Function at 0x1400033a0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x360]
sub rsp, 0x460
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rsp + 0x4b0], rbx
mov rax, qword [0x1400bc8f8]
xor rax, rsp
mov qword [rbp + 0x350], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
mov qword [rbp - 0x80], rcx
xor r12d, r12d
mov dword [rsp + 0x40], r12d
mov qword [rcx], r12
mov qword [rcx + 8], r12
call fcn.140004af0
mov qword [rdi], rax
mov dword [rsp + 0x40], 1
mov rcx, rbx
call fcn.140003a20
mov r14, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x1400039ef
mov qword [rbp + 0x2ac], r12
mov dword [rbp + 0x2b4], r12d
mov dword [rbp + 0x290], 0x64
mov ecx, dword [0x1400cb654]
mov dword [rbp + 0x294], ecx
mov qword [rbp + 0x298], rax
lea rax, [rbp + 0x2e0]
mov qword [rbp + 0x2a0], rax
mov dword [rbp + 0x2a8], 0x40
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rbp + 0x2ac], eax
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x320]
lea r8d, [r12 + 0x29]
lea rdx, [rbp + 0x290]
mov rcx, qword [0x1400cb690]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov qword [rbp + 0x2ac], r12
mov dword [rbp + 0x2b4], r12d
mov dword [rbp + 0x290], 0x64
mov eax, dword [0x1400cb654]
mov dword [rbp + 0x294], eax
movsxd rax, dword [rbp + 0x31c]
add rax, r14
mov qword [rbp + 0x298], rax
lea rax, [rbp - 0x78]
mov qword [rbp + 0x2a0], rax
mov dword [rbp + 0x2a8], 0x108
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rbp + 0x2ac], eax
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x320]
lea r8d, [r12 + 0x29]
lea rdx, [rbp + 0x290]
mov rcx, qword [0x1400cb690]
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [rbp + 0x1c], r12d
je 0x1400039ef
mov edx, dword [rbp + 0x18]
add rdx, r14
lea rcx, [rbp + 0x328]
call fcn.1400013d0
movups xmm0, xmmword [rax]
mov ecx, dword [rax + 0x10]
mov r15d, r12d
mov dword [rsp + 0x34], r12d
movups xmmword [rsp + 0x60], xmm0
psrldq xmm0, 8
movq rax, xmm0
shr rax, 0x20
test eax, eax
mov dword [rbp + 0x320], ecx
je 0x1400039ef
mov ecx, dword [rsp + 0x60]
add rcx, r14
call fcn.140001470
mov rbx, rax
mov esi, r12d
mov dword [rsp + 0x38], r12d
test rax, rax
je 0x140003941
nop
mov qword [rbp + 0x338], r12
mov qword [rbp + 0x340], 0xf
mov byte [rbp + 0x328], 0
mov rax, qword [0x1400cb6b0]
test rax, rax
cmove rax, rbx
mov qword [0x1400cb6b0], rax
add rax, 0x10000
cmp rbx, rax
ja 0x1400038d6
mov qword [rbp + 0x2d4], r12
mov dword [rbp + 0x2dc], r12d
mov dword [rbp + 0x2b8], 0x64
mov eax, dword [0x1400cb654]
mov dword [rbp + 0x2bc], eax
lea rax, [r14 + 2]
add rax, rbx
mov qword [rbp + 0x2c0], rax
lea rax, [rbp + 0x190]
mov qword [rbp + 0x2c8], rax
mov dword [rbp + 0x2d0], 0xff
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rbp + 0x2d4], eax
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x348]
mov r8d, 0x29
lea rdx, [rbp + 0x2b8]
mov rcx, qword [0x1400cb690]
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x190]
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx - 0x10], xmm1
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x60], xmm0
mov rax, qword [rcx + 0x70]
mov qword [rdx + 0x70], rax
mov eax, dword [rcx + 0x78]
mov dword [rdx + 0x78], eax
movzx eax, word [rcx + 0x7c]
mov word [rdx + 0x7c], ax
movzx eax, byte [rcx + 0x7e]
mov byte [rdx + 0x7e], al
mov qword [rbp + 0x2a0], r12
mov qword [rbp + 0x2a8], 0xf
mov byte [rbp + 0x290], 0
lea rax, [rbp + 0x90]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140003710
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x290]
call fcn.140005340
mov rdx, qword [rbp + 0x340]
cmp rdx, 0x10
jb 0x14000376e
inc rdx
mov rcx, qword [rbp + 0x328]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003769
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400039e1
call fcn.140008188
movups xmm0, xmmword [rbp + 0x290]
movups xmmword [rbp + 0x328], xmm0
movups xmm1, xmmword [rbp + 0x2a0]
movups xmmword [rbp + 0x338], xmm1
mov r13, qword [rdi]
mov rbx, r13
mov rdi, qword [r13 + 8]
mov r15, qword [rbp + 0x2a8]
mov r14, qword [rbp + 0x2a0]
mov r12, qword [rbp + 0x290]
cmp byte [rdi + 0x19], 0
jne 0x140003816
nop
lea rdx, [rbp + 0x328]
cmp r15, 0x10
cmovae rdx, r12
lea rcx, [rdi + 0x20]
cmp qword [rdi + 0x38], 0x10
jb 0x1400037ce
mov rcx, qword [rdi + 0x20]
mov rsi, qword [rdi + 0x30]
mov r8, rsi
cmp r14, rsi
cmovb r8, r14
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400037f9
cmp rsi, r14
jae 0x1400037f1
mov eax, 0xffffffff
jmp 0x1400037f9
xor eax, eax
cmp rsi, r14
seta al
shr eax, 0x1f
test al, al
je 0x140003806
mov rdi, qword [rdi + 0x10]
jmp 0x14000380c
mov rbx, rdi
mov rdi, qword [rdi]
cmp byte [rdi + 0x19], 0
je 0x1400037b0
mov esi, dword [rsp + 0x38]
cmp rbx, r13
je 0x140003872
lea rdx, [rbx + 0x20]
cmp qword [rbx + 0x38], 0x10
jb 0x14000382a
mov rdx, qword [rbx + 0x20]
lea rcx, [rbp + 0x328]
cmp r15, 0x10
cmovae rcx, r12
mov rdi, qword [rbx + 0x30]
mov r8, r14
cmp rdi, r14
cmovb r8, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140003864
cmp r14, rdi
jae 0x14000385c
mov eax, 0xffffffff
jmp 0x140003864
xor eax, eax
cmp r14, rdi
seta al
shr eax, 0x1f
test al, al
jne 0x140003872
mov rdi, qword [rsp + 0x48]
jmp 0x1400038ba
lea rax, [rbp + 0x328]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, [0x14000a440]
mov rdi, qword [rsp + 0x48]
mov rcx, rdi
call fcn.140001570
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.140001850
mov rbx, qword [rsp + 0x50]
movsxd rdx, esi
mov ecx, dword [rbp + 0x320]
mov r14, qword [rsp + 0x58]
add rcx, r14
lea rax, [rcx + rdx*8]
mov qword [rbx + 0x40], rax
xor r12d, r12d
inc esi
mov dword [rsp + 0x38], esi
movsxd rax, esi
mov ecx, dword [rsp + 0x60]
lea rcx, [rcx + rax*8]
add rcx, r14
call fcn.140001470
mov rbx, rax
mov rdx, qword [rbp + 0x340]
cmp rdx, 0x10
jb 0x140003933
inc rdx
mov rcx, qword [rbp + 0x328]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000392e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400039e8
call fcn.140008188
test rbx, rbx
jne 0x140003580
mov r15d, dword [rsp + 0x34]
inc r15d
mov dword [rsp + 0x34], r15d
mov qword [rbp + 0x2fc], r12
mov dword [rbp + 0x304], r12d
mov dword [rbp + 0x2e0], 0x64
mov eax, dword [0x1400cb654]
mov dword [rbp + 0x2e4], eax
movsxd rax, r15d
lea rcx, [rax + rax*4]
mov eax, dword [rbp + 0x18]
lea rax, [rax + rcx*4]
add rax, r14
mov qword [rbp + 0x2e8], rax
lea rax, [rbp + 0x328]
mov qword [rbp + 0x2f0], rax
mov dword [rbp + 0x2f8], 0x14
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rbp + 0x2fc], eax
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x34c]
mov r8d, 0x29
lea rdx, [rbp + 0x2e0]
mov rcx, qword [0x1400cb690]
call qword [sym.imp.KERNEL32.dll_WriteFile]
movups xmm0, xmmword [rbp + 0x328]
mov ecx, dword [rbp + 0x338]
jmp 0x14000353d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, rdi
mov rcx, qword [rbp + 0x350]
xor rcx, rsp
call fcn.1400085d0
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x460
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret