Function at 0x1400053d0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x3d0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x3c0], rax
cmp dword [rcx + 8], 0xffffffff
mov rsi, r8
mov r14d, edx
mov rdi, rcx
je 0x140005405
mov rcx, qword [rcx]
call fcn.140004a40
mov rcx, qword [rdi]
mov dword [rdi + 8], 0xffffffff
cmp r14d, dword [rcx + 8]
jl 0x14000541f
mov eax, 0x10000
jmp 0x1400054ee
mov qword [rsp + 0x408], rbp
cmp r14d, dword [rcx + 0x14]
jge 0x140005432
call fcn.140004230
mov rax, qword [rdi]
xor ebp, ebp
mov qword [rsp + 0x3f8], rbx
cmp dword [rax + 0x14], r14d
jge 0x14000549a
mov rbx, qword [rdi]
test rbx, rbx
je 0x140005491
cmp dword [rbx + 0x1c], ebp
je 0x140005491
mov edx, dword [rbx + 0x14]
inc edx
cmp edx, dword [rbx + 8]
je 0x140005491
mov ecx, dword [rbx + 0x54]
lea r8, [rbx + 0x7c]
add ecx, dword [rbx + 0x50]
xor r9d, r9d
mov eax, dword [rbx + 0x4c]
add eax, 0x2e
mov dword [rbx + 0x14], edx
add ecx, eax
mov dword [rsp + 0x20], ebp
add dword [rbx + 0x18], ecx
lea rdx, [rbx + 0x2c]
mov rcx, rbx
call fcn.140003fb0
mov ecx, ebp
test eax, eax
sete cl
mov dword [rbx + 0x1c], ecx
mov rax, qword [rdi]
cmp dword [rax + 0x14], r14d
jl 0x140005445
lea r8, [rsp + 0x60]
mov edx, r14d
mov rcx, rdi
call fcn.140004c80
test byte [rsp + 0x168], 0x10
movzx eax, byte [rsi]
je 0x14000550a
cmp al, 0x2f
je 0x1400054d2
cmp al, 0x5c
je 0x1400054d2
test al, al
je 0x1400054c9
cmp byte [rsi + 1], 0x3a
je 0x1400054d2
lea rcx, [rdi + 0x150]
jmp 0x1400054d4
xor ecx, ecx
mov rdx, rsi
call fcn.1400052a0
xor eax, eax
mov rbx, qword [rsp + 0x3f8]
mov rbp, qword [rsp + 0x408]
mov rcx, qword [rsp + 0x3c0]
xor rcx, rsp
call fcn.140006620
add rsp, 0x3d0
pop r14
pop rdi
pop rsi
ret
mov r14, rsi
mov rcx, rsi
test al, al
je 0x14000552b
cmp al, 0x2f
je 0x14000551c
cmp al, 0x5c
jne 0x140005520
lea r14, [rcx + 1]
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x140005514
mov r8, rsi
lea rcx, [rsp + 0x1a0]
mov edx, 0x104
call fcn.14000a800
cmp r14, rsi
jne 0x14000554f
mov byte [rsp + 0x1a0], bpl
jmp 0x140005587
mov rax, r14
sub rax, rsi
cmp rax, 0x104
jae 0x140005704
mov byte [rsp + rax + 0x1a0], bpl
movzx eax, byte [rsp + 0x1a0]
cmp al, 0x2f
je 0x1400055b9
cmp al, 0x5c
je 0x1400055b9
test al, al
je 0x140005587
cmp byte [rsp + 0x1a1], 0x3a
je 0x1400055b9
lea r9, [rsp + 0x1a0]
mov qword [rsp + 0x20], r14
lea r8, [rdi + 0x150]
lea rdx, str._s_s_s
lea rcx, [rsp + 0x2b0]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rdi + 0x150]
jmp 0x1400055db
mov r9, r14
lea r8, [rsp + 0x1a0]
lea rdx, str._s_s
lea rcx, [rsp + 0x2b0]
call qword [sym.imp.USER32.dll_wsprintfA]
xor ecx, ecx
lea rdx, [rsp + 0x1a0]
call fcn.1400052a0
mov eax, dword [rsp + 0x168]
lea rcx, [rsp + 0x2b0]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000562c
mov eax, 0x200
jmp 0x1400054de
mov rdx, qword [rdi + 0x140]
mov rcx, qword [rdi]
call fcn.1400044d0
cmp qword [rdi + 0x148], rbp
jne 0x140005660
mov ecx, 0x4000
call fcn.140006924
mov qword [rdi + 0x148], rax
nop word [rax + rax]
mov rdx, qword [rdi + 0x148]
lea r9, [rsp + 0x50]
mov rcx, qword [rdi]
mov r8d, 0x4000
call fcn.1400046f0
mov ebx, eax
cmp eax, 0xffffff96
je 0x1400056e7
test eax, eax
js 0x1400056b6
jle 0x1400056ab
mov rdx, qword [rdi + 0x148]
lea r9, [rsp + 0x190]
mov r8d, eax
mov qword [rsp + 0x20], rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400056bd
cmp byte [rsp + 0x50], bpl
jne 0x1400056c4
test ebx, ebx
jne 0x140005660
mov ebp, 0x5000000
jmp 0x1400056ec
mov ebp, 0x400
jmp 0x1400056ec
lea r9, [rsp + 0x17c]
mov rcx, rsi
lea r8, [rsp + 0x16c]
lea rdx, [rsp + 0x174]
call qword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x1400056ec
mov ebp, 0x1000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi]
call fcn.140004a40
mov eax, ebp
jmp 0x1400054de
call fcn.14000674c
int3