Function at 0x14000f1a4
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
lea rbp, [rax - 0x2a8]
sub rsp, 0x3a0
cmp dword [rbp + 0x2d0], 3
mov esi, r9d
mov r12, r8
mov ebx, edx
mov rdi, rcx
je 0x14000f46b
cmp dword [rbp + 0x2d0], 2
je 0x14000f1fa
cmp dword [rbp + 0x2d0], 1
je 0x14000f1fa
mov eax, 0x10000
jmp 0x14000f514
cmp dword [rcx + 8], 0xffffffff
je 0x14000f208
mov rcx, qword [rcx]
call fcn.14000cf4c
mov rcx, qword [rdi]
or dword [rdi + 8], 0xffffffff
cmp ebx, dword [rcx + 8]
jge 0x14000f1f0
cmp ebx, dword [rcx + 0x14]
jge 0x14000f21e
call fcn.14000cca8
mov rax, qword [rdi]
cmp dword [rax + 0x14], ebx
jge 0x14000f237
mov rcx, qword [rdi]
call fcn.14000cd04
mov r11, qword [rdi]
cmp dword [r11 + 0x14], ebx
jl 0x14000f226
lea r8, [rbp + 0x60]
mov edx, ebx
mov rcx, rdi
call fcn.14000d118
test byte [rbp + 0x168], 0x10
je 0x14000f291
cmp dword [rbp + 0x2d0], 1
je 0x14000f4f5
cmp byte [r12], 0x2f
je 0x14000f282
cmp byte [r12], 0x5c
je 0x14000f282
xor esi, esi
cmp byte [r12], sil
je 0x14000f279
cmp byte [r12 + 1], 0x3a
je 0x14000f282
lea rcx, [rdi + 0x150]
jmp 0x14000f284
xor ecx, ecx
mov rdx, r12
call fcn.14000d664
jmp 0x14000f4f5
xor esi, esi
cmp dword [rbp + 0x2d0], 1
je 0x14000f38b
mov al, byte [r12]
mov r9, r12
mov rcx, r12
jmp 0x14000f2bd
cmp al, 0x2f
je 0x14000f2b4
cmp al, 0x5c
jne 0x14000f2b8
lea r9, [rcx + 1]
inc rcx
mov al, byte [rcx]
test al, al
jne 0x14000f2ac
lea rdx, [rsp + 0x50]
mov rcx, r12
sub rdx, r12
mov al, byte [rcx]
mov byte [rdx + rcx], al
inc rcx
test al, al
jne 0x14000f2cc
cmp r9, r12
jne 0x14000f2e4
mov byte [rsp + 0x50], sil
jmp 0x14000f306
mov rax, r9
sub rax, r12
mov byte [rsp + rax + 0x50], sil
mov al, byte [rsp + 0x50]
cmp al, 0x2f
je 0x14000f334
cmp al, 0x5c
je 0x14000f334
test al, al
je 0x14000f306
cmp byte [rsp + 0x51], 0x3a
je 0x14000f334
mov qword [rsp + 0x20], r9
lea r8, [rdi + 0x150]
lea rdx, [0x14006e47c]
lea r9, [rsp + 0x50]
lea rcx, [rbp + 0x190]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rdi + 0x150]
jmp 0x14000f34f
lea r8, [rsp + 0x50]
lea rdx, str._s_s
lea rcx, [rbp + 0x190]
call qword [sym.imp.USER32.dll_wsprintfA]
xor ecx, ecx
lea rdx, [rsp + 0x50]
call fcn.14000d664
mov eax, dword [rbp + 0x168]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], eax
lea rcx, [rbp + 0x190]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r12, rax
cmp r12, 0xffffffffffffffff
jne 0x14000f39b
mov eax, 0x200
jmp 0x14000f514
mov rdx, qword [rdi + 0x140]
mov rcx, qword [rdi]
call fcn.14000ec18
cmp qword [rdi + 0x148], rsi
jne 0x14000f3c4
mov ecx, 0x4000
call fcn.14004e114
mov qword [rdi + 0x148], rax
mov rdx, qword [rdi + 0x148]
mov rcx, qword [rdi]
lea r9, [rsp + 0x40]
mov r8d, 0x4000
call fcn.14000ee10
mov ebx, eax
cmp eax, 0xffffff96
je 0x14000f445
test eax, eax
js 0x14000f417
jle 0x14000f40c
mov rdx, qword [rdi + 0x148]
lea r9, [rsp + 0x44]
mov r8d, eax
mov rcx, r12
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000f41e
cmp byte [rsp + 0x40], sil
jne 0x14000f425
test ebx, ebx
jne 0x14000f3c4
mov esi, 0x5000000
jmp 0x14000f44a
mov esi, 0x400
jmp 0x14000f44a
lea r9, [rbp + 0x17c]
lea r8, [rbp + 0x16c]
lea rdx, [rbp + 0x174]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x14000f44a
mov esi, 0x1000
cmp dword [rbp + 0x2d0], 1
je 0x14000f45c
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi]
call fcn.14000cf4c
mov eax, esi
jmp 0x14000f514
cmp edx, dword [rcx + 8]
je 0x14000f4c3
cmp dword [rcx + 8], 0xffffffff
je 0x14000f47e
mov rcx, qword [rcx]
call fcn.14000cf4c
mov rcx, qword [rdi]
or dword [rdi + 8], 0xffffffff
cmp ebx, dword [rcx + 8]
jge 0x14000f1f0
cmp ebx, dword [rcx + 0x14]
jge 0x14000f498
call fcn.14000cca8
mov rax, qword [rdi]
cmp dword [rax + 0x14], ebx
jge 0x14000f4b1
mov rcx, qword [rdi]
call fcn.14000cd04
mov r11, qword [rdi]
cmp dword [r11 + 0x14], ebx
jl 0x14000f4a0
mov rdx, qword [rdi + 0x140]
mov rcx, qword [rdi]
call fcn.14000ec18
mov dword [rdi + 8], ebx
mov rcx, qword [rdi]
lea r9, [rbp + 0x2d0]
mov r8d, esi
mov rdx, r12
call fcn.14000ee10
xor esi, esi
mov ebx, eax
test eax, eax
jg 0x14000f4ec
mov rcx, qword [rdi]
call fcn.14000cf4c
or dword [rdi + 8], 0xffffffff
cmp byte [rbp + 0x2d0], sil
je 0x14000f4f9
xor eax, eax
jmp 0x14000f514
test ebx, ebx
jle 0x14000f504
mov eax, 0x600
jmp 0x14000f514
mov eax, 0x5000000
mov ecx, 0x1000
cmp ebx, 0xffffff96
cmove eax, ecx
lea r11, [rsp + 0x3a0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r12, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret