Function at 0x140384da0
Capabilities:
Write file on windows

Disassembly:
jmp 0x140384da0
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov r14, r8
mov r13, rdx
mov rsi, rcx
mov rax, qword [0x14056a550]
xor rax, rsp
mov qword [rsp + 0x50], rax
test rcx, rcx
je 0x140384e37
mov rbx, qword [rsi + 0x1a0]
mov rdi, qword [rsi + 0x248]
mov ebp, dword [rsi + 0x298]
mov r12d, ebp
shr r12d, 7
and r12d, 1
shr ebp, 8
and ebp, 1
test r13, r13
je 0x140384e6d
test r14, r14
je 0x140384e6d
cmp qword [rsi + 0x78], r13
ja 0x140384e0f
cmp qword [rsi + 0xb0], r13
jae 0x140384fc1
mov qword [rsi + 0x178], 0
mov qword [rsi + 0x1b8], 0
cmp dword [0x1407108a8], 0
jne 0x140384fe9
jmp 0x140385061
cmp dword [0x1407108a8], 0
je 0x140384f14
call fcn.140003c1a
movsxd rbx, eax
test r14, r14
je 0x140384f2b
mov ebp, dword [0x1407108a8]
mov edi, 1
mov r12d, ebp
test rsi, rsi
jne 0x140384e95
jmp 0x140384fe0
mov qword [rsi + 0x178], 0
mov qword [rsi + 0x1b8], 0
test r14, r14
je 0x140384f36
test rsi, rsi
je 0x140384fe0
mov r15, qword [rsi + 0x88]
test r15, r15
je 0x140384fe0
cmp r15, r13
je 0x140384fe0
mov rdx, qword [rsi + 0x78]
sub r15, rdx
je 0x140384fe0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x4c]
mov rcx, rbx
mov r8d, r15d
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140385407
mov rax, qword [rsi + 0x170]
add rax, r15
mov qword [rsi + 0x170], rax
test byte [rsi + 0x29c], 4
jne 0x14038540f
add qword [rsi + 0x168], r15
cmp dword [0x1407108a8], 0
jne 0x140384fe9
jmp 0x140385061
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
test r14, r14
jne 0x140384e55
mov r15d, 1
jmp 0x1403853e6
mov eax, dword [rsi + 0x294]
test eax, 0x400
jne 0x14038534f
mov rcx, qword [rsi + 0x108]
mov r15d, 1
test rcx, rcx
je 0x1403853db
cmp byte [rcx + 0x32], 0
je 0x1403853db
cmp word [rsi + 0x27a], 0
jne 0x1403853db
mov rdx, qword [rsi + 0x78]
mov rdi, qword [rsi + 0xa0]
sub rdi, rdx
test rdi, rdi
jle 0x140385428
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x4c]
mov rcx, rbx
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor r15d, r15d
cmp eax, 1
sbb r15d, r15d
or r15d, eax
mov eax, dword [rsi + 0x294]
mov rdx, qword [rsi + 0x78]
jmp 0x14038542e
mov qword [rsi + 0x178], 0
mov qword [rsi + 0x1b8], 0
test rsi, rsi
jne 0x140384e95
cmp dword [0x1407108a8], 0
je 0x140385061
test rdi, rdi
je 0x140385008
mov eax, 1
test r12d, r12d
je 0x14038501c
cmp rdi, 0xfffffffffffffffa
jne 0x14038501c
mov r15, rdi
xor edi, edi
mov r8, rbx
jmp 0x14038503a
mov r15d, 0xffffffff
test rsi, rsi
jne 0x1403853db
jmp 0x1403853e6
mov r15, rdi
cmp rdi, 2
ja 0x140385037
call fcn.140003c1a
movsxd r8, eax
xor edi, edi
mov eax, dword [0x1407108a8]
jmp 0x14038503a
mov dil, 1
test eax, eax
je 0x140385055
test r12d, r12d
je 0x140385055
test ebp, ebp
je 0x140385055
mov ecx, r8d
mov r12, r8
call fcn.1400034b3
mov r8, r12
test dil, dil
mov rdi, r15
je 0x14038529d
test rsi, rsi
je 0x140385226
test byte [rsi + 0x299], 0x40
je 0x1403850e5
mov eax, dword [rsi + 0x294]
test eax, 0x1000000
jne 0x1403850e5
mov rcx, qword [rsi + 0x78]
cmp rcx, r13
je 0x140385092
cmp qword [rsi + 0x88], r13
jne 0x1403850e5
add rcx, qword [rsi + 0x1b0]
mov rdx, qword [rsi + 0x1c8]
lea r8, [rdx + rdx]
add r8, qword [rsi + 0x80]
cmp rcx, r8
jbe 0x1403850e5
add r13, r14
mov qword [rsi + 0x88], r13
or eax, 0x400
mov dword [rsi + 0x294], eax
add qword [rsi + 0x90], rdx
mov qword [rsi + 0x80], r13
add qword [rsi + 0x168], r14
mov r15d, 1
jmp 0x1403853db
cmp qword [rsi + 0x88], r13
jne 0x1403850f8
add r14, r13
mov r13, qword [rsi + 0x78]
sub r14, r13
mov eax, dword [rsi + 0x290]
not eax
test eax, 0x4400000
jne 0x14038510e
or byte [rsi + 0x295], 8
mov rax, qword [rsi + 0x240]
test rax, rax
mov r12d, 0x20000
cmovne r12, rax
cmp r14, r12
jbe 0x140385239
mov qword [rsp + 0x38], rdi
mov rdi, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbp, r13
lea r13, [rsp + 0x4c]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x40], rbp
nop dword [rax]
mov ecx, 0xfffffff5
call rdi
cmp rbx, rax
jne 0x140385190
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
jne 0x140385190
mov ecx, 1
mov rdx, rbp
mov r8d, r12d
call fcn.1400011b3
cmp eax, 0xffffffff
je 0x14038520b
mov dword [rsp + 0x4c], eax
jmp 0x1403851bb
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov rdx, rbp
mov r8d, r12d
mov r9, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r15d, eax
cmp eax, 1
jne 0x1403852cf
mov eax, dword [rsp + 0x4c]
mov ecx, eax
sub r14, rcx
test rsi, rsi
je 0x1403851e0
mov rdx, qword [rsi + 0x240]
test rdx, rdx
mov r8d, 0x20000
cmove rdx, r8
jmp 0x1403851e5
mov edx, 0x20000
cmp r14, rdx
cmovbe r12, r14
mov r15d, 1
test r14, r14
je 0x1403852c8
add rbp, rcx
test eax, eax
jne 0x140385150
jmp 0x1403852c8
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x30]
jmp 0x1403851a2
mov r12d, 0x20000
cmp r14, 0x20000
ja 0x14038512b
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp rbx, rax
jne 0x140385276
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
jne 0x140385276
mov r15d, 1
mov ecx, 1
mov rdx, r13
mov r8d, r14d
call fcn.1400011b3
cmp eax, 0xffffffff
jne 0x1403852f8
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x4c]
mov rcx, rbx
mov rdx, r13
mov r8d, r14d
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r15d, eax
test r15d, r15d
jne 0x1403852f8
jmp 0x1403852de
mov rcx, r13
mov edx, r14d
xor r9d, r9d
call fcn.140003a44
movsxd r15, eax
cmp r15, r14
mov eax, 0xffffffff
cmovne r15d, eax
test rsi, rsi
jne 0x1403853db
jmp 0x1403853e6
mov r14, qword [rsp + 0x30]
jmp 0x1403852f8
mov r14, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
test r15d, r15d
jne 0x1403852f8
cmp rdi, 1
jne 0x1403852f2
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor r15d, r15d
cmp eax, 6
je 0x1403852f8
mov r15d, 0xffffffff
test rsi, rsi
je 0x1403853e6
and byte [rsi + 0x295], 0xfb
mov qword [rsi + 0x88], 0
mov rax, qword [rsi + 0x78]
add rax, qword [rsi + 0x1c8]
mov qword [rsi + 0x90], rax
mov rax, qword [rsi + 0x170]
add rax, r14
mov qword [rsi + 0x170], rax
test byte [rsi + 0x29c], 4
jne 0x1403853d4
add qword [rsi + 0x168], r14
jmp 0x1403853db
mov rdx, qword [rsi + 0x78]
mov rdi, qword [rsi + 0x88]
sub rdi, rdx
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x4c]
mov rcx, rbx
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor r15d, r15d
cmp eax, 1
sbb r15d, r15d
and byte [rsi + 0x295], 0xfb
or r15d, eax
mov qword [rsi + 0x88], 0
mov rax, qword [rsi + 0x78]
mov rcx, qword [rsi + 0x1c8]
add rcx, rax
mov qword [rsi + 0x90], rcx
mov qword [rsi + 0x80], rax
mov rax, qword [rsi + 0x170]
add rax, rdi
mov qword [rsi + 0x170], rax
test byte [rsi + 0x29c], 4
jne 0x1403853d4
add qword [rsi + 0x168], rdi
jmp 0x1403853db
mov qword [rsi + 0x168], rax
mov qword [rsi + 0x158], 0
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140003706
mov eax, r15d
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r15d, 0xffffffff
jmp 0x1403853db
mov qword [rsi + 0x168], rax
cmp dword [0x1407108a8], 0
jne 0x140384fe9
jmp 0x140385061
mov r15d, 1
and eax, 0xfffffbff
mov dword [rsi + 0x294], eax
mov qword [rsi + 0x88], 0
mov r8, qword [rsi + 0x1c8]
lea rax, [rdx + r8]
mov qword [rsi + 0x90], rax
mov qword [rsi + 0x80], rdx
mov qword [rsi + 0xa0], rdx
mov rcx, rdx
mov dl, 0x20
call fcn.1400020b8
jmp 0x1403853b1