Function at 0x4cb5f0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x378
mov rsi, qword [rsp + 0x3e0]
mov r15, qword [rsp + 0x3e8]
mov r12, rcx
mov r13, rdx
mov rdi, r8
mov r14, r9
mov dword [rsp + 0x7c], 0
test rsi, rsi
je 0x4cb4e0
mov rcx, rsi
mov rax, r9
xor ebx, ebx
shl rcx, 4
add rcx, r9
nop
mov edx, dword [rax]
add rax, 0x10
add rbx, rdx
cmp rax, rcx
jne 0x4cb1e0
mov edx, 0xffffffff
mov eax, 0x2747
cmp rbx, rdx
ja 0x4cb370
test r15, r15
je 0x4cb388
cmp dword [r15 + 0x10], 0xc
mov eax, 0x32
jne 0x4cb370
mov edx, dword [rdi + 0x1e0]
test edx, edx
je 0x4cb4c8
lea rax, [rsp + 0xf0]
lea r8, [rsp + 0x7c]
mov rcx, r15
mov r9, rax
mov qword [rsp + 0x50], rax
call fcn.004d3470
test eax, eax
jne 0x4cb370
lea rbp, [rsi + 2]
cmp rbp, 5
jbe 0x4cb450
mov edx, 0x10
mov rcx, rbp
call fcn.004b7620
mov r15, rax
test rax, rax
je 0x4cb5e0
lea r11, [rsp + 0x60]
lea rdx, [rsp + 0x80]
mov r8d, 0x10
mov qword [rsp + 0x80], 0
mov rcx, r11
mov qword [rsp + 0x58], r11
mov qword [rsp + 0x88], 0
call fcn.004b76f0
movdqu xmm3, xmmword [rsp + 0x60]
mov r11, qword [rsp + 0x58]
lea rax, [rsp + 0x90]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x7c]
movups xmmword [r15], xmm3
cmp eax, 1
je 0x4cb4b8
cmp eax, 2
je 0x4cb568
mov qword [rsp + 0x58], r11
mov r8d, 0x607
lea rdx, str.src_win_pipe.c
lea rcx, [0x0071c444]
call qword [sym.imp.msvcrt.dll__assert]
mov r11, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
mov r8d, 0x278
mov rcx, r11
call fcn.004b76f0
movdqu xmm1, xmmword [rsp + 0x60]
mov edx, 2
movups xmmword [r15 + 0x10], xmm1
test rbx, rbx
jne 0x4cb408
mov qword [rsp + 0x20], rbp
mov r9, r15
mov r8, rdi
mov rdx, r13
mov rax, qword [rsp + 0x3f0]
mov dword [rsp + 0x30], 1
mov rcx, r12
mov qword [rsp + 0x28], rax
call fcn.004c8bf0
cmp r15, qword [rsp + 0x48]
je 0x4cb370
mov rcx, r15
mov dword [rsp + 0x48], eax
call fcn.004b75f0
mov eax, dword [rsp + 0x48]
add rsp, 0x378
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rbp, [rsi + 1]
cmp rbp, 5
jbe 0x4cb575
mov edx, 0x10
mov rcx, rbp
call fcn.004b7620
mov r15, rax
test rax, rax
je 0x4cb5e0
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x60]
mov r8d, 0x10
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 0
call fcn.004b76f0
movdqu xmm4, xmmword [rsp + 0x60]
mov edx, 1
lea rax, [rsp + 0x90]
mov qword [rsp + 0x48], rax
movups xmmword [r15], xmm4
test rbx, rbx
je 0x4cb32e
nop dword [rax]
or dword [rsp + 0x80], 1
mov dword [rsp + 0x88], ebx
test rsi, rsi
je 0x4cb32e
shl rdx, 4
shl rsi, 4
xor eax, eax
add rdx, r15
nop dword [rax]
movdqu xmm0, xmmword [r14 + rax]
movups xmmword [rdx + rax], xmm0
add rax, 0x10
cmp rsi, rax
jne 0x4cb430
jmp 0x4cb32e
lea r11, [rsp + 0x60]
lea rdx, [rsp + 0x80]
mov r8d, 0x10
mov qword [rsp + 0x80], 0
mov rcx, r11
mov qword [rsp + 0x58], r11
mov qword [rsp + 0x88], 0
call fcn.004b76f0
movdqu xmm2, xmmword [rsp + 0x60]
mov r11, qword [rsp + 0x58]
lea rax, [rsp + 0x90]
mov qword [rsp + 0x48], rax
mov r15, rax
mov eax, dword [rsp + 0x7c]
movaps xmmword [rsp + 0x90], xmm2
cmp eax, 1
jne 0x4cb2d5
or dword [rsp + 0x80], 6
jmp 0x4cb302
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rdi + 0x1e0], eax
mov edx, eax
jmp 0x4cb228
xor ebx, ebx
test r15, r15
jne 0x4cb20a
lea rcx, [rsp + 0x60]
lea rdx, [rsp + 0x80]
mov r8d, 0x10
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 0
mov ebp, 1
call fcn.004b76f0
movdqu xmm5, xmmword [rsp + 0x60]
movaps xmmword [rsp + 0x90], xmm5
mov qword [rsp + 0x20], rbp
mov r8, rdi
mov rdx, r13
mov rcx, r12
mov rax, qword [rsp + 0x3f0]
mov dword [rsp + 0x30], 1
lea r9, [rsp + 0x90]
mov qword [rsp + 0x28], rax
call fcn.004c8bf0
jmp 0x4cb370
or dword [rsp + 0x80], 2
jmp 0x4cb302
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x60]
mov r8d, 0x10
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 0
call fcn.004b76f0
movdqu xmm5, xmmword [rsp + 0x60]
mov edx, 1
lea rax, [rsp + 0x90]
mov qword [rsp + 0x48], rax
mov r15, rax
movaps xmmword [rsp + 0x90], xmm5
test rbx, rbx
jne 0x4cb408
jmp 0x4cb52e
mov eax, 8
jmp 0x4cb370
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rsi, qword [rsp + 0x80]
mov rax, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x90]
mov r13, rdx
mov edx, dword [r8 + 0x110]
mov r12, rcx
mov rbx, r8
test edx, edx
jne 0x4cb688
test rax, rax
je 0x4cb650
mov qword [rsp + 0x28], r9
mov r8d, 0x62f
lea rdx, str.src_win_pipe.c
lea rcx, str.send_handle__NULL
call qword [sym.imp.msvcrt.dll__assert]
mov r9, qword [rsp + 0x28]
mov r8, rbx
mov rdx, r13
mov rcx, r12
mov dword [rsp + 0x90], 0
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x80], rsi
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp fcn.004c8bf0
mov rdx, r13
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp 0x4cb190