Function at 0x14000b900
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rbx
push rbp
push r12
push r13
push r15
sub rsp, 0x2c0
mov rax, qword [0x1400471b0]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rbx, rcx
lea r13, [r11 + 0x10]
call fcn.140003e70
xor r12d, r12d
mov qword [rsp + 0x28], r13
mov r9, rbx
mov qword [rsp + 0x20], r12
xor r8d, r8d
xor edx, edx
mov rcx, qword [rax]
mov r15, rax
or rcx, 2
call fcn.14001bd30
test eax, eax
mov ebp, eax
mov rbx, 0xffffffffffffffff
cmovs ebp, ebx
add ebp, 0x1b
je 0x14000bb6e
mov qword [rsp + 0x2b8], rsi
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x2b0], rdi
mov qword [rsp + 0x2a8], r14
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetLocalTime]
mov rdx, qword [0x14004b138]
movzx eax, dx
mov rcx, rdx
shr rcx, 0x10
movzx r8d, cx
imul ecx, eax, 0x64
movzx eax, word [0x14004b13e]
add r8d, ecx
imul r9d, r8d, 0x64
mov r8, qword [rsp + 0x60]
add r9d, eax
mov rax, r8
shr rax, 0x10
movzx edx, ax
movzx eax, r8w
imul ecx, eax, 0x64
shr r8, 0x30
add edx, ecx
imul eax, edx, 0x64
add eax, r8d
cmp eax, r9d
jbe 0x14000ba03
movaps xmm0, xmmword [rsp + 0x60]
lea rcx, [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
call fcn.14000b7a0
movsxd rsi, ebp
mov eax, 2
lea rcx, [rsi + rsi]
mul rcx
cmovo rax, rbx
mov rcx, rax
call fcn.140013440
movzx ecx, word [rsp + 0x6e]
mov rdx, rsi
movzx r8d, word [rsp + 0x6c]
mov r14, rax
movzx r10d, word [rsp + 0x6a]
movzx r11d, word [rsp + 0x68]
movzx ebx, word [rsp + 0x66]
movzx edi, word [rsp + 0x62]
movzx r9d, word [rsp + 0x60]
mov dword [rsp + 0x48], ecx
mov rcx, rax
mov dword [rsp + 0x40], r8d
lea r8, str.__04d__02d__02d__02d:_02d:_02d._03d_
mov dword [rsp + 0x38], r10d
mov dword [rsp + 0x30], r11d
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], edi
call fcn.140003e80
mov r9, qword [rsp + 0x2f0]
lea eax, [rbp - 0x1a]
mov rcx, qword [r15]
lea rdx, [r14 + 0x34]
movsxd r8, eax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r12
call fcn.14001bf8c
cmp qword [0x14004b130], r12
mov rdi, qword [rsp + 0x2b0]
mov rsi, qword [rsp + 0x2b8]
je 0x14000bb5e
mov rcx, r14
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrlenW]
mov rcx, qword [0x14004b130]
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov ebx, eax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFilePointer]
mov rcx, qword [0x14004b130]
lea r8d, [rbx + rbx]
lea r9, [rsp + 0x70]
mov qword [rsp + 0x20], r12
mov rdx, r14
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
test eax, eax
je 0x14000bb5e
mov eax, dword [0x14003e30c]
lea rcx, [rsp + 0x86]
mov dword [rsp + 0x80], eax
xor edx, edx
movzx eax, word [0x14003e310]
mov r8d, 0x202
mov word [rsp + 0x84], ax
call fcn.140015a40
mov rcx, qword [0x14004b130]
lea r9, [rsp + 0x70]
mov r8d, 4
mov qword [rsp + 0x20], r12
lea rdx, [rsp + 0x80]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
mov rcx, qword [0x14004b130]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FlushFileBuffers]
mov rcx, r14
call fcn.140012fbc
mov r14, qword [rsp + 0x2a8]
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.140012f70
add rsp, 0x2c0
pop r15
pop r13
pop r12
pop rbp
pop rbx
ret