Function at 0x140008ae8
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rsi, rcx
mov r14d, 4
mov ecx, r14d
mov rbp, rdx
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov rcx, rax
mov dword [rax], 0xd60e6
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov ecx, r14d
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov rcx, rax
mov dword [rax], 0xfff2190d
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov ecx, r14d
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov rcx, rax
mov dword [rax], 0xfff18d00
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov ecx, r14d
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov ecx, r14d
mov rdi, rax
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov dword [rdi], 0xfff34acc
xor r15d, r15d
mov rbx, rax
mov dword [rax], r15d
mov ecx, dword [rdi]
and ecx, 0x6f29
mov dword [rax], ecx
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov ecx, r14d
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov rcx, rax
mov dword [rax], 0x8167bda3
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov ecx, r14d
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov ecx, r14d
mov rdi, rax
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov dword [rdi], 0x19e2d
mov rbx, rax
mov dword [rax], r15d
mov ecx, dword [rdi]
and ecx, 0xfff8672c
mov dword [rax], ecx
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov ecx, r14d
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov rcx, rax
mov dword [rax], 0x120888
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov ecx, r14d
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov rcx, rax
mov dword [rax], 0xf2320
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov ecx, r14d
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov rcx, rax
mov dword [rax], 0x6d6a4a80
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, r14d
mov rsi, rax
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov rdi, rax
mov ecx, r14d
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov dword [rdi], 0xfff8f26a
mov rbx, rax
mov dword [rax], r15d
mov ecx, dword [rdi]
and ecx, 0xfff788bf
mov dword [rax], ecx
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov ecx, r14d
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov rcx, rax
mov dword [rax], 0xfffd37ce
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov ecx, r14d
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov rcx, rax
mov dword [rax], 0xfff603ed
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov ecx, r14d
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov ecx, r14d
mov rdi, rax
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov dword [rdi], 0x77bfd
mov rbx, rax
mov dword [rax], r15d
mov ecx, dword [rdi]
and ecx, 0xfff12243
mov dword [rax], ecx
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov ecx, r14d
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov rcx, rax
mov dword [rax], 0x5a49f
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov ecx, r14d
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov rcx, rax
mov dword [rax], 0xfe132bc4
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov ecx, r14d
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov ecx, r14d
mov rdi, rax
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov dword [rdi], 0x2855a
mov rbx, rax
mov dword [rax], r15d
mov ecx, dword [rdi]
and ecx, 0x146ca
mov dword [rax], ecx
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov ecx, r14d
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov rcx, rax
mov dword [rax], 0xb3216088
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
or r8, 0xffffffffffffffff
inc r8
cmp word [rbp + r8*2], r15w
jne 0x140008d90
lea r8d, [r8*2 + 2]
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x70]
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r14
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov rcx, rax
mov dword [rax], 0x5beec5c0
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, r14
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov rcx, rax
mov dword [rax], 0xffff18c4
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, r14
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov rcx, rax
mov dword [rax], 0x4b4a1838
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, r14
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov rcx, rax
mov dword [rax], 0x81b27
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, r14
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov rcx, rax
mov dword [rax], 0xfffbdccc
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, r14
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov rcx, rax
mov dword [rax], 0x7951a
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, r14
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov rcx, rax
mov dword [rax], 0xe3b30773
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, r14
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov rcx, r14
mov rdi, rax
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov dword [rdi], 0xfffdd9d1
mov rbx, rax
mov dword [rax], r15d
mov ecx, dword [rdi]
and ecx, 0xfff27e95
mov dword [rax], ecx
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, rsi
call qword [0x14000c028]
mov rcx, r14
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov rcx, rax
mov dword [rax], 0x64023
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, r14
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov rcx, rax
mov dword [rax], 0x5876a
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, r14
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov rcx, rax
mov dword [rax], 0x56dca
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, r14
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov rcx, r14
mov rdi, rax
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov dword [rdi], 0xbbdd6
mov rbx, rax
mov dword [rax], r15d
mov ecx, dword [rdi]
and ecx, 0xfff3384d
mov dword [rax], ecx
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, r14
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov rcx, rax
mov dword [rax], 0x116310
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, r14
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov rcx, rax
mov dword [rax], 0x5653d8
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, r14
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov rcx, r14
mov rdi, rax
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov dword [rdi], 0xfff1287d
mov rcx, rdi
mov rbx, rax
mov dword [rax], r15d
mov edx, dword [rdi]
and edx, 0xfffce86c
mov dword [rax], edx
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, r14
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov rcx, rax
mov dword [rax], 0x1af1b7
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, r14
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__]
mov rcx, rax
mov dword [rax], 0xe1e6236c
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret