Function at 0x100009298
Capabilities:
Write file on windows

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0xa0
lea rbp, [rsp + 0x30]
mov qword [rbp + 0xa0], rbx
mov qword [rbp + 0xa8], rsi
mov qword [rbp + 0xb0], rdi
mov rax, qword [0x100024390]
xor rax, rbp
mov qword [rbp + 0x68], rax
mov rdi, rdx
mov qword [rbp + 0x10], rdx
mov r10, rcx
mov qword [rbp + 0x18], rcx
xor esi, esi
mov dword [rbp], esi
mov r12, rsi
mov qword [rbp + 8], rsi
mov dword [rbp + 4], esi
lea rbx, [rdx + 0x10]
cmp rbx, rsi
jne 0x100009306
mov rax, rsi
movabs r15, 0xffffffffffffff0
jmp 0x100009385
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea r9d, [rax + 1]
lea eax, [r9 + r9]
movsxd rcx, eax
lea rax, [rcx + 0xf]
cmp rax, rcx
ja 0x100009332
movabs r15, 0xffffffffffffff0
mov rax, r15
jmp 0x10000933c
movabs r15, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.10001d390
sub rsp, rax
lea rdi, [rsp + 0x30]
cmp rdi, rsi
je 0x10000937a
mov word [rdi], si
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], rdi
or r9d, 0xffffffff
mov r8, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
neg eax
sbb rax, rax
and rax, rdi
jmp 0x10000937d
mov rax, rsi
mov rdi, qword [rbp + 0x10]
mov r10, qword [rbp + 0x18]
lea r8, [rbp + 8]
mov qword [rbp + 0x28], rsi
cmp rax, rsi
je 0x1000093ea
lea r9, [rbp + 0x28]
mov r13d, 0x100
mov rcx, r13
mov qword [rbp + 0x38], rcx
mov qword [rbp + 0x48], rax
cmp rcx, rsi
je 0x1000093c2
cmp word [rax], si
je 0x1000093c2
add rax, 2
mov qword [rbp + 0x48], rax
dec rcx
mov qword [rbp + 0x38], rcx
jmp 0x1000093a7
mov edx, esi
mov r14d, 0x80070057
cmp rcx, rsi
cmove edx, r14d
cmp r9, rsi
je 0x1000093f9
cmp edx, esi
jl 0x1000093e5
mov rax, r13
sub rax, rcx
mov qword [r9], rax
jmp 0x1000093f9
mov qword [r9], rsi
jmp 0x1000093f9
mov r14d, 0x80070057
mov edx, r14d
mov r13d, 0x100
cmp r8, rsi
je 0x100009419
cmp edx, esi
jl 0x100009412
mov rax, qword [rbp + 0x28]
add rax, rax
mov qword [r8], rax
mov r12, qword [rbp + 8]
jmp 0x100009419
mov qword [r8], rsi
mov r12, qword [rbp + 8]
cmp edx, esi
jge 0x100009435
lea rdx, [0x1000035c8]
mov ecx, 4
call fcn.100006e7c
xor eax, eax
jmp 0x100009a46
mov eax, 0xffffffff
cmp r12, rax
jbe 0x100009446
xor eax, eax
jmp 0x100009a46
mov dword [rbp], r12d
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 4]
mov ebx, 4
mov r8d, ebx
lea rdx, [rbp]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, esi
jne 0x100009481
lea rdx, [0x1000035c8]
mov ecx, ebx
call fcn.100006e7c
xor eax, eax
jmp 0x100009a46
mov r8d, dword [rbp]
lea rdx, [0x1000039c8]
mov ecx, 2
call fcn.100006e7c
lea rsi, [rdi + 0x10]
xor eax, eax
cmp rsi, rax
jne 0x1000094a6
mov rdx, rax
jmp 0x10000950f
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea r9d, [rax + 1]
lea eax, [r9 + r9]
movsxd rcx, eax
lea rax, [rcx + 0xf]
cmp rax, rcx
ja 0x1000094c6
mov rax, r15
and rax, 0xfffffffffffffff0
call fcn.10001d390
sub rsp, rax
lea rdi, [rsp + 0x30]
xor eax, eax
cmp rdi, rax
je 0x100009508
mov word [rdi], ax
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], rdi
or r9d, 0xffffffff
mov r8, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
neg eax
sbb rdx, rdx
and rdx, rdi
xor eax, eax
jmp 0x10000950b
mov rdx, rax
mov rdi, qword [rbp + 0x10]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 4]
mov r8d, dword [rbp]
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor ecx, ecx
cmp eax, ecx
jne 0x100009541
lea rdx, [0x1000035c8]
mov ecx, ebx
call fcn.100006e7c
xor eax, eax
jmp 0x100009a46
mov r8, rsi
lea rdx, [0x1000039f0]
mov ecx, 2
call fcn.100006e7c
lea rsi, [rdi + 0x110]
xor r8d, r8d
cmp rsi, r8
jne 0x100009569
mov rax, r8
jmp 0x1000095d5
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea r9d, [rax + 1]
lea eax, [r9 + r9]
movsxd rcx, eax
lea rax, [rcx + 0xf]
cmp rax, rcx
ja 0x100009589
mov rax, r15
and rax, 0xfffffffffffffff0
call fcn.10001d390
sub rsp, rax
lea rdi, [rsp + 0x30]
xor r8d, r8d
cmp rdi, r8
je 0x1000095ce
mov word [rdi], r8w
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], rdi
or r9d, 0xffffffff
mov r8, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
neg eax
sbb rax, rax
and rax, rdi
xor r8d, r8d
jmp 0x1000095d1
mov rax, r8
mov rdi, qword [rbp + 0x10]
lea r10, [rbp + 8]
mov qword [rbp + 0x20], r8
cmp rax, r8
je 0x100009631
lea r9, [rbp + 0x20]
mov rcx, r13
mov qword [rbp + 0x40], rcx
mov qword [rbp + 0x58], rax
cmp rcx, r8
je 0x10000960d
cmp word [rax], r8w
je 0x10000960d
add rax, 2
mov qword [rbp + 0x58], rax
dec rcx
mov qword [rbp + 0x40], rcx
jmp 0x1000095f1
mov edx, r8d
cmp rcx, r8
cmove edx, r14d
cmp r9, r8
je 0x100009634
cmp edx, r8d
jl 0x10000962c
mov rax, r13
sub rax, rcx
mov qword [r9], rax
jmp 0x100009634
mov qword [r9], r8
jmp 0x100009634
mov edx, r14d
cmp r10, r8
je 0x100009655
cmp edx, r8d
jl 0x10000964e
mov rax, qword [rbp + 0x20]
add rax, rax
mov qword [r10], rax
mov r12, qword [rbp + 8]
jmp 0x100009655
mov qword [r10], r8
mov r12, qword [rbp + 8]
cmp edx, r8d
jge 0x10000966f
lea rdx, [0x1000035c8]
mov ecx, ebx
call fcn.100006e7c
xor eax, eax
jmp 0x100009a46
mov eax, 0xffffffff
cmp r12, rax
jbe 0x100009680
xor eax, eax
jmp 0x100009a46
mov dword [rbp], r12d
mov qword [rsp + 0x20], r8
lea r9, [rbp + 4]
mov r8d, ebx
lea rdx, [rbp]
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor ecx, ecx
cmp eax, ecx
jne 0x1000096b9
lea rdx, [0x1000035c8]
mov ecx, ebx
call fcn.100006e7c
xor eax, eax
jmp 0x100009a46
mov r8d, dword [rbp]
lea rdx, [0x100003a10]
mov ecx, 2
call fcn.100006e7c
lea rsi, [rdi + 0x110]
xor eax, eax
cmp rsi, rax
jne 0x1000096e1
mov rdx, rax
jmp 0x10000974a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea r9d, [rax + 1]
lea eax, [r9 + r9]
movsxd rcx, eax
lea rax, [rcx + 0xf]
cmp rax, rcx
ja 0x100009701
mov rax, r15
and rax, 0xfffffffffffffff0
call fcn.10001d390
sub rsp, rax
lea rdi, [rsp + 0x30]
xor eax, eax
cmp rdi, rax
je 0x100009743
mov word [rdi], ax
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], rdi
or r9d, 0xffffffff
mov r8, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
neg eax
sbb rdx, rdx
and rdx, rdi
xor eax, eax
jmp 0x100009746
mov rdx, rax
mov rdi, qword [rbp + 0x10]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 4]
mov r8d, dword [rbp]
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor ecx, ecx
cmp eax, ecx
jne 0x10000977c
lea rdx, [0x1000035c8]
mov ecx, ebx
call fcn.100006e7c
xor eax, eax
jmp 0x100009a46
mov r8, rsi
lea rdx, [0x100003a30]
mov ecx, 2
call fcn.100006e7c
lea rsi, [rdi + 0x210]
xor r8d, r8d
cmp rsi, r8
jne 0x1000097a4
mov rax, r8
jmp 0x100009810
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea r9d, [rax + 1]
lea eax, [r9 + r9]
movsxd rcx, eax
lea rax, [rcx + 0xf]
cmp rax, rcx
ja 0x1000097c4
mov rax, r15
and rax, 0xfffffffffffffff0
call fcn.10001d390
sub rsp, rax
lea rdi, [rsp + 0x30]
xor r8d, r8d
cmp rdi, r8
je 0x100009809
mov word [rdi], r8w
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], rdi
or r9d, 0xffffffff
mov r8, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
neg eax
sbb rax, rax
and rax, rdi
xor r8d, r8d
jmp 0x10000980c
mov rax, r8
mov rdi, qword [rbp + 0x10]
lea r10, [rbp + 8]
mov qword [rbp + 0x30], r8
cmp rax, r8
je 0x10000986c
lea r9, [rbp + 0x30]
mov qword [rbp + 0x60], r13
mov qword [rbp + 0x50], rax
mov rdx, r13
cmp r13, r8
je 0x100009848
cmp word [rax], r8w
je 0x100009848
add rax, 2
mov qword [rbp + 0x50], rax
dec r13
mov qword [rbp + 0x60], r13
jmp 0x10000982c
mov ecx, r8d
cmp r13, r8
cmove ecx, r14d
xor r14d, r14d
cmp r9, r14
je 0x100009872
cmp ecx, r14d
jl 0x100009867
sub rdx, r13
mov qword [r9], rdx
jmp 0x100009872
mov qword [r9], r14
jmp 0x100009872
mov ecx, r14d
xor r14d, r14d
cmp r10, r14
je 0x100009893
cmp ecx, r14d
jl 0x10000988c
mov rax, qword [rbp + 0x30]
add rax, rax
mov qword [r10], rax
mov r12, qword [rbp + 8]
jmp 0x100009893
mov qword [r10], r14
mov r12, qword [rbp + 8]
cmp ecx, r14d
jge 0x1000098ad
lea rdx, [0x1000035c8]
mov ecx, ebx
call fcn.100006e7c
xor eax, eax
jmp 0x100009a46
mov eax, 0xffffffff
cmp r12, rax
jbe 0x1000098be
xor eax, eax
jmp 0x100009a46
mov dword [rbp], r12d
mov qword [rsp + 0x20], r14
lea r9, [rbp + 4]
mov r8d, ebx
lea rdx, [rbp]
mov r12, qword [rbp + 0x18]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, r14d
jne 0x1000098f9
lea rdx, [0x1000035c8]
mov ecx, ebx
call fcn.100006e7c
xor eax, eax
jmp 0x100009a46
mov r8d, dword [rbp]
lea rdx, [0x100003a48]
mov ecx, 2
call fcn.100006e7c
lea rsi, [rdi + 0x210]
cmp rsi, r14
jne 0x10000991f
mov rdx, r14
jmp 0x100009985
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea r8d, [rax + 1]
lea eax, [r8 + r8]
movsxd rcx, eax
lea rax, [rcx + 0xf]
cmp rax, rcx
ja 0x10000993f
mov rax, r15
and rax, 0xfffffffffffffff0
call fcn.10001d390
sub rsp, rax
lea rdi, [rsp + 0x30]
cmp rdi, r14
je 0x10000997e
mov word [rdi], r14w
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], rdi
or r9d, 0xffffffff
mov r8, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
neg eax
sbb rdx, rdx
and rdx, rdi
jmp 0x100009981
mov rdx, r14
mov rdi, qword [rbp + 0x10]
mov qword [rsp + 0x20], r14
lea r9, [rbp + 4]
mov r8d, dword [rbp]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, r14d
jne 0x1000099b5
lea rdx, [0x1000035c8]
mov ecx, ebx
call fcn.100006e7c
xor eax, eax
jmp 0x100009a46
lea r8, [rdi + 0x110]
lea rdx, [0x100003a30]
mov ecx, 2
call fcn.100006e7c
lea rdx, [rdi + 0x310]
mov qword [rsp + 0x20], r14
lea r9, [rbp + 4]
mov esi, 8
mov r8d, esi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, r14d
jne 0x100009a05
lea rdx, [0x1000035c8]
mov ecx, ebx
call fcn.100006e7c
xor eax, eax
jmp 0x100009a46
lea rdx, [rdi + 0x318]
mov qword [rsp + 0x20], r14
lea r9, [rbp + 4]
mov r8d, esi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, r14d
jne 0x100009a38
lea rdx, [0x1000035c8]
mov ecx, ebx
call fcn.100006e7c
xor eax, eax
jmp 0x100009a46
mov eax, 1
jmp 0x100009a46
mov rcx, qword [rbp + 0x68]
xor rcx, rbp
call fcn.100011c90
mov rbx, qword [rbp + 0xa0]
mov rsi, qword [rbp + 0xa8]
mov rdi, qword [rbp + 0xb0]
lea rsp, [rbp + 0x70]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret