Function at 0x140048370
Capabilities:
Resolve function by parsing pe exports
Write file on windows

Disassembly:
push rbx
push rdi
sub rsp, 0x78
mov rax, qword [rcx + 8]
mov edi, 0
mov rbx, rcx
test dword [rax + 0x80], 0x100
movsxd rax, dword [0x1401bafe8]
setne dil
imul rcx, rax, 0x38
mov rax, qword [0x140175020]
add edi, 3
test dword [rcx + rax + 0x18], 0x10000
je 0x1400483d5
mov r8, qword [rcx + rax]
lea rcx, str._s_MONITOR:_s:
mov rdx, qword [section..data]
call fcn.140002310
mov edx, edi
lea rcx, str.Writing_section__d_n
call fcn.140001fb0
call fcn.140008a90
cmp dword [rbx + 0x100], 0
je 0x140048421
movsxd rax, dword [rbx + 0x4c]
mov edx, 0x40
mov rcx, qword [rbx + 0x28]
add rax, 0x14
lea r8d, [rdx - 0x41]
lea r9, [rbx + rax*4]
call fcn.14007d820
test eax, eax
je 0x14004846c
lea r8, str.Failed_to_start_writing_ol_section_for_CGF_n
mov edx, 1
mov ecx, 0x2b8f
add rsp, 0x78
pop rdi
pop rbx
jmp fcn.140001480
mov rax, qword [rbx + 8]
test dword [rax + 0x68], 0x800
jne 0x14004846c
movsxd rax, dword [rbx + 0x4c]
mov edx, 0x40
mov rcx, qword [rbx + 0x28]
add rax, 0x14
lea r8d, [rdx - 0x41]
lea r9, [rbx + rax*4]
call fcn.14007d5a0
test eax, eax
je 0x14004846c
lea r8, str.Failed_to_start_writing_ol_section_n
mov edx, 1
mov ecx, 0x2b92
add rsp, 0x78
pop rdi
pop rbx
jmp fcn.140001480
mov qword [rsp + 0x70], rbp
mov edx, 2
mov qword [rsp + 0x68], rsi
mov rcx, rbx
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x58], r13
lea r9d, [rdx - 3]
mov qword [rsp + 0x50], r14
lea r8d, [rdx + 2]
mov qword [rsp + 0x48], r15
call qword [0x1401baf10]
mov r9d, edi
mov edx, 0x9b
mov r8d, 0xffffffff
mov rcx, rbx
call qword [0x1401baf60]
mov rax, qword [rbx + 8]
mov ecx, dword [rax + 0x68]
movsxd rax, dword [rbx + 0x4c]
shl ecx, 0xd
not ecx
and ecx, 0x1000000
or ecx, edi
mov dword [rbx + rax*4 + 0x68], ecx
inc dword [rbx + 0x4c]
mov rax, qword [rbx + 0x18]
mov qword [rbx + 0x88], 0
mov r13, qword [rax]
mov qword [rsp + 0x38], r13
test r13, r13
je 0x1400488f9
nop word [rax + rax]
mov rax, qword [r13 + 0x18]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140048795
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0xa8], rax
test rax, rax
je 0x14004877a
nop word [rax + rax]
mov rsi, qword [rax + 0x10]
test rsi, rsi
je 0x140048766
nop dword [rax]
cmp qword [rsi + 0x20], 0
je 0x140048751
mov r15b, 1
xor r13b, r13b
movzx r12d, r15b
call fcn.140008a90
mov rcx, qword [rbx + 8]
mov rax, qword [rsi + 0x20]
test byte [rcx + 0x68], 0x20
mov edi, dword [rax]
je 0x1400485c3
movzx eax, byte [rax + 0x3c]
cmp al, 4
je 0x1400485c0
cmp al, 3
je 0x1400485b0
sub al, 6
cmp al, r15b
jbe 0x1400485b0
cmp byte [rsi + 0x50], r13b
jne 0x1400485c0
mov r12d, dword [rcx + 0x80]
shr r12d, 9
and r12b, r15b
cmp dword [rbx + 0xd8], 0
je 0x1400485c3
movzx r12d, r15b
jmp 0x1400485c0
mov rcx, rsi
call fcn.1400745d0
test eax, eax
jne 0x1400485c3
movzx r13d, r15b
xor r15b, r15b
mov r9d, dword [rbx + 0x88]
cmp edi, r9d
jne 0x1400486eb
test r15b, r15b
je 0x1400485de
mov rdi, qword [rsi + 0x28]
jmp 0x1400485e0
xor edi, edi
mov r14, qword [rsi + 0x20]
mov dword [rbx + 0xd0], 0
cmp qword [r14 + 0x30], 0
je 0x140048639
lea rdx, [rsp + 0x90]
mov rcx, r14
call fcn.1400432f0
mov ebp, eax
test rdi, rdi
je 0x14004862e
cmp qword [rdi + 0x30], 0
je 0x14004862e
lea rdx, [rsp + 0x98]
mov rcx, rdi
call fcn.1400432f0
mov r9d, dword [rbx + 0x88]
add ebp, eax
jmp 0x14004863e
mov r9d, dword [rbx + 0x88]
inc ebp
jmp 0x14004863e
mov ebp, 2
mov r8d, ebp
mov edx, reloc.WS2_32.dll_send
mov rcx, rbx
call qword [0x1401baf10]
cmp qword [r14 + 0x30], 0
mov edx, 0x8a
mov rcx, rbx
je 0x1400486a4
movzx r9d, word [rsp + 0x90]
mov r8, r14
call fcn.140048cd0
test rdi, rdi
je 0x140048696
cmp qword [rdi + 0x30], 0
je 0x140048696
movzx r9d, word [rsp + 0x98]
mov r8, rdi
mov edx, 0x98
mov rcx, rbx
call fcn.140048cd0
jmp 0x1400486d7
lea rax, str.CM_
mov qword [rsp + 0x20], rax
jmp 0x1400486c2
xor r9d, r9d
lea rbp, str.CM_
mov qword [rsp + 0x20], rbp
lea r8d, [r9 - 1]
call qword [0x1401baf38]
mov qword [rsp + 0x20], rbp
xor r9d, r9d
mov edx, 0x98
mov rcx, rbx
lea r8d, [r9 - 1]
call qword [0x1401baf38]
mov edx, reloc.WS2_32.dll_send
mov rcx, rbx
call qword [0x1401baf18]
inc dword [rbx + 0x88]
cmp byte [rsi + 0x50], 0
jne 0x140048743
mov rdi, qword [rsi + 0x30]
mov dword [rsp + 0xa0], 0xfffffffe
test rdi, rdi
je 0x140048743
nop word [rax + rax]
lea rax, [rsp + 0xa0]
movzx r9d, r12b
mov qword [rsp + 0x28], rax
mov r8, rdi
mov rdx, rsi
mov byte [rsp + 0x20], r15b
mov rcx, rbx
call fcn.140045140
inc dword [rbx + 0x8c]
mov rdi, qword [rdi + 8]
test rdi, rdi
jne 0x140048710
cmp r13b, 1
jne 0x140048751
mov rcx, rsi
call fcn.1400745d0
mov rsi, qword [rsi + 8]
test rsi, rsi
jne 0x140048550
mov rax, qword [rsp + 0xa8]
mov rax, qword [rax]
mov qword [rsp + 0xa8], rax
test rax, rax
jne 0x140048540
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
test rax, rax
jne 0x140048520
mov r13, qword [rsp + 0x38]
mov r13, qword [r13 + 8]
mov qword [rsp + 0x38], r13
test r13, r13
jne 0x140048500
mov rax, qword [rbx + 0x18]
mov r13, qword [rax]
test r13, r13
je 0x1400488f9
mov r15, qword [r13 + 0x18]
test r15, r15
je 0x140048833
mov r14, qword [r15 + 0x10]
test r14, r14
je 0x14004882b
nop dword [rax]
mov rsi, qword [r14 + 0x18]
test rsi, rsi
je 0x140048823
nop dword [rax]
call fcn.140008a90
movsxd rbp, dword [rsi + 0x38]
xor edi, edi
test rbp, rbp
jle 0x14004881b
mov rax, qword [rsi + 0x20]
mov rcx, qword [rax + rdi*8]
mov rdx, qword [rcx + 0x18]
test rdx, rdx
je 0x140048813
mov eax, dword [rbx + 0x98]
cmp dword [rdx], eax
jl 0x140048813
mov rcx, rbx
call fcn.140041410
inc rdi
cmp rdi, rbp
jl 0x1400487f0
mov rsi, qword [rsi]
test rsi, rsi
jne 0x1400487e0
mov r14, qword [r14]
test r14, r14
jne 0x1400487d0
mov r15, qword [r15]
test r15, r15
jne 0x1400487c0
mov r13, qword [r13 + 8]
test r13, r13
jne 0x1400487b7
mov rax, qword [rbx + 0x18]
mov r13, qword [rax]
test r13, r13
je 0x1400488f9
mov r12, qword [r13 + 0x18]
test r12, r12
je 0x1400488e5
nop dword [rax]
mov r15, qword [r12 + 0x10]
test r15, r15
je 0x1400488d8
nop word [rax + rax]
mov r14, qword [r15 + 0x20]
test r14, r14
je 0x1400488d0
nop dword [rax]
movsxd rbp, dword [r14 + 0x18]
xor esi, esi
xor edi, edi
test rbp, rbp
jle 0x1400488c8
nop dword [rax]
test sil, 0xf
jne 0x14004889b
call fcn.140008a90
mov rax, qword [r14 + 0x10]
mov rcx, qword [rax + rdi*8]
mov rdx, qword [rcx + 0x18]
test rdx, rdx
je 0x1400488be
mov eax, dword [rbx + 0x98]
cmp dword [rdx], eax
jl 0x1400488be
mov rcx, rbx
call fcn.140041410
inc esi
inc rdi
cmp rdi, rbp
jl 0x140048890
mov r14, qword [r14]
test r14, r14
jne 0x140048880
mov r15, qword [r15]
test r15, r15
jne 0x140048870
mov r12, qword [r12]
test r12, r12
jne 0x140048860
mov r13, qword [r13 + 8]
test r13, r13
jne 0x140048850
mov rax, qword [rbx + 0x18]
mov r13, qword [rax]
mov r12, qword [rsp + 0x60]
test r13, r13
je 0x140048b22
nop word [rax + rax]
mov r15, qword [r13 + 0x18]
test r15, r15
je 0x140048b15
nop dword [rax]
mov r14, qword [r15 + 0x10]
test r14, r14
je 0x140048b09
nop dword [rax]
mov rbp, qword [r14 + 0x10]
test rbp, rbp
je 0x140048afd
nop dword [rax]
cmp qword [rbp + 0x20], 0
je 0x140048af0
call fcn.140008a90
mov rdx, qword [rbp + 0x20]
xor r8d, r8d
mov dword [rbx + 0xd0], r8d
movzx ecx, byte [rdx + 0x3c]
cmp cl, 3
je 0x14004896c
cmp cl, 6
jne 0x14004898b
mov rax, qword [rdx + 0x30]
mov rcx, qword [rax]
mov eax, 1
mov qword [rbx + 0xb0], rcx
mov dword [rbx + 0xd0], 1
jmp 0x1400489c6
mov eax, r8d
cmp cl, 7
jne 0x1400489c6
mov rax, qword [rdx + 0x30]
mov rcx, qword [rax]
mov qword [rbx + 0xb0], rcx
mov dword [rbx + 0xd0], 1
mov rax, qword [rdx + 0x30]
mov rcx, qword [rax + 8]
mov qword [rbx + 0xb8], rcx
inc dword [rbx + 0xd0]
mov eax, dword [rbx + 0xd0]
mov rdx, qword [rbp + 0x28]
test rdx, rdx
je 0x140048a33
mov dword [rbx + 0xd0], r8d
movzx eax, byte [rdx + 0x3c]
cmp al, 3
je 0x1400489e2
cmp al, 6
jne 0x1400489fc
mov rax, qword [rdx + 0x30]
mov rcx, qword [rax]
mov qword [rbx + 0xb0], rcx
mov dword [rbx + 0xd0], 1
jmp 0x140048a37
cmp al, 7
jne 0x140048a64
mov rax, qword [rdx + 0x30]
mov rcx, qword [rax]
mov qword [rbx + 0xb0], rcx
mov dword [rbx + 0xd0], 1
mov rax, qword [rdx + 0x30]
mov rcx, qword [rax + 8]
mov qword [rbx + 0xb8], rcx
inc dword [rbx + 0xd0]
mov eax, dword [rbx + 0xd0]
test eax, eax
jle 0x140048a64
lea rsi, [rbx + 0xb0]
mov edi, r8d
mov rdx, qword [rsi]
mov eax, dword [rbx + 0x98]
cmp dword [rdx], eax
jl 0x140048a56
mov rcx, rbx
call fcn.140041410
inc edi
add rsi, 8
cmp edi, dword [rbx + 0xd0]
jl 0x140048a41
cmp byte [rbp + 0x50], 0
jne 0x140048af0
mov rsi, qword [rbp + 0x30]
test rsi, rsi
je 0x140048af0
call fcn.140008a90
mov rdi, qword [rsi + 0x18]
test rdi, rdi
je 0x140048ae7
mov rdx, qword [rdi + 0x10]
test rdx, rdx
je 0x140048aa9
mov rdx, qword [rdx + 0x18]
test rdx, rdx
je 0x140048aa9
mov eax, dword [rbx + 0x98]
cmp dword [rdx], eax
jl 0x140048aa9
mov rcx, rbx
call fcn.140041410
mov rdx, qword [rdi + 0x18]
test rdx, rdx
je 0x140048ac4
mov eax, dword [rbx + 0xa0]
cmp dword [rdx], eax
jl 0x140048ac4
mov rcx, rbx
call fcn.140046170
mov rdx, qword [rdi + 0x20]
test rdx, rdx
je 0x140048adf
mov eax, dword [rbx + 0xa0]
cmp dword [rdx], eax
jl 0x140048adf
mov rcx, rbx
call fcn.140046170
mov rdi, qword [rdi]
test rdi, rdi
jne 0x140048a85
mov rsi, qword [rsi + 8]
test rsi, rsi
jne 0x140048a77
mov rbp, qword [rbp + 8]
test rbp, rbp
jne 0x140048940
mov r14, qword [r14]
test r14, r14
jne 0x140048930
mov r15, qword [r15]
test r15, r15
jne 0x140048920
mov r13, qword [r13 + 8]
test r13, r13
jne 0x140048910
mov edx, 2
mov rcx, rbx
mov r15, qword [rsp + 0x48]
mov r14, qword [rsp + 0x50]
mov r13, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
pop rdi
pop rbx
jmp qword [0x1401baf18]