Function at 0x14008da50
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rdi
push r13
push r15
sub rsp, 0x60
mov r10, qword [rcx]
xor ebp, ebp
mov qword [rsp + 0xa0], rbp
mov r13, rcx
mov edi, ebp
lea r11, [rbp - 1]
cmp r10, rcx
je 0x14008db0d
nop dword [rax + rax]
mov rcx, qword [r10 + 0x20]
lea rdx, [r10]
mov r10, qword [r10]
mov rax, r11
nop dword [rax]
inc rax
cmp word [rcx + rax*2], bp
jne 0x14008da90
mov r8, qword [rdx + 0x10]
lea r9, [rdx + 0x10]
add rdi, 4
add rdi, rax
cmp r8, r9
je 0x14008daf8
nop dword [rax]
mov rdx, qword [r8 + 0x18]
lea rcx, [r8]
mov r8, qword [r8]
mov rax, rbp
test rdx, rdx
je 0x14008daf0
mov rax, qword [rcx + 0x10]
mov rcx, r11
nop dword [rax]
inc rcx
cmp word [rax + rcx*2], bp
jne 0x14008dad0
mov rax, r11
nop dword [rax]
inc rax
cmp word [rdx + rax*2], bp
jne 0x14008dae0
add rax, 3
add rax, rcx
add rdi, rax
cmp r8, r9
jne 0x14008dab0
add rdi, 2
cmp r10, r13
jne 0x14008da80
mov qword [rsp + 0xa0], rdi
lea rbx, [rdi + 2]
mov eax, 2
mul rbx
cmovo rax, r11
mov rcx, rax
call fcn.140094b74
mov qword [rsp + 0xa8], rax
mov r15, rax
mov qword [rsp + 0x98], rax
mov rcx, rax
test rax, rax
jne 0x14008db4f
lea eax, [rcx + 8]
add rsp, 0x60
pop r15
pop r13
pop rdi
pop rbp
pop rbx
ret
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], r12
mov r12, qword [r13]
mov qword [rsp + 0x48], r14
lea r14, [rax + rbx*2]
cmp r12, r13
je 0x14008dc4b
lea r8, str.__s__r_n
lea r15, str._s_s_r_n
nop dword [rax]
lea rbx, [r12]
mov rdx, r14
mov r12, qword [r12]
sub rdx, rax
mov rax, qword [rbx + 0x20]
xor r9d, r9d
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x98]
sar rdx, 1
mov qword [rsp + 0x20], rbp
call fcn.140001db0
lea rsi, [rbx + 0x10]
mov rbx, qword [rbx + 0x10]
cmp rbx, rsi
je 0x14008dc0e
mov r8, qword [rbx + 0x18]
lea rax, [rbx]
mov rbx, qword [rbx]
test r8, r8
je 0x14008dc09
mov rcx, qword [rsp + 0x98]
mov rdx, r14
mov rax, qword [rax + 0x10]
sub rdx, rcx
mov qword [rsp + 0x38], r8
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x98]
sar rdx, 1
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rbp
call fcn.140001db0
cmp rbx, rsi
jne 0x14008dbc1
mov rax, qword [rsp + 0x98]
lea r8, str.__s__r_n
mov dword [rax], 0xa000d
lea rcx, [rax + 4]
mov qword [rsp + 0x98], rcx
mov rax, rcx
cmp r12, r13
jne 0x14008db80
mov rdi, qword [rsp + 0xa0]
mov r15, qword [rsp + 0xa8]
lea esi, [rdi + rdi]
lea r14d, [rsi + 3]
mov ecx, r14d
call fcn.140094b74
mov r12, qword [rsp + 0x50]
mov rbx, rax
test rax, rax
je 0x14008dd25
mov ecx, dword [r13 + 0x18]
test ecx, ecx
je 0x14008dcfa
sub ecx, 1
je 0x14008dce0
sub ecx, 1
je 0x14008dcc3
cmp ecx, 1
jne 0x14008dd25
mov qword [rsp + 0x38], rbp
add rax, 3
mov qword [rsp + 0x30], rbp
mov r9d, edi
mov dword [rsp + 0x28], r14d
mov r8, r15
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov word [rbx], 0xbbef
mov byte [rbx + 2], 0xbf
lea esi, [rax + 3]
jmp 0x14008dd27
lea r9, [rdi + rdi]
mov r8, r15
lea rdx, [rax + 2]
mov rcx, r13
call fcn.14008dfe0
add esi, 2
mov word [rbx], 0xfffe
jmp 0x14008dd27
lea r8, [rdi + rdi]
mov rdx, r15
lea rcx, [rax + 2]
call fcn.1400b1500
add esi, 2
mov word [rbx], 0xfeff
jmp 0x14008dd27
mov qword [rsp + 0x38], rbp
mov r9d, edi
mov qword [rsp + 0x30], rbp
mov r8, r15
mov dword [rsp + 0x28], r14d
mov edx, 0x200
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, edi
jmp 0x14008dd27
mov esi, ebp
mov rcx, qword [r13 + 0x10]
xor r9d, r9d
mov qword [rsp + 0x30], rbp
xor r8d, r8d
mov dword [rsp + 0x28], ebp
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, qword [rsp + 0x48]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14008dd82
lea r9, [rsp + 0x90]
mov qword [rsp + 0x20], rbp
mov r8d, esi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14008dd8a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rsi, qword [rsp + 0x58]
cmp rbx, r15
je 0x14008dd9c
mov rcx, rbx
call fcn.140062970
mov rcx, r15
call fcn.140062970
mov eax, ebp
add rsp, 0x60
pop r15
pop r13
pop rdi
pop rbp
pop rbx
ret