Function at 0x10004e1b8
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
mov rax, qword [0x1000af140]
xor rax, rsp
mov qword [rsp + 0xa8], rax
xor ebp, ebp
lea rcx, [r11 - 0x74]
xor edx, edx
lea r8d, [rbp + 0x28]
mov dword [rsp + 0x60], ebp
call sub.msvcrt.dll_memset
mov rcx, qword [0x1000bafc8]
lea rdx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_GetWindowPlacement]
mov r12d, 0x98
mov rcx, r12
call fcn.1000a1c84
cmp rax, rbp
je 0x10004e230
mov rcx, rax
call fcn.10006d000
mov rbx, rax
jmp 0x10004e233
mov rbx, rbp
lea rdx, [0x10001a570]
mov rcx, rbx
call fcn.10006e94c
mov rcx, r12
call fcn.1000a1c84
cmp rax, rbp
je 0x10004e25c
mov rcx, rax
call fcn.10006d000
mov r13, rax
jmp 0x10004e25f
mov r13, rbp
lea rdx, [0x10001f4a0]
mov rcx, r13
call fcn.10006e94c
mov r9d, dword [rsp + 0x7c]
lea rsi, [0x10001b684]
mov r14d, 0xa
lea rcx, [rsp + 0x90]
mov r8, rsi
mov rdx, r14
call sub.msvcrt.dll_swprintf_s
lea rdx, [rsp + 0x90]
mov rcx, r13
call fcn.10006eb54
mov rcx, r12
call fcn.1000a1c84
cmp rax, rbp
je 0x10004e2bd
mov rcx, rax
call fcn.10006d000
mov rdi, rax
jmp 0x10004e2c0
mov rdi, rbp
lea rdx, [0x10001f4b0]
mov rcx, rdi
mov qword [rsp + 0x58], rdi
call fcn.10006e94c
mov r9d, dword [rsp + 0x80]
lea rcx, [rsp + 0x90]
mov r8, rsi
mov rdx, r14
call sub.msvcrt.dll_swprintf_s
lea rdx, [rsp + 0x90]
mov rcx, rdi
call fcn.10006eb54
mov rcx, qword [0x1000bafc8]
lea rdx, [rsp + 0x48]
call qword [sym.imp.USER32.dll_GetClientRect]
mov rax, qword [0x1000bb040]
mov edx, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x50]
sub edx, dword [rsp + 0x4c]
mov qword [rsp + 0x28], rax
mov rax, qword [0x1000bafc8]
sub ecx, dword [rsp + 0x48]
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x44]
mov qword [rsp + 0x20], rax
call fcn.1000685dc
mov r11d, dword [rsp + 0x50]
mov eax, dword [rsp + 0x54]
sub r11d, dword [rsp + 0x48]
sub eax, dword [rsp + 0x4c]
mov rcx, r12
sub r11d, dword [rsp + 0x44]
sub eax, dword [rsp + 0x38]
add dword [rsp + 0x84], r11d
add dword [rsp + 0x88], eax
call fcn.1000a1c84
cmp rax, rbp
je 0x10004e38c
mov rcx, rax
call fcn.10006d000
mov r15, rax
jmp 0x10004e38f
mov r15, rbp
lea rdx, [0x10001f4c0]
mov rcx, r15
call fcn.10006e94c
mov r9d, dword [rsp + 0x84]
lea rcx, [rsp + 0x90]
sub r9d, dword [rsp + 0x7c]
mov r8, rsi
mov rdx, r14
call sub.msvcrt.dll_swprintf_s
lea rdx, [rsp + 0x90]
mov rcx, r15
call fcn.10006eb54
mov rcx, r12
call fcn.1000a1c84
cmp rax, rbp
je 0x10004e3e8
mov rcx, rax
call fcn.10006d000
mov r14, rax
jmp 0x10004e3eb
mov r14, rbp
lea rdx, [0x10001f4d8]
mov rcx, r14
call fcn.10006e94c
mov r9d, dword [rsp + 0x88]
lea rcx, [rsp + 0x90]
sub r9d, dword [rsp + 0x80]
mov r8, rsi
mov edx, 0xa
call sub.msvcrt.dll_swprintf_s
lea rdx, [rsp + 0x90]
mov rcx, r14
call fcn.10006eb54
mov rcx, r12
call fcn.1000a1c84
cmp rax, rbp
je 0x10004e449
mov rcx, rax
call fcn.10006d000
mov rsi, rax
jmp 0x10004e44c
mov rsi, rbp
lea rdx, [0x10001f4f8]
mov rcx, rsi
call fcn.10006e94c
mov rcx, qword [0x1000bafc8]
call qword [sym.imp.USER32.dll_IsIconic]
cmp eax, ebp
je 0x10004e47d
test byte [rsp + 0x64], 2
je 0x10004e47d
mov edi, 1
mov cl, dil
jmp 0x10004e498
mov rcx, qword [0x1000bafc8]
call qword [sym.imp.USER32.dll_IsZoomed]
movzx ecx, bpl
mov edi, 1
cmp eax, ebp
cmovne ecx, edi
cmp cl, bpl
lea rax, [0x10001b5e0]
lea rdx, [0x10001f50c]
cmovne rdx, rax
mov rcx, rsi
call fcn.10006eb54
mov rcx, r12
call fcn.1000a1c84
cmp rax, rbp
je 0x10004e4cf
mov rcx, rax
call fcn.10006d000
mov r12, rax
jmp 0x10004e4d2
mov r12, rbp
lea rdx, [0x10001f510]
mov rcx, r12
call fcn.10006e94c
mov r9d, dword [0x1000b6e60]
lea r8, [0x10001b684]
lea rcx, [rsp + 0x90]
mov edx, 0xa
call sub.msvcrt.dll_swprintf_s
lea rdx, [rsp + 0x90]
mov rcx, r12
call fcn.10006eb54
mov ecx, 0x98
call fcn.1000a1c84
cmp rax, rbp
je 0x10004e52b
mov rcx, rax
call fcn.10006d000
mov rbp, rax
lea rdx, [0x10001f520]
mov rcx, rbp
call fcn.10006e94c
mov r9d, dword [0x1000b6e64]
lea r8, [0x10001b684]
lea rcx, [rsp + 0x90]
mov edx, 0xa
call sub.msvcrt.dll_swprintf_s
lea rdx, [rsp + 0x90]
mov rcx, rbp
call fcn.10006eb54
mov ecx, 0x98
call fcn.1000a1c84
test rax, rax
je 0x10004e583
mov rcx, rax
call fcn.10006d000
jmp 0x10004e585
xor eax, eax
lea rdx, [0x10001f530]
mov rcx, rax
mov qword [rsp + 0x38], rax
call fcn.10006e94c
mov r11, qword [0x1000bb030]
mov rcx, qword [rsp + 0x38]
cmp byte [r11 + 0x12c], 0
lea rax, [0x10001ef90]
lea rdx, [0x10001ef68]
cmovne rdx, rax
call fcn.10006eb54
or r8d, 0xffffffff
mov rdx, r13
mov rcx, rbx
call fcn.10006ebf0
mov rdx, qword [rsp + 0x58]
or r13d, 0xffffffff
mov r8d, r13d
mov rcx, rbx
call fcn.10006ebf0
mov r8d, r13d
mov rdx, r15
mov rcx, rbx
call fcn.10006ebf0
mov r8d, r13d
mov rdx, r14
mov rcx, rbx
call fcn.10006ebf0
mov r8d, r13d
mov rdx, rsi
mov rcx, rbx
call fcn.10006ebf0
mov rdx, qword [rsp + 0x38]
mov r8d, r13d
mov rcx, rbx
call fcn.10006ebf0
mov r8d, r13d
mov rdx, r12
mov rcx, rbx
call fcn.10006ebf0
mov r8d, r13d
mov rdx, rbp
mov rcx, rbx
call fcn.10006ebf0
xor r12d, r12d
lea r8, [rsp + 0x44]
lea rdx, [rsp + 0x38]
mov rcx, rbx
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x44], r12d
call fcn.10006eca4
cmp rbx, r12
je 0x10004e671
mov rcx, rbx
call fcn.10006d08c
mov rcx, rbx
call sub.msvcrt.dll_free
cmp byte [0x1000bb01d], r12b
lea rax, [0x10001f580]
lea rcx, [0x10001f558]
cmove rcx, rax
xor r9d, r9d
xor edx, edx
lea r13d, [r9 + 0x1c]
mov dword [rsp + 0x20], r12d
mov r8d, r13d
call fcn.10004fe74
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x10004e6d5
mov rcx, qword [rsp + 0x38]
call sub.msvcrt.dll_free
lea r9, [0x10001f5a0]
lea r8, [0x10001f248]
mov edx, 0x94b
mov ecx, 0x800
call fcn.100065cf8
jmp 0x10004e79b
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x30]
mov r8d, 2
mov rcx, rax
mov dword [rsp + 0x40], r12d
mov byte [rsp + 0x30], 0xff
mov byte [rsp + 0x31], 0xfe
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, r12d
je 0x10004e766
cmp dword [rsp + 0x40], 2
jne 0x10004e766
mov ebp, dword [rsp + 0x44]
mov rsi, qword [rsp + 0x38]
lea r9, [rsp + 0x40]
lea r8d, [rbp + rbp]
mov rdx, rsi
mov rcx, rbx
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, r12d
je 0x10004e750
mov eax, dword [rsp + 0x40]
mov r9, rbp
add r9, r9
cmp rax, r9
jne 0x10004e750
mov rcx, rsi
call sub.msvcrt.dll_free
jmp 0x10004e78d
mov rcx, rsi
call sub.msvcrt.dll_free
lea r9, [0x10001f690]
mov edx, 0x962
jmp 0x10004e77c
mov rcx, qword [rsp + 0x38]
call sub.msvcrt.dll_free
lea r9, [0x10001f610]
mov edx, 0x958
lea r8, [0x10001f248]
mov ecx, 0x800
call fcn.100065cf8
mov r8b, dil
mov edx, r13d
mov rcx, rbx
call fcn.10004fb60
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.1000a2150
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret