Function at 0x140027ba0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x6c0
mov rax, qword [0x140144038]
xor rax, rsp
mov qword [rsp + 0x6b0], rax
mov r15d, dword [rsp + 0x710]
mov r12d, r9d
mov r14, r8
mov ebp, edx
mov rdi, rcx
cmp r15d, 3
je 0x140027f47
lea eax, [r15 - 1]
cmp eax, 1
ja 0x140028054
cmp dword [rcx + 8], 0xffffffff
je 0x140027c03
mov rcx, qword [rcx]
call fcn.140027060
mov rbx, qword [rdi]
mov dword [rdi + 8], 0xffffffff
cmp ebp, dword [rbx + 8]
jge 0x140028054
xor esi, esi
cmp ebp, dword [rbx + 0x14]
jge 0x140027c4c
test rbx, rbx
je 0x140027c4c
mov eax, dword [rbx + 0x28]
lea r8, [rbx + 0x7c]
lea rdx, [rbx + 0x2c]
mov dword [rbx + 0x18], eax
xor r9d, r9d
mov dword [rbx + 0x14], esi
mov rcx, rbx
mov dword [rsp + 0x20], esi
call fcn.140026160
mov ecx, esi
test eax, eax
sete cl
mov dword [rbx + 0x1c], ecx
mov rbx, qword [rdi]
cmp dword [rbx + 0x14], ebp
jge 0x140027ca5
test rbx, rbx
je 0x140027c9d
cmp dword [rbx + 0x1c], esi
je 0x140027c9d
mov edx, dword [rbx + 0x14]
inc edx
cmp edx, dword [rbx + 8]
je 0x140027c9d
mov ecx, dword [rbx + 0x54]
lea r8, [rbx + 0x7c]
add ecx, dword [rbx + 0x50]
xor r9d, r9d
mov eax, dword [rbx + 0x4c]
add eax, 0x2e
mov dword [rbx + 0x14], edx
add ecx, eax
mov dword [rsp + 0x20], esi
add dword [rbx + 0x18], ecx
lea rdx, [rbx + 0x2c]
mov rcx, rbx
call fcn.140026160
mov ecx, esi
test eax, eax
sete cl
mov dword [rbx + 0x1c], ecx
mov rbx, qword [rdi]
cmp dword [rbx + 0x14], ebp
jl 0x140027c54
lea r8, [rsp + 0x60]
mov edx, ebp
mov rcx, rdi
call fcn.140027300
test byte [rsp + 0x26c], 0x10
je 0x140027d21
cmp r15d, 1
je 0x140027cf3
movzx eax, word [r14]
cmp ax, 0x2f
je 0x140027ce8
cmp ax, 0x5c
je 0x140027ce8
test ax, ax
je 0x140027ce1
cmp word [r14 + 2], 0x3a
je 0x140027ce8
lea rsi, [rdi + 0x250]
mov rdx, r14
mov rcx, rsi
call fcn.140027a30
xor eax, eax
mov rcx, qword [rsp + 0x6b0]
xor rcx, rsp
call fcn.1400a23f0
lea r11, [rsp + 0x6c0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
cmp r15d, 1
je 0x140027e65
movzx ecx, word [r14]
mov r9, r14
mov rax, r14
test cx, cx
je 0x140027d61
nop word [rax + rax]
cmp cx, 0x2f
je 0x140027d52
cmp cx, 0x5c
je 0x140027d52
add rax, 2
jmp 0x140027d59
lea r9, [rax + 2]
mov rax, r9
movzx ecx, word [rax]
test cx, cx
jne 0x140027d40
lea rdx, [rsp + 0x290]
mov rcx, r14
sub rdx, r14
nop
movzx eax, word [rcx]
mov word [rcx + rdx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x140027d70
cmp r9, r14
jne 0x140027d8f
mov word [rsp + 0x290], si
jmp 0x140027dd3
mov rax, r9
sub rax, r14
sar rax, 1
add rax, rax
cmp rax, 0x208
jae 0x140028073
mov word [rsp + rax + 0x290], si
movzx eax, word [rsp + 0x290]
cmp ax, 0x2f
je 0x140027e01
cmp ax, 0x5c
je 0x140027e01
test ax, ax
je 0x140027dd3
cmp word [rsp + 0x292], 0x3a
je 0x140027e01
mov qword [rsp + 0x20], r9
lea rbx, [rdi + 0x250]
mov r8, rbx
lea r9, [rsp + 0x290]
lea rdx, str._s_s_s
lea rcx, [rsp + 0x4a0]
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x140027e21
lea r8, [rsp + 0x290]
lea rdx, str._s_s
lea rcx, [rsp + 0x4a0]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rbx, rsi
lea rdx, [rsp + 0x290]
mov rcx, rbx
call fcn.140027a30
mov eax, dword [rsp + 0x26c]
lea rcx, [rsp + 0x4a0]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp r14, 0xffffffffffffffff
jne 0x140027e75
mov eax, 0x200
jmp 0x140027cf5
mov rdx, qword [rdi + 0x240]
mov rcx, qword [rdi]
call fcn.140026ac0
cmp qword [rdi + 0x248], rsi
jne 0x140027ea0
mov ecx, 0x4000
call fcn.1400a2ca4
mov qword [rdi + 0x248], rax
nop
mov rdx, qword [rdi + 0x248]
lea r9, [rsp + 0x50]
mov rcx, qword [rdi]
mov r8d, 0x4000
call fcn.140026ce0
mov ebx, eax
cmp eax, 0xffffff96
je 0x140027f24
test eax, eax
js 0x140027ef3
jle 0x140027ee8
mov rdx, qword [rdi + 0x248]
lea r9, [rsp + 0x54]
mov r8d, eax
mov qword [rsp + 0x20], rsi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140027efa
cmp byte [rsp + 0x50], sil
jne 0x140027f01
test ebx, ebx
jne 0x140027ea0
mov esi, 0x5000000
jmp 0x140027f29
mov esi, 0x400
jmp 0x140027f29
lea r9, [rsp + 0x280]
mov rcx, r14
lea r8, [rsp + 0x270]
lea rdx, [rsp + 0x278]
call qword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x140027f29
mov esi, 0x1000
cmp r15d, 1
je 0x140027f38
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi]
call fcn.140027060
mov eax, esi
jmp 0x140027cf5
mov eax, dword [rcx + 8]
cmp ebp, eax
je 0x140028013
cmp eax, 0xffffffff
je 0x140027f5f
mov rcx, qword [rcx]
call fcn.140027060
mov rbx, qword [rdi]
mov dword [rdi + 8], 0xffffffff
cmp ebp, dword [rbx + 8]
jge 0x140028054
xor esi, esi
cmp ebp, dword [rbx + 0x14]
jge 0x140027fa8
test rbx, rbx
je 0x140027fa8
mov eax, dword [rbx + 0x28]
lea r8, [rbx + 0x7c]
lea rdx, [rbx + 0x2c]
mov dword [rbx + 0x18], eax
xor r9d, r9d
mov dword [rbx + 0x14], esi
mov rcx, rbx
mov dword [rsp + 0x20], esi
call fcn.140026160
mov ecx, esi
test eax, eax
sete cl
mov dword [rbx + 0x1c], ecx
mov rbx, qword [rdi]
cmp dword [rbx + 0x14], ebp
jge 0x140028001
test rbx, rbx
je 0x140027ff9
cmp dword [rbx + 0x1c], esi
je 0x140027ff9
mov edx, dword [rbx + 0x14]
inc edx
cmp edx, dword [rbx + 8]
je 0x140027ff9
mov ecx, dword [rbx + 0x54]
lea r8, [rbx + 0x7c]
add ecx, dword [rbx + 0x50]
xor r9d, r9d
mov eax, dword [rbx + 0x4c]
add eax, 0x2e
mov dword [rbx + 0x14], edx
add ecx, eax
mov dword [rsp + 0x20], esi
add dword [rbx + 0x18], ecx
lea rdx, [rbx + 0x2c]
mov rcx, rbx
call fcn.140026160
mov ecx, esi
test eax, eax
sete cl
mov dword [rbx + 0x1c], ecx
mov rbx, qword [rdi]
cmp dword [rbx + 0x14], ebp
jl 0x140027fb0
mov rdx, qword [rdi + 0x240]
mov rcx, rbx
call fcn.140026ac0
mov dword [rdi + 8], ebp
mov rcx, qword [rdi]
lea r9, [rsp + 0x50]
mov r8d, r12d
mov rdx, r14
call fcn.140026ce0
mov ebx, eax
test eax, eax
jg 0x14002803b
mov rcx, qword [rdi]
call fcn.140027060
mov dword [rdi + 8], 0xffffffff
cmp byte [rsp + 0x50], 0
jne 0x140027cf3
test ebx, ebx
jle 0x14002805e
mov eax, 0x600
jmp 0x140027cf5
mov eax, 0x10000
jmp 0x140027cf5
cmp ebx, 0xffffff96
mov eax, 0x5000000
mov ecx, 0x1000
cmove eax, ecx
jmp 0x140027cf5
call fcn.1400a2dbc
int3