Function at 0x1000464d0
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
mov rax, qword [0x1000a5140]
xor rax, rsp
mov qword [rsp + 0xa8], rax
xor ebp, ebp
lea rcx, [r11 - 0x74]
xor edx, edx
lea r8d, [rbp + 0x28]
mov dword [rsp + 0x60], ebp
call sub.msvcrt.dll_memset
mov rcx, qword [0x1000b1078]
lea rdx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_GetWindowPlacement]
mov r12d, 0x98
mov rcx, r12
call fcn.1000990c0
cmp rax, rbp
je 0x100046548
mov rcx, rax
call fcn.100065368
mov rbx, rax
jmp 0x10004654b
mov rbx, rbp
lea rdx, [0x100016478]
mov rcx, rbx
call fcn.100066cb4
mov rcx, r12
call fcn.1000990c0
cmp rax, rbp
je 0x100046574
mov rcx, rax
call fcn.100065368
mov r13, rax
jmp 0x100046577
mov r13, rbp
lea rdx, [0x10001afc0]
mov rcx, r13
call fcn.100066cb4
mov r9d, dword [rsp + 0x7c]
lea rsi, [0x100017044]
mov r14d, 0xa
lea rcx, [rsp + 0x90]
mov r8, rsi
mov rdx, r14
call sub.msvcrt.dll_swprintf_s
lea rdx, [rsp + 0x90]
mov rcx, r13
call fcn.100066ebc
mov rcx, r12
call fcn.1000990c0
cmp rax, rbp
je 0x1000465d5
mov rcx, rax
call fcn.100065368
mov rdi, rax
jmp 0x1000465d8
mov rdi, rbp
lea rdx, [0x10001afd0]
mov rcx, rdi
mov qword [rsp + 0x58], rdi
call fcn.100066cb4
mov r9d, dword [rsp + 0x80]
lea rcx, [rsp + 0x90]
mov r8, rsi
mov rdx, r14
call sub.msvcrt.dll_swprintf_s
lea rdx, [rsp + 0x90]
mov rcx, rdi
call fcn.100066ebc
mov rcx, qword [0x1000b1078]
lea rdx, [rsp + 0x48]
call qword [sym.imp.USER32.dll_GetClientRect]
mov rax, qword [0x1000b10e0]
mov edx, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x50]
sub edx, dword [rsp + 0x4c]
mov qword [rsp + 0x28], rax
mov rax, qword [0x1000b1078]
sub ecx, dword [rsp + 0x48]
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x44]
mov qword [rsp + 0x20], rax
call fcn.100060578
mov r11d, dword [rsp + 0x50]
mov eax, dword [rsp + 0x54]
sub r11d, dword [rsp + 0x48]
sub eax, dword [rsp + 0x4c]
mov rcx, r12
sub r11d, dword [rsp + 0x44]
sub eax, dword [rsp + 0x38]
add dword [rsp + 0x84], r11d
add dword [rsp + 0x88], eax
call fcn.1000990c0
cmp rax, rbp
je 0x1000466a4
mov rcx, rax
call fcn.100065368
mov r15, rax
jmp 0x1000466a7
mov r15, rbp
lea rdx, [0x10001afe0]
mov rcx, r15
call fcn.100066cb4
mov r9d, dword [rsp + 0x84]
lea rcx, [rsp + 0x90]
sub r9d, dword [rsp + 0x7c]
mov r8, rsi
mov rdx, r14
call sub.msvcrt.dll_swprintf_s
lea rdx, [rsp + 0x90]
mov rcx, r15
call fcn.100066ebc
mov rcx, r12
call fcn.1000990c0
cmp rax, rbp
je 0x100046700
mov rcx, rax
call fcn.100065368
mov r14, rax
jmp 0x100046703
mov r14, rbp
lea rdx, [0x10001aff8]
mov rcx, r14
call fcn.100066cb4
mov r9d, dword [rsp + 0x88]
lea rcx, [rsp + 0x90]
sub r9d, dword [rsp + 0x80]
mov r8, rsi
mov edx, 0xa
call sub.msvcrt.dll_swprintf_s
lea rdx, [rsp + 0x90]
mov rcx, r14
call fcn.100066ebc
mov rcx, r12
call fcn.1000990c0
cmp rax, rbp
je 0x100046761
mov rcx, rax
call fcn.100065368
mov rsi, rax
jmp 0x100046764
mov rsi, rbp
lea rdx, [0x10001b018]
mov rcx, rsi
call fcn.100066cb4
mov rcx, qword [0x1000b1078]
call qword [sym.imp.USER32.dll_IsIconic]
cmp eax, ebp
je 0x100046795
test byte [rsp + 0x64], 2
je 0x100046795
mov edi, 1
mov cl, dil
jmp 0x1000467b0
mov rcx, qword [0x1000b1078]
call qword [sym.imp.USER32.dll_IsZoomed]
movzx ecx, bpl
mov edi, 1
cmp eax, ebp
cmovne ecx, edi
cmp cl, bpl
lea rax, [0x100016fa0]
lea rdx, [0x10001b02c]
cmovne rdx, rax
mov rcx, rsi
call fcn.100066ebc
mov rcx, r12
call fcn.1000990c0
cmp rax, rbp
je 0x1000467e7
mov rcx, rax
call fcn.100065368
mov r12, rax
jmp 0x1000467ea
mov r12, rbp
lea rdx, [0x10001b030]
mov rcx, r12
call fcn.100066cb4
mov r9d, dword [0x1000ace04]
lea r8, [0x100017044]
lea rcx, [rsp + 0x90]
mov edx, 0xa
call sub.msvcrt.dll_swprintf_s
lea rdx, [rsp + 0x90]
mov rcx, r12
call fcn.100066ebc
mov ecx, 0x98
call fcn.1000990c0
cmp rax, rbp
je 0x100046843
mov rcx, rax
call fcn.100065368
mov rbp, rax
lea rdx, [0x10001b040]
mov rcx, rbp
call fcn.100066cb4
mov r9d, dword [0x1000ace08]
lea r8, [0x100017044]
lea rcx, [rsp + 0x90]
mov edx, 0xa
call sub.msvcrt.dll_swprintf_s
lea rdx, [rsp + 0x90]
mov rcx, rbp
call fcn.100066ebc
mov ecx, 0x98
call fcn.1000990c0
test rax, rax
je 0x10004689b
mov rcx, rax
call fcn.100065368
jmp 0x10004689d
xor eax, eax
lea rdx, [0x10001b050]
mov rcx, rax
mov qword [rsp + 0x38], rax
call fcn.100066cb4
mov r11, qword [0x1000b10d8]
mov rcx, qword [rsp + 0x38]
cmp byte [r11 + 0x12c], 0
lea rax, [0x10001aab0]
lea rdx, [0x10001aa88]
cmovne rdx, rax
call fcn.100066ebc
or r8d, 0xffffffff
mov rdx, r13
mov rcx, rbx
call fcn.100066f58
mov rdx, qword [rsp + 0x58]
or r13d, 0xffffffff
mov r8d, r13d
mov rcx, rbx
call fcn.100066f58
mov r8d, r13d
mov rdx, r15
mov rcx, rbx
call fcn.100066f58
mov r8d, r13d
mov rdx, r14
mov rcx, rbx
call fcn.100066f58
mov r8d, r13d
mov rdx, rsi
mov rcx, rbx
call fcn.100066f58
mov rdx, qword [rsp + 0x38]
mov r8d, r13d
mov rcx, rbx
call fcn.100066f58
mov r8d, r13d
mov rdx, r12
mov rcx, rbx
call fcn.100066f58
mov r8d, r13d
mov rdx, rbp
mov rcx, rbx
call fcn.100066f58
xor r12d, r12d
lea r8, [rsp + 0x44]
lea rdx, [rsp + 0x38]
mov rcx, rbx
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x44], r12d
call fcn.10006700c
cmp rbx, r12
je 0x100046989
mov rcx, rbx
call fcn.1000653f4
mov rcx, rbx
call sub.msvcrt.dll_free
cmp byte [0x1000b10f2], r12b
lea rax, [0x10001b0a0]
lea rcx, [0x10001b078]
cmove rcx, rax
xor r9d, r9d
xor edx, edx
lea r13d, [r9 + 0x1c]
mov dword [rsp + 0x20], r12d
mov r8d, r13d
call fcn.10004840c
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1000469ed
mov rcx, qword [rsp + 0x38]
call sub.msvcrt.dll_free
lea r9, [0x10001b0c0]
lea r8, [0x10001ad68]
mov edx, 0x94b
mov ecx, 0x800
call fcn.10005e0ac
jmp 0x100046ab3
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x30]
mov r8d, 2
mov rcx, rax
mov dword [rsp + 0x40], r12d
mov byte [rsp + 0x30], 0xff
mov byte [rsp + 0x31], 0xfe
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, r12d
je 0x100046a7e
cmp dword [rsp + 0x40], 2
jne 0x100046a7e
mov ebp, dword [rsp + 0x44]
mov rsi, qword [rsp + 0x38]
lea r9, [rsp + 0x40]
lea r8d, [rbp + rbp]
mov rdx, rsi
mov rcx, rbx
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, r12d
je 0x100046a68
mov eax, dword [rsp + 0x40]
mov r9, rbp
add r9, r9
cmp rax, r9
jne 0x100046a68
mov rcx, rsi
call sub.msvcrt.dll_free
jmp 0x100046aa5
mov rcx, rsi
call sub.msvcrt.dll_free
lea r9, [0x10001b1b0]
mov edx, 0x962
jmp 0x100046a94
mov rcx, qword [rsp + 0x38]
call sub.msvcrt.dll_free
lea r9, [0x10001b130]
mov edx, 0x958
lea r8, [0x10001ad68]
mov ecx, 0x800
call fcn.10005e0ac
mov r8b, dil
mov edx, r13d
mov rcx, rbx
call fcn.1000480f8
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.1000995a0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret