Function at 0x1400b5fd0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x6c0
mov rax, qword [0x14026eff8]
xor rax, rsp
mov qword [rsp + 0x6b0], rax
mov r13d, dword [rsp + 0x710]
mov r15d, r9d
mov r14, r8
mov ebp, edx
mov rsi, rcx
lea eax, [r13 - 1]
cmp eax, 2
ja 0x1400b649c
mov eax, dword [rcx + 8]
cmp r13d, 3
jne 0x1400b6137
cmp edx, eax
je 0x1400b60df
cmp eax, 0xffffffff
je 0x1400b603d
mov rcx, qword [rcx]
call fcn.1400b8d70
mov rcx, qword [rsi]
mov dword [rsi + 8], 0xffffffff
cmp ebp, dword [rcx + 8]
jge 0x1400b649c
cmp dword [rcx + 0x14], ebp
jle 0x1400b6060
call fcn.1400b8e20
mov rcx, qword [rsi]
cmp dword [rcx + 0x14], ebp
jge 0x1400b60d0
mov rbx, rcx
xor edi, edi
mov rcx, rbx
test rbx, rbx
je 0x1400b60c8
cmp dword [rbx + 0x1c], edi
je 0x1400b60c8
mov edx, dword [rbx + 0x14]
inc edx
cmp edx, dword [rbx + 8]
je 0x1400b60c8
mov ecx, dword [rbx + 0x54]
lea r8, [rbx + 0x7c]
add ecx, dword [rbx + 0x50]
xor r9d, r9d
mov eax, dword [rbx + 0x4c]
mov dword [rsp + 0x40], edi
add eax, 0x2e
add ecx, eax
mov qword [rsp + 0x38], rdi
add dword [rbx + 0x18], ecx
mov rcx, rbx
mov dword [rbx + 0x14], edx
lea rdx, [rbx + 0x2c]
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
call fcn.1400b99f0
mov ecx, edi
test eax, eax
sete cl
mov dword [rbx + 0x1c], ecx
mov rcx, qword [rsi]
mov rbx, rcx
cmp dword [rcx + 0x14], ebp
jl 0x1400b6067
mov rdx, qword [rsi + 0x240]
call fcn.1400b8e80
mov dword [rsi + 8], ebp
mov rcx, qword [rsi]
lea r9, [rsp + 0x50]
mov r8d, r15d
mov rdx, r14
call fcn.1400b93c0
mov ebx, eax
test eax, eax
jg 0x1400b6107
mov rcx, qword [rsi]
call fcn.1400b8d70
mov dword [rsi + 8], 0xffffffff
cmp byte [rsp + 0x50], 0
jne 0x1400b626e
test ebx, ebx
jle 0x1400b6120
mov eax, 0x600
jmp 0x1400b64a1
mov eax, 0x1000
cmp ebx, 0xffffff96
mov edi, 0x5000000
cmove edi, eax
mov eax, edi
jmp 0x1400b64a1
cmp eax, 0xffffffff
je 0x1400b6144
mov rcx, qword [rcx]
call fcn.1400b8d70
mov rbx, qword [rsi]
mov dword [rsi + 8], 0xffffffff
cmp ebp, dword [rbx + 8]
jge 0x1400b649c
xor edi, edi
cmp dword [rbx + 0x14], ebp
jle 0x1400b61a5
test rbx, rbx
je 0x1400b61a2
mov eax, dword [rbx + 0x28]
lea r8, [rbx + 0x7c]
mov dword [rsp + 0x40], edi
lea rdx, [rbx + 0x2c]
mov qword [rsp + 0x38], rdi
xor r9d, r9d
mov dword [rsp + 0x30], edi
mov rcx, rbx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
mov dword [rbx + 0x18], eax
mov dword [rbx + 0x14], edi
call fcn.1400b99f0
mov ecx, edi
test eax, eax
sete cl
mov dword [rbx + 0x1c], ecx
mov rbx, qword [rsi]
cmp dword [rbx + 0x14], ebp
jge 0x1400b6210
mov rax, rbx
test rbx, rbx
je 0x1400b6208
cmp dword [rbx + 0x1c], edi
je 0x1400b6208
mov edx, dword [rbx + 0x14]
inc edx
cmp edx, dword [rbx + 8]
je 0x1400b6208
mov ecx, dword [rbx + 0x54]
lea r8, [rbx + 0x7c]
add ecx, dword [rbx + 0x50]
xor r9d, r9d
mov eax, dword [rbx + 0x4c]
mov dword [rsp + 0x40], edi
add eax, 0x2e
add ecx, eax
mov qword [rsp + 0x38], rdi
add dword [rbx + 0x18], ecx
mov rcx, rbx
mov dword [rbx + 0x14], edx
lea rdx, [rbx + 0x2c]
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
call fcn.1400b99f0
test eax, eax
mov ecx, edi
sete cl
mov dword [rbx + 0x1c], ecx
mov rax, qword [rsi]
mov rbx, rax
cmp dword [rax + 0x14], ebp
jl 0x1400b61a7
lea r8, [rsp + 0x60]
mov edx, ebp
mov rcx, rsi
call fcn.1400b5460
mov eax, dword [rsp + 0x26c]
shr eax, 4
test al, 1
je 0x1400b6275
cmp r13d, 1
je 0x1400b626e
movzx eax, word [r14]
cmp ax, 0x2f
je 0x1400b6254
cmp ax, 0x5c
je 0x1400b6254
test ax, ax
je 0x1400b6250
cmp word [r14 + 2], 0x3a
je 0x1400b6254
xor cl, cl
jmp 0x1400b6256
mov cl, 1
test cl, cl
lea rax, [rsi + 0x250]
mov rdx, r14
cmove rdi, rax
mov rcx, rdi
call fcn.1400b5280
xor eax, eax
jmp 0x1400b64a1
mov word [rsp + 0x4a0], di
cmp r13d, 1
je 0x1400b63b0
movzx eax, word [r14]
mov rbx, r14
mov rcx, r14
test ax, ax
je 0x1400b62b3
cmp ax, 0x2f
je 0x1400b62a2
cmp ax, 0x5c
jne 0x1400b62a6
lea rbx, [rcx + 2]
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x1400b6296
mov r8d, 0x104
lea rcx, [rsp + 0x290]
mov rdx, r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
cmp rbx, r14
jne 0x1400b62d9
mov word [rsp + 0x290], di
jmp 0x1400b631d
mov rax, rbx
sub rax, r14
sar rax, 1
add rax, rax
cmp rax, 0x208
jae 0x1400b64cd
mov word [rsp + rax + 0x290], di
movzx eax, word [rsp + 0x290]
cmp ax, 0x2f
je 0x1400b634a
cmp ax, 0x5c
je 0x1400b634a
test ax, ax
je 0x1400b631d
cmp word [rsp + 0x292], 0x3a
je 0x1400b634a
lea rbp, [rsi + 0x250]
mov qword [rsp + 0x20], rbx
mov r8, rbp
lea r9, [rsp + 0x290]
lea rdx, str._s_s_s
lea rcx, [rsp + 0x4a0]
call fcn.1400b8bf0
jmp 0x1400b636c
mov r9, rbx
lea r8, [rsp + 0x290]
lea rdx, str._s_s
lea rcx, [rsp + 0x4a0]
call fcn.1400b8bf0
mov rbp, rdi
lea rdx, [rsp + 0x290]
mov rcx, rbp
call fcn.1400b5280
mov eax, dword [rsp + 0x26c]
lea rcx, [rsp + 0x4a0]
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp r14, 0xffffffffffffffff
jne 0x1400b63c0
mov eax, 0x200
jmp 0x1400b64a1
mov rdx, qword [rsi + 0x240]
mov rcx, qword [rsi]
call fcn.1400b8e80
cmp qword [rsi + 0x248], rdi
jne 0x1400b63f0
mov ecx, 0x4000
call fcn.1401022a0
mov qword [rsi + 0x248], rax
nop dword [rax]
mov rdx, qword [rsi + 0x248]
lea r9, [rsp + 0x50]
mov rcx, qword [rsi]
mov r8d, 0x4000
call fcn.1400b93c0
mov ebx, eax
cmp eax, 0xffffff96
je 0x1400b647c
test eax, eax
js 0x1400b6443
jle 0x1400b6438
mov rdx, qword [rsi + 0x248]
lea r9, [rsp + 0x54]
mov r8d, eax
mov qword [rsp + 0x20], rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400b644a
cmp byte [rsp + 0x50], dil
jne 0x1400b6451
test ebx, ebx
jne 0x1400b63f0
mov edi, 0x5000000
jmp 0x1400b6481
mov edi, 0x400
jmp 0x1400b6481
mov rcx, qword [rsi]
call fcn.1400b8d70
lea r9, [rsp + 0x280]
mov rcx, r14
lea r8, [rsp + 0x270]
lea rdx, [rsp + 0x278]
call qword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x1400b6489
mov edi, 0x1000
mov rcx, qword [rsi]
call fcn.1400b8d70
cmp r13d, 1
je 0x1400b6498
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x1400b64a1
mov eax, 0x10000
mov rcx, qword [rsp + 0x6b0]
xor rcx, rsp
call fcn.140102140
lea r11, [rsp + 0x6c0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
call fcn.140102428
int3