Function at 0x1400443f0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
mov qword [rbp - 0x21], 0xfffffffffffffffe
mov qword [rsp + 0xe0], rbx
mov rax, qword [0x14016ca00]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rdi, rdx
mov r14, rcx
mov rcx, qword [rcx + 8]
test rcx, rcx
jne 0x140044438
xor al, al
jmp 0x14004468d
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rsi, rax
test rax, rax
je 0x140044431
lea rcx, [rbp - 0x39]
call fcn.14006d290
nop
mov dword [rsp + 0x20], 2
mov r9d, 1
mov r8d, 0x40000000
mov rdx, rdi
lea rcx, [rbp - 0x39]
call fcn.14006fad0
test al, al
jne 0x140044526
mov ecx, 0x800
call fcn.1400bbc88
mov rsi, rax
mov ecx, 0x800
call fcn.1400bbc88
mov rbx, rax
test rsi, rsi
je 0x140044510
test rax, rax
je 0x140044508
xor edx, edx
mov r8d, 0x800
mov rcx, rsi
call fcn.1400c2130
lea rax, [0x14012b9e8]
mov qword [rsp + 0x20], rax
lea r9, str.RC::RCWordLibOperater::ExportUserWordLibAndCiCache
lea r8, str._s__:__s
mov edx, 0x400
mov rcx, rsi
call fcn.140007140
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call fcn.1400c2130
cmp qword [rdi + 0x18], 8
jb 0x1400444ed
mov rdi, qword [rdi]
mov r9, rdi
mov r8, rsi
mov edx, 0x400
mov rcx, rbx
call fcn.140007140
mov rcx, rbx
call fcn.140015100
mov rcx, rsi
call fcn.1400bd2dc
test rbx, rbx
je 0x14004467d
mov rcx, rbx
call fcn.1400bd2dc
jmp 0x14004467d
mov dword [rbp - 0x2d], 0xffff0001
xor r15d, r15d
mov dword [rbp - 0x31], r15d
mov rbx, qword [rbp - 0x39]
test rbx, rbx
je 0x14004467d
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x14004467d
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x31]
lea r8d, [r15 + 4]
lea rdx, [rbp - 0x2d]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140044663
cmp dword [rbp - 0x31], 4
jne 0x140044663
mov rax, qword [rsi]
mov dl, 1
mov rcx, rsi
call qword [rax + 0x30]
test al, al
je 0x14004467d
mov rax, qword [rsi]
lea rdx, [rbp + 7]
mov rcx, rsi
call qword [rax + 0x28]
nop
lea r8, [0x140172240]
mov rdx, rax
lea rcx, [rbp - 0x29]
call fcn.1400bac40
nop
cmp qword [rbp + 0x1f], 8
jb 0x1400445bc
mov rcx, qword [rbp + 7]
call fcn.1400bd20c
mov qword [rbp + 0x1f], 7
mov qword [rbp + 0x17], r15
mov word [rbp + 7], r15w
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x29]
call fcn.1400bad50
nop
xor dil, dil
cmp qword [rbp - 9], 0
je 0x140044608
cmp qword [r14 + 8], 0
je 0x140044605
lea r8, [rbp - 0x19]
lea rdx, [rbp - 0x39]
mov rcx, r14
call fcn.140044b90
movzx edi, al
mov rbx, qword [rbp - 0x39]
jmp 0x140044608
xor dil, dil
test rbx, rbx
je 0x140044627
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x140044627
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x140044627
mov qword [rbx], 0xffffffffffffffff
cmp qword [rbp - 1], 8
jb 0x140044637
mov rcx, qword [rbp - 0x19]
call fcn.1400bd20c
mov qword [rbp - 1], 7
mov qword [rbp - 9], r15
mov word [rbp - 0x19], r15w
mov rbx, qword [rbp - 0x29]
test rbx, rbx
je 0x140044680
mov rcx, rbx
call fcn.140068380
mov rcx, rbx
call fcn.1400bd20c
jmp 0x140044680
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x14004467d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x14004467d
mov qword [rbx], 0xffffffffffffffff
xor dil, dil
lea rcx, [rbp - 0x39]
call fcn.14006fa80
movzx eax, dil
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1400bcae0
mov rbx, qword [rsp + 0xe0]
add rsp, 0xa0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret