r12b
je 0x14000a6c1
add rcx, 2
jmp 0x14000a6b0
movzx eax, byte [rdx]
test al, al
jne 0x14000a6ce
cmp byte [rdx + 1], r12b
je 0x14000a6e1
mov byte [rcx], al
movzx eax, byte [rdx + 1]
mov byte [rcx + 1], al
add rcx, 2
add rdx, 2
jmp 0x14000a6c1
mov word [rcx], r12w
lea rdx, [0x140033ea4]
movzx r8d, word [0x14003e0d2]
lea rcx, [rbp - 1]
call fcn.14000bec0
movsxd r9, eax
cmp r12w, r9w
jge 0x14000a729
lea rdx, [rbp - 1]
movzx r8d, r9w
lea rcx, [rbp - 0x18]
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
mov byte [rcx - 1], al
mov byte [rcx], r12b
lea rcx, [rcx + 2]
sub r8, 1
jne 0x14000a712
movsx rax, r9w
lea rdx, [rbp - 0x19]
mov rcx, r13
mov word [rbp + rax*2 - 0x19], r12w
nop word [rax + rax]
cmp byte [rcx], r12b
jne 0x14000a74b
cmp byte [rcx + 1], r12b
je 0x14000a751
add rcx, 2
jmp 0x14000a740
movzx eax, byte [rdx]
test al, al
jne 0x14000a75e
cmp byte [rdx + 1], r12b
je 0x14000a771
mov byte [rcx], al
movzx eax, byte [rdx + 1]
mov byte [rcx + 1], al
add rcx, 2
add rdx, 2
jmp 0x14000a751
mov word [rcx], r12w
mov rdx, rbx
mov rcx, r13
nop dword [rax + rax]
cmp byte [rcx], r12b
jne 0x14000a78b
cmp byte [rcx + 1], r12b
je 0x14000a791
add rcx, 2
jmp 0x14000a780
movzx eax, byte [rdx]
test al, al
jne 0x14000a79e
cmp byte [rdx + 1], r12b
je 0x14000a7b1
mov byte [rcx], al
movzx eax, byte [rdx + 1]
mov byte [rcx + 1], al
add rcx, 2
add rdx, 2
jmp 0x14000a791
mov word [rcx], r12w
lea rdx, [0x140033ea4]
movzx r8d, word [0x14003e0d4]
lea rcx, [rbp + 7]
call fcn.14000bec0
movsxd r9, eax
cmp r12w, r9w
jge 0x14000a7f9
lea rdx, [rbp + 7]
movzx r8d, r9w
lea rcx, [rbp - 0x18]
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
mov byte [rcx - 1], al
mov byte [rcx], r12b
lea rcx, [rcx + 2]
sub r8, 1
jne 0x14000a7e2
movsx rax, r9w
lea rdx, [rbp - 0x19]
mov rcx, r13
mov word [rbp + rax*2 - 0x19], r12w
nop word [rax + rax]
cmp byte [rcx], r12b
jne 0x14000a81b
cmp byte [rcx + 1], r12b
je 0x14000a821
add rcx, 2
jmp 0x14000a810
movzx eax, byte [rdx]
test al, al
jne 0x14000a82e
cmp byte [rdx + 1], r12b
je 0x14000a841
mov byte [rcx], al
movzx eax, byte [rdx + 1]
mov byte [rcx + 1], al
add rcx, 2
add rdx, 2
jmp 0x14000a821
mov word [rcx], r12w
mov rdx, rbx
mov rcx, r13
nop dword [rax + rax]
cmp byte [rcx], r12b
jne 0x14000a85b
cmp byte [rcx + 1], r12b
je 0x14000a861
add rcx, 2
jmp 0x14000a850
movzx eax, byte [rdx]
test al, al
jne 0x14000a86e
cmp byte [rdx + 1], r12b
je 0x14000a881
mov byte [rcx], al
movzx eax, byte [rdx + 1]
mov byte [rcx + 1], al
add rcx, 2
add rdx, 2
jmp 0x14000a861
mov word [rcx], r12w
lea rdx, [0x140033ea4]
movzx r8d, word [0x14003e0d6]
lea rcx, [rbp + 0xf]
call fcn.14000bec0
movsxd r9, eax
cmp r12w, r9w
jge 0x14000a8c9
lea rdx, [rbp + 0xf]
movzx r8d, r9w
lea rcx, [rbp - 0x18]
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
mov byte [rcx - 1], al
mov byte [rcx], r12b
add rcx, 2
sub r8, 1
jne 0x14000a8b2
movsx rax, r9w
lea rdx, [rbp - 0x19]
mov word [rbp + rax*2 - 0x19], r12w
mov rax, r13
nop word [rax + rax]
cmp byte [rax], r12b
jne 0x14000a8eb
cmp byte [rax + 1], r12b
je 0x14000a8f1
add rax, 2
jmp 0x14000a8e0
movzx ecx, byte [rdx]
test cl, cl
jne 0x14000a8fe
cmp byte [rdx + 1], r12b
je 0x14000a911
mov byte [rax], cl
movzx ecx, byte [rdx + 1]
mov byte [rax + 1], cl
add rax, 2
add rdx, 2
jmp 0x14000a8f1
mov word [rax], r12w
mov ecx, r12d
mov rax, r13
nop dword [rax + rax]
cmp byte [rax], r12b
jne 0x14000a92b
cmp byte [rax + 1], r12b
je 0x14000a933
add rax, 2
inc ecx
jmp 0x14000a920
add cx, cx
movsx rdi, cx
mov rcx, r12
mov rbx, rdi
test edi, edi
jle 0x14000a960
nop dword [rax]
nop dword [rax + rax]
not byte [rcx + r15 + 0x80]
inc rcx
cmp rcx, rbx
jl 0x14000a950
mov rcx, qword [r14]
lea r9, [rbp - 0x25]
mov r8d, edi
mov qword [rsp + 0x20], r12
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14000a9a7
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x14000a995
mov eax, eax
lea rcx, [0x140030680]
mov ecx, dword [rcx + rax*4]
jmp 0x14000a99a
mov ecx, operator
mov dword [0x140042de8], ecx
mov byte [0x1400433b0], r12b
mov rcx, r12
test edi, edi
jle 0x14000a9c0
nop
not byte [rcx + r15 + 0x80]
inc rcx
cmp rcx, rbx
jl 0x14000a9b0
cmp dword [rbp - 0x25], edi
jne 0x14000aadc
lea rdx, [0x14003c050]
mov ecx, r12d
mov rax, rdx
cmp byte [rax], r12b
jne 0x14000a9e1
cmp byte [rax + 1], r12b
je 0x14000a9e9
add rax, 2
inc ecx
jmp 0x14000a9d6
add cx, cx
movsx rdi, cx
mov rcx, r12
mov rbx, rdi
test edi, edi
jle 0x14000aa0b
nop word [rax + rax]
not byte [rcx + rdx]
inc rcx
cmp rcx, rbx
jl 0x14000aa00
mov rcx, qword [r14]
lea r9, [rbp - 0x21]
mov r8d, edi
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14000aa4f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x14000aa3d
mov eax, eax
lea rcx, [0x140030680]
mov ecx, dword [rcx + rax*4]
jmp 0x14000aa42
mov ecx, operator
mov dword [0x140042de8], ecx
mov byte [0x1400433b0], r12b
mov rcx, r12
test edi, edi
jle 0x14000aa6b
lea rdx, [0x14003c050]
nop dword [rax]
not byte [rcx + rdx]
inc rcx
cmp rcx, rbx
jl 0x14000aa60
cmp dword [rbp - 0x21], edi
jne 0x14000aadc
mov ebx, 0x8000
mov edi, 0x4000
mov edx, 0x100
lea rcx, [0x140042920]
mov r8, rsi
call fcn.140029e70
test ax, ax
jg 0x14000a414
movzx eax, r12w
mov r13, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x90]
mov rbx, qword [rsp + 0xd0]
mov r15, qword [rsp + 0x80]
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.14002c160
add rsp, 0x98
pop r14
pop r12
pop rsi
pop rbp
ret
mov eax, 0xfffffffc
jmp 0x14000aa9b
mov eax, 0xfffffffe
jmp 0x14000aa9b
mov eax, 0xfffffffd
jmp 0x14000aa9b