Function at 0x14003fd30
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 8], rcx
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
mov rbx, r8
mov rdi, rdx
mov r13, qword [0x1401252a8]
xor sil, sil
cmp qword [r13 + 8], 0xffffffffffffffff
je 0x14004004e
xor r12d, r12d
mov qword [rbp - 1], r12
mov r14d, 0xf
mov qword [rbp + 7], r14
mov byte [rbp - 0x11], sil
mov r8b, 0x20
mov rdx, qword [rdx + 0x10]
lea rcx, [rbp - 0x11]
call fcn.140040360
lea rcx, [rbp - 0x11]
cmp qword [rbp + 7], 0x10
cmovae rcx, qword [rbp - 0x11]
mov r9d, dword [rdi + 0x10]
cmp qword [rdi + 0x18], 8
jb 0x14003fdb5
mov rdi, qword [rdi]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov eax, dword [rbp - 1]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x140040017
mov rcx, qword [rbp - 1]
mov rdx, qword [rbp + 7]
cmp rcx, rdx
jae 0x14003fe0a
lea rax, [rcx + 1]
mov qword [rbp - 1], rax
lea rax, [rbp - 0x11]
cmp rdx, 0x10
cmovae rax, qword [rbp - 0x11]
mov word [rax + rcx], 9
jmp 0x14003fe16
mov r9b, 9
lea rcx, [rbp - 0x11]
call fcn.140037870
lea r9, [rbp - 0x14]
movabs r8, 0xcccccccccccccccd
test rbx, rbx
jns 0x14003fe70
neg rbx
nop dword [rax]
dec r9
mov rax, r8
mul rbx
shr rdx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub bl, cl
add bl, 0x30
mov byte [r9], bl
mov rbx, rdx
test rdx, rdx
jne 0x14003fe30
dec r9
mov byte [r9], 0x2d
jmp 0x14003fe98
dec r9
mov rax, r8
mul rbx
shr rdx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub bl, cl
add bl, 0x30
mov byte [r9], bl
mov rbx, rdx
test rdx, rdx
jne 0x14003fe70
mov rsi, r12
mov qword [rbp + 0x1f], r12
mov qword [rbp + 0x27], r14
mov byte [rbp + 0xf], sil
lea rax, [rbp - 0x14]
cmp r9, rax
je 0x14003fecb
lea r8, [rbp - 0x14]
sub r8, r9
mov rdx, r9
lea rcx, [rbp + 0xf]
call fcn.140037080
mov r14, qword [rbp + 0x27]
mov rsi, qword [rbp + 0x1f]
lea r9, [rbp + 0xf]
mov rdi, qword [rbp + 0xf]
cmp r14, 0x10
cmovae r9, rdi
mov r15, qword [rbp - 1]
mov rcx, qword [rbp + 7]
mov rax, rcx
sub rax, r15
cmp rsi, rax
ja 0x14003ff1c
lea rax, [r15 + rsi]
mov qword [rbp - 1], rax
lea rbx, [rbp - 0x11]
cmp rcx, 0x10
cmovae rbx, qword [rbp - 0x11]
lea rcx, [rbx + r15]
mov r8, rsi
mov rdx, r9
call fcn.140073d70
lea rax, [rsi + rbx]
mov byte [rax + r15], r12b
jmp 0x14003ff35
mov qword [rsp + 0x20], rsi
mov rdx, rsi
lea rcx, [rbp - 0x11]
call fcn.14003c1e0
mov r14, qword [rbp + 0x27]
mov rdi, qword [rbp + 0xf]
cmp r14, 0x10
jb 0x14003ff6c
lea rdx, [r14 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14003ff64
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140040079
mov rcx, rdi
call fcn.140071ab4
mov rcx, qword [rbp - 1]
mov rdx, qword [rbp + 7]
cmp rcx, rdx
jae 0x14003ff96
lea rax, [rcx + 1]
mov qword [rbp - 1], rax
lea rax, [rbp - 0x11]
cmp rdx, 0x10
cmovae rax, qword [rbp - 0x11]
mov word [rax + rcx], 0xd
jmp 0x14003ffa2
mov r9b, 0xd
lea rcx, [rbp - 0x11]
call fcn.140037870
mov rcx, qword [rbp - 1]
mov rdx, qword [rbp + 7]
cmp rcx, rdx
jae 0x14003ffcc
lea rax, [rcx + 1]
mov qword [rbp - 1], rax
lea rax, [rbp - 0x11]
cmp rdx, 0x10
cmovae rax, qword [rbp - 0x11]
mov word [rax + rcx], 0xa
jmp 0x14003ffd8
mov r9b, 0xa
lea rcx, [rbp - 0x11]
call fcn.140037870
lea rcx, [r13 + 0x78]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rbp - 0x11]
cmp qword [rbp + 7], 0x10
cmovae rdx, qword [rbp - 0x11]
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x67]
mov r8d, dword [rbp - 1]
mov rcx, qword [r13 + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne sil
lea rcx, [r13 + 0x78]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rdx, qword [rbp + 7]
cmp rdx, 0x10
jb 0x14004004e
inc rdx
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040049
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140040073
call fcn.140071ab4
movzx eax, sil
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140077e4c
int3
call fcn.140077e4c
int3