Function at 0x415f58
Capabilities:
Write file on windows

Disassembly:
test rdx, rdx
je 0x41621f
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x3b8]
sub rsp, 0x480
xor r15d, r15d
mov rsi, r8
mov rdi, rdx
test r8, r8
je 0x416205
cmp r9, 0x400000
ja 0x416205
mov r9, qword [0x004e1cf8]
lea rax, [rsp + 0x68]
mov r8, qword [0x004e1ad8]
lea rdx, [0x004942e8]
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x50]
lea rax, [0x0048d7e0]
mov dword [rsp + 0x60], r15d
mov qword [rsp + 0x50], rax
or r12, 0xffffffffffffffff
lea rax, [0x004e3010]
mov word [rsp + 0x68], r15w
mov r13d, 0x104
mov qword [rsp + 0x20], rax
mov rbx, r12
mov dword [rsp + 0x64], r13d
mov dword [rsp + 0x40], 0x50000
call fcn.004012e8
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x4161d0
mov qword [rsp + 0x30], r15
lea r8d, [r15 + 3]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov edx, 0xc0000000
mov dword [rsp + 0x20], r8d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, r12
je 0x4161d0
lea r9d, [r15 + 2]
mov qword [rbp + 0x3c8], r15
lea r8, [rbp + 0x3cc]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rbp + 0x3c8], eax
cmp eax, 0xffffffff
jne 0x41607a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, 4
mov dword [rbp + 0x3c8], r15d
mov r8d, r14d
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x3c8]
mov rcx, rbx
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rax, r12
inc rax
cmp word [rdi + rax*2], r15w
jne 0x4160a7
inc eax
mov dword [rbp + 0x3c8], r15d
lea r9, [rbp + 0x3c8]
mov dword [rbp + 0x3c0], eax
mov r8d, r14d
mov qword [rsp + 0x20], r15
lea rdx, [rbp + 0x3c0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r8, rdi
lea rcx, [rbp + 0x170]
mov rdx, r13
call fcn.0042e77c
mov edx, dword [rbp + 0x3c0]
lea r8, [0x00489ec0]
add edx, edx
lea rcx, [rbp + 0x170]
call fcn.00460e80
mov edx, dword [rbp + 0x3c0]
mov dword [rbp + 0x3c8], r15d
lea r8d, [rdx + rdx]
test r8d, r8d
je 0x41613e
lea r9, [rbp + 0x3c8]
mov qword [rsp + 0x20], r15
lea rdx, [rbp + 0x170]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rbp + 0x3d8]
mov rcx, rsi
call fcn.00460c7c
lea r9, [rbp + 0x3c8]
mov dword [rbp + 0x3c8], r15d
mov r8d, r14d
mov qword [rsp + 0x20], r15
lea rdx, [rbp + 0x3d8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdi, qword [rbp + 0x3d8]
mov r14, r15
test rdi, rdi
je 0x4161c4
mov r13d, 0xfffffff
mov r8d, edi
mov dword [rbp + 0x3c8], r15d
cmp rdi, r13
mov qword [rsp + 0x20], r15
lea rdx, [r14 + rsi]
mov rcx, rbx
cmova r8d, r13d
lea r9, [rbp + 0x3c8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4161c4
mov eax, dword [rbp + 0x3c8]
add r14, rax
sub rdi, rax
jne 0x416188
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, r12
mov r8, qword [rbp + 0x3d8]
xor edx, edx
mov rcx, rsi
call fcn.00424830
mov qword [rsp + 0x58], r15
lea rax, [0x004837b8]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x60], r15d
cmp rbx, r12
je 0x416205
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x4d0]
add rsp, 0x480
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret