Function at 0x14000a880
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x6c0
mov rax, qword [0x1401bf0a0]
xor rax, rsp
mov qword [rsp + 0x6b0], rax
cmp dword [rcx + 8], 0xffffffff
mov rsi, r8
mov r14d, edx
mov rdi, rcx
je 0x14000a8b5
mov rcx, qword [rcx]
call fcn.140009f40
mov rax, qword [rdi]
mov dword [rdi + 8], 0xffffffff
cmp r14d, dword [rax + 8]
jl 0x14000a8cf
mov eax, 0x10000
jmp 0x14000a9d0
mov qword [rsp + 0x6e8], rbx
mov qword [rsp + 0x6f8], rbp
xor ebp, ebp
cmp dword [rax + 0x14], r14d
jle 0x14000a920
mov rbx, rax
test rax, rax
je 0x14000a91c
mov eax, dword [rax + 0x28]
lea r8, [rbx + 0x7c]
lea rdx, [rbx + 0x2c]
mov dword [rbx + 0x18], eax
xor r9d, r9d
mov dword [rbx + 0x14], ebp
mov rcx, rbx
mov dword [rsp + 0x20], ebp
call fcn.1400092a0
test eax, eax
mov ecx, ebp
sete cl
mov dword [rbx + 0x1c], ecx
mov rax, qword [rdi]
cmp dword [rax + 0x14], r14d
jge 0x14000a977
mov rbx, rax
test rax, rax
je 0x14000a971
cmp dword [rax + 0x1c], ebp
je 0x14000a971
mov edx, dword [rax + 0x14]
inc edx
cmp edx, dword [rax + 8]
je 0x14000a971
mov ecx, dword [rax + 0x54]
lea r8, [rbx + 0x7c]
add ecx, dword [rax + 0x50]
xor r9d, r9d
mov eax, dword [rax + 0x4c]
add eax, 0x2e
mov dword [rbx + 0x14], edx
add ecx, eax
mov dword [rsp + 0x20], ebp
add dword [rbx + 0x18], ecx
lea rdx, [rbx + 0x2c]
mov rcx, rbx
call fcn.1400092a0
test eax, eax
mov ecx, ebp
sete cl
mov dword [rbx + 0x1c], ecx
mov rax, qword [rdi]
cmp dword [rax + 0x14], r14d
jl 0x14000a922
lea r8, [rsp + 0x60]
mov edx, r14d
mov rcx, rdi
call fcn.140009fe0
test byte [rsp + 0x26c], 0x10
movzx eax, word [rsi]
je 0x14000a9ec
cmp ax, 0x2f
je 0x14000a9b3
cmp ax, 0x5c
je 0x14000a9b3
test ax, ax
je 0x14000a9ac
cmp word [rsi + 2], 0x3a
je 0x14000a9b3
lea rbp, [rdi + 0x250]
mov rdx, rsi
mov rcx, rbp
call fcn.14000a710
xor eax, eax
mov rbx, qword [rsp + 0x6e8]
mov rbp, qword [rsp + 0x6f8]
mov rcx, qword [rsp + 0x6b0]
xor rcx, rsp
call fcn.1400ba210
add rsp, 0x6c0
pop r14
pop rdi
pop rsi
ret
mov r9, rsi
mov rcx, rsi
test ax, ax
je 0x14000aa14
cmp ax, 0x2f
je 0x14000aa03
cmp ax, 0x5c
jne 0x14000aa07
lea r9, [rcx + 2]
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x14000a9f7
lea rdx, [rsp + 0x290]
mov rcx, rsi
sub rdx, rsi
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rdx + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x14000aa30
cmp r9, rsi
jne 0x14000aa4f
mov word [rsp + 0x290], bp
jmp 0x14000aa93
mov rax, r9
sub rax, rsi
sar rax, 1
add rax, rax
cmp rax, 0x208
jae 0x14000ac15
mov word [rsp + rax + 0x290], bp
movzx eax, word [rsp + 0x290]
cmp ax, 0x2f
je 0x14000aac1
cmp ax, 0x5c
je 0x14000aac1
test ax, ax
je 0x14000aa93
cmp word [rsp + 0x292], 0x3a
je 0x14000aac1
mov qword [rsp + 0x20], r9
lea rbx, [rdi + 0x250]
mov r8, rbx
lea r9, [rsp + 0x290]
lea rdx, str._s_s_s
lea rcx, [rsp + 0x4a0]
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x14000aae1
lea r8, [rsp + 0x290]
lea rdx, str._s_s
lea rcx, [rsp + 0x4a0]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rbx, rbp
lea rdx, [rsp + 0x290]
mov rcx, rbx
call fcn.14000a710
mov eax, dword [rsp + 0x26c]
lea rcx, [rsp + 0x4a0]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000ab35
mov eax, 0x200
jmp 0x14000a9c0
mov rdx, qword [rdi + 0x240]
mov rcx, qword [rdi]
call fcn.1400099a0
cmp qword [rdi + 0x248], rbp
jne 0x14000ab60
mov ecx, 0x4000
call fcn.1400ba300
mov qword [rdi + 0x248], rax
nop
mov rdx, qword [rdi + 0x248]
lea r9, [rsp + 0x50]
mov rcx, qword [rdi]
mov r8d, 0x4000
call fcn.140009bc0
mov ebx, eax
cmp eax, 0xffffff96
je 0x14000abf8
test eax, eax
js 0x14000abb3
jle 0x14000aba8
mov rdx, qword [rdi + 0x248]
lea r9, [rsp + 0x54]
mov r8d, eax
mov qword [rsp + 0x20], rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000abba
cmp byte [rsp + 0x50], bpl
jne 0x14000abc1
test ebx, ebx
jne 0x14000ab60
mov ebx, 0x5000000
jmp 0x14000abfd
mov ebx, 0x400
jmp 0x14000abfd
lea r9, [rsp + 0x280]
mov rcx, rsi
lea r8, [rsp + 0x270]
lea rdx, [rsp + 0x278]
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi]
call fcn.140009f40
jmp 0x14000a9be
mov ebx, 0x1000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi]
call fcn.140009f40
mov eax, ebx
jmp 0x14000a9c0
call fcn.1400ba440
int3