Function at 0x100048078
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
mov rax, qword [0x1000a1140]
xor rax, rsp
mov qword [rsp + 0xa8], rax
xor ebp, ebp
lea rcx, [r11 - 0x74]
xor edx, edx
lea r8d, [rbp + 0x28]
mov dword [rsp + 0x60], ebp
call sub.msvcrt.dll_memset
mov rcx, qword [0x1000acba0]
lea rdx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_GetWindowPlacement]
mov r12d, 0x98
mov rcx, r12
call fcn.1000910f4
cmp rax, rbp
je 0x1000480f0
mov rcx, rax
call fcn.1000602ec
mov rbx, rax
jmp 0x1000480f3
mov rbx, rbp
lea rdx, [0x10001b890]
mov rcx, rbx
call fcn.100061c08
mov rcx, r12
call fcn.1000910f4
cmp rax, rbp
je 0x10004811c
mov rcx, rax
call fcn.1000602ec
mov r13, rax
jmp 0x10004811f
mov r13, rbp
lea rdx, [0x10001b8a0]
mov rcx, r13
call fcn.100061c08
mov r9d, dword [rsp + 0x7c]
lea rsi, [0x1000154b0]
mov r14d, 0xa
lea rcx, [rsp + 0x90]
mov r8, rsi
mov rdx, r14
call sub.msvcrt.dll_swprintf_s
lea rdx, [rsp + 0x90]
mov rcx, r13
call fcn.100061e10
mov rcx, r12
call fcn.1000910f4
cmp rax, rbp
je 0x10004817d
mov rcx, rax
call fcn.1000602ec
mov rdi, rax
jmp 0x100048180
mov rdi, rbp
lea rdx, [0x10001b8b0]
mov rcx, rdi
mov qword [rsp + 0x58], rdi
call fcn.100061c08
mov r9d, dword [rsp + 0x80]
lea rcx, [rsp + 0x90]
mov r8, rsi
mov rdx, r14
call sub.msvcrt.dll_swprintf_s
lea rdx, [rsp + 0x90]
mov rcx, rdi
call fcn.100061e10
mov rcx, qword [0x1000acba0]
lea rdx, [rsp + 0x48]
call qword [sym.imp.USER32.dll_GetClientRect]
mov rax, qword [0x1000acbf8]
mov edx, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x50]
sub edx, dword [rsp + 0x4c]
mov qword [rsp + 0x28], rax
mov rax, qword [0x1000acba0]
sub ecx, dword [rsp + 0x48]
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x44]
mov qword [rsp + 0x20], rax
call fcn.100064638
mov r11d, dword [rsp + 0x50]
mov eax, dword [rsp + 0x54]
sub r11d, dword [rsp + 0x48]
sub eax, dword [rsp + 0x4c]
mov rcx, r12
sub r11d, dword [rsp + 0x44]
sub eax, dword [rsp + 0x38]
add dword [rsp + 0x84], r11d
add dword [rsp + 0x88], eax
call fcn.1000910f4
cmp rax, rbp
je 0x10004824c
mov rcx, rax
call fcn.1000602ec
mov r15, rax
jmp 0x10004824f
mov r15, rbp
lea rdx, [0x10001b8c0]
mov rcx, r15
call fcn.100061c08
mov r9d, dword [rsp + 0x84]
lea rcx, [rsp + 0x90]
sub r9d, dword [rsp + 0x7c]
mov r8, rsi
mov rdx, r14
call sub.msvcrt.dll_swprintf_s
lea rdx, [rsp + 0x90]
mov rcx, r15
call fcn.100061e10
mov rcx, r12
call fcn.1000910f4
cmp rax, rbp
je 0x1000482a8
mov rcx, rax
call fcn.1000602ec
mov r14, rax
jmp 0x1000482ab
mov r14, rbp
lea rdx, [0x10001b8d8]
mov rcx, r14
call fcn.100061c08
mov r9d, dword [rsp + 0x88]
lea rcx, [rsp + 0x90]
sub r9d, dword [rsp + 0x80]
mov r8, rsi
mov edx, 0xa
call sub.msvcrt.dll_swprintf_s
lea rdx, [rsp + 0x90]
mov rcx, r14
call fcn.100061e10
mov rcx, r12
call fcn.1000910f4
cmp rax, rbp
je 0x100048309
mov rcx, rax
call fcn.1000602ec
mov rsi, rax
jmp 0x10004830c
mov rsi, rbp
lea rdx, [0x10001b8f8]
mov rcx, rsi
call fcn.100061c08
mov rcx, qword [0x1000acba0]
call qword [sym.imp.USER32.dll_IsIconic]
cmp eax, ebp
je 0x10004833d
test byte [rsp + 0x64], 2
je 0x10004833d
mov edi, 1
mov cl, dil
jmp 0x100048358
mov rcx, qword [0x1000acba0]
call qword [sym.imp.USER32.dll_IsZoomed]
movzx ecx, bpl
mov edi, 1
cmp eax, ebp
cmovne ecx, edi
cmp cl, bpl
lea rax, [0x10001b90c]
lea rdx, [0x10001b910]
cmovne rdx, rax
mov rcx, rsi
call fcn.100061e10
mov rcx, r12
call fcn.1000910f4
cmp rax, rbp
je 0x10004838f
mov rcx, rax
call fcn.1000602ec
mov r12, rax
jmp 0x100048392
mov r12, rbp
lea rdx, [0x10001b918]
mov rcx, r12
call fcn.100061c08
mov r9d, dword [0x1000a84ac]
lea r8, [0x1000154b0]
lea rcx, [rsp + 0x90]
mov edx, 0xa
call sub.msvcrt.dll_swprintf_s
lea rdx, [rsp + 0x90]
mov rcx, r12
call fcn.100061e10
mov ecx, 0x98
call fcn.1000910f4
cmp rax, rbp
je 0x1000483eb
mov rcx, rax
call fcn.1000602ec
mov rbp, rax
lea rdx, [0x10001b928]
mov rcx, rbp
call fcn.100061c08
mov r9d, dword [0x1000a8be0]
lea r8, [0x1000154b0]
lea rcx, [rsp + 0x90]
mov edx, 0xa
call sub.msvcrt.dll_swprintf_s
lea rdx, [rsp + 0x90]
mov rcx, rbp
call fcn.100061e10
mov ecx, 0x98
call fcn.1000910f4
test rax, rax
je 0x100048443
mov rcx, rax
call fcn.1000602ec
jmp 0x100048445
xor eax, eax
lea rdx, [0x10001b938]
mov rcx, rax
mov qword [rsp + 0x38], rax
call fcn.100061c08
mov r11, qword [0x1000acb80]
mov rcx, qword [rsp + 0x38]
cmp byte [r11 + 0x12c], 0
lea rax, [0x1000154d0]
lea rdx, [0x1000154e0]
cmovne rdx, rax
call fcn.100061e10
or r8d, 0xffffffff
mov rdx, r13
mov rcx, rbx
call fcn.100061eac
mov rdx, qword [rsp + 0x58]
or r13d, 0xffffffff
mov r8d, r13d
mov rcx, rbx
call fcn.100061eac
mov r8d, r13d
mov rdx, r15
mov rcx, rbx
call fcn.100061eac
mov r8d, r13d
mov rdx, r14
mov rcx, rbx
call fcn.100061eac
mov r8d, r13d
mov rdx, rsi
mov rcx, rbx
call fcn.100061eac
mov rdx, qword [rsp + 0x38]
mov r8d, r13d
mov rcx, rbx
call fcn.100061eac
mov r8d, r13d
mov rdx, r12
mov rcx, rbx
call fcn.100061eac
mov r8d, r13d
mov rdx, rbp
mov rcx, rbx
call fcn.100061eac
xor r12d, r12d
lea r8, [rsp + 0x44]
lea rdx, [rsp + 0x38]
mov rcx, rbx
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x44], r12d
call fcn.100061f60
cmp rbx, r12
je 0x100048531
mov rcx, rbx
call fcn.100060378
mov rcx, rbx
call sub.msvcrt.dll_free
cmp byte [0x1000acbbe], r12b
lea rax, [0x10001b988]
lea rcx, [0x10001b960]
cmove rcx, rax
xor r9d, r9d
xor edx, edx
lea r13d, [r9 + 0x1c]
mov dword [rsp + 0x20], r12d
mov r8d, r13d
call fcn.100049d8c
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x100048595
mov rcx, qword [rsp + 0x38]
call sub.msvcrt.dll_free
lea r9, [0x10001b9b0]
lea r8, [0x10001b638]
mov edx, 0x94b
mov ecx, 0x800
call fcn.100069a3c
jmp 0x10004865b
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x30]
mov r8d, 2
mov rcx, rax
mov dword [rsp + 0x40], r12d
mov byte [rsp + 0x30], 0xff
mov byte [rsp + 0x31], 0xfe
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, r12d
je 0x100048626
cmp dword [rsp + 0x40], 2
jne 0x100048626
mov ebp, dword [rsp + 0x44]
mov rsi, qword [rsp + 0x38]
lea r9, [rsp + 0x40]
lea r8d, [rbp + rbp]
mov rdx, rsi
mov rcx, rbx
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, r12d
je 0x100048610
mov eax, dword [rsp + 0x40]
mov r9, rbp
add r9, r9
cmp rax, r9
jne 0x100048610
mov rcx, rsi
call sub.msvcrt.dll_free
jmp 0x10004864d
mov rcx, rsi
call sub.msvcrt.dll_free
lea r9, [0x10001baa0]
mov edx, 0x962
jmp 0x10004863c
mov rcx, qword [rsp + 0x38]
call sub.msvcrt.dll_free
lea r9, [0x10001ba20]
mov edx, 0x958
lea r8, [0x10001b638]
mov ecx, 0x800
call fcn.100069a3c
mov r8b, dil
mov edx, r13d
mov rcx, rbx
call fcn.100049a78
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.1000915c0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret