Function at 0x1402cd620
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov r14, r9
mov r15, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x140353a28]
xor rax, rbp
mov qword [rbp], rax
mov eax, dword [0x140354e28]
mov ecx, dword [0x140354e2c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete byte [rbp - 1]
cmp ecx, 0xa
setl byte [rbp - 2]
mov eax, 0xe626149f
mov r13d, 0x75dc54d8
mov r12d, 0xc6b38496
jmp 0x1402cd690
mov eax, 0x75dc54d8
nop word [rax + rax]
cmp eax, 0xef3e1c34
jle 0x1402cd730
cmp eax, 0x41c14eb8
jle 0x1402cd790
cmp eax, 0x56856e8b
jle 0x1402cd7fe
cmp eax, 0x56856e8c
je 0x1402cd8a6
cmp eax, 0x61366ecb
je 0x1402cd682
cmp eax, 0x75dc54d8
jne 0x1402cd690
mov eax, select
call fcn.1402de5c0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x20], rax
mov eax, select
call fcn.1402de5c0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x20]
mov qword [rbp - 0x30], rax
mov eax, dword [0x140354e28]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x61366ecb
cmove eax, r12d
cmp dword [0x140354e2c], 0xa
cmovl eax, r12d
jmp 0x1402cd690
cmp eax, 0xbaa9924f
jle 0x1402cd7d0
cmp eax, 0xca8ce025
jle 0x1402cd826
cmp eax, 0xca8ce026
je 0x1402cd8bf
cmp eax, 0xd9479c8f
je 0x1402cd8d2
cmp eax, 0xe626149f
jne 0x1402cd690
movzx ecx, byte [rbp - 1]
cmp byte [rbp - 2], 0
mov eax, 0x61366ecb
cmovne eax, r13d
test cl, cl
cmovne eax, r13d
jmp 0x1402cd690
cmp eax, 0x1079ce94
jle 0x1402cd846
cmp eax, 0x1079ce95
je 0x1402cd93c
cmp eax, 0x3c8f26b8
jne 0x1402cd9ad
mov rax, qword [rbp - 0x48]
mov rcx, qword [rbp + 0x70]
mov qword [rcx], rax
mov eax, 0x1079ce95
jmp 0x1402cd690
cmp eax, 0xa81b2a44
jg 0x1402cd882
cmp eax, 0x9a46d7c5
je 0x1402cd946
cmp eax, 0xa47dd175
jne 0x1402cd690
mov eax, 0x5eb4b44
mov edi, dword [rbp - 0x24]
jmp 0x1402cd690
cmp eax, 0x41c14eb9
je 0x1402cd954
cmp eax, 0x4c9c1251
jne 0x1402cd690
cmp dword [rbp - 8], 0
setns byte [rbp - 3]
mov eax, 0x56856e8c
jmp 0x1402cd690
cmp eax, 0xbaa99250
je 0x1402cd977
cmp eax, 0xc6b38496
jne 0x1402cd690
mov eax, 0xa81b2a45
jmp 0x1402cd690
cmp eax, 0xef3e1c35
je 0x1402cd989
cmp eax, 0x5eb4b44
jne 0x1402cd690
cmp qword [rbp + 0x70], 0
mov dword [rbp - 0xc], edi
mov eax, 0xad554f7d
mov ecx, 0xef3e1c35
cmovne eax, ecx
cmp dword [rbp - 0xc], 0
mov ecx, 0xad554f7d
cmovs eax, ecx
jmp 0x1402cd690
cmp eax, 0xa81b2a45
je 0x1402cd99f
cmp eax, 0xad554f7d
jne 0x1402cd690
mov rax, qword [rbp - 0x38]
mov eax, 0x9a46d7c5
jmp 0x1402cd690
cmp byte [rbp - 3], 0
mov eax, 0x5eb4b44
mov ecx, 0xbaa99250
cmovne eax, ecx
mov edi, dword [rbp - 8]
jmp 0x1402cd690
mov rax, qword [rbp - 0x40]
mov eax, dword [rax]
mov dword [rbp - 0x24], eax
mov eax, 0xa47dd175
jmp 0x1402cd690
mov rax, qword [rbp - 0x20]
mov qword [rax], r15
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x38], rax
mov rax, qword [rbp - 0x38]
mov rax, qword [rbp - 0x20]
mov rcx, qword [rbp - 0x18]
sub rsp, 0x50
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
add rsp, 0x50
mov edi, eax
cmp eax, 0x103
mov eax, 0x5eb4b44
mov ecx, 0x41c14eb9
cmove eax, ecx
jmp 0x1402cd690
mov eax, 0xad554f7d
jmp 0x1402cd690
mov rax, qword [rbp - 0x30]
mov eax, 0x224fe7d1
jmp 0x1402cd690
sub rsp, 0x20
mov rcx, rsi
xor edx, edx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
add rsp, 0x20
mov dword [rbp - 8], eax
mov eax, 0x4c9c1251
jmp 0x1402cd690
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x40], rax
mov eax, 0xca8ce026
jmp 0x1402cd690
mov rax, qword [rbp - 0x18]
mov rax, qword [rax + 8]
mov qword [rbp - 0x48], rax
mov eax, 0x3c8f26b8
jmp 0x1402cd690
mov rax, qword [rbp - 0x30]
mov eax, 0xd9479c8f
jmp 0x1402cd690
cmp eax, 0x224fe7d1
jne 0x1402cd690
mov esi, dword [rbp - 0xc]
mov rcx, qword [rbp]
xor rcx, rbp
sub rsp, 0x20
call fcn.1402de620
add rsp, 0x20
mov eax, esi
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret