Function at 0x14004bad0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x300
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x140092690]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
mov rsi, rdx
mov rbx, rcx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdx
xor edi, edi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x54], edi
mov qword [rsp + 0x60], 0xffffffffffffffff
test rdx, rdx
jne 0x14004bb5e
lea r8, str.One_or_more_given_parameters_are_invalid_
mov edx, 0x800432b1
call fcn.140049a90
lea rcx, [rsp + 0x80]
call fcn.14001e1b0
lea rdx, [0x14008dfb0]
lea rcx, [rsp + 0x80]
call sub.VCRUNTIME140.dll__CxxThrowException
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x40]
call fcn.140046f30
test al, al
jne 0x14004bba6
lea r8, str.The_system_is_out_of_memory_
mov edx, 0x800432b4
mov rcx, rbx
call fcn.140049a90
lea rcx, [rsp + 0x90]
call fcn.14001e1f0
lea rdx, [0x14008e010]
lea rcx, [rsp + 0x90]
call sub.VCRUNTIME140.dll__CxxThrowException
xor eax, eax
mov dword [rsp + 0xe8], eax
mov byte [rsp + 0xec], al
lea r8, [rbx + 0x1a]
lea edx, [rax + 5]
lea r9d, [rax + 3]
lea rcx, [rsp + 0xe8]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsnbcpy_s]
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0xf0]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rbx + 0x120]
mov r8d, 0x1ff
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0xe8]
call fcn.140048e90
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0xc0]
call fcn.140008d08
nop
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0xf0]
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x58]
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0xc0]
call fcn.14000a4ac
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
mov qword [rsp + 0x60], rax
cmp rax, 0xffffffffffffffff
jne 0x14004bcbf
lea r8, str.An_error_occurred_while_creating_the_profile_database.
mov edx, 0x80043aa1
mov rcx, rbx
call fcn.140049a90
lea rcx, [rsp + 0xa0]
call fcn.14001e370
lea rdx, [0x14008e070]
lea rcx, [rsp + 0xa0]
call sub.VCRUNTIME140.dll__CxxThrowException
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x54]
mov r8d, dword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14004bd5f
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x54], eax
jne 0x14004bd5f
cmp qword [rsp + 0x40], 0
je 0x14004bd01
mov rcx, qword [rsp + 0x40]
call sub.mfc140.dll_Ordinal_266
mov qword [rsp + 0x40], rdi
jmp 0x14004bd0f
mov rcx, qword [rsp + 0x48]
call fcn.14000a8d4
mov qword [rsp + 0x48], rdi
mov byte [rbx + 0x19], 0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0xc0]
call fcn.14000909c
nop
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.140059ef0
lea r11, [rsp + 0x300]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
lea r8, str.An_error_occurred_while_saving_the_DOM_tree_to_an_XML_file.
mov edx, 0x80043aa0
mov rcx, rbx
call fcn.140049a90
lea rcx, [rsp + 0xb0]
call fcn.14001e370
lea rdx, [0x14008e070]
lea rcx, [rsp + 0xb0]
call sub.VCRUNTIME140.dll__CxxThrowException
int3