Function at 0x140002238
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x588]
sub rsp, 0x660
mov rax, qword [0x14000a010]
xor rax, rsp
mov qword [rbp + 0x550], rax
xor r12d, r12d
mov rbx, rcx
mov qword [rsp + 0x30], r12
lea rcx, str..PogoSweepdriver
mov dword [rsp + 0x28], r12d
xor r9d, r9d
mov edx, 0xc0000000
mov qword [rsp + 0x58], r12
lea r15d, [r12 + 3]
lea r8d, [r12 + 2]
mov dword [rsp + 0x20], r15d
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_CreateFileW]
or rdi, 0xffffffffffffffff
lea r13, str.D:_a_work1_s_src_vctoolsCompilerUtc_src_toolspogopogosweep_sweepsys.cpp
mov r14, rax
cmp rax, rdi
jne 0x1400022ce
mov r8d, 0x88
mov rdx, r13
mov ecx, 0x40a
call fcn.140005a6c
mov r8, qword [rbx + 0x10]
mov r9, rdi
inc r9
cmp word [r8 + r9*2], r12w
jne 0x1400022d5
mov qword [rsp + 0x38], r12
lea rax, [rbp + 0x40]
mov qword [rsp + 0x30], r12
mov esi, 0x104
mov dword [rsp + 0x28], esi
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_string_l1_1_0.dll_WideCharToMultiByte]
mov edx, esi
lea rcx, [rbp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strupr_s]
lea ecx, [rsi - 4]
mov r8, r15
mov qword [rsp + 0x40], rcx
lea rax, [rbp + 0x350]
mov qword [rsp + 0x38], rax
lea r9, [rbp + 0x450]
lea rax, [rbp + 0x150]
mov qword [rsp + 0x30], 0x200
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x40]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__splitpath_s]
lea rax, [rbp + 0x150]
inc rdi
cmp byte [rax + rdi], r12b
jne 0x140002362
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x54]
mov qword [rsp + 0x30], rax
lea r9d, [rdi + 1]
lea rax, [rsp + 0x58]
mov esi, 8
mov dword [rsp + 0x28], esi
lea r8, [rbp + 0x150]
mov edx, 0x15600a
mov qword [rsp + 0x20], rax
mov rcx, r14
call qword [sym.imp.api_ms_win_core_io_l1_1_1.dll_DeviceIoControl]
mov edi, 0x408
test eax, eax
jne 0x1400023d6
mov rcx, qword [rbx + 0x10]
call fcn.1400020e0
mov qword [rsp + 0x58], rax
test rax, rax
jne 0x1400023d6
mov r9, qword [rbx + 0x10]
mov r8d, 0xbc
mov rdx, r13
mov ecx, edi
call fcn.1400059ec
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x54]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x58]
lea rax, [rsp + 0x70]
mov dword [rsp + 0x28], 0xc4
mov r9d, esi
mov qword [rsp + 0x20], rax
mov edx, 0x156002
mov rcx, r14
call qword [sym.imp.api_ms_win_core_io_l1_1_1.dll_DeviceIoControl]
test eax, eax
jne 0x14000242c
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov r9, qword [rbx + 0x10]
mov r8d, 0xcf
mov rdx, r13
mov ecx, edi
call fcn.1400059ec
int3
mov rcx, qword [rbx + 0x18]
lea rdx, [0x140007020]
mov r8d, 0x10
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfsopen]
mov rsi, rax
test rax, rax
jne 0x140002460
mov r9, qword [rbx + 0x18]
lea ecx, [rax + 0x57]
mov r8d, 0xda
mov rdx, r13
call fcn.1400059ec
mov r15d, 0x32
mov edx, dword [rsp + 0x7c]
xor ecx, ecx
mov r8d, 0x1000
lea r9d, [rcx + 4]
call qword [sym.imp.api_ms_win_core_memory_l1_1_2.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
jne 0x14000249e
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov r8d, 0xea
lea ecx, [rdi + 2]
mov rdx, r13
call fcn.140005a6c
lea rax, [rsp + 0x54]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x58]
mov eax, dword [rsp + 0x7c]
mov r9d, 8
mov dword [rsp + 0x28], eax
mov edx, 0x156002
mov rcx, r14
mov qword [rsp + 0x20], rdi
call qword [sym.imp.api_ms_win_core_io_l1_1_1.dll_DeviceIoControl]
mov eax, dword [rsp + 0x7c]
mov eax, dword [rdi + 0x64]
test eax, eax
je 0x1400024fe
mov ecx, 0x3a99
call fcn.140005310
mov r8, qword [rbx + 0x18]
mov rcx, rax
mov edx, 0x41d
call fcn.140003ed4
jmp 0x1400025dc
mov ecx, dword [rdi + 0xc]
mov eax, dword [rsp + 0x7c]
cmp ecx, eax
je 0x140002593
movups xmm0, xmmword [rdi]
lea rcx, [rsp + 0x70]
mov edx, 0x80
mov r8d, 0x8000
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdi + 0x10]
lea rax, [rdx + rdi]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdi + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdi + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdi + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdi + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdi + 0x60]
movups xmmword [rcx + 0x60], xmm0
add rcx, rdx
xor edx, edx
movups xmm1, xmmword [rdi + 0x70]
movups xmmword [rcx - 0x10], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
mov eax, dword [rax + 0x40]
mov dword [rcx + 0x40], eax
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_memory_l1_1_2.dll_VirtualFree]
jmp 0x1400025dc
cmp byte [rdi + 0x51], r12b
jne 0x1400025b0
mov r9, qword [rbx + 0x10]
mov r8d, 0x11d
mov rdx, r13
mov ecx, 0x423
call fcn.1400059ec
mov eax, dword [rdi + 0xc]
test eax, eax
je 0x1400025dc
lea rcx, [rdi + 0x40]
call qword [sym.imp.api_ms_win_core_com_l1_1_1.dll_CoCreateGuid]
test eax, eax
je 0x1400025e9
mov r9, qword [rbx + 0x18]
mov r8d, 0x128
mov rdx, r13
mov ecx, 0x40b
call fcn.1400059ec
dec r15d
test r15d, r15d
jle 0x140002660
jmp 0x140002466
mov edx, dword [rdi + 0xc]
mov r15d, 1
mov r8d, r15d
mov byte [rsp + 0x50], r15b
mov r9, rsi
mov word [rdi + 0x60], r15w
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rax, r15
jne 0x140002649
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
test eax, eax
jne 0x140002649
xor r8d, r8d
lea edx, [rax + 0x52]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140002649
mov r9, rsi
lea rcx, [rsp + 0x50]
mov r8d, r15d
mov edx, r15d
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rax, r15
je 0x140002660
mov r9, qword [rbx + 0x18]
mov r8d, 0x137
mov rdx, r13
mov ecx, 0x5b
call fcn.1400059ec
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test eax, eax
sete dil
cmp byte [rbx + 1], r12b
je 0x1400026c9
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x54]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x58]
mov dword [rsp + 0x28], r12d
mov r9d, 8
mov edx, 0x156006
mov qword [rsp + 0x20], r12
mov rcx, r14
call qword [sym.imp.api_ms_win_core_io_l1_1_1.dll_DeviceIoControl]
test eax, eax
jne 0x1400026c9
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov r9, qword [rbx + 0x10]
mov r8d, 0x158
mov rdx, r13
mov ecx, 0x408
call fcn.1400059ec
int3
mov rcx, r14
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test dil, dil
jne 0x1400026ee
mov r9, qword [rbx + 0x18]
mov r8d, 0x164
mov rdx, r13
mov ecx, 0x5b
call fcn.1400059ec
mov rcx, qword [rbp + 0x550]
xor rcx, rsp
call fcn.140002e50
lea r11, [rsp + 0x660]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret