Function at 0x1403d1590
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
push rbp
sub rsp, 0x48
mov rbp, rcx
mov rbx, r8
mov rdi, rdx
xor r15b, r15b
test rbp, rbp
je 0x1403d1caa
movzx r14d, byte [rbp + 0x298]
and r14d, 0x80
movzx r13d, byte [rbp + 0x299]
shr r14d, 7
and r13d, 1
mov rsi, qword [rbp + 0x1a0]
mov r12, qword [rbp + 0x248]
test rdi, rdi
je 0x1403d1c8c
test rbx, rbx
je 0x1403d197f
cmp rdi, qword [rbp + 0x78]
jb 0x1403d16b3
cmp rdi, qword [rbp + 0xb0]
ja 0x1403d16b3
xor eax, eax
mov qword [rbp + 0x178], rax
mov qword [rbp + 0x1b8], rax
mov r10, qword [rbp + 0x88]
test r10, r10
je 0x1403d16c3
cmp rdi, r10
je 0x1403d16c3
mov rdx, qword [rbp + 0x78]
sub r10, rdx
je 0x1403d16c3
mov rax, rsp
mov rcx, rsi
mov r8d, r10d
lea r9, [rsp + 0x40]
mov qword [rax + 0x20], 0
mov qword [r9 - 0x10], r10
mov qword [r9 - 8], r11
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r11, qword [rsp + 0x38]
mov r10, qword [rsp + 0x30]
test eax, eax
jne 0x1403d1687
mov r13d, 0xffffffff
test rbp, rbp
jne 0x1403d1b0f
jmp 0x1403d1b1a
mov rax, qword [rbp + 0x170]
add rax, r10
mov qword [rbp + 0x170], rax
test byte [rbp + 0x29c], 4
je 0x1403d16aa
mov qword [rbp + 0x168], rax
jmp 0x1403d16c3
add qword [rbp + 0x168], r10
jmp 0x1403d16c3
xor eax, eax
mov qword [rbp + 0x178], rax
mov qword [rbp + 0x1b8], rax
cmp dword [0x141a6ae3c], 0
je 0x1403d1771
test r12, r12
je 0x1403d1673
test r14d, r14d
je 0x1403d16f6
cmp r12, 0xfffffffffffffffa
je 0x1403d1b2e
lea rax, [r12 - 1]
cmp rax, 1
jbe 0x1403d1701
test r13d, r13d
jne 0x1403d171f
jmp 0x1403d1771
lea rax, [r12 - 1]
cmp rax, 1
ja 0x1403d1771
mov r15b, 1
call fcn.14043d530
movsxd r11, eax
cmp dword [0x141a6ae3c], 0
je 0x1403d1741
test r14d, r14d
je 0x1403d1741
test r13d, r13d
je 0x1403d1741
mov eax, r11d
mov ecx, eax
mov dword [rsp + 0x30], eax
call fcn.14043d2b0
mov eax, dword [rsp + 0x30]
test r15b, r15b
jne 0x1403d1741
test rbp, rbp
je 0x1403d1b44
jmp 0x1403d1771
mov rcx, rdi
mov edx, ebx
mov r8d, eax
xor r9d, r9d
call fcn.14043d310
mov r13d, eax
movsxd r13, r13d
mov edx, 0xffffffff
cmp r13, rbx
cmovne r13d, edx
test rbp, rbp
jne 0x1403d1b0f
jmp 0x1403d1b1a
mov r13d, 1
test byte [rbp + 0x299], 0x40
jne 0x1403d1789
mov r14, qword [rbp + 0x88]
jmp 0x1403d17cc
test byte [rbp + 0x297], 1
jne 0x1403d1780
mov r10, qword [rbp + 0x78]
mov r14, qword [rbp + 0x88]
cmp rdi, r10
je 0x1403d17a7
cmp rdi, r14
jne 0x1403d17db
mov r15, qword [rbp + 0x1c8]
mov r9, qword [rbp + 0x80]
mov r8, qword [rbp + 0x1b0]
add r10, r8
lea r11, [r9 + r15*2]
cmp r10, r11
ja 0x1403d194b
cmp rdi, r14
jne 0x1403d17db
mov rdi, qword [rbp + 0x78]
sub r14, rdi
add rbx, r14
test byte [rbp + 0x293], 4
je 0x1403d17f4
test byte [rbp + 0x292], 0x40
je 0x1403d17f4
or byte [rbp + 0x295], 8
mov r15, qword [rbp + 0x240]
test r15, r15
je 0x1403d180e
cmp rbx, r15
jbe 0x1403d188f
mov rax, rbx
jmp 0x1403d1820
cmp rbx, 0x20000
jbe 0x1403d188f
mov rax, rbx
mov r15d, 0x20000
mov qword [rsp + 0x30], r12
mov r14, rdi
mov r13d, ebx
mov r12, rdi
mov rdi, rbx
mov rbx, rax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp rsi, rax
je 0x1403d1bc1
mov r10, rsp
mov rcx, rsi
mov rdx, r14
mov r8d, r15d
lea r9, [rsp + 0x40]
mov qword [r10 + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
je 0x1403d1b66
test rbx, rbx
je 0x1403d1b56
cmp eax, 1
jne 0x1403d1b56
mov edx, dword [rsp + 0x40]
test edx, edx
ja 0x1403d1834
jmp 0x1403d1bab
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp rsi, rax
je 0x1403d1c33
mov rax, rsp
mov rcx, rsi
mov rdx, rdi
mov r8d, ebx
lea r9, [rsp + 0x40]
mov qword [rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r13d, eax
test r13d, r13d
jne 0x1403d18da
cmp r12, 1
je 0x1403d1c1c
mov r13d, 0xffffffff
test rbp, rbp
je 0x1403d1b0d
mov rdx, qword [rbp + 0x78]
add rdx, qword [rbp + 0x1c8]
mov qword [rbp + 0x90], rdx
mov rdx, rbx
add rdx, qword [rbp + 0x170]
and byte [rbp + 0x295], 0xfb
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x170], rdx
test byte [rbp + 0x29c], 4
je 0x1403d1936
mov qword [rbp + 0x168], rdx
test rbp, rbp
jne 0x1403d1b0f
jmp 0x1403d1b1a
add qword [rbp + 0x168], rbx
test rbp, rbp
jne 0x1403d1b0f
jmp 0x1403d1b1a
or byte [rbp + 0x295], 4
add rdi, rbx
add qword [rbp + 0x90], r15
add qword [rbp + 0x168], rbx
mov qword [rbp + 0x88], rdi
test rbp, rbp
mov qword [rbp + 0x80], rdi
jne 0x1403d1b0f
jmp 0x1403d1b1a
xor eax, eax
mov qword [rbp + 0x178], rax
mov qword [rbp + 0x1b8], rax
mov dil, byte [rbp + 0x295]
mov r13d, 1
test dil, 4
je 0x1403d1a30
mov rax, rsp
mov rcx, rsi
mov rdx, qword [rbp + 0x78]
lea r9, [rsp + 0x40]
mov rbx, qword [rbp + 0x88]
sub rbx, rdx
mov r8d, ebx
mov qword [rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r13d, eax
mov edx, 0xffffffff
test r13d, r13d
mov rsi, qword [rbp + 0x78]
mov rcx, qword [rbp + 0x1c8]
cmove r13d, edx
mov rdx, qword [rbp + 0x170]
add rcx, rsi
and byte [rbp + 0x295], 0xfb
add rdx, rbx
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x90], rcx
mov qword [rbp + 0x80], rsi
mov qword [rbp + 0x170], rdx
test byte [rbp + 0x29c], 4
jne 0x1403d1921
jmp 0x1403d1936
mov rdx, qword [rbp + 0x108]
test rdx, rdx
je 0x1403d1d0f
cmp byte [rdx + 0x32], 0
je 0x1403d1d0f
movzx edx, word [rbp + 0x27a]
test edx, edx
jg 0x1403d1d0f
mov rdx, qword [rbp + 0x78]
mov rbx, qword [rbp + 0xa0]
sub rbx, rdx
test rbx, rbx
jle 0x1403d1aa2
mov rax, rsp
mov rcx, rsi
mov r8d, ebx
lea r9, [rsp + 0x40]
mov qword [rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r13d, eax
mov esi, 0xffffffff
test r13d, r13d
mov rdx, qword [rbp + 0x78]
mov dil, byte [rbp + 0x295]
cmove r13d, esi
mov r8, qword [rbp + 0x1c8]
mov rcx, rdx
mov qword [rbp + 0x80], rdx
and dil, 0xfb
mov qword [rbp + 0xa0], rdx
mov byte [rbp + 0x295], dil
lea rsi, [rdx + r8]
mov edx, 0x20
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x90], rsi
call fcn.14042ad60
mov rdx, qword [rbp + 0x170]
add rdx, rbx
mov qword [rbp + 0x170], rdx
test byte [rbp + 0x29c], 4
jne 0x1403d1921
add qword [rbp + 0x168], rbx
test rbp, rbp
je 0x1403d1b1a
mov qword [rbp + 0x158], 0
mov eax, r13d
add rsp, 0x48
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov r15b, 1
mov r11, rsi
test r13d, r13d
jne 0x1403d171f
mov eax, esi
jmp 0x1403d1741
cmp rbx, 0x20000
jbe 0x1403d188f
jmp 0x1403d1817
mov r12, qword [rsp + 0x30]
mov r13d, eax
mov rbx, rdi
jmp 0x1403d18c5
mov edx, dword [rsp + 0x40]
add r14, rdx
sub rbx, rdx
test rbp, rbp
je 0x1403d1b97
mov r9, qword [rbp + 0x240]
test r9, r9
je 0x1403d1b97
cmp rbx, r9
cmovbe r15, rbx
test rbx, rbx
je 0x1403d1bb6
test edx, edx
ja 0x1403d1834
jmp 0x1403d1bb6
cmp rbx, 0x20000
cmovbe r15, rbx
test rbx, rbx
jne 0x1403d1886
mov r13d, eax
mov rbx, rdi
jmp 0x1403d18da
mov r13d, eax
mov rbx, rdi
jmp 0x1403d18e3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
jne 0x1403d1848
mov ecx, 1
mov rdx, r14
mov r8d, r15d
call fcn.1404848b8
mov edx, eax
cmp edx, 0xffffffff
je 0x1403d1bf8
mov dword [rsp + 0x40], edx
mov eax, 1
jmp 0x1403d1b6a
mov r10, rsp
mov rcx, rsi
mov rdx, r12
mov r8d, r13d
lea r9, [rsp + 0x40]
mov qword [r10 + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x1403d1867
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 6
jne 0x1403d18d4
xor r13d, r13d
jmp 0x1403d18da
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
jne 0x1403d18a3
mov r13d, ebx
mov ecx, 1
mov rdx, rdi
mov r8d, r13d
call fcn.1404848b8
cmp eax, 0xffffffff
je 0x1403d1c68
mov r13d, 1
jmp 0x1403d18da
mov rax, rsp
mov rcx, rsi
mov rdx, rdi
mov r8d, r13d
lea r9, [rsp + 0x40]
mov qword [rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x1403d18c2
xor eax, eax
mov qword [rbp + 0x178], rax
mov qword [rbp + 0x1b8], rax
test rbx, rbx
je 0x1403d198f
jmp 0x1403d161b
cmp dword [0x141a6ae3c], 0
jne 0x1403d1d05
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rsi, rax
mov r14d, dword [0x141a6ae3c]
mov r13d, r14d
mov r12d, 1
test rbx, rbx
jne 0x1403d1cea
mov r13d, 1
test rbp, rbp
jne 0x1403d1b0f
jmp 0x1403d1b1a
test r14d, r14d
jne 0x1403d1701
cmp rbx, 0x20000
jbe 0x1403d188f
jmp 0x1403d1817
call fcn.14043d530
movsxd rsi, eax
jmp 0x1403d1cc1
test rbp, rbp
jne 0x1403d1b0f
jmp 0x1403d1b1a