Function at 0x7ff7cbf4d4e8
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xf0
mov rax, qword [0x7ff7cbf93a08]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov qword [rbp - 0x59], rcx
mov r12d, r9d
cmp qword [rcx + 0x18], 0x10
mov r15d, r8d
mov rsi, rdx
mov rbx, rcx
jb 0x7ff7cbf4d527
mov rcx, qword [rcx]
and qword [rsp + 0x30], 0
xor r9d, r9d
and dword [rsp + 0x28], 0
xor r8d, r8d
mov edx, 0x1f01ff
mov dword [rsp + 0x20], 2
call qword [sym.imp.kernel32.dll_CreateFileA]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x7ff7cbf4d655
call qword [sym.imp.kernel32.dll_GetLastError]
movabs rdx, 0x68402805f23f05fe
movabs rcx, 0x4294963d26228a5
mov qword [rbp - 0x19], rcx
movabs rcx, 0xe1b652f26fba99a6
mov qword [rbp - 0x11], rcx
movabs rcx, 0x5c378c31ecae17f7
mov qword [rbp - 9], rcx
movabs rcx, 0x83b338e8db4129c8
mov qword [rbp - 1], rcx
movabs rcx, 0xccec465fcd4509f9
mov qword [rbp + 7], rcx
movabs rcx, 0xc642deaea7eac92a
mov qword [rbp + 0xf], rcx
movabs rcx, 0x93d5729d1b9afdc3
mov qword [rbp - 0x41], rcx
movabs rcx, 0x305eea1189da7692
mov qword [rbp - 0x39], rcx
movabs rcx, 0xecc15cc8b43509ad
mov qword [rbp - 0x31], rcx
movabs rcx, 0xbf85227fa32c2989
movups xmm1, xmmword [rbp - 0x39]
mov qword [rbp - 0x29], rcx
movabs rcx, 0xc64883f682b1e941
mov qword [rbp - 0x21], rcx
lea rcx, [rsp + 0x40]
movups xmm2, xmmword [rbp - 0x29]
mov qword [rbp - 0x49], rdx
mov edx, eax
movups xmm0, xmmword [rbp - 0x49]
pxor xmm2, xmmword [rbp + 7]
pxor xmm0, xmmword [rbp - 0x19]
pxor xmm1, xmmword [rbp - 9]
movdqa xmmword [rbp - 0x69], xmm2
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmmword [rbp - 0x79], xmm1
call fcn.7ff7cbf63d9c
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x7ff7cbf4d8b7
mov edi, 0x1000
jmp 0x7ff7cbf4d88f
mov edi, 0x1000
test r12d, r12d
je 0x7ff7cbf4d780
lea edx, [r15 + 0x64]
mov r9d, 4
mov r8d, edi
xor ecx, ecx
call qword [sym.imp.kernel32.dll_VirtualAlloc]
mov rdx, rax
lea r8d, [r15 + 1]
sub rsi, rax
mov cl, r12b
add cl, byte [rsi + rdx]
mov byte [rdx], cl
inc rdx
sub r8, 1
jne 0x7ff7cbf4d682
mov rsi, rax
test rax, rax
jne 0x7ff7cbf4d780
mov rcx, r14
call qword [sym.imp.kernel32.dll_CloseHandle]
movabs rcx, 0x4294963d26228a5
movabs rax, 0x68402825f23f05fe
mov qword [rbp - 0x49], rcx
movabs rcx, 0xe1b652f26fba99a6
mov qword [rbp - 0x41], rcx
movabs rcx, 0x5c378c31ecae17f7
mov qword [rbp - 0x19], rax
movabs rax, 0x88c431970b9afdc3
mov qword [rbp - 0x39], rcx
movabs rcx, 0x83b338e8db4129c8
mov qword [rbp - 0x11], rax
movabs rax, 0x7c52e0588a8e6387
movups xmm0, xmmword [rbp - 0x19]
mov qword [rbp - 0x31], rcx
movabs rcx, 0xccec465fcd4509f9
mov qword [rbp - 9], rax
movabs rax, 0xf1dc558db66147a1
pxor xmm0, xmmword [rbp - 0x49]
mov qword [rbp - 0x29], rcx
movabs rcx, 0xc642deaea7eac92a
mov qword [rbp - 1], rax
movabs rax, 0xccec465fcd450380
movups xmm1, xmmword [rbp - 9]
mov qword [rbp + 0xf], rcx
mov qword [rbp - 0x21], rcx
lea rcx, [rsp + 0x40]
pxor xmm1, xmmword [rbp - 0x39]
mov qword [rbp + 7], rax
movups xmm2, xmmword [rbp + 7]
movdqa xmmword [rsp + 0x40], xmm0
pxor xmm2, xmmword [rbp - 0x29]
movdqa xmmword [rbp - 0x69], xmm2
movdqa xmmword [rbp - 0x79], xmm1
call fcn.7ff7cbf63d9c
jmp 0x7ff7cbf4d885
and qword [rsp + 0x20], 0
lea r9, [rbp - 0x59]
mov r8d, r15d
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
jne 0x7ff7cbf4d8c0
call qword [sym.imp.kernel32.dll_GetLastError]
movabs rcx, 0x4294963d26228a5
movabs rdx, 0x68402805f23f05fe
mov qword [rbp - 0x49], rcx
movabs rcx, 0xe1b652f26fba99a6
mov qword [rbp - 0x41], rcx
movabs rcx, 0x5c378c31ecae17f7
mov qword [rbp - 0x19], rdx
movabs rdx, 0x93c1729d1b9afdc3
mov qword [rbp - 0x39], rcx
movabs rcx, 0x83b338e8db4129c8
mov qword [rbp - 0x11], rdx
movabs rdx, 0x7c52e0588acb639e
movups xmm0, xmmword [rbp - 0x19]
mov qword [rbp - 0x31], rcx
movabs rcx, 0xccec465fcd4509f9
mov qword [rbp - 9], rdx
movabs rdx, 0xa3d84b81bf6147a1
pxor xmm0, xmmword [rbp - 0x49]
mov qword [rbp - 0x29], rcx
movabs rcx, 0xc642deaea7eac92a
mov qword [rbp - 1], rdx
movabs rdx, 0xccec465fcd4f51dc
movups xmm1, xmmword [rbp - 9]
mov qword [rbp + 0xf], rcx
mov qword [rbp + 7], rdx
mov edx, eax
movups xmm2, xmmword [rbp + 7]
mov qword [rbp - 0x21], rcx
lea rcx, [rsp + 0x40]
pxor xmm1, xmmword [rbp - 0x39]
pxor xmm2, xmmword [rbp - 0x29]
movdqa xmmword [rbp - 0x69], xmm2
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmmword [rbp - 0x79], xmm1
call fcn.7ff7cbf63d9c
mov rcx, r14
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x7ff7cbf4d8b7
mov rcx, qword [rbx]
inc rdx
cmp rdx, rdi
jb 0x7ff7cbf4d8b2
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x7ff7cbf4d92e
mov rcx, r8
call fcn.7ff7cbf77c70
and qword [rbx + 0x10], 0
xor eax, eax
jmp 0x7ff7cbf4d905
mov rcx, r14
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x7ff7cbf4d8fb
mov rcx, qword [rbx]
inc rdx
cmp rdx, rdi
jb 0x7ff7cbf4d8f6
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x7ff7cbf4d92e
mov rcx, r8
call fcn.7ff7cbf77c70
and qword [rbx + 0x10], 0
mov eax, 1
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.7ff7cbf77d90
add rsp, 0xf0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3