Function at 0x1400379c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x4f8]
sub rsp, 0x5f8
mov rax, qword [0x1401b3838]
xor rax, rsp
mov qword [rbp + 0x4e0], rax
xor esi, esi
mov dword [rsp + 0x40], esi
mov ecx, dword [0x1401c2a18]
mov rax, qword gs:[0x58]
mov edx, 0x10
mov rdi, qword [rax + rcx*8]
add rdi, rdx
mov rcx, rdi
call fcn.140078f50
cmp rax, 0xffffffffffffffff
je 0x140037d21
xor ecx, ecx
call fcn.140101b88
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.140101b38
lea rdx, str._04d__02d__02d__02d:_02d:_02d
test rax, rax
je 0x140037a88
mov r9d, dword [rax + 0x10]
inc r9d
mov r8d, dword [rax + 0x14]
add r8d, 0x76c
mov ecx, dword [rax]
mov dword [rsp + 0x38], ecx
mov ecx, dword [rax + 4]
mov dword [rsp + 0x30], ecx
mov ecx, dword [rax + 8]
mov dword [rsp + 0x28], ecx
mov eax, dword [rax + 0xc]
mov dword [rsp + 0x20], eax
lea rcx, [rbp + 0x80]
call fcn.140037850
jmp 0x140037aae
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea rcx, [rbp + 0x80]
call fcn.140037850
xor edx, edx
mov r8d, 0xf8
lea rcx, [rbp - 0x80]
call fcn.140121c70
mov edx, 3
lea r8d, [rdx - 2]
lea rcx, [rbp - 0x80]
call fcn.14001b9d0
nop
mov rcx, rdi
call fcn.140078f50
test rax, rax
jne 0x140037b93
mov rbx, rsi
mov r8, rbx
mov rdx, qword [str.MW_DEBUG_LOG__04d.txt]
lea rcx, [rbp + 0xa0]
call fcn.1400378b0
inc rbx
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
lea rcx, [rbp + 0xa0]
call qword [sym.imp.KERNEL32.DLL_CreateFileA]
mov rdx, rax
mov rcx, rdi
call fcn.14007bc90
mov rcx, rdi
cmp rbx, 0x64
je 0x140037c43
call fcn.140078f50
test rax, rax
je 0x140037ae6
mov rcx, rdi
call fcn.140078f50
cmp rax, 0xffffffffffffffff
je 0x140037ae6
lea rdx, [0x14014dfe8]
lea rcx, [rbp - 0x70]
call fcn.1400146d0
mov rcx, rax
lea rdx, [rbp + 0x80]
call fcn.1400146d0
mov rcx, rax
mov dl, 9
call fcn.140037540
mov rcx, rax
lea rdx, str._Log_start__r_n
call fcn.1400146d0
lea rbx, [rbp + 0x528]
call fcn.140008950
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rsi
mov r9, qword [rbp + 0x520]
mov r8d, 0x400
lea rdx, [rbp + 0xe0]
mov rcx, qword [rax]
call fcn.140101590
lea rdx, [rbp + 0x80]
lea rcx, [rbp - 0x70]
call fcn.1400146d0
mov rcx, rax
mov dl, 9
call fcn.140037540
mov rcx, rax
lea rdx, [rbp + 0xe0]
call fcn.1400146d0
mov rcx, rax
lea rdx, [0x14014dfe8]
call fcn.1400146d0
nop
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], 0xf
mov byte [rsp + 0x48], 0
mov dword [rsp + 0x40], 2
mov rcx, qword [rbp + 8]
test cl, 2
jne 0x140037c54
mov rax, qword [rbp - 0x28]
mov r8, qword [rax]
test r8, r8
je 0x140037c54
mov rax, qword [rbp - 0x48]
mov rdx, qword [rax]
cmp r8, qword [rbp]
cmovb r8, qword [rbp]
sub r8, rdx
jmp 0x140037c79
mov rdx, 0xffffffffffffffff
call fcn.14007bc90
jmp 0x140037d18
test cl, 4
jne 0x140037c84
mov rax, qword [rbp - 0x30]
mov rcx, qword [rax]
test rcx, rcx
je 0x140037c84
mov rax, qword [rbp - 0x50]
mov rdx, qword [rax]
mov rax, qword [rbp - 0x18]
movsxd r8, dword [rax]
sub r8, rdx
add r8, rcx
lea rcx, [rsp + 0x48]
call fcn.140011f80
nop
lea rbx, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae rbx, qword [rsp + 0x48]
mov rcx, rdi
call fcn.140078f50
mov rcx, rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x68]
mov r8d, dword [rsp + 0x58]
mov rdx, rbx
call qword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
jne 0x140037ccc
mov rdx, 0xffffffffffffffff
mov rcx, rdi
call fcn.14007bc90
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x140037d05
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140037d00
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140037d3c
call fcn.14012d3b0
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], 0xf
mov byte [rsp + 0x48], 0
lea rcx, [rbp - 0x80]
call fcn.14001b070
mov rcx, qword [rbp + 0x4e0]
xor rcx, rsp
call fcn.14012d380
add rsp, 0x5f8
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1400fd3f0
nop
int3