Function at 0x100407d20
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x100], rbx
mov rax, qword [0x100420010]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov r12, rdx
mov r15, rcx
xor esi, esi
mov dword [rsp + 0x40], esi
mov ecx, 0x1000
call fcn.10040fcd8
mov r14, rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x100080
mov r13d, 2
mov dword [rsp + 0x20], r13d
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [rsi + 3]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x100407e36
lea r8, str.__Configuration_file_to_set_the_logging_properties_of_the_SQLWriter_service._r_n__EnableLogging__TRUE__FALSE_true_is_the_default_behavior__r_n__TraceFile__C:Program_FilesMicrosoft_SQL_Server90SharedSqlWriterLog.txt____default_location_for_the_trace_file_is_the_SQLWriter.exe_folder__r_n__TraceLevel__DEFAULT__MINIMAL__VERBOSE____DEFAULT_is_the_initial_value_r_n__TraceFileSizeMb__Default_size_is_1_MB._Once_the_log_is_full_it_will_be_written_to_old_TraceFile._Any_pre_existing_old_TraceFile_will_be_over_written._r_n__ForceFlush__TRUE__FALSE_FALSE_is_the_default_value__force_flush_is_used_when_a_crash_is_expected_and_the_log_will_flush_for_each_write__r_n_r_n
mov edx, 0x800
lea rcx, [r15 + 0x88]
call fcn.100401210
mov ecx, 0x800
call fcn.10040fcd8
mov rsi, rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x800
mov qword [rsp + 0x20], rsi
mov rdi, 0xffffffffffffffff
mov r9d, edi
lea r8, [r15 + 0x88]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
inc rdi
cmp byte [rsi + rdi], 0
jne 0x100407e05
mov r8, rdi
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
lea rbp, str.TRUE
lea rdi, str.FALSE
mov r8, rdi
cmp dword [r15 + 8], 0
cmovne r8, rbp
mov r9, r12
lea rdx, str.EnableTracing
lea rcx, str.Logging
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [r15 + 0x38]
sub ecx, r13d
je 0x100407ea3
sub ecx, 1
je 0x100407e9a
mov edx, 0x800
cmp ecx, 1
mov rcx, r14
je 0x100407e8b
lea r8, str.DEFAULT
jmp 0x100407eb2
mov r9d, 0xe
lea r8, str.LEGACY
jmp 0x100407eb8
lea r8, str.VERBOSE
jmp 0x100407eaa
lea r8, str.MINIMAL
mov rcx, r14
mov edx, 0x800
mov r9d, 0x10
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
mov r9, r12
mov r8, r14
lea rdx, str.TraceLevel
lea rcx, str.Logging
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov word [r14], si
mov r9, r12
mov r8, qword [r15 + 0x18]
lea rdx, str.TraceFile
lea rcx, str.Logging
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [r15 + 0x10a4]
lea r9, [rsp + 0x9a]
test ecx, ecx
jns 0x100407f50
neg ecx
nop dword [rax]
sub r9, 2
mov eax, 0xcccccccd
mul ecx
shr edx, 3
movzx eax, dx
shl ax, 2
lea r8d, [rax + rdx]
add r8w, r8w
sub cx, r8w
add cx, 0x30
mov word [r9], cx
mov ecx, edx
test edx, edx
jne 0x100407f10
add r9, 0xfffffffffffffffe
mov eax, 0x2d
mov word [r9], ax
jmp 0x100407f7f
sub r9, 2
mov eax, 0xcccccccd
mul ecx
shr edx, 3
movzx eax, dx
shl ax, 2
lea r8d, [rax + rdx]
add r8w, r8w
sub cx, r8w
add cx, 0x30
mov word [r9], cx
mov ecx, edx
test edx, edx
jne 0x100407f50
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x100418e30]
movdqu xmmword [rsp + 0x60], xmm1
mov word [rsp + 0x50], si
lea rax, [rsp + 0x9a]
cmp r9, rax
je 0x100407fc3
lea r8, [rsp + 0x9a]
sub r8, r9
sar r8, 1
mov rdx, r9
lea rcx, [rsp + 0x50]
call fcn.100408fd0
mov dword [rsp + 0x40], r13d
and r13d, 0xfffffffd
mov dword [rsp + 0x40], r13d
mov ebx, 1
mov dword [rsp + 0x40], ebx
lea r8, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae r8, qword [rsp + 0x50]
mov r9, r12
lea rdx, str.TraceFileSizeMb
lea rcx, str.Logging
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov word [r14], si
cmp dword [r15 + 0x34], 0
cmovne rdi, rbp
mov r9, r12
mov r8, rdi
lea rdx, str.ForceFlush
lea rcx, str.Logging
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov rcx, r14
call fcn.100410100
and ebx, 0xfffffffe
mov dword [rsp + 0x40], ebx
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x10040807d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x100408078
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x100408078
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.100410100
movdqa xmm0, xmmword [0x100418e30]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], si
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.10040fdf0
mov rbx, qword [rsp + 0x100]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret