Function at 0x140142a50
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 8]
mov rdi, r8
mov rsi, rdx
and dword [rbx + 0x40], 0xfdffffff
cmp dword [rbx + 0xa4], 2
je 0x140142a89
mov rax, qword [rcx]
call qword [rax + 0x18]
mov dword [rbx + 0xa4], 2
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x14015e1c0
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov r14, qword [rcx + 0x18]
mov rdi, r8
mov rbp, rdx
mov rsi, rcx
test r8, r8
js 0x140142be5
xor ebx, ebx
test r8, r8
je 0x140142bd9
cmp qword [rcx + 0x78], rbx
je 0x140142b2d
nop dword [rax]
mov r9, qword [rsi + 0x78]
lea rcx, [rbx + rbp]
mov r8, rdi
mov edx, 1
sub r8, rbx
call fcn.1401ca874
add rbx, rax
test rax, rax
jne 0x140142b1f
call fcn.1401c934c
xor ecx, ecx
cmp dword [rax], 4
sete cl
jmp 0x140142b27
xor ecx, ecx
cmp rbx, rdi
setl cl
test ecx, ecx
jne 0x140142af0
jmp 0x140142b70
cmp dword [rcx + 0xa0], 0xffffffff
je 0x140142b75
nop word [rax + rax]
mov ecx, dword [rsi + 0xa0]
lea rdx, [rbx + rbp]
mov r8d, 0x7fffffff
mov rax, rdi
sub rax, rbx
cmp rax, r8
cmovb r8d, eax
call fcn.1401cb4dc
test eax, eax
jle 0x140142b70
cdqe
add rbx, rax
cmp rbx, rdi
jl 0x140142b40
test rbx, rbx
jne 0x140142bd9
mov rbx, 0xffffffffffffffff
call fcn.1401c934c
mov edx, ebx
lea rcx, [rsp + 0x40]
mov rdi, rax
call fcn.140192b70
cmp dword [rdi], 0x1c
mov r8, rax
mov eax, 4
mov edx, 2
cmove edx, eax
mov rcx, r14
call fcn.14015c0f0
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx]
test eax, eax
je 0x140142bc6
cmp eax, ebx
je 0x140142be0
sub eax, 1
mov dword [rcx], eax
jne 0x140142be0
mov rcx, qword [rsp + 0x40]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140143660
mov rax, rbx
jmp 0x140142c35
and dword [rsi + 0x40], 0xffdfffff
mov rax, rbx
jmp 0x140142c35
mov edx, 0x16
lea rcx, [rsp + 0x40]
call fcn.140192b70
mov r8, rax
mov edx, 2
mov rcx, r14
call fcn.14015c0f0
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx]
test eax, eax
je 0x140142c20
cmp eax, 0xffffffff
je 0x140142c2e
sub eax, 1
mov dword [rcx], eax
jne 0x140142c2e
mov rcx, qword [rsp + 0x40]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140143660
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
push rbp
push rsi
push r14
push r15
sub rsp, 0x38
cmp qword [rcx + 0x78], 0
mov rbp, r8
mov r15, qword [rcx + 0x18]
mov r14, rdx
mov rsi, rcx
jne 0x14015e2cf
cmp dword [rcx + 0xa0], 0xffffffff
jne 0x14015e2cf
cmp qword [rcx + 0x80], 0xffffffffffffffff
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x30], r12
je 0x14015e2c6
xor r12d, r12d
mov rdi, r8
mov ebx, r12d
nop word [rax + rax]
mov rcx, qword [rsi + 0x80]
lea rdx, [rbx + r14]
mov r8d, 0x2000000
mov qword [rsp + 0x20], r12
cmp rdi, r8
lea r9, [rsp + 0x60]
cmovl r8d, edi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14015e27c
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x14015e25f
add rbx, rax
sub rdi, rax
cmp rbx, rbp
jl 0x14015e220
mov rax, rbx
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x68]
mov r12, qword [rsp + 0x30]
add rsp, 0x38
pop r15
pop r14
pop rsi
pop rbp
ret
test rbx, rbx
jne 0x14015e25f
lea edx, [rbx - 1]
lea rcx, [rsp + 0x78]
call fcn.140192a00
mov r8, rax
lea edx, [rbx + 2]
mov rcx, r15
call fcn.14015c0f0
mov rcx, qword [rsp + 0x78]
mov eax, dword [rcx]
test eax, eax
je 0x14015e2b8
cmp eax, 0xffffffff
je 0x14015e2c6
sub eax, 1
mov dword [rcx], eax
jne 0x14015e2c6
mov rcx, qword [rsp + 0x78]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140143660
mov rax, 0xffffffffffffffff
jmp 0x14015e262
add rsp, 0x38
pop r15
pop r14
pop rsi
pop rbp
jmp 0x140142ab0