Function at 0x428bf0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
mov r12d, dword [r8 + 0x110]
mov r13, qword [rsp + 0xf0]
mov r15, rcx
mov rbx, rdx
mov rbp, r8
mov r14, r9
mov rax, qword [rsp + 0x100]
test r12d, r12d
jne 0x428dc0
mov dword [rdx + 8], 3
mov qword [rbx + 0x80], r8
mov qword [rdx + 0x78], 0
mov qword [rdx + 0x70], rax
mov dword [rdx + 0x88], 0
mov qword [rdx + 0xa0], 0
mov qword [rdx + 0xa8], 0xffffffffffffffff
mov qword [rdx + 0x40], 0
mov qword [rdx + 0x48], 0
mov qword [rdx + 0x50], 0
mov qword [rdx + 0x58], 0
test dword [r8 + 0x58], 0x180000
jne 0x428e34
test r13, r13
mov dword [rbx + 0x90], 0
mov qword [rbx + 0x98], 0
je 0x428db0
cmp r13, 1
jne 0x428f00
mov r13d, dword [r14]
mov rsi, qword [r14]
mov rdx, qword [r14 + 8]
mov eax, dword [rbp + 0x58]
mov ecx, eax
and ecx, 0x1100000
cmp ecx, 0x1100000
je 0x428f40
test eax, 0x1000000
je 0x428de1
movabs rax, 0xffffffff00000000
mov qword [rbx + 0x98], rdx
mov qword [rbx + 0x68], 0
and rax, rsi
or rax, r13
mov qword [rbx + 0x90], rax
mov rax, qword [rbp + 0x208]
test rax, rax
je 0x428fe0
mov rax, qword [rax + 0x68]
mov qword [rbx + 0x68], rax
mov rax, qword [rbp + 0x208]
mov qword [rax + 0x68], rbx
mov qword [rbp + 0x208], rbx
mov eax, dword [rbp + 0x100]
test eax, eax
je 0x428ec5
mov qword [rbx + 0x60], r13
add qword [rbp + 0x60], r13
mov eax, dword [rbp + 0x7c]
lea edx, [rax + 1]
test eax, eax
mov dword [rbp + 0x7c], edx
jne 0x428d80
mov eax, dword [rbp + 0x58]
test al, 4
jne 0x428d80
mov edx, eax
or edx, 4
test al, 8
mov dword [rbp + 0x58], edx
je 0x428d80
mov rax, qword [rbp + 8]
add dword [rax + 8], 1
nop dword [rax]
add dword [r15 + 0x20], 1
add dword [rbp + 0x78], 1
add dword [rbp + 0x100], 1
mov eax, r12d
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor edx, edx
xor r13d, r13d
jmp 0x428cc9
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0x20], r13
mov qword [rsp + 0x28], rax
call fcn.004283d0
mov r12d, eax
jmp 0x428d90
test eax, 0x100000
lea rax, [rbx + 0x40]
mov rcx, qword [rbp + 0x118]
mov r9d, 0
mov r8d, r13d
mov qword [rsp + 0x20], rax
je 0x428e61
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x429011
mov qword [rbx + 0x60], 0
mov rcx, qword [rbx + 0xa0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0xa0], 0
jmp 0x428d51
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
test rax, rax
mov qword [rbx + 0xa0], rax
je 0x429145
or rax, 1
mov qword [rbx + 0x58], rax
jmp 0x428c97
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x428ff0
mov qword [rbx + 0x60], 0
test byte [rbp + 0x5a], 8
je 0x428d51
mov rdx, qword [rbx + 0xa0]
lea rcx, [rbx + 0xa8]
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0xffffffff
mov r9, rbx
lea r8, [0x00426280]
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
test eax, eax
jne 0x428d51
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
jmp 0x428d90
mov rdx, qword [rbx + 0x68]
cmp rdx, rbx
je 0x42912a
mov rax, qword [rdx + 0x68]
mov qword [rbx + 0x68], rax
mov r8d, 0x10
lea rcx, [0x00426350]
call qword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
test eax, eax
jne 0x428d49
call fcn.0044a680
nop word [rax + rax]
xor edx, edx
xor r9d, r9d
xor eax, eax
nop word [rax + rax]
shl rax, 4
mov eax, dword [r14 + rax]
add r9, rax
lea eax, [rdx + 1]
cmp r13, rax
mov rdx, rax
ja 0x428f10
mov eax, 0xffffffff
cmp r9, rax
jbe 0x429065
mov r12d, 0x2747
jmp 0x428d90
mov rcx, qword [rbp + 0x118]
lea r9, [rsp + 0x7c]
mov qword [rsp + 0x20], 0
mov r8d, r13d
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x428eb7
mov qword [rbx + 0x60], 0
mov eax, dword [rbp + 0x7c]
lea edx, [rax + 1]
test eax, eax
mov dword [rbp + 0x7c], edx
jne 0x428fa0
mov eax, dword [rbp + 0x58]
test al, 4
jne 0x428fa0
mov edx, eax
or edx, 4
test al, 8
mov dword [rbp + 0x58], edx
je 0x428fa0
mov rax, qword [rbp + 8]
add dword [rax + 8], 1
nop word cs:[rax + rax]
add dword [r15 + 0x20], 1
xor r8d, r8d
xor edx, edx
add dword [rbp + 0x78], 1
lea r9, [rbx + 0x40]
add dword [rbp + 0x100], 1
mov rcx, qword [r15 + 0x38]
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
jne 0x428d90
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x0044e6b0]
mov ecx, eax
call fcn.00416440
nop
mov qword [rbx + 0x68], rbx
mov qword [rbp + 0x208], rbx
jmp 0x428d3b
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rsi
cmp eax, 0x3e5
jne 0x429120
mov qword [rbx + 0x60], r13
add qword [rbp + 0x60], r13
jmp 0x428e77
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rsi
cmp eax, 0x3e5
jne 0x429043
mov qword [rbx + 0x60], r13
add qword [rbp + 0x60], r13
mov edx, 0xffffffff
mov rcx, qword [rbx + 0xa0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x428e17
call rsi
mov rcx, qword [rbx + 0xa0]
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0xa0], 0
jmp 0x428d90
lea rcx, [r9 + 0xb8]
mov qword [rsp + 0x48], r9
call fcn.004109f0
test rax, rax
mov rdi, rax
mov qword [rsp + 0x50], rax
je 0x42913a
mov rsi, rbx
mov ecx, 0x16
lea rax, [rax + 0xb8]
rep movsq qword [rdi], qword [rsi]
mov r9, qword [rsp + 0x48]
mov qword [rax - 8], rbx
xor esi, esi
mov dword [rax - 0x30], 1
mov edi, 0xb8
mov qword [rsp + 0x58], rax
xor ebx, ebx
nop word [rax + rax]
shl rbx, 4
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x48], r9
add rbx, r14
mov r8d, dword [rbx]
mov rdx, qword [rbx + 8]
lea rcx, [rax + rdi]
call sub.msvcrt.dll_memcpy
mov eax, dword [rbx]
lea ebx, [rsi + 1]
mov r9, qword [rsp + 0x48]
mov rsi, rbx
add rdi, rax
cmp r13, rbx
ja 0x4290c0
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x60]
mov r8d, r9d
mov rbx, qword [rsp + 0x50]
call fcn.00410be0
mov rsi, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
mov r13d, esi
jmp 0x428cc9
call rsi
mov r12d, eax
jmp 0x428d90
mov qword [rbp + 0x208], 0
jmp 0x428eda
mov r12d, 8
jmp 0x428d90
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x0044e712]
mov ecx, eax
call fcn.00416440
nop
nop word [rax + rax]