Function at 0x14002b010
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x6d0
mov rax, qword [0x1400bc0f8]
xor rax, rsp
mov qword [rsp + 0x6c0], rax
mov r15d, dword [rsp + 0x720]
mov r12d, r9d
mov r14, r8
mov ebp, edx
mov rdi, rcx
lea eax, [r15 - 2]
cmp eax, 1
jbe 0x14002b0b1
cmp r15d, 1
jne 0x14002b080
mov eax, dword [rcx + 8]
cmp eax, 0xffffffff
je 0x14002b06d
mov rcx, qword [rcx]
call fcn.14002dd10
mov rbx, qword [rdi]
mov dword [rdi + 8], 0xffffffff
cmp ebp, dword [rbx + 8]
jl 0x14002b1bd
mov eax, 0x10000
mov rcx, qword [rsp + 0x6c0]
xor rcx, rsp
call fcn.14003fb10
lea r11, [rsp + 0x6d0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov eax, dword [rcx + 8]
cmp r15d, 3
jne 0x14002b060
cmp ebp, eax
je 0x14002b167
cmp eax, 0xffffffff
je 0x14002b0cf
mov rcx, qword [rcx]
call fcn.14002dd10
mov rcx, qword [rdi]
mov dword [rdi + 8], 0xffffffff
cmp ebp, dword [rcx + 8]
jge 0x14002b080
cmp ebp, dword [rcx + 0x14]
jge 0x14002b0e8
call fcn.14002ddb0
mov rbx, qword [rdi]
cmp dword [rbx + 0x14], ebp
jge 0x14002b155
xor esi, esi
test rbx, rbx
je 0x14002b14d
cmp dword [rbx + 0x1c], esi
je 0x14002b14d
mov edx, dword [rbx + 0x14]
inc edx
cmp edx, dword [rbx + 8]
je 0x14002b14d
mov ecx, dword [rbx + 0x54]
lea r8, [rbx + 0x7c]
add ecx, dword [rbx + 0x50]
xor r9d, r9d
mov eax, dword [rbx + 0x4c]
mov dword [rsp + 0x40], esi
add eax, 0x2e
add ecx, eax
mov qword [rsp + 0x38], rsi
add dword [rbx + 0x18], ecx
mov rcx, rbx
mov dword [rbx + 0x14], edx
lea rdx, [rbx + 0x2c]
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
call fcn.14002e9b0
mov ecx, esi
test eax, eax
sete cl
mov dword [rbx + 0x1c], ecx
mov rbx, qword [rdi]
cmp dword [rbx + 0x14], ebp
jl 0x14002b0f2
mov rdx, qword [rdi + 0x240]
mov rcx, rbx
call fcn.14002de10
mov dword [rdi + 8], ebp
mov rcx, qword [rdi]
lea r9, [rsp + 0x50]
mov r8d, r12d
mov rdx, r14
call fcn.14002e380
mov ebx, eax
test eax, eax
jg 0x14002b18f
mov rcx, qword [rdi]
call fcn.14002dd10
mov dword [rdi + 8], 0xffffffff
cmp byte [rsp + 0x50], 0
jne 0x14002b2cd
test ebx, ebx
jle 0x14002b1a8
mov eax, 0x600
jmp 0x14002b085
cmp ebx, 0xffffff96
mov eax, 0x5000000
mov ecx, 0x1000
cmove eax, ecx
jmp 0x14002b085
xor esi, esi
cmp ebp, dword [rbx + 0x14]
jge 0x14002b205
test rbx, rbx
je 0x14002b205
mov eax, dword [rbx + 0x28]
lea r8, [rbx + 0x7c]
mov dword [rsp + 0x40], esi
lea rdx, [rbx + 0x2c]
mov qword [rsp + 0x38], rsi
xor r9d, r9d
mov dword [rsp + 0x30], esi
mov rcx, rbx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
mov dword [rbx + 0x18], eax
mov dword [rbx + 0x14], esi
call fcn.14002e9b0
mov ecx, esi
test eax, eax
sete cl
mov dword [rbx + 0x1c], ecx
mov rbx, qword [rdi]
cmp dword [rbx + 0x14], ebp
jge 0x14002b273
nop dword [rax]
test rbx, rbx
je 0x14002b26b
cmp dword [rbx + 0x1c], esi
je 0x14002b26b
mov edx, dword [rbx + 0x14]
inc edx
cmp edx, dword [rbx + 8]
je 0x14002b26b
mov ecx, dword [rbx + 0x54]
lea r8, [rbx + 0x7c]
add ecx, dword [rbx + 0x50]
xor r9d, r9d
mov eax, dword [rbx + 0x4c]
mov dword [rsp + 0x40], esi
add eax, 0x2e
add ecx, eax
mov qword [rsp + 0x38], rsi
add dword [rbx + 0x18], ecx
mov rcx, rbx
mov dword [rbx + 0x14], edx
lea rdx, [rbx + 0x2c]
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
call fcn.14002e9b0
mov ecx, esi
test eax, eax
sete cl
mov dword [rbx + 0x1c], ecx
mov rbx, qword [rdi]
cmp dword [rbx + 0x14], ebp
jl 0x14002b210
lea r8, [rsp + 0x60]
mov edx, ebp
mov rcx, rdi
call fcn.14002a540
test byte [rsp + 0x26c], 0x10
je 0x14002b2d4
cmp r15d, 1
je 0x14002b2cd
movzx eax, word [r14]
cmp ax, 0x2f
je 0x14002b2b3
cmp ax, 0x5c
je 0x14002b2b3
test ax, ax
je 0x14002b2af
cmp word [r14 + 2], 0x3a
je 0x14002b2b3
xor cl, cl
jmp 0x14002b2b5
mov cl, 1
test cl, cl
lea rax, [rdi + 0x250]
mov rdx, r14
cmove rsi, rax
mov rcx, rsi
call fcn.14002a3d0
xor eax, eax
jmp 0x14002b085
cmp r15d, 1
je 0x14002b415
movzx ecx, word [r14]
mov r9, r14
mov rax, r14
test cx, cx
je 0x14002b311
nop dword [rax]
cmp cx, 0x2f
je 0x14002b302
cmp cx, 0x5c
je 0x14002b302
add rax, 2
jmp 0x14002b309
lea r9, [rax + 2]
mov rax, r9
movzx ecx, word [rax]
test cx, cx
jne 0x14002b2f0
lea rdx, [rsp + 0x2a0]
mov rcx, r14
sub rdx, r14
nop
movzx eax, word [rcx]
mov word [rdx + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x14002b320
cmp r9, r14
jne 0x14002b33f
mov word [rsp + 0x2a0], si
jmp 0x14002b383
mov rax, r9
sub rax, r14
sar rax, 1
add rax, rax
cmp rax, 0x208
jae 0x14002b4fa
mov word [rsp + rax + 0x2a0], si
movzx eax, word [rsp + 0x2a0]
cmp ax, 0x2f
je 0x14002b3b1
cmp ax, 0x5c
je 0x14002b3b1
test ax, ax
je 0x14002b383
cmp word [rsp + 0x2a2], 0x3a
je 0x14002b3b1
mov qword [rsp + 0x20], r9
lea rbx, [rdi + 0x250]
mov r8, rbx
lea r9, [rsp + 0x2a0]
lea rdx, str._s_s_s
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x14002b3d1
lea r8, [rsp + 0x2a0]
lea rdx, str._s_s
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rbx, rsi
lea rdx, [rsp + 0x2a0]
mov rcx, rbx
call fcn.14002a3d0
mov eax, dword [rsp + 0x26c]
lea rcx, [rsp + 0x4b0]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp r14, 0xffffffffffffffff
jne 0x14002b425
mov eax, 0x200
jmp 0x14002b085
mov rdx, qword [rdi + 0x240]
mov rcx, qword [rdi]
call fcn.14002de10
cmp qword [rdi + 0x248], rsi
jne 0x14002b450
mov ecx, 0x4000
call fcn.14003f754
mov qword [rdi + 0x248], rax
nop
mov rdx, qword [rdi + 0x248]
lea r9, [rsp + 0x50]
mov rcx, qword [rdi]
mov r8d, 0x4000
call fcn.14002e380
mov ebx, eax
cmp eax, 0xffffff96
je 0x14002b4d7
test eax, eax
js 0x14002b4a6
jle 0x14002b49b
mov rdx, qword [rdi + 0x248]
lea r9, [rsp + 0x290]
mov r8d, eax
mov qword [rsp + 0x20], rsi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14002b4ad
cmp byte [rsp + 0x50], sil
jne 0x14002b4b4
test ebx, ebx
jne 0x14002b450
mov esi, 0x5000000
jmp 0x14002b4dc
mov esi, 0x400
jmp 0x14002b4dc
lea r9, [rsp + 0x280]
mov rcx, r14
lea r8, [rsp + 0x270]
lea rdx, [rsp + 0x278]
call qword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x14002b4dc
mov esi, 0x1000
cmp r15d, 1
je 0x14002b4eb
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi]
call fcn.14002dd10
mov eax, esi
jmp 0x14002b085
call fcn.14003f890
int3