Function at 0x410fb0
Capabilities:
Write file on windows

Disassembly:
push rbp
sub rsp, 0xaf0
mov rbp, rsp
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x938], 0
mov qword [rbp + 0x930], 0
mov qword [rbp + 0x928], 0
mov qword [rbp + 0x920], 0
mov qword [rbp + 0x918], 0
mov qword [rbp + 0xb00], rcx
mov qword [rbp + 0xb08], rdx
mov qword [rbp + 0xb10], r8
mov rcx, qword [rbp + 0xb08]
call fcn.00409bc0
mov rcx, qword [rbp + 0xb10]
call fcn.00409bc0
nop
mov dword [rbp + 0xaec], 0
lea rcx, [rbp + 0x930]
mov rdx, qword [rbp + 0xb08]
call fcn.00409fd0
lea rcx, [rbp + 0x88]
lea rdx, [0x00431196]
call fcn.0040b020
mov rcx, qword [rbp + 0x88]
mov rdx, qword [rbp + 0x930]
mov r8d, 1
call fcn.0040b520
lea rcx, [rbp + 0x928]
mov rdx, qword [rbp + 0x930]
mov r8d, 1
mov r9d, eax
sub r9d, 1
call fcn.0040b440
lea rcx, [rbp + 0x80]
lea rdx, [0x00431196]
call fcn.0040b020
mov rcx, qword [rbp + 0x80]
mov rdx, qword [rbp + 0x930]
mov r8d, 1
call fcn.0040b520
mov dword [rbp + 0x9c], eax
mov dword [rbp + 0xa0], 0
cmp qword [rbp + 0x930], 0
je 0x411115
mov rax, qword [rbp + 0x930]
mov eax, dword [rax - 4]
mov dword [rbp + 0xa0], eax
lea rcx, [rbp + 0x78]
lea rdx, [0x00431196]
call fcn.0040b020
mov rcx, qword [rbp + 0x78]
mov rdx, qword [rbp + 0x930]
mov r8d, 1
call fcn.0040b520
lea rcx, [rbp + 0x920]
mov rdx, qword [rbp + 0x930]
mov r8d, dword [rbp + 0x9c]
mov r9d, dword [rbp + 0xa0]
sub r9d, eax
add r9d, 1
call fcn.0040b440
mov cx, 0x101
lea rdx, [rbp + 0x950]
mov rax, qword [0x00432f18]
call qword [rax]
mov ecx, 2
mov edx, 1
mov r8d, 6
mov rax, qword [0x00432de0]
call qword [rax]
mov rcx, qword [rbp + 0xb00]
mov qword [rcx + 0x38], rax
mov rcx, qword [rbp + 0x928]
call fcn.00410d30
test al, al
jne 0x4111d0
lea rcx, [rbp + 0x70]
mov rdx, qword [rbp + 0x928]
xor r8, r8
call fcn.0040ac80
lea rcx, [rbp + 0x938]
mov rdx, qword [rbp + 0x70]
call fcn.00410e10
jmp 0x4111e3
lea rcx, [rbp + 0x938]
mov rdx, qword [rbp + 0x928]
call fcn.00409fd0
mov word [rbp + 0x940], 2
movzx rcx, word [0x00439334]
mov rax, qword [0x00432e50]
call qword [rax]
mov word [rbp + 0x942], ax
lea rcx, [rbp + 0x68]
mov rdx, qword [rbp + 0x938]
xor r8, r8
call fcn.0040ac80
mov rcx, qword [rbp + 0x68]
call fcn.0040aaa0
mov rcx, rax
mov rax, qword [0x00432da8]
call qword [rax]
mov dword [rbp + 0x944], eax
mov rax, qword [rbp + 0xb00]
mov rcx, qword [rax + 0x38]
lea rdx, [rbp + 0x940]
mov r8d, 0x10
mov rax, qword [0x00432d98]
call qword [rax]
cmp eax, 0xffffffff
je 0x4115cf
lea rcx, [rbp + 0x60]
mov edx, 0xa
lea r8, [0x004116b4]
mov r9, qword [rbp + 0x920]
lea rax, [0x004116cc]
mov qword [rsp + 0x20], rax
mov rax, qword [0x004392e8]
mov qword [rsp + 0x28], rax
lea rax, [0x0041176c]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0x928]
mov qword [rsp + 0x38], rax
lea rax, [0x0041178c]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x928]
mov qword [rsp + 0x48], rax
mov rax, qword [rbp + 0x920]
mov qword [rsp + 0x50], rax
lea rax, [0x00411808]
mov qword [rsp + 0x58], rax
call fcn.0040b350
lea rcx, [rbp + 0x918]
mov rdx, qword [rbp + 0x60]
xor r8, r8
call fcn.0040ac80
lea rcx, [rbp + 0x106]
mov edx, 0x802
xor r8, r8
call fcn.00405ca0
lea rcx, [rbp + 0x918]
call fcn.0040a260
mov qword [rbp + 0x90], rax
mov dword [rbp + 0x98], 0
cmp qword [rbp + 0x918], 0
je 0x411336
mov rax, qword [rbp + 0x918]
mov eax, dword [rax - 4]
mov dword [rbp + 0x98], eax
mov rax, qword [rbp + 0xb00]
mov rcx, qword [rax + 0x38]
mov rdx, qword [rbp + 0x90]
mov r8d, dword [rbp + 0x98]
xor r9, r9
mov rax, qword [0x00432e20]
call qword [rax]
cmp eax, 0xffffffff
je 0x4115cf
lea rcx, [rbp + 0x106]
mov edx, 0x802
xor r8, r8
call fcn.00405ca0
mov rax, qword [rbp + 0xb00]
mov rcx, qword [rax + 0x38]
lea rdx, [rbp + 0x106]
mov r8d, 0x28
xor r9, r9
mov rax, qword [0x00432e60]
call qword [rax]
mov dword [rbp + 0x910], eax
mov dword [rbp + 0x914], 1
mov rax, qword [rbp + 0xb00]
mov rcx, qword [rax + 0x38]
lea rdx, [rbp + 0xa7]
mov r8d, 1
xor r9, r9
mov rax, qword [0x00432e60]
call qword [rax]
mov rax, qword [rbp + 0xb00]
mov rcx, qword [rax + 0x38]
lea rdx, [rbp + 0xa6]
mov r8d, 1
xor r9, r9
mov rax, qword [0x00432e60]
call qword [rax]
mov rax, qword [rbp + 0xb00]
mov rcx, qword [rax + 0x38]
lea rdx, [rbp + 0xa5]
mov r8d, 1
xor r9, r9
mov rax, qword [0x00432e60]
call qword [rax]
cmp byte [rbp + 0xa7], 0x50
jne 0x41143f
cmp byte [rbp + 0xa6], 0x4e
jne 0x41143f
cmp byte [rbp + 0xa5], 0x47
jne 0x41143f
mov dword [rbp + 0x90c], 0
jmp 0x4114a4
cmp byte [rbp + 0xa7], 0x4e
jne 0x411466
cmp byte [rbp + 0xa6], 0x47
jne 0x411466
cmp byte [rbp + 0xa5], 0xd
jne 0x411466
mov dword [rbp + 0x90c], 0xffffffff
jmp 0x4114a4
cmp byte [rbp + 0xa7], 0x47
jne 0x41148d
cmp byte [rbp + 0xa6], 0xd
jne 0x41148d
cmp byte [rbp + 0xa5], 0xa
jne 0x41148d
mov dword [rbp + 0x90c], 0xfffffffe
jmp 0x4114a4
add dword [rbp + 0x914], 1
cmp dword [rbp + 0x914], 0x12d
jne 0x4113ac
nop
lea rcx, [rbp + 0xa8]
mov edx, 0x5e
xor r8, r8
call fcn.00405ca0
mov rax, qword [rbp + 0xb00]
mov rcx, qword [rax + 0x38]
lea rdx, [rbp + 0xa8]
mov r8d, dword [rbp + 0x90c]
add r8d, 0x5e
xor r9, r9
mov rax, qword [0x00432e60]
call qword [rax]
mov dword [rbp + 0x910], eax
mov rcx, qword [rbp + 0xb10]
call fcn.0040ae00
mov rcx, rax
mov edx, 0x40000000
mov r8d, 2
xor r9, r9
mov dword [rsp + 0x20], 2
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov rcx, qword [rbp + 0xb00]
mov qword [rcx + 0x30], rax
mov rax, qword [rbp + 0xb00]
cmp qword [rax + 0x30], 0xffffffffffffffff
je 0x4115cf
lea rcx, [rbp + 0x106]
mov edx, 0x802
xor r8, r8
call fcn.00405ca0
mov rax, qword [rbp + 0xb00]
mov rcx, qword [rax + 0x38]
lea rdx, [rbp + 0x106]
mov r8d, 0x802
xor r9, r9
mov rax, qword [0x00432e60]
call qword [rax]
mov dword [rbp + 0x910], eax
mov eax, dword [rbp + 0x910]
add dword [rbp + 0xaec], eax
mov rax, qword [rbp + 0xb00]
mov rcx, qword [rax + 0x30]
lea rdx, [rbp + 0x106]
mov r8d, dword [rbp + 0x910]
lea r9, [rbp + 0x908]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
cmp dword [rbp + 0x910], 0xffffffff
je 0x4115ce
cmp dword [rbp + 0x910], 0
jne 0x411540
nop
lea rcx, [rbp + 0x60]
call fcn.004099f0
lea rcx, [rbp + 0x68]
mov edx, 2
call fcn.00409b20
lea rcx, [rbp + 0x78]
mov edx, 3
call fcn.00409ad0
lea rcx, [rbp + 0x918]
call fcn.00409a40
lea rcx, [rbp + 0x920]
mov edx, 4
call fcn.00409ad0
lea rcx, [rbp + 0xb08]
mov edx, 2
call fcn.00409ad0
mov eax, dword [rbp + 0xaec]
lea rsp, [rbp + 0xaf0]
pop rbp
ret