Function at 0x14001d3a0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov qword [rsp + 0x28], rdx
movsxd rax, dword [rcx + 4]
test rax, rax
jle 0x14001d6dd
mov rdi, rcx
lea rbx, [rcx + rax + 0xc]
movabs r15, 0xffffffff00000000
add rdi, 0xc
xor esi, esi
lea r14, [0x140026af4]
lea r12, [0x140028070]
jmp 0x14001d439
mov ecx, 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
mov qword [rsp + 0x20], 0
mov rcx, rax
lea rdx, [0x140027794]
mov r8d, 1
lea r9, [rsp + 0x38]
nop word cs:[rax + rax]
nop dword [rax]
call sub.KERNEL32.dll_WriteFile
inc esi
jo 0x14001d6ee
inc rdi
cmp rdi, rbx
jae 0x14001d6dd
xor eax, eax
nop dword [rax + rax]
cmp byte [rdi + rax], 0x25
je 0x14001d460
lea rcx, [rdi + rax + 1]
inc rax
cmp rcx, rbx
jb 0x14001d440
add rax, rdi
mov r13, rax
jmp 0x14001d469
lea r13, [rdi + rax]
test rax, rax
je 0x14001d4a5
mov rbp, r13
sub rbp, rdi
lea rax, [rbp - 0x80000000]
cmp rax, r15
jb 0x14001d6ee
mov ecx, 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
mov qword [rsp + 0x20], 0
mov rcx, rax
mov rdx, rdi
mov r8d, ebp
lea r9, [rsp + 0x50]
call sub.KERNEL32.dll_WriteFile
cmp byte [r13 + 1], 0x6c
jne 0x14001d4d0
lea rdi, [r13 + 2]
lea rax, [r13 + 3]
cmp byte [r13 + 2], 0x6c
cmove rdi, rax
cmp rdi, rbx
jb 0x14001d4dd
jmp 0x14001d6dd
lea rdi, [r13 + 1]
cmp rdi, rbx
jae 0x14001d6dd
movzx eax, byte [rdi]
add eax, 0xffffff9c
cmp eax, 0x14
ja case.0x14001d4ef.101
movsxd rax, dword [r14 + rax*4]
add rax, r14
jmp rax
mov eax, esi
shr eax, 0x1f
add eax, esi
jne 0x14001d6f3
mov ecx, 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
mov qword [rsp + 0x20], 0
mov rcx, rax
lea rdx, str._____
mov r8d, 5
lea r9, [rsp + 0x48]
jmp 0x14001d420
mov rbp, rdi
sub rbp, r13
lea rax, [rbp - 0x7fffffff]
cmp rax, r15
jb 0x14001d6ee
inc rbp
mov ecx, 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
mov qword [rsp + 0x20], 0
mov rcx, rax
mov rdx, r13
mov r8d, ebp
lea r9, [rsp + 0x30]
call sub.KERNEL32.dll_WriteFile
inc rdi
cmp rdi, rbx
jb 0x14001d439
jmp 0x14001d6dd
mov eax, esi
shr eax, 0x1f
add eax, esi
jne 0x14001d6f3
mov ecx, 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
mov qword [rsp + 0x20], 0
mov rcx, rax
lea rdx, str._____
mov r8d, 5
lea r9, [rsp + 0x4c]
jmp 0x14001d420
mov eax, esi
shr eax, 0x1f
add eax, esi
jne 0x14001d6f3
mov ecx, 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
mov qword [rsp + 0x20], 0
mov rcx, rax
lea rdx, [0x140027884]
mov r8d, 2
lea r9, [rsp + 0x3c]
call sub.KERNEL32.dll_WriteFile
mov rdx, qword [rsp + 0x28]
test rdx, rdx
je 0x14001d3ea
lea rax, [rsp + 0x67]
xor r13d, r13d
mov rcx, rdx
nop dword [rax + rax]
mov r8d, edx
and r8d, 0xf
movzx r8d, byte [r8 + r12 + 0xc]
mov byte [rax], r8b
shr rcx, 4
inc r13
dec rax
cmp rdx, 0xf
mov rdx, rcx
ja 0x14001d610
lea rax, [r13 - 0x80000000]
cmp rax, r15
jb 0x14001d6ee
lea rbp, [rsp + 0x68]
sub rbp, r13
mov ecx, 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
mov qword [rsp + 0x20], 0
mov rcx, rax
mov rdx, rbp
mov r8d, r13d
lea r9, [rsp + 0x34]
jmp 0x14001d420
mov eax, esi
shr eax, 0x1f
add eax, esi
jne 0x14001d6f3
mov ecx, 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
mov qword [rsp + 0x20], 0
mov rcx, rax
lea rdx, str._____
mov r8d, 5
lea r9, [rsp + 0x44]
jmp 0x14001d420
mov eax, esi
shr eax, 0x1f
add eax, esi
jne 0x14001d6f3
mov ecx, 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
mov qword [rsp + 0x20], 0
mov rcx, rax
lea rdx, str._____
mov r8d, 5
lea r9, [rsp + 0x40]
jmp 0x14001d420
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.140003430
call fcn.1400053c0
mov rcx, rax
call fcn.140005420
int3