Function at 0x465614
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x210
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov rax, qword [0x004bf230]
xor rax, rsp
mov qword [rsp + 0x208], rax
mov r13b, r8b
mov rbp, rdx
mov r14, rcx
xor r15d, r15d
cmp qword [rdx + 0x18], r15
jne 0x465724
lea ebx, [r15 + 7]
mov qword [r11 - 0x1a0], rbx
mov qword [r11 - 0x1a8], r15
mov word [r11 - 0x1b8], r15w
xor eax, eax
or r12, 0xffffffffffffffff
mov rcx, r12
mov rdx, qword [0x004c26e0]
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x78]
call fcn.00404e54
nop
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x48]
call fcn.0046019c
nop
mov r9, r12
xor r8d, r8d
mov rdx, rax
mov rcx, rbp
call fcn.004020b0
nop
cmp qword [rsp + 0x68], 8
jb 0x4656d6
mov rcx, qword [rsp + 0x50]
call fcn.00443d3c
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x60], r15
mov word [rsp + 0x50], r15w
cmp qword [rsp + 0x98], 8
jb 0x4656fe
mov rcx, qword [rsp + 0x80]
call fcn.00443d3c
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0x90], r15
mov word [rsp + 0x80], r15w
cmp qword [rbp + 0x18], r15
jne 0x465799
xor al, al
jmp 0x465deb
cmp qword [rdx + 0x20], 8
jb 0x465731
mov rcx, qword [rdx + 8]
jmp 0x465735
lea rcx, [rdx + 8]
xor edx, edx
call fcn.00445770
mov ebx, 7
or r12, 0xffffffffffffffff
cmp eax, r15d
je 0x46578c
mov rdx, rbp
lea rcx, [rsp + 0x48]
call fcn.004606e8
nop
mov r9, r12
xor r8d, r8d
mov rdx, rax
mov rcx, rbp
call fcn.004020b0
nop
cmp qword [rsp + 0x68], 8
jb 0x46577c
mov rcx, qword [rsp + 0x50]
call fcn.00443d3c
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x60], r15
mov word [rsp + 0x50], r15w
cmp qword [rbp + 0x18], r15
jne 0x465799
xor al, al
jmp 0x465deb
mov qword [rsp + 0xc0], rbx
mov qword [rsp + 0xb8], r15
mov word [rsp + 0xa8], r15w
mov r8b, r13b
lea rdx, [rsp + 0xa0]
mov rcx, r14
call fcn.00463bd8
cmp al, r15b
jne 0x465802
cmp qword [rsp + 0xc0], 8
jb 0x4657e2
mov rcx, qword [rsp + 0xa8]
call fcn.00443d3c
mov qword [rsp + 0xc0], rbx
mov qword [rsp + 0xb8], r15
mov word [rsp + 0xa8], r15w
xor al, al
jmp 0x465deb
lea rdx, [rsp + 0xa8]
cmp qword [rsp + 0xc0], 8
cmovae rdx, qword [rsp + 0xa8]
lea rax, [rsp + 0xf8]
mov qword [rsp + 0xf0], rax
lea rcx, [rsp + 0xf0]
call fcn.00459e40
nop
mov qword [rsp + 0xe8], rbx
mov qword [rsp + 0xe0], r15
mov word [rsp + 0xd0], r15w
xor eax, eax
mov rcx, r12
mov rdx, qword [rsp + 0xf0]
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0xc8]
call fcn.00404e54
nop
cmp qword [rbp + 0x20], 8
jb 0x465888
mov rcx, qword [rbp + 8]
jmp 0x46588c
lea rcx, [rbp + 8]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, r12
jne 0x465942
cmp qword [rsp + 0xe8], 8
jb 0x4658d6
mov rcx, qword [rsp + 0xd0]
call fcn.00443d3c
mov qword [rsp + 0xe8], rbx
mov qword [rsp + 0xe0], r15
mov word [rsp + 0xd0], r15w
lea rax, [rsp + 0xf8]
mov rcx, qword [rsp + 0xf0]
cmp rcx, rax
je 0x46590a
call fcn.0044460c
nop
cmp qword [rsp + 0xc0], 8
jb 0x465922
mov rcx, qword [rsp + 0xa8]
call fcn.00443d3c
mov qword [rsp + 0xc0], rbx
mov qword [rsp + 0xb8], r15
mov word [rsp + 0xa8], r15w
xor al, al
jmp 0x465deb
mov dword [rsp + 0x44], r15d
mov byte [rsp + 0x200], 0xff
mov byte [rsp + 0x201], 0xfe
mov byte [rsp + 0x202], 0xd
mov byte [rsp + 0x203], r15b
mov byte [rsp + 0x204], 0xa
mov byte [rsp + 0x205], r15b
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x44]
mov r8d, 6
lea rdx, [rsp + 0x200]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rsp + 0x40], r15d
lea rdx, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 8
cmovae rdx, qword [rsp + 0xd0]
mov r8d, dword [rsp + 0xe0]
add r8d, r8d
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, r15d
je 0x465d62
cmp dword [rsp + 0x40], r15d
je 0x465d62
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.004551b8
mov rdi, qword [rax + 0x70]
cmp rdi, r15
je 0x465cde
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0x90], r15
mov word [rsp + 0x80], r15w
lea rdx, str.Preparing_Watson:
mov rcx, rdi
call fcn.0045fe58
lea rdx, [r14 + 0x208]
mov r9, r12
xor r8d, r8d
lea rcx, [rsp + 0x78]
call fcn.004020b0
lea r8, [rsp + 0x80]
cmp qword [rsp + 0x98], 8
cmovae r8, qword [rsp + 0x80]
lea rdx, str.__P1_s
mov rcx, rdi
call fcn.0045fe58
lea rdx, [r14 + 0x230]
mov r9, r12
xor r8d, r8d
lea rcx, [rsp + 0x78]
call fcn.004020b0
lea r8, [rsp + 0x80]
cmp qword [rsp + 0x98], 8
cmovae r8, qword [rsp + 0x80]
lea rdx, str.__P2_s
mov rcx, rdi
call fcn.0045fe58
lea rdx, [r14 + 0x258]
mov r9, r12
xor r8d, r8d
lea rcx, [rsp + 0x78]
call fcn.004020b0
lea r8, [rsp + 0x80]
cmp qword [rsp + 0x98], 8
cmovae r8, qword [rsp + 0x80]
lea rdx, str.__P3_s
mov rcx, rdi
call fcn.0045fe58
lea rdx, [r14 + 0x280]
mov r9, r12
xor r8d, r8d
lea rcx, [rsp + 0x78]
call fcn.004020b0
lea r8, [rsp + 0x80]
cmp qword [rsp + 0x98], 8
cmovae r8, qword [rsp + 0x80]
lea rdx, str.__P4_s
mov rcx, rdi
call fcn.0045fe58
lea rdx, [r14 + 0x2a8]
mov r9, r12
xor r8d, r8d
lea rcx, [rsp + 0x78]
call fcn.004020b0
lea r8, [rsp + 0x80]
cmp qword [rsp + 0x98], 8
cmovae r8, qword [rsp + 0x80]
lea rdx, str.__P5_s
mov rcx, rdi
call fcn.0045fe58
lea rdx, [r14 + 0x2d0]
mov r9, r12
xor r8d, r8d
lea rcx, [rsp + 0x78]
call fcn.004020b0
lea r8, [rsp + 0x80]
cmp qword [rsp + 0x98], 8
cmovae r8, qword [rsp + 0x80]
lea rdx, str.__P6_s
mov rcx, rdi
call fcn.0045fe58
lea rdx, [r14 + 0x2f8]
mov r9, r12
xor r8d, r8d
lea rcx, [rsp + 0x78]
call fcn.004020b0
lea r8, [rsp + 0x80]
cmp qword [rsp + 0x98], 8
cmovae r8, qword [rsp + 0x80]
lea rdx, str.__P7_s
mov rcx, rdi
call fcn.0045fe58
lea rdx, [r14 + 0x320]
mov r9, r12
xor r8d, r8d
lea rcx, [rsp + 0x78]
call fcn.004020b0
lea r8, [rsp + 0x80]
cmp qword [rsp + 0x98], 8
cmovae r8, qword [rsp + 0x80]
lea rdx, str.__P8_s
mov rcx, rdi
call fcn.0045fe58
lea rdx, [r14 + 0x348]
mov r9, r12
xor r8d, r8d
lea rcx, [rsp + 0x78]
call fcn.004020b0
lea r8, [rsp + 0x80]
cmp qword [rsp + 0x98], 8
cmovae r8, qword [rsp + 0x80]
lea rdx, str.__P9_s
mov rcx, rdi
call fcn.0045fe58
lea rdx, [r14 + 0x370]
mov r9, r12
xor r8d, r8d
lea rcx, [rsp + 0x78]
call fcn.004020b0
lea r8, [rsp + 0x80]
cmp qword [rsp + 0x98], 8
cmovae r8, qword [rsp + 0x80]
lea rdx, str.__P10_s
mov rcx, rdi
call fcn.0045fe58
nop
cmp qword [rsp + 0x98], 8
jb 0x465cc5
mov rcx, qword [rsp + 0x80]
call fcn.00443d3c
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0x90], r15
mov word [rsp + 0x80], r15w
cmp qword [rsp + 0xe8], 8
jb 0x465cf6
mov rcx, qword [rsp + 0xd0]
call fcn.00443d3c
mov qword [rsp + 0xe8], rbx
mov qword [rsp + 0xe0], r15
mov word [rsp + 0xd0], r15w
lea rax, [rsp + 0xf8]
mov rcx, qword [rsp + 0xf0]
cmp rcx, rax
je 0x465d2a
call fcn.0044460c
nop
cmp qword [rsp + 0xc0], 8
jb 0x465d42
mov rcx, qword [rsp + 0xa8]
call fcn.00443d3c
mov qword [rsp + 0xc0], rbx
mov qword [rsp + 0xb8], r15
mov word [rsp + 0xa8], r15w
mov al, 1
jmp 0x465deb
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp qword [rsp + 0xe8], 8
jb 0x465d84
mov rcx, qword [rsp + 0xd0]
call fcn.00443d3c
mov qword [rsp + 0xe8], rbx
mov qword [rsp + 0xe0], r15
mov word [rsp + 0xd0], r15w
lea rax, [rsp + 0xf8]
mov rcx, qword [rsp + 0xf0]
cmp rcx, rax
je 0x465db8
call fcn.0044460c
nop
cmp qword [rsp + 0xc0], 8
jb 0x465dd0
mov rcx, qword [rsp + 0xa8]
call fcn.00443d3c
mov qword [rsp + 0xc0], rbx
mov qword [rsp + 0xb8], r15
mov word [rsp + 0xa8], r15w
xor al, al
mov rcx, qword [rsp + 0x208]
xor rcx, rsp
call fcn.00443d60
lea r11, [rsp + 0x210]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret