Function at 0x10043a270
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x278]
sub rsp, 0x360
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov rax, qword [0x100499010]
xor rax, rsp
mov qword [rbp + 0x250], rax
xor edx, edx
mov r8d, 0x224
lea rcx, [rbp + 0x20]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x80
lea rcx, [rbp - 0x60]
call sub.VCRUNTIME140.dll_memset
xor r12d, r12d
mov dword [rsp + 0x40], r12d
mov dword [rsp + 0x44], r12d
mov dword [rsp + 0x48], r12d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], r12w
lea r8d, [r12 + 0x10]
lea rdx, str.WorkingDirectory
lea rcx, [rsp + 0x50]
call fcn.10040da90
nop
call fcn.10044da70
mov rcx, rax
lea r8, [rsp + 0x50]
lea rdx, [rbp - 0x80]
call fcn.10040a3c0
nop
lea r9, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae r9, qword [rbp - 0x80]
mov edx, 0x112
mov r8d, edx
lea rcx, [rbp + 0x20]
lea rax, [rbp + 0x20]
sub r9, rax
lea rax, [r8 + 0x7ffffeec]
test rax, rax
je 0x10043a374
movzx eax, word [rcx + r9]
test ax, ax
je 0x10043a374
mov word [rcx], ax
add rcx, 2
sub r8, 1
jne 0x10043a351
lea rax, [rcx - 2]
test r8, r8
cmovne rax, rcx
mov word [rax], r12w
mov rcx, rdx
lea rax, [rbp + 0x20]
nop word [rax + rax]
cmp word [rax], 0
je 0x10043a3a0
add rax, 2
sub rcx, 1
jne 0x10043a390
mov rax, rdx
sub rax, rcx
mov r8, r12
test rcx, rcx
cmovne r8, rax
je 0x10043a403
sub rdx, r8
lea rcx, [rbp + 0x20]
lea rcx, [rcx + r8*2]
je 0x10043a3f4
lea rax, [r8 + 0x7ffffeec]
add rax, rdx
lea r9, str.SQLCACHE.BIN
sub r9, rcx
test rax, rax
je 0x10043a3f4
movzx r8d, word [rcx + r9]
test r8w, r8w
je 0x10043a3f4
mov word [rcx], r8w
add rcx, 2
dec rax
sub rdx, 1
jne 0x10043a3d3
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], r12w
mov r9d, dword [0x1004a921c]
mov dword [rsp + 0x44], r9d
test r9d, r9d
je 0x10043a430
xor edx, edx
lea ecx, [rdx + 2]
lea r8d, [rdx + 0x75]
call fcn.100432180
xor ecx, ecx
call fcn.10043a0a0
mov r9d, dword [0x1004a921c]
mov dword [rsp + 0x44], r9d
test r9d, r9d
je 0x10043a8d2
xor edx, edx
lea ecx, [rdx + 2]
lea r8d, [rdx + 0x76]
call fcn.100432180
lea rcx, [rbp + 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcslwr]
mov r9, rax
xor edx, edx
lea ecx, [rdx + 2]
lea r8d, [rdx + 0x77]
call fcn.100432180
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x100080
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x10043a7f6
lea rdi, [0x1004793e8]
mov rbx, r12
movzx ecx, word [0x100472a38]
cmp cx, word [0x100472884]
jne 0x10043a4cc
movzx eax, word [0x100472a3a]
cmp ax, word [0x100472886]
je 0x10043a616
lea rdx, [0x100472a38]
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x10043a616
mov ecx, 0x82
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x10043a616
xor edx, edx
mov r8d, 0x80
lea rcx, [rbp - 0x60]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x80
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
lea rdx, [0x100472a38]
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov rsi, 0xffffffffffffffff
test rax, rax
je 0x10043a5d4
sub rax, rdi
sar rax, 1
cdqe
lea r14, [rax + rax]
mov r9, r14
mov r8, rdi
mov edx, 0x82
mov rcx, rbx
call fcn.10044c240
mov word [r14 + rbx], r12w
mov rax, rsi
inc rax
cmp word [rbx + rax*2], 0
jne 0x10043a564
lea rdx, [rbp - 0x60]
mov rcx, rsi
inc rcx
cmp word [rdx + rcx*2], 0
jne 0x10043a575
add rax, rcx
cmp rax, 0x40
jae 0x10043a5ce
mov r8, rbx
mov edx, 0x80
lea rcx, [rbp - 0x60]
call fcn.10042b640
lea r8, [0x100472884]
mov edx, 0x80
lea rcx, [rbp - 0x60]
call fcn.10042b640
add rdi, 2
add rdi, r14
lea rdx, [0x100472a38]
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
jne 0x10043a53d
cmp word [rdi], 0
je 0x10043a627
mov rax, rsi
nop word [rax + rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x10043a5e0
lea rcx, [rbp - 0x60]
nop
inc rsi
cmp word [rcx + rsi*2], 0
jne 0x10043a5f0
add rax, rsi
cmp rax, 0x40
jae 0x10043a627
mov r8, rdi
mov edx, 0x40
lea rcx, [rbp - 0x60]
call fcn.10040d600
jmp 0x10043a627
mov r8, rdi
mov edx, 0x80
lea rcx, [rbp - 0x60]
call fcn.10040b320
test rbx, rbx
je 0x10043a635
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, [rbp - 0x60]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtol]
mov r10d, eax
mov eax, 0x14f8b589
imul r10d
mov r9d, edx
sar r9d, 0xd
mov ecx, r9d
shr ecx, 0x1f
add r9d, ecx
imul ecx, r9d, 0x186a0
mov r8d, r10d
sub r8d, ecx
mov eax, 0x10624dd3
imul r8d
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, r9d, 0x64
add edx, ecx
lea ecx, [rdx + rdx*4]
add ecx, ecx
mov eax, 0x10624dd3
imul r10d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
sub ecx, edx
imul eax, ecx, 0x3e8
add r10d, eax
mov dword [rsp + 0x48], r10d
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x40]
mov r8d, 4
lea rdx, [rsp + 0x48]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x40]
mov r8d, 4
lea rdx, [rsp + 0x44]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
call fcn.1004342d0
movzx ebx, al
lea rcx, [0x1004a9188]
mov rax, qword [0x1004a90d0]
call qword [case.0x10044bd0b.0]
test eax, eax
jne 0x10043a72e
cmp dword [0x1004a8ebc], eax
je 0x10043a721
test bl, bl
je 0x10043a721
lea rdx, str.StoreOperationCache
lea rcx, str.__s_____Waiting_for_CritSec__n
call fcn.10043bdc0
lea rcx, [0x1004a9188]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x1004a8ebc], 0
je 0x10043a74e
test bl, bl
je 0x10043a74e
lea rdx, str.StoreOperationCache
lea rcx, str.__s_____Enters_CritSec__n
call fcn.10043bdc0
mov edi, r12d
cmp dword [0x1004a921c], r12d
jle 0x10043a7b8
nop word [rax + rax]
mov edx, edi
lea rcx, [0x1004a9210]
call qword [sym.imp.SQLSVC.dll_SHRecMemLock]
mov rbx, rax
test rax, rax
je 0x10043a7ae
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x40]
mov r8d, 0x20
mov rdx, rax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x40]
mov r8d, dword [rbx + 8]
mov rdx, qword [rbx + 0x10]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
inc edi
cmp edi, dword [0x1004a921c]
jl 0x10043a760
call fcn.1004342d0
movzx ebx, al
lea rcx, [0x1004a9188]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [0x1004a8ebc], 0
je 0x10043a7ed
test bl, bl
je 0x10043a7ed
lea rdx, str.StoreOperationCache
lea rcx, str.__s_____Leaves_CritSec__n
call fcn.10043bdc0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.1004342d0
movzx ebx, al
lea rcx, [0x1004a9188]
mov rax, qword [0x1004a90d0]
call qword [case.0x10044bd0b.0]
test eax, eax
jne 0x10043a842
cmp dword [0x1004a8ebc], eax
je 0x10043a835
test bl, bl
je 0x10043a835
lea rdx, str.StoreOperationCache
lea rcx, str.__s_____Waiting_for_CritSec__n
call fcn.10043bdc0
lea rcx, [0x1004a9188]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x1004a8ebc], 0
je 0x10043a862
test bl, bl
je 0x10043a862
lea rdx, str.StoreOperationCache
lea rcx, str.__s_____Enters_CritSec__n
call fcn.10043bdc0
mov ebx, r12d
cmp dword [0x1004a921c], ebx
jle 0x10043a89c
nop dword [rax]
mov edx, ebx
lea rcx, [0x1004a9210]
call qword [sym.imp.SQLSVC.dll_SHRecMemLock]
test rax, rax
je 0x10043a892
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x10043a892
call fcn.10043b3b0
inc ebx
cmp ebx, dword [0x1004a921c]
jl 0x10043a870
call fcn.1004342d0
movzx ebx, al
lea rcx, [0x1004a9188]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [0x1004a8ebc], 0
je 0x10043a8d2
test bl, bl
je 0x10043a8d2
lea rdx, str.StoreOperationCache
lea rcx, str.__s_____Leaves_CritSec__n
call fcn.10043bdc0
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x10043a915
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x10043a910
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x10043a910
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.100469388
movdqa xmm0, xmmword [0x100482320]
movdqu xmmword [rbp - 0x70], xmm0
mov word [rbp - 0x80], r12w
mov rcx, qword [rbp + 0x250]
xor rcx, rsp
call fcn.100469360
lea r11, [rsp + 0x360]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret