Function at 0x7ff6c0909fb0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
mov qword [rsp + 0x20], r9
push rdi
sub rsp, 0x890
mov rax, qword [0x7ff6c0922058]
xor rax, rsp
mov qword [rsp + 0x880], rax
cmp dword [rsp + 0x8a8], 0
jl 0x7ff6c0909ffe
mov rax, qword [rsp + 0x8a0]
mov eax, dword [rax + 0x438]
cmp dword [rsp + 0x8a8], eax
jl 0x7ff6c090a003
jmp 0x7ff6c090a2cc
movsxd rax, dword [rsp + 0x8a8]
imul rax, rax, 0x218
mov rcx, qword [rsp + 0x8a0]
lea rax, [rcx + rax + 8]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0
jne 0x7ff6c090a033
jmp 0x7ff6c090a2cc
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.DLL_GetLocalTime]
movzx eax, word [rsp + 0x76]
mov rcx, qword [rsp + 0x40]
cmp eax, dword [rcx + 0x104]
jne 0x7ff6c090a078
movzx eax, word [rsp + 0x72]
mov rcx, qword [rsp + 0x40]
cmp eax, dword [rcx + 0x108]
jne 0x7ff6c090a078
movzx eax, word [rsp + 0x70]
mov rcx, qword [rsp + 0x40]
cmp eax, dword [rcx + 0x10c]
je 0x7ff6c090a1b3
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x210]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
movzx eax, word [rsp + 0x76]
mov rcx, qword [rsp + 0x40]
mov dword [rcx + 0x104], eax
movzx eax, word [rsp + 0x72]
mov rcx, qword [rsp + 0x40]
mov dword [rcx + 0x108], eax
movzx eax, word [rsp + 0x70]
mov rcx, qword [rsp + 0x40]
mov dword [rcx + 0x10c], eax
mov rax, qword [rsp + 0x40]
add rax, 4
mov rcx, qword [rsp + 0x40]
add rcx, 0x110
mov rdx, qword [rsp + 0x40]
mov edx, dword [rdx + 0x104]
mov dword [rsp + 0x28], edx
mov rdx, qword [rsp + 0x40]
mov edx, dword [rdx + 0x108]
mov dword [rsp + 0x20], edx
mov rdx, qword [rsp + 0x40]
mov r9d, dword [rdx + 0x10c]
mov r8, rax
lea rdx, [0x7ff6c091a738]
call qword [sym.imp.USER32.dll_wsprintfA]
mov rax, qword [rsp + 0x40]
add rax, 0x110
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 1
mov edx, 0x40000000
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_CreateFileA]
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 0x210], rax
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x210], 0xffffffffffffffff
jne 0x7ff6c090a16f
mov rax, qword [rsp + 0x40]
mov dword [rax], 0
jmp 0x7ff6c090a2cc
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x210]
call qword [sym.imp.KERNEL32.DLL_SetFilePointer]
cmp eax, 0xffffffff
jne 0x7ff6c090a1b3
mov rax, qword [rsp + 0x40]
mov dword [rax], 0
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x210]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x7ff6c090a2cc
lea rax, [rsp + 0x480]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
lea rax, [rsp + 0x8b8]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x8b0]
mov qword [rsp + 0x68], rax
call fcn.7ff6c090a2f0
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], 0
mov r9, qword [rsp + 0x68]
mov r8d, 0x400
lea rdx, [rsp + 0x480]
mov rcx, qword [rax]
call qword [sym.imp.ucrtbase.dll___stdio_common_vsprintf_s]
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0
jge 0x7ff6c090a234
mov dword [rsp + 0x4c], 0xffffffff
jmp 0x7ff6c090a23c
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x4c], eax
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x80]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
movzx eax, word [rsp + 0x7c]
movzx ecx, word [rsp + 0x7a]
movzx edx, word [rsp + 0x78]
lea rdi, [rsp + 0x480]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
mov r9d, ecx
mov r8d, edx
lea rdx, [0x7ff6c091a750]
lea rcx, [rsp + 0x80]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rsp + 0x80]
call sub.ucrtbase.dll_strlen
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x58]
mov r8d, eax
lea rdx, [rsp + 0x80]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x210]
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov rcx, qword [rsp + 0x880]
xor rcx, rsp
call fcn.7ff6c0917700
add rsp, 0x890
pop rdi
ret