Function at 0x100049cf0
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
mov rax, qword [0x1000aa140]
xor rax, rsp
mov qword [rsp + 0xa8], rax
xor ebp, ebp
lea rcx, [r11 - 0x74]
xor edx, edx
lea r8d, [rbp + 0x28]
mov dword [rsp + 0x60], ebp
call sub.msvcrt.dll_memset
mov rcx, qword [0x1000b5f98]
lea rdx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_GetWindowPlacement]
mov r12d, 0x98
mov rcx, r12
call fcn.10009d604
cmp rax, rbp
je 0x100049d68
mov rcx, rax
call fcn.100068ab4
mov rbx, rax
jmp 0x100049d6b
mov rbx, rbp
lea rdx, [0x100018478]
mov rcx, rbx
call fcn.10006a400
mov rcx, r12
call fcn.10009d604
cmp rax, rbp
je 0x100049d94
mov rcx, rax
call fcn.100068ab4
mov r13, rax
jmp 0x100049d97
mov r13, rbp
lea rdx, [0x10001ceb0]
mov rcx, r13
call fcn.10006a400
mov r9d, dword [rsp + 0x7c]
lea rsi, [0x100019194]
mov r14d, 0xa
lea rcx, [rsp + 0x90]
mov r8, rsi
mov rdx, r14
call sub.msvcrt.dll_swprintf_s
lea rdx, [rsp + 0x90]
mov rcx, r13
call fcn.10006a608
mov rcx, r12
call fcn.10009d604
cmp rax, rbp
je 0x100049df5
mov rcx, rax
call fcn.100068ab4
mov rdi, rax
jmp 0x100049df8
mov rdi, rbp
lea rdx, [0x10001cec0]
mov rcx, rdi
mov qword [rsp + 0x58], rdi
call fcn.10006a400
mov r9d, dword [rsp + 0x80]
lea rcx, [rsp + 0x90]
mov r8, rsi
mov rdx, r14
call sub.msvcrt.dll_swprintf_s
lea rdx, [rsp + 0x90]
mov rcx, rdi
call fcn.10006a608
mov rcx, qword [0x1000b5f98]
lea rdx, [rsp + 0x48]
call qword [sym.imp.USER32.dll_GetClientRect]
mov rax, qword [0x1000b6008]
mov edx, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x50]
sub edx, dword [rsp + 0x4c]
mov qword [rsp + 0x28], rax
mov rax, qword [0x1000b5f98]
sub ecx, dword [rsp + 0x48]
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x44]
mov qword [rsp + 0x20], rax
call fcn.100064334
mov r11d, dword [rsp + 0x50]
mov eax, dword [rsp + 0x54]
sub r11d, dword [rsp + 0x48]
sub eax, dword [rsp + 0x4c]
mov rcx, r12
sub r11d, dword [rsp + 0x44]
sub eax, dword [rsp + 0x38]
add dword [rsp + 0x84], r11d
add dword [rsp + 0x88], eax
call fcn.10009d604
cmp rax, rbp
je 0x100049ec4
mov rcx, rax
call fcn.100068ab4
mov r15, rax
jmp 0x100049ec7
mov r15, rbp
lea rdx, [0x10001ced0]
mov rcx, r15
call fcn.10006a400
mov r9d, dword [rsp + 0x84]
lea rcx, [rsp + 0x90]
sub r9d, dword [rsp + 0x7c]
mov r8, rsi
mov rdx, r14
call sub.msvcrt.dll_swprintf_s
lea rdx, [rsp + 0x90]
mov rcx, r15
call fcn.10006a608
mov rcx, r12
call fcn.10009d604
cmp rax, rbp
je 0x100049f20
mov rcx, rax
call fcn.100068ab4
mov r14, rax
jmp 0x100049f23
mov r14, rbp
lea rdx, [0x10001cee8]
mov rcx, r14
call fcn.10006a400
mov r9d, dword [rsp + 0x88]
lea rcx, [rsp + 0x90]
sub r9d, dword [rsp + 0x80]
mov r8, rsi
mov edx, 0xa
call sub.msvcrt.dll_swprintf_s
lea rdx, [rsp + 0x90]
mov rcx, r14
call fcn.10006a608
mov rcx, r12
call fcn.10009d604
cmp rax, rbp
je 0x100049f81
mov rcx, rax
call fcn.100068ab4
mov rsi, rax
jmp 0x100049f84
mov rsi, rbp
lea rdx, [0x10001cf08]
mov rcx, rsi
call fcn.10006a400
mov rcx, qword [0x1000b5f98]
call qword [sym.imp.USER32.dll_IsIconic]
cmp eax, ebp
je 0x100049fb5
test byte [rsp + 0x64], 2
je 0x100049fb5
mov edi, 1
mov cl, dil
jmp 0x100049fd0
mov rcx, qword [0x1000b5f98]
call qword [sym.imp.USER32.dll_IsZoomed]
movzx ecx, bpl
mov edi, 1
cmp eax, ebp
cmovne ecx, edi
cmp cl, bpl
lea rax, [0x1000190f8]
lea rdx, [0x10001cf1c]
cmovne rdx, rax
mov rcx, rsi
call fcn.10006a608
mov rcx, r12
call fcn.10009d604
cmp rax, rbp
je 0x10004a007
mov rcx, rax
call fcn.100068ab4
mov r12, rax
jmp 0x10004a00a
mov r12, rbp
lea rdx, [0x10001cf20]
mov rcx, r12
call fcn.10006a400
mov r9d, dword [0x1000b1e04]
lea r8, [0x100019194]
lea rcx, [rsp + 0x90]
mov edx, 0xa
call sub.msvcrt.dll_swprintf_s
lea rdx, [rsp + 0x90]
mov rcx, r12
call fcn.10006a608
mov ecx, 0x98
call fcn.10009d604
cmp rax, rbp
je 0x10004a063
mov rcx, rax
call fcn.100068ab4
mov rbp, rax
lea rdx, [0x10001cf30]
mov rcx, rbp
call fcn.10006a400
mov r9d, dword [0x1000b1e08]
lea r8, [0x100019194]
lea rcx, [rsp + 0x90]
mov edx, 0xa
call sub.msvcrt.dll_swprintf_s
lea rdx, [rsp + 0x90]
mov rcx, rbp
call fcn.10006a608
mov ecx, 0x98
call fcn.10009d604
test rax, rax
je 0x10004a0bb
mov rcx, rax
call fcn.100068ab4
jmp 0x10004a0bd
xor eax, eax
lea rdx, [0x10001cf40]
mov rcx, rax
mov qword [rsp + 0x38], rax
call fcn.10006a400
mov r11, qword [0x1000b6000]
mov rcx, qword [rsp + 0x38]
cmp byte [r11 + 0x12c], 0
lea rax, [0x10001c9a0]
lea rdx, [0x10001c978]
cmovne rdx, rax
call fcn.10006a608
or r8d, 0xffffffff
mov rdx, r13
mov rcx, rbx
call fcn.10006a6a4
mov rdx, qword [rsp + 0x58]
or r13d, 0xffffffff
mov r8d, r13d
mov rcx, rbx
call fcn.10006a6a4
mov r8d, r13d
mov rdx, r15
mov rcx, rbx
call fcn.10006a6a4
mov r8d, r13d
mov rdx, r14
mov rcx, rbx
call fcn.10006a6a4
mov r8d, r13d
mov rdx, rsi
mov rcx, rbx
call fcn.10006a6a4
mov rdx, qword [rsp + 0x38]
mov r8d, r13d
mov rcx, rbx
call fcn.10006a6a4
mov r8d, r13d
mov rdx, r12
mov rcx, rbx
call fcn.10006a6a4
mov r8d, r13d
mov rdx, rbp
mov rcx, rbx
call fcn.10006a6a4
xor r12d, r12d
lea r8, [rsp + 0x44]
lea rdx, [rsp + 0x38]
mov rcx, rbx
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x44], r12d
call fcn.10006a758
cmp rbx, r12
je 0x10004a1a9
mov rcx, rbx
call fcn.100068b40
mov rcx, rbx
call sub.msvcrt.dll_free
cmp byte [0x1000b5ff5], r12b
lea rax, [0x10001cf90]
lea rcx, [0x10001cf68]
cmove rcx, rax
xor r9d, r9d
xor edx, edx
lea r13d, [r9 + 0x1c]
mov dword [rsp + 0x20], r12d
mov r8d, r13d
call fcn.10004cf80
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x10004a20d
mov rcx, qword [rsp + 0x38]
call sub.msvcrt.dll_free
lea r9, [0x10001cfb0]
lea r8, [0x10001cc58]
mov edx, 0x94b
mov ecx, 0x800
call fcn.100061ef8
jmp 0x10004a2d3
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x30]
mov r8d, 2
mov rcx, rax
mov dword [rsp + 0x40], r12d
mov byte [rsp + 0x30], 0xff
mov byte [rsp + 0x31], 0xfe
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, r12d
je 0x10004a29e
cmp dword [rsp + 0x40], 2
jne 0x10004a29e
mov ebp, dword [rsp + 0x44]
mov rsi, qword [rsp + 0x38]
lea r9, [rsp + 0x40]
lea r8d, [rbp + rbp]
mov rdx, rsi
mov rcx, rbx
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, r12d
je 0x10004a288
mov eax, dword [rsp + 0x40]
mov r9, rbp
add r9, r9
cmp rax, r9
jne 0x10004a288
mov rcx, rsi
call sub.msvcrt.dll_free
jmp 0x10004a2c5
mov rcx, rsi
call sub.msvcrt.dll_free
lea r9, [0x10001d0a0]
mov edx, 0x962
jmp 0x10004a2b4
mov rcx, qword [rsp + 0x38]
call sub.msvcrt.dll_free
lea r9, [0x10001d020]
mov edx, 0x958
lea r8, [0x10001cc58]
mov ecx, 0x800
call fcn.100061ef8
mov r8b, dil
mov edx, r13d
mov rcx, rbx
call fcn.10004cc6c
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.10009dad0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret