Function at 0x140014870
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x3c0
mov rax, qword [0x1400731c8]
xor rax, rsp
mov qword [rsp + 0x3b0], rax
cmp dword [rcx + 8], 0xffffffff
mov rsi, r8
mov ebp, edx
mov rdi, rcx
je 0x1400148a3
mov rcx, qword [rcx]
call fcn.140013e80
mov rcx, qword [rdi]
mov dword [rdi + 8], 0xffffffff
cmp ebp, dword [rcx + 8]
jl 0x1400148bc
mov eax, 0x10000
jmp 0x14001498b
mov qword [rsp + 0x3f8], r14
cmp ebp, dword [rcx + 0x14]
jge 0x1400148ce
call fcn.140013670
mov rax, qword [rdi]
xor r14d, r14d
mov qword [rsp + 0x3e8], rbx
cmp dword [rax + 0x14], ebp
jge 0x140014938
mov rbx, qword [rdi]
test rbx, rbx
je 0x140014930
cmp dword [rbx + 0x1c], r14d
je 0x140014930
mov edx, dword [rbx + 0x14]
inc edx
cmp edx, dword [rbx + 8]
je 0x140014930
mov ecx, dword [rbx + 0x54]
lea r8, [rbx + 0x7c]
add ecx, dword [rbx + 0x50]
xor r9d, r9d
mov eax, dword [rbx + 0x4c]
add eax, 0x2e
mov dword [rbx + 0x14], edx
add ecx, eax
mov dword [rsp + 0x20], r14d
add dword [rbx + 0x18], ecx
lea rdx, [rbx + 0x2c]
mov rcx, rbx
call fcn.1400133f0
mov ecx, r14d
test eax, eax
sete cl
mov dword [rbx + 0x1c], ecx
mov rax, qword [rdi]
cmp dword [rax + 0x14], ebp
jl 0x1400148e1
lea r8, [rsp + 0x60]
mov edx, ebp
mov rcx, rdi
call fcn.1400140b0
test byte [rsp + 0x168], 0x10
movzx eax, byte [rsi]
je 0x1400149a6
cmp al, 0x2f
je 0x14001496f
cmp al, 0x5c
je 0x14001496f
test al, al
je 0x140014966
cmp byte [rsi + 1], 0x3a
je 0x14001496f
lea rcx, [rdi + 0x150]
jmp 0x140014971
xor ecx, ecx
mov rdx, rsi
call fcn.140014710
xor eax, eax
mov rbx, qword [rsp + 0x3e8]
mov r14, qword [rsp + 0x3f8]
mov rcx, qword [rsp + 0x3b0]
xor rcx, rsp
call fcn.140017e70
add rsp, 0x3c0
pop rdi
pop rsi
pop rbp
ret
mov r9, rsi
mov rcx, rsi
test al, al
je 0x1400149c7
cmp al, 0x2f
je 0x1400149b8
cmp al, 0x5c
jne 0x1400149bc
lea r9, [rcx + 1]
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x1400149b0
lea rdx, [rsp + 0x190]
mov rcx, rsi
sub rdx, rsi
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x1400149e0
cmp r9, rsi
jne 0x1400149fd
mov byte [rsp + 0x190], r14b
jmp 0x140014a35
mov rax, r9
sub rax, rsi
cmp rax, 0x104
jae 0x140014ba5
mov byte [rsp + rax + 0x190], r14b
movzx eax, byte [rsp + 0x190]
cmp al, 0x2f
je 0x140014a67
cmp al, 0x5c
je 0x140014a67
test al, al
je 0x140014a35
cmp byte [rsp + 0x191], 0x3a
je 0x140014a67
mov qword [rsp + 0x20], r9
lea r8, [rdi + 0x150]
lea r9, [rsp + 0x190]
lea rdx, str._s_s_s
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rdi + 0x150]
jmp 0x140014a86
lea r8, [rsp + 0x190]
lea rdx, str._s_s
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.USER32.dll_wsprintfA]
xor ecx, ecx
lea rdx, [rsp + 0x190]
call fcn.140014710
mov eax, dword [rsp + 0x168]
lea rcx, [rsp + 0x2a0]
mov qword [rsp + 0x30], r14
xor r9d, r9d
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140014ad7
mov eax, 0x200
jmp 0x14001497b
mov rdx, qword [rdi + 0x140]
mov rcx, qword [rdi]
call fcn.140013910
cmp qword [rdi + 0x148], r14
jne 0x140014b00
mov ecx, 0x4000
call fcn.140017ee0
mov qword [rdi + 0x148], rax
mov rdx, qword [rdi + 0x148]
lea r9, [rsp + 0x50]
mov rcx, qword [rdi]
mov r8d, 0x4000
call fcn.140013b30
mov ebx, eax
cmp eax, 0xffffff96
je 0x140014b86
test eax, eax
js 0x140014b53
jle 0x140014b48
mov rdx, qword [rdi + 0x148]
lea r9, [rsp + 0x54]
mov r8d, eax
mov qword [rsp + 0x20], r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140014b5b
cmp byte [rsp + 0x50], r14b
jne 0x140014b63
test ebx, ebx
jne 0x140014b00
mov r14d, 0x5000000
jmp 0x140014b8c
mov r14d, 0x400
jmp 0x140014b8c
lea r9, [rsp + 0x17c]
mov rcx, rsi
lea r8, [rsp + 0x16c]
lea rdx, [rsp + 0x174]
call qword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x140014b8c
mov r14d, 0x1000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi]
call fcn.140013e80
mov eax, r14d
jmp 0x14001497b
call fcn.1400185c8
int3