Function at 0x1400ad20c
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3fd0]
mov eax, 0x40d0
call fcn.140101610
sub rsp, rax
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x4120], rbx
mov rax, qword [0x140192630]
xor rax, rsp
mov qword [rbp + 0x3fc0], rax
mov r14, rdx
mov rdi, rcx
mov qword [rsp + 0x60], rcx
call fcn.14006ebf0
nop
xor r13d, r13d
mov byte [rdi + 0x3038], r13b
mov r15d, 0x800
mov r9d, r15d
lea r8, [rbp + 0xfc0]
lea rdx, [rbp + 0x1fc0]
lea rcx, [0x1401c9200]
call fcn.1400b2f34
lea rcx, [rbp + 0x1fc0]
call fcn.140070448
test al, al
jne 0x1400ad2a5
mov word [rbp + 0x1fc0], r13w
lea rcx, [rbp + 0xfc0]
call fcn.140070448
test al, al
jne 0x1400ad2bd
mov word [rbp + 0xfc0], r13w
mov word [rbp + 0x2fc0], r13w
lea rdx, [r14 + 0x852a]
cmp word [rdx], r13w
je 0x1400ad2e1
mov r8, r15
lea rcx, [rbp + 0x1fc0]
call fcn.140096ef0
lea rdx, [r14 + 0x952a]
cmp word [rdx], r13w
je 0x1400ad2fd
mov r8, r15
lea rcx, [rbp + 0xfc0]
call fcn.140096ef0
lea rdx, [r14 + 0xa52a]
cmp word [rdx], r13w
je 0x1400ad319
mov r8, r15
lea rcx, [rbp + 0x2fc0]
call fcn.140096ef0
cmp word [rbp + 0xfc0], 0x2a
jne 0x1400ad335
cmp word [rbp + 0xfc2], r13w
jne 0x1400ad335
mov word [rbp + 0xfc0], r13w
lea rbx, [r14 + 0x1018]
mov rcx, rbx
call fcn.1400810ec
mov rcx, rax
mov r8d, 6
lea rdx, str.WinCon
call fcn.14009a02c
test eax, eax
jne 0x1400ad375
movzx eax, r13w
mov word [rbp + 0x2fc0], ax
movzx ecx, r13w
mov word [rbp + 0xfc0], cx
jmp 0x1400ad383
movzx ecx, word [rbp + 0xfc0]
movzx eax, word [rbp + 0x2fc0]
lea rsi, [rdi + 0x1030]
mov word [rsi], r13w
cmp word [rbx], r13w
je 0x1400ad786
cmp word [rbp + 0x1fc0], r13w
jne 0x1400ad3b9
test cx, cx
jne 0x1400ad3b9
test ax, ax
jne 0x1400ad3b9
cmp byte [r14 + 0xb52a], r13b
je 0x1400ad786
mov rcx, rbx
call fcn.140070448
test al, al
je 0x1400ad786
lea rcx, [rdi + 0x2030]
mov r8, r15
mov rdx, rbx
call fcn.140096ef0
mov qword [rdi + 0x3030], rbx
mov r8, r15
mov rdx, rsi
lea rcx, str.Rar_SF
call fcn.1400d0414
mov r15, rax
test rax, rax
je 0x1400ad761
mov rdx, rbx
mov rcx, rdi
call fcn.1400ae814
test al, al
je 0x1400ad437
mov ecx, 0x5f5
call fcn.140090e20
mov rcx, rax
call fcn.1400d63e4
mov edx, 1
lea rcx, [0x1401d5778]
call fcn.140069e78
jmp 0x1400ad761
mov r8, r15
mov rdx, rbx
mov rcx, rdi
call fcn.1400adf50
test al, al
je 0x1400ad786
mov rcx, r15
call fcn.1401280c8
mov edx, 0x10000
lea rcx, [rsp + 0x30]
call fcn.140004d50
nop
mov r9, qword [rsp + 0x38]
mov r8, qword [rsp + 0x30]
mov rdx, rbx
mov rcx, rdi
call fcn.1400aed9c
mov qword [rsp + 0x28], rax
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov r15, rax
test rax, rax
jne 0x1400ad4a1
lea rcx, [rsp + 0x30]
call fcn.14000a788
jmp 0x1400ad786
mov byte [rsp + 0x20], r13b
mov r12b, r13b
xor edx, edx
lea r8d, [rdx + 3]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r13, rax
xor edx, edx
test rax, rax
je 0x1400ad623
movzx eax, word [rbp + 0x1fc0]
test ax, ax
je 0x1400ad52b
mov r9, r15
lea r8, [0x1400ae180]
mov edx, 3
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
mov r9, r15
lea r8, [0x1400ae180]
mov edx, 0xe
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
mov r9d, reloc.SHELL32.dll_SHRestricted
lea r8, [rbp + 0x1fc0]
mov rdx, r15
mov rcx, rdi
call fcn.1400ada0c
mov cl, al
mov byte [rsp + 0x20], al
movzx eax, word [rbp + 0x1fc0]
xor edx, edx
jmp 0x1400ad52d
mov cl, dl
cmp word [rbp + 0xfc0], dx
jne 0x1400ad543
cmp word [rbp + 0x2fc0], dx
je 0x1400ad61a
test ax, ax
je 0x1400ad550
test cl, cl
je 0x1400ad61a
lea rdx, [0x140158568]
lea rcx, [rbp + 0xfc0]
call fcn.14007f744
test al, al
jne 0x1400ad57e
lea rdx, [0x140158568]
lea rcx, [rbp + 0x2fc0]
call fcn.14007f744
test al, al
je 0x1400ad596
mov r9, r15
lea r8, [0x1400ae180]
mov edx, 2
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
mov r9, r15
lea r8, [0x1400ae180]
lea rdx, [0x140158570]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
xor eax, eax
cmp word [rbp + 0xfc0], ax
je 0x1400ad5f6
lea rdx, [0x140158568]
lea rcx, [rbp + 0xfc0]
call fcn.14007f744
mov r9d, 0x65
lea r8, [rbp + 0xfc0]
mov rdx, r15
mov rcx, rdi
test al, al
je 0x1400ad5ec
call fcn.1400ad878
jmp 0x1400ad5f1
call fcn.1400adc6c
mov r12b, al
xor eax, eax
cmp word [rbp + 0x2fc0], ax
je 0x1400ad61a
mov r9d, 0x66
lea r8, [rbp + 0x2fc0]
mov rdx, r15
mov rcx, rdi
call fcn.1400adc6c
or r12b, al
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
xor r13d, r13d
test eax, eax
je 0x1400ad492
cmp word [rbp + 0xfc0], r13w
je 0x1400ad64c
test r12b, r12b
je 0x1400ad492
cmp byte [rsp + 0x20], r13b
jne 0x1400ad665
test r12b, r12b
jne 0x1400ad665
cmp byte [r14 + 0xb52a], r13b
je 0x1400ad6f0
cmp byte [r14 + 0xb52a], r13b
je 0x1400ad679
mov rdx, rsi
mov rcx, rdi
call fcn.1400adffc
mov qword [rbp + 0xf80], r13
mov qword [rbp + 0xf88], r13
mov qword [rbp + 0xf90], r13
xor r8d, r8d
lea rdx, [rsp + 0x70]
mov rcx, rsi
call fcn.14007194c
mov r14, qword [rsp + 0x28]
test al, al
je 0x1400ad6dd
mov rcx, qword [rbp + 0xf70]
add rcx, r14
mov r15d, 0x200000
cmp rcx, r15
jbe 0x1400ad6dd
mov ecx, 0x5a0
call fcn.140090e20
mov rdx, rax
mov r8d, r15d
lea rcx, [0x1401b6732]
call fcn.1400d6c94
jmp 0x1400ad492
mov r8d, 0x800
mov rdx, rsi
mov rcx, rbx
call fcn.140096ef0
jmp 0x1400ad6f5
mov r14, qword [rsp + 0x28]
test r14, r14
je 0x1400ad757
mov r9, qword [rsp + 0x38]
mov r8, qword [rsp + 0x30]
mov rdx, rsi
mov rcx, rdi
call fcn.1400aed9c
test rax, rax
jne 0x1400ad757
lea rdx, [0x140158578]
mov rcx, rsi
call fcn.1400d0e50
mov rbx, rax
test rax, rax
je 0x1400ad757
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, rax
call fcn.14012b8d4
mov r9, rbx
mov r8, r14
mov edx, 1
mov rcx, qword [rsp + 0x30]
call fcn.140128494
mov rcx, rbx
call fcn.1401280c8
nop
lea rcx, [rsp + 0x30]
call fcn.14000a788
cmp word [rsi], r13w
je 0x1400ad786
mov rcx, qword [rdi]
mov rbx, qword [rcx + 8]
mov rcx, rbx
call qword [fcn.140016c20]
mov r8d, 4
mov rdx, rsi
mov rcx, rdi
call rbx
nop
mov rax, rdi
mov rcx, qword [rbp + 0x3fc0]
xor rcx, rsp
call fcn.140101680
mov rbx, qword [rsp + 0x4120]
add rsp, 0x40d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret