Function at 0x1400142b0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0xa70
test byte [0x1400df368], 0x40
mov rdi, r8
mov esi, edx
mov ebx, ecx
je 0x140014608
lea rcx, [rsp + 0x70]
mov qword [rsp + 0xa98], r12
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
xor r9d, r9d
mov qword [rsp + 0x30], 0
lea rcx, str.ADC_EventLog.txt
lea r8d, [r9 + 1]
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov r12, rax
je 0x140014600
lea rcx, [rsp + 0x280]
xor edx, edx
mov r8d, 0x3e8
call fcn.14007cd30
lea rcx, [rsp + 0x180]
xor edx, edx
mov r8d, 0xfa
call fcn.14007cd30
lea rcx, [rsp + 0x80]
xor edx, edx
mov r8d, 0xfa
call fcn.14007cd30
lea rdx, [rsp + 0x180]
mov ecx, ebx
call fcn.140014020
mov edx, esi
sub edx, 1
je 0x14001453b
sub edx, 1
je 0x140014532
sub edx, 1
je 0x1400143b5
sub edx, 1
je 0x1400143a9
cmp edx, 1
jne 0x14001439e
lea rdx, str.User_Selected_by_OEM
jmp 0x140014542
cmp esi, 3
jne 0x14001454f
jmp 0x1400143c9
lea rdx, str.Save_at_Shut_down
jmp 0x140014542
lea rdx, str.User_Selected
lea rcx, [rsp + 0x80]
call fcn.14007dc1c
cmp ebx, 0x10
jne 0x1400144d2
mov qword [rsp + 0xa90], rbp
mov ebp, dword [rdi + 0x20]
mov qword [rsp + 0xa68], r13
mov r13d, dword [rdi]
lea rcx, [rsp + 0x670]
xor edx, edx
mov r8d, 0x3e8
mov qword [rsp + 0xa60], r14
mov r14d, dword [rdi + 0x24]
call fcn.14007cd30
xor ebx, ebx
test ebp, ebp
je 0x14001444b
lea rsi, [rdi + 4]
mov r9d, dword [rsi]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x670]
lea rdx, str.Index___i______ulDisplayType___d__n
mov r8d, ebx
repne scasb al, byte [rdi]
not rcx
lea rcx, [rsp + rcx + 0x66f]
call fcn.14007dc1c
add ebx, 1
add rsi, 4
cmp ebx, ebp
jb 0x140014413
movzx ecx, word [rsp + 0x7c]
movzx eax, word [rsp + 0x7e]
movzx r9d, word [rsp + 0x7a]
movzx r8d, word [rsp + 0x78]
mov dword [rsp + 0x60], r14d
mov dword [rsp + 0x58], r13d
mov dword [rsp + 0x50], ebp
lea rdx, [rsp + 0x80]
mov qword [rsp + 0x48], rdx
mov dword [rsp + 0x40], 3
lea rdx, [rsp + 0x180]
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], 0x10
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rdx, str._02d:_02d:_02d:_03d_____state_d___s___option_d___s____Number_of_displays_d__ADC_Flag_d__Desktop_View_d__n_n
lea rcx, [rsp + 0x280]
call fcn.14007dc1c
mov r14, qword [rsp + 0xa60]
mov r13, qword [rsp + 0xa68]
mov rbp, qword [rsp + 0xa90]
jmp 0x1400145a3
mov eax, dword [rdi]
movzx ecx, word [rsp + 0x7e]
movzx edx, word [rsp + 0x7c]
movzx r9d, word [rsp + 0x7a]
movzx r8d, word [rsp + 0x78]
mov dword [rsp + 0x50], eax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], 3
lea rax, [rsp + 0x180]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edx
lea rcx, [rsp + 0x280]
lea rdx, str._02d:_02d:_02d:_03d_____state_d___s___option_d___s___Data_d__n_n
call fcn.14007dc1c
jmp 0x1400145a3
lea rdx, str.Save_ONLY
jmp 0x140014542
lea rdx, str.Save_and_Apply
lea rcx, [rsp + 0x80]
call fcn.14007dc1c
movzx edx, word [rsp + 0x7c]
movzx eax, word [rsp + 0x7e]
movzx r9d, word [rsp + 0x7a]
movzx r8d, word [rsp + 0x78]
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x40], esi
lea rcx, [rsp + 0x180]
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], edx
lea rcx, [rsp + 0x280]
lea rdx, str._02d:_02d:_02d:_03d_____state_d___s___option_d___s___n_n
call fcn.14007dc1c
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x280]
lea r9, [rsp + 0xaa8]
lea rdx, [rsp + 0x280]
repne scasb al, byte [rdi]
mov dword [rsp + 0xaa8], 0
mov qword [rsp + 0x20], rax
not rcx
lea r8, [rcx - 1]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r12, qword [rsp + 0xa98]
add rsp, 0xa70
pop rdi
pop rsi
pop rbx
ret