Function at 0x140001970
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
push rbx
push rbp
push r12
sub rsp, 0x1b0
mov rax, qword [0x140015028]
xor rax, rsp
mov qword [rsp + 0x180], rax
cmp dword [rcx + 0x58], 0
mov r12d, r8d
mov rbp, rdx
mov rbx, rcx
je 0x140001c03
mov qword [r11 - 0x20], rsi
mov qword [r11 - 0x30], r13
mov qword [r11 - 0x38], r14
mov r14d, 1
xor r13d, r13d
lea rcx, str.C:AEFilters.log
mov qword [rsp + 0x30], r13
xor r9d, r9d
mov edx, 0x40000000
mov r8d, r14d
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov rsi, rax
jne 0x140001a31
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x30], r13
lea rcx, str.C:AEFilters.log
xor r9d, r9d
mov r8d, r14d
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov rsi, rax
je 0x140001beb
cmp dword [rbx + 4], r13d
mov qword [rsp + 0x1a0], rdi
mov edi, r13d
cmovne edi, r14d
cmp dword [rbx + 8], r13d
je 0x140001a4d
add edi, 2
cmp dword [rbx + 0xc], r13d
je 0x140001a56
add edi, 4
cmp dword [rbx + 0x10], r13d
je 0x140001a5f
add edi, 8
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea rax, [rsp + 0x90]
lea r9, str.ddMMMyy
lea r8, [rsp + 0x68]
xor edx, edx
mov ecx, 0x400
mov dword [rsp + 0x28], 0x14
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetDateFormatA]
lea rax, [rsp + 0x78]
lea r9, str.HH:mm:ss
lea r8, [rsp + 0x68]
xor edx, edx
mov ecx, 0x400
mov dword [rsp + 0x28], 0x14
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetTimeFormatA]
cmp r12d, 0xffffffff
jne 0x140001b18
mov eax, dword [rbx + 0x18]
movzx ecx, word [rsp + 0x76]
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], ecx
lea rax, [rsp + 0x78]
lea r9, [rbx + 0x68]
lea r8, str._s__s__s._i:__s___i____i__r_n
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x90]
lea rcx, [rsp + 0xb0]
mov edx, 0xc8
mov qword [rsp + 0x20], rax
call fcn.140003ed0
jmp 0x140001b6a
mov eax, dword [rbx + 0x18]
movzx ecx, word [rsp + 0x76]
mov dword [rsp + 0x50], edi
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x40], r12d
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], ecx
lea rax, [rsp + 0x78]
lea r9, [rbx + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x90]
lea r8, str._s__s__s._i:__s___i____i____i__r_n
lea rcx, [rsp + 0xb0]
mov edx, 0xc8
mov qword [rsp + 0x20], rax
call fcn.140003ed0
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [rsp + 0x1f0], r13d
je 0x140001ba8
lea r9, [rsp + 0x60]
lea rdx, [0x140012144]
mov r8d, 2
mov rcx, rsi
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0xb0]
repne scasb al, byte [rdi]
lea r9, [rsp + 0x60]
lea rdx, [rsp + 0xb0]
not rcx
mov qword [rsp + 0x20], r13
lea r8, [rcx - 1]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x1a0]
mov r13, qword [rsp + 0x198]
mov rsi, qword [rsp + 0x1a8]
mov r14, qword [rsp + 0x190]
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.140003f10
add rsp, 0x1b0
pop r12
pop rbp
pop rbx
ret