Function at 0x1400046e0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x360]
sub rsp, 0x460
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rsp + 0x4b0], rbx
mov rax, qword [0x14009baf8]
xor rax, rsp
mov qword [rbp + 0x350], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
mov qword [rbp - 0x80], rcx
xor r12d, r12d
mov dword [rsp + 0x40], r12d
mov qword [rcx], r12
mov qword [rcx + 8], r12
call fcn.140005e30
mov qword [rdi], rax
mov dword [rsp + 0x40], 1
mov rcx, rbx
call fcn.140004d60
mov r14, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140004d2f
mov qword [rbp + 0x2ac], r12
mov dword [rbp + 0x2b4], r12d
mov dword [rbp + 0x290], 0x64
mov ecx, dword [0x1400aa854]
mov dword [rbp + 0x294], ecx
mov qword [rbp + 0x298], rax
lea rax, [rbp + 0x2e0]
mov qword [rbp + 0x2a0], rax
mov dword [rbp + 0x2a8], 0x40
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rbp + 0x2ac], eax
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x320]
lea r8d, [r12 + 0x29]
lea rdx, [rbp + 0x290]
mov rcx, qword [0x1400aa890]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov qword [rbp + 0x2ac], r12
mov dword [rbp + 0x2b4], r12d
mov dword [rbp + 0x290], 0x64
mov eax, dword [0x1400aa854]
mov dword [rbp + 0x294], eax
movsxd rax, dword [rbp + 0x31c]
add rax, r14
mov qword [rbp + 0x298], rax
lea rax, [rbp - 0x78]
mov qword [rbp + 0x2a0], rax
mov dword [rbp + 0x2a8], 0x108
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rbp + 0x2ac], eax
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x320]
lea r8d, [r12 + 0x29]
lea rdx, [rbp + 0x290]
mov rcx, qword [0x1400aa890]
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [rbp + 0x1c], r12d
je 0x140004d2f
mov edx, dword [rbp + 0x18]
add rdx, r14
lea rcx, [rbp + 0x328]
call fcn.1400013d0
movups xmm0, xmmword [rax]
mov ecx, dword [rax + 0x10]
mov r15d, r12d
mov dword [rsp + 0x34], r12d
movups xmmword [rsp + 0x60], xmm0
psrldq xmm0, 8
movq rax, xmm0
shr rax, 0x20
test eax, eax
mov dword [rbp + 0x320], ecx
je 0x140004d2f
mov ecx, dword [rsp + 0x60]
add rcx, r14
call fcn.140001470
mov rbx, rax
mov esi, r12d
mov dword [rsp + 0x38], r12d
test rax, rax
je 0x140004c81
nop
mov qword [rbp + 0x338], r12
mov qword [rbp + 0x340], 0xf
mov byte [rbp + 0x328], 0
mov rax, qword [0x1400aa8b0]
test rax, rax
cmove rax, rbx
mov qword [0x1400aa8b0], rax
add rax, 0x10000
cmp rbx, rax
ja 0x140004c16
mov qword [rbp + 0x2d4], r12
mov dword [rbp + 0x2dc], r12d
mov dword [rbp + 0x2b8], 0x64
mov eax, dword [0x1400aa854]
mov dword [rbp + 0x2bc], eax
lea rax, [r14 + 2]
add rax, rbx
mov qword [rbp + 0x2c0], rax
lea rax, [rbp + 0x190]
mov qword [rbp + 0x2c8], rax
mov dword [rbp + 0x2d0], 0xff
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rbp + 0x2d4], eax
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x348]
mov r8d, 0x29
lea rdx, [rbp + 0x2b8]
mov rcx, qword [0x1400aa890]
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x190]
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx - 0x10], xmm1
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x60], xmm0
mov rax, qword [rcx + 0x70]
mov qword [rdx + 0x70], rax
mov eax, dword [rcx + 0x78]
mov dword [rdx + 0x78], eax
movzx eax, word [rcx + 0x7c]
mov word [rdx + 0x7c], ax
movzx eax, byte [rcx + 0x7e]
mov byte [rdx + 0x7e], al
mov qword [rbp + 0x2a0], r12
mov qword [rbp + 0x2a8], 0xf
mov byte [rbp + 0x290], 0
lea rax, [rbp + 0x90]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140004a50
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x290]
call fcn.140006680
mov rdx, qword [rbp + 0x340]
cmp rdx, 0x10
jb 0x140004aae
inc rdx
mov rcx, qword [rbp + 0x328]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004aa9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004d21
call fcn.140009288
movups xmm0, xmmword [rbp + 0x290]
movups xmmword [rbp + 0x328], xmm0
movups xmm1, xmmword [rbp + 0x2a0]
movups xmmword [rbp + 0x338], xmm1
mov r13, qword [rdi]
mov rbx, r13
mov rdi, qword [r13 + 8]
mov r15, qword [rbp + 0x2a8]
mov r14, qword [rbp + 0x2a0]
mov r12, qword [rbp + 0x290]
cmp byte [rdi + 0x19], 0
jne 0x140004b56
nop
lea rdx, [rbp + 0x328]
cmp r15, 0x10
cmovae rdx, r12
lea rcx, [rdi + 0x20]
cmp qword [rdi + 0x38], 0x10
jb 0x140004b0e
mov rcx, qword [rdi + 0x20]
mov rsi, qword [rdi + 0x30]
mov r8, rsi
cmp r14, rsi
cmovb r8, r14
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140004b39
cmp rsi, r14
jae 0x140004b31
mov eax, 0xffffffff
jmp 0x140004b39
xor eax, eax
cmp rsi, r14
seta al
shr eax, 0x1f
test al, al
je 0x140004b46
mov rdi, qword [rdi + 0x10]
jmp 0x140004b4c
mov rbx, rdi
mov rdi, qword [rdi]
cmp byte [rdi + 0x19], 0
je 0x140004af0
mov esi, dword [rsp + 0x38]
cmp rbx, r13
je 0x140004bb2
lea rdx, [rbx + 0x20]
cmp qword [rbx + 0x38], 0x10
jb 0x140004b6a
mov rdx, qword [rbx + 0x20]
lea rcx, [rbp + 0x328]
cmp r15, 0x10
cmovae rcx, r12
mov rdi, qword [rbx + 0x30]
mov r8, r14
cmp rdi, r14
cmovb r8, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140004ba4
cmp r14, rdi
jae 0x140004b9c
mov eax, 0xffffffff
jmp 0x140004ba4
xor eax, eax
cmp r14, rdi
seta al
shr eax, 0x1f
test al, al
jne 0x140004bb2
mov rdi, qword [rsp + 0x48]
jmp 0x140004bfa
lea rax, [rbp + 0x328]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, [0x14000b430]
mov rdi, qword [rsp + 0x48]
mov rcx, rdi
call fcn.140001570
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.140001850
mov rbx, qword [rsp + 0x50]
movsxd rdx, esi
mov ecx, dword [rbp + 0x320]
mov r14, qword [rsp + 0x58]
add rcx, r14
lea rax, [rcx + rdx*8]
mov qword [rbx + 0x40], rax
xor r12d, r12d
inc esi
mov dword [rsp + 0x38], esi
movsxd rax, esi
mov ecx, dword [rsp + 0x60]
lea rcx, [rcx + rax*8]
add rcx, r14
call fcn.140001470
mov rbx, rax
mov rdx, qword [rbp + 0x340]
cmp rdx, 0x10
jb 0x140004c73
inc rdx
mov rcx, qword [rbp + 0x328]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004c6e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004d28
call fcn.140009288
test rbx, rbx
jne 0x1400048c0
mov r15d, dword [rsp + 0x34]
inc r15d
mov dword [rsp + 0x34], r15d
mov qword [rbp + 0x2fc], r12
mov dword [rbp + 0x304], r12d
mov dword [rbp + 0x2e0], 0x64
mov eax, dword [0x1400aa854]
mov dword [rbp + 0x2e4], eax
movsxd rax, r15d
lea rcx, [rax + rax*4]
mov eax, dword [rbp + 0x18]
lea rax, [rax + rcx*4]
add rax, r14
mov qword [rbp + 0x2e8], rax
lea rax, [rbp + 0x328]
mov qword [rbp + 0x2f0], rax
mov dword [rbp + 0x2f8], 0x14
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rbp + 0x2fc], eax
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x34c]
mov r8d, 0x29
lea rdx, [rbp + 0x2e0]
mov rcx, qword [0x1400aa890]
call qword [sym.imp.KERNEL32.dll_WriteFile]
movups xmm0, xmmword [rbp + 0x328]
mov ecx, dword [rbp + 0x338]
jmp 0x14000487d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, rdi
mov rcx, qword [rbp + 0x350]
xor rcx, rsp
call fcn.1400096d0
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x460
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret