Function at 0x14020b158
Capabilities:
Write file on windows

Disassembly:
jmp 0x14028fe40
push rbp
push rsi
push rdi
sub rsp, 0x210
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x40
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140961e80]
xor rax, rbp
mov qword [rbp + 0x1b8], rax
call fcn.14020b419
nop
call fcn.14021295d
nop
mov eax, dword [0x140966640]
and eax, 1
test eax, eax
jne 0x140290066
cmp qword [0x140966638], 0
je 0x14028fea6
mov rax, qword [0x140966638]
cmp qword [rax], 0
jne 0x14028ff08
call fcn.14020b635
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
je 0x14028ff08
mov rax, qword [rbp + 0x28]
lea rdx, [0x14094c2f8]
mov rcx, rax
call sym.SystemInformer.exe_PhConcatStringRef2
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov rcx, rax
call sym.SystemInformer.exe_PhDoesFileExist
movzx eax, al
test eax, eax
je 0x14028fef4
mov rax, qword [rbp + 8]
mov qword [0x140966638], rax
mov byte [0x140966631], 1
jmp 0x14028fefe
mov rcx, qword [rbp + 8]
call sym.SystemInformer.exe_PhDereferenceObject
nop
mov rcx, qword [rbp + 0x28]
call sym.SystemInformer.exe_PhDereferenceObject
nop
cmp qword [0x140966638], 0
je 0x14028ff1f
mov rax, qword [0x140966638]
cmp qword [rax], 0
jne 0x14028ff3a
mov r8b, 1
lea rdx, str.SystemInformer_settings.xml
mov ecx, 2
call fcn.14021095a
mov qword [0x140966638], rax
cmp qword [0x140966638], 0
je 0x140290066
mov rax, qword [0x140966638]
cmp qword [rax], 0
je 0x140290066
mov rax, qword [0x140966638]
mov rcx, rax
call sym.SystemInformer.exe_PhLoadSettings
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0xc0000102
jne 0x140290066
lea rax, str.If_you_select_No__the_settings_system_will_not_function_properly.
mov qword [rsp + 0x20], rax
lea r9, str.System_Informers_settings_file_is_corrupt._Do_you_want_to_reset_it_
mov r8d, 0xffff
mov edx, 6
xor ecx, ecx
call sym.SystemInformer.exe_PhShowMessage2
cmp eax, 6
jne 0x14029004e
lea rax, [rbp + 0xb8]
lea rcx, str._settings___settings_
mov rdi, rax
mov rsi, rcx
mov ecx, 0x16
rep movsb byte [rdi], byte [rsi]
mov rax, qword [0x140966638]
mov dword [rsp + 0x30], 0x60
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 5
mov r9d, 0x80
mov r8d, 0x120116
mov rdx, rax
lea rcx, [rbp + 0x68]
call sym.SystemInformer.exe_PhCreateFile
test eax, eax
jl 0x14029004c
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0x15
lea rax, [rbp + 0xb8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x88]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ntdll.dll_NtWriteFile]
nop
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ntdll.dll_NtClose]
nop
jmp 0x140290066
mov rcx, qword [0x140966638]
call sym.SystemInformer.exe_PhDereferenceObject
nop
mov qword [0x140966638], 0
call sym.SystemInformer.exe_PhUpdateCachedSettings
nop
lea rcx, str.EnablePlugins
call fcn.1402139d4
test eax, eax
je 0x140290088
mov dword [rbp + 0x1b4], 1
jmp 0x140290092
mov dword [rbp + 0x1b4], 0
movzx eax, byte [rbp + 0x1b4]
mov byte [0x140966630], al
lea rcx, str.MaxSizeUnit
call fcn.1402139d4
mov dword [0x14095f194], eax
lea rcx, str.MaxPrecisionUnit
call fcn.1402139d4
mov word [0x14095f198], ax
lea rcx, str.EnableWindowText
call fcn.1402139d4
test eax, eax
je 0x1402900e0
mov dword [rbp + 0x1b4], 1
jmp 0x1402900ea
mov dword [rbp + 0x1b4], 0
movzx eax, byte [rbp + 0x1b4]
mov byte [0x14096ef3d], al
lea rcx, str.EnableThemeSupport
call fcn.1402139d4
test eax, eax
je 0x140290113
mov dword [rbp + 0x1b4], 1
jmp 0x14029011d
mov dword [rbp + 0x1b4], 0
movzx eax, byte [rbp + 0x1b4]
mov byte [0x14096b2a8], al
cmp dword [0x14095f7f0], 0x72
jb 0x14029014f
lea rcx, str.EnableThemeAcrylicSupport
call fcn.1402139d4
test eax, eax
je 0x14029014f
mov dword [rbp + 0x1b4], 1
jmp 0x140290159
mov dword [rbp + 0x1b4], 0
movzx eax, byte [rbp + 0x1b4]
mov byte [0x14096b2a9], al
lea rcx, str.TreeListBorderEnable
call fcn.1402139d4
test eax, eax
je 0x140290182
mov dword [rbp + 0x1b4], 1
jmp 0x14029018c
mov dword [rbp + 0x1b4], 0
movzx eax, byte [rbp + 0x1b4]
mov byte [0x14096b2aa], al
lea rcx, str.EnableDeferredLayout
call fcn.1402139d4
test eax, eax
je 0x1402901b5
mov dword [rbp + 0x1b4], 1
jmp 0x1402901bf
mov dword [rbp + 0x1b4], 0
movzx eax, byte [rbp + 0x1b4]
mov byte [0x14096ef38], al
lea rcx, str.EnableServiceNonPoll
call fcn.1402139d4
test eax, eax
je 0x1402901e8
mov dword [rbp + 0x1b4], 1
jmp 0x1402901f2
mov dword [rbp + 0x1b4], 0
movzx eax, byte [rbp + 0x1b4]
mov byte [0x140969c78], al
lea rcx, str.EnableServiceNonPollNotify
call fcn.1402139d4
test eax, eax
je 0x14029021b
mov dword [rbp + 0x1b4], 1
jmp 0x140290225
mov dword [rbp + 0x1b4], 0
movzx eax, byte [rbp + 0x1b4]
mov byte [0x140969c79], al
lea rcx, str.NonPollFlushInterval
call fcn.1402139d4
mov dword [0x14095ea28], eax
lea rcx, str.SampleCountAutomatic
call fcn.1402139d4
test eax, eax
je 0x140290296
xor edx, edx
mov ecx, 0x4e
call sym.SystemInformer.exe_PhGetSystemMetrics
inc eax
cdq
sub eax, edx
sar eax, 1
mov dword [rbp + 0xe4], eax
cmp dword [rbp + 0xe4], 0x1000
jbe 0x140290283
mov dword [rbp + 0xe4], 0x1000
mov edx, dword [rbp + 0xe4]
lea rcx, str.SampleCount
call fcn.140211607
nop
cmp qword [0x140966680], 0
je 0x140290383
mov rax, qword [0x140966680]
cmp qword [rax], 0
je 0x140290383
mov rax, qword [0x140966680]
xor r8d, r8d
lea rdx, [0x14094c308]
mov rcx, rax
call sym.SystemInformer.exe_PhEqualStringRef
movzx eax, al
test eax, eax
je 0x1402902e9
xor edx, edx
lea rcx, str.ReleaseChannel
call fcn.140211607
nop
jmp 0x140290383
mov rax, qword [0x140966680]
xor r8d, r8d
lea rdx, [0x14094c318]
mov rcx, rax
call sym.SystemInformer.exe_PhEqualStringRef
movzx eax, al
test eax, eax
je 0x14029031d
mov edx, 1
lea rcx, str.ReleaseChannel
call fcn.140211607
nop
jmp 0x140290383
mov rax, qword [0x140966680]
xor r8d, r8d
lea rdx, [0x14094c328]
mov rcx, rax
call sym.SystemInformer.exe_PhEqualStringRef
movzx eax, al
test eax, eax
je 0x140290351
mov edx, 2
lea rcx, str.ReleaseChannel
call fcn.140211607
nop
jmp 0x140290383
mov rax, qword [0x140966680]
xor r8d, r8d
lea rdx, [0x14094c338]
mov rcx, rax
call sym.SystemInformer.exe_PhEqualStringRef
movzx eax, al
test eax, eax
je 0x140290383
mov edx, 3
lea rcx, str.ReleaseChannel
call fcn.140211607
nop
lea rcx, [rbp - 0x50]
lea rdx, [0x140683bc0]
call fcn.1402124fd
mov rcx, qword [rbp + 0x1b8]
xor rcx, rbp
call fcn.14020ee98
lea rsp, [rbp + 0x1c0]
pop rdi
pop rsi
pop rbp
ret