Function at 0x140058ae4
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x758]
sub rsp, 0x850
mov rax, qword [0x140083bc0]
xor rax, rsp
mov qword [rbp + 0x740], rax
cmp qword [rcx + 8], 0
mov rsi, rcx
jne 0x140058b27
mov ecx, 0x139f
jmp 0x1400591b6
mov r8, qword [section..data]
lea rcx, [rsp + 0x40]
mov ebx, 0x800
mov edx, ebx
call fcn.1400029a0
mov ecx, eax
test eax, eax
jne 0x1400591b6
mov r8, qword [str.API_Name_]
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.140001c84
mov ecx, eax
test eax, eax
jne 0x1400591b6
mov r8, qword [str.Measuring_Period_]
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.140001c84
mov ecx, eax
test eax, eax
jne 0x1400591b6
mov r8, qword [str.Thread_Time_]
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.140001c84
mov ecx, eax
test eax, eax
jne 0x1400591b6
mov r8, qword [str.Thread___Total_]
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.140001c84
mov ecx, eax
test eax, eax
jne 0x1400591b6
mov r8, qword [str.Process_Id_]
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.140001c84
mov ecx, eax
test eax, eax
jne 0x1400591b6
mov r8, qword [str.Process_Name_]
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.140001c84
mov ecx, eax
test eax, eax
jne 0x1400591b6
mov r8, qword [str.Thread_Id_]
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.140001c84
mov ecx, eax
test eax, eax
jne 0x1400591b6
mov r8, qword [str.Thread_Name_]
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.140001c84
mov ecx, eax
test eax, eax
jne 0x1400591b6
mov r8, qword [str.Interval_Hits_]
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.140001c84
mov ecx, eax
test eax, eax
jne 0x1400591b6
mov r8, qword [str.Interval_Time_]
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.140001c84
mov ecx, eax
test eax, eax
jne 0x1400591b6
mov r8, qword [str.Exec_Hits_]
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.140001c84
mov ecx, eax
test eax, eax
jne 0x1400591b6
mov r8, qword [str.Exec_Time_]
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.140001c84
mov ecx, eax
test eax, eax
jne 0x1400591b6
mov r8, qword [str.Exec_Ave_]
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.140001c84
mov ecx, eax
test eax, eax
jne 0x1400591b6
mov r8, qword [str.Exec___Total_]
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.140001c84
mov ecx, eax
test eax, eax
jne 0x1400591b6
mov r8, qword [str.Exec___Thread_]
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.140001c84
mov ecx, eax
test eax, eax
jne 0x1400591b6
mov r8, qword [str.Preempt_Hits_]
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.140001c84
mov ecx, eax
test eax, eax
jne 0x1400591b6
mov r8, qword [str.Preempt_Time_]
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.140001c84
mov ecx, eax
test eax, eax
jne 0x1400591b6
mov r8, qword [str.Preempt_Ave_]
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.140001c84
mov ecx, eax
test eax, eax
jne 0x1400591b6
mov r8, qword [str.Preempt___Total_]
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.140001c84
mov ecx, eax
test eax, eax
jne 0x1400591b6
mov r8, qword [str.Preempt____Total_Thread__]
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.140001c84
mov ecx, eax
test eax, eax
jne 0x1400591b6
mov r8, qword [str.Interval_CPU_0__]
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.140001c84
mov ecx, eax
test eax, eax
jne 0x1400591b6
mov r8, qword [str.Interval_CPU_1__]
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.140001c84
mov ecx, eax
test eax, eax
jne 0x1400591b6
mov r8, qword [str.Interval_CPU_2__]
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.140001c84
mov ecx, eax
test eax, eax
jne 0x1400591b6
mov r8, qword [str.Interval_CPU_3__]
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.140001c84
mov ecx, eax
test eax, eax
jne 0x1400591b6
mov r8, qword [str.Interval_CPU_4__]
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.140001c84
mov ecx, eax
test eax, eax
jne 0x1400591b6
mov r8, qword [str.Interval_CPU_5__]
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.140001c84
mov ecx, eax
test eax, eax
jne 0x1400591b6
mov r8, qword [str.Interval_CPU_6__]
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.140001c84
mov ecx, eax
test eax, eax
jne 0x1400591b6
mov r8, qword [str.Interval_CPU_7__]
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.140001c84
mov ecx, eax
test eax, eax
jne 0x1400591b6
mov r8, qword [str.Interval_CPU_8__]
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.140001c84
mov ecx, eax
test eax, eax
jne 0x1400591b6
mov r8, qword [str.Interval_CPU_9__]
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.140001c84
mov ecx, eax
test eax, eax
jne 0x1400591b6
mov r8, qword [str.Interval_CPU_10__]
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.140001c84
mov ecx, eax
test eax, eax
jne 0x1400591b6
mov r8, qword [str.Interval_CPU_11__]
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.140001c84
mov ecx, eax
test eax, eax
jne 0x1400591b6
mov r8, qword [str.Interval_CPU_12__]
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.140001c84
mov ecx, eax
test eax, eax
jne 0x1400591b6
mov r8, qword [str.Interval_CPU_13__]
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.140001c84
mov ecx, eax
test eax, eax
jne 0x1400591b6
mov r8, qword [str.Interval_CPU_14__]
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.140001c84
mov ecx, eax
test eax, eax
jne 0x1400591b6
mov r8, qword [str.Interval_CPU_15__]
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.140001c84
mov ecx, eax
test eax, eax
jne 0x1400591b6
mov r8, qword [str.Interval_CPU_16__]
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.140001c84
mov ecx, eax
test eax, eax
jne 0x1400591b6
mov r8, qword [str.Interval_CPU_17__]
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.140001c84
mov ecx, eax
test eax, eax
jne 0x1400591b6
mov r8, qword [str.Interval_CPU_18__]
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.140001c84
mov ecx, eax
test eax, eax
jne 0x1400591b6
mov r8, qword [str.Interval_CPU_19__]
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.140001c84
mov ecx, eax
test eax, eax
jne 0x1400591b6
mov r8, qword [str.Interval_CPU_20__]
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.140001c84
mov ecx, eax
test eax, eax
jne 0x1400591b6
mov r8, qword [str.Interval_CPU_21__]
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.140001c84
mov ecx, eax
test eax, eax
jne 0x1400591b6
mov r8, qword [str.Interval_CPU_22__]
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.140001c84
mov ecx, eax
test eax, eax
jne 0x1400591b6
mov r8, qword [str.Interval_CPU_23__]
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.140001c84
mov ecx, eax
test eax, eax
jne 0x1400591b6
mov r8, qword [str.Interval_CPU_24__]
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.140001c84
mov ecx, eax
test eax, eax
jne 0x1400591b6
mov r8, qword [str.Interval_CPU_25__]
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.140001c84
mov ecx, eax
test eax, eax
jne 0x1400591b6
mov r8, qword [str.Interval_CPU_26__]
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.140001c84
mov ecx, eax
test eax, eax
jne 0x1400591b6
mov r8, qword [str.Interval_CPU_27__]
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.140001c84
mov ecx, eax
test eax, eax
jne 0x1400591b6
mov r8, qword [str.Interval_CPU_28__]
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.140001c84
mov ecx, eax
test eax, eax
jne 0x1400591b6
mov r8, qword [str.Interval_CPU_29__]
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.140001c84
mov ecx, eax
test eax, eax
jne 0x1400591b6
mov r8, qword [str.Interval_CPU_30__]
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.140001c84
mov ecx, eax
test eax, eax
jne 0x1400591b6
mov r8, qword [str.Interval_CPU_31__]
lea rcx, [rsp + 0x40]
mov edx, ebx
call fcn.140001c84
mov ecx, eax
test eax, eax
jne 0x1400591b6
lea r8, [0x140070500]
mov edx, ebx
lea rcx, [rsp + 0x40]
call fcn.140001c84
mov ecx, eax
test eax, eax
jne 0x1400591b6
mov edx, ebx
lea rax, [rsp + 0x40]
cmp byte [rax], 0
je 0x14005915b
inc rax
sub rdx, 1
jne 0x14005914d
mov rax, rdx
neg rax
mov rax, rdx
sbb ecx, ecx
sub rbx, rdx
not ecx
and ecx, 0x80070057
neg rax
sbb rdi, rdi
and rdi, rbx
test rdx, rdx
je 0x1400591b6
mov rcx, qword [rsi + 8]
lea r9, [rsp + 0x30]
and dword [rsp + 0x30], 0
lea rdx, [rsp + 0x40]
and qword [rsp + 0x20], 0
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop dword [rax + rax]
mov eax, dword [rsp + 0x30]
sub rax, rdi
neg rax
sbb ecx, ecx
and ecx, 0x1f
mov eax, ecx
mov rcx, qword [rbp + 0x740]
xor rcx, rsp
call fcn.140061140
lea r11, [rsp + 0x850]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret