Function at 0x4283d0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x368
mov rdi, qword [rsp + 0x3d0]
mov r15, rcx
mov rbp, rdx
mov r12, r8
mov r14, r9
mov dword [rsp + 0x68], 0
test rdi, rdi
je 0x4286e4
mov rcx, rdi
mov rax, r9
xor ebx, ebx
shl rcx, 4
add rcx, r9
nop word [rax + rax]
mov edx, dword [rax]
add rax, 0x10
add rbx, rdx
cmp rcx, rax
jne 0x428420
mov eax, 0xffffffff
mov esi, 0x2747
cmp rbx, rax
jbe 0x428453
mov eax, esi
add rsp, 0x368
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
cmp qword [rsp + 0x3d8], 0
je 0x428671
mov rax, qword [rsp + 0x3d8]
mov esi, 0x32
cmp dword [rax + 0x10], 0xc
jne 0x42843d
mov edx, dword [r12 + 0x1e0]
test edx, edx
je 0x4288d0
lea rax, [rsp + 0xe0]
mov rcx, qword [rsp + 0x3d8]
lea r8, [rsp + 0x68]
mov r9, rax
mov qword [rsp + 0x40], rax
call fcn.00432cd0
test eax, eax
mov esi, eax
jne 0x42843d
lea rax, [rdi + 2]
cmp rax, 5
mov qword [rsp + 0x30], rax
ja 0x4287e6
lea rax, [rsp + 0x50]
lea rdx, [rsp + 0x70]
mov r8d, 0x10
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
lea r13, [rsp + 0x80]
mov rcx, rax
mov qword [rsp + 0x38], rax
call fcn.00410be0
mov rax, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rdx
mov eax, dword [rsp + 0x68]
cmp eax, 1
je 0x4288c6
cmp eax, 2
jne 0x428528
or dword [rsp + 0x70], 2
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
mov r8d, 0x278
call fcn.00410be0
mov rdx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
mov qword [r13 + 0x18], rdx
mov qword [r13 + 0x10], rax
mov edx, 2
test rbx, rbx
je 0x42858f
or dword [rsp + 0x70], 1
test rdi, rdi
mov dword [rsp + 0x78], ebx
je 0x42858f
shl rdx, 4
shl rdi, 4
xor eax, eax
add rdx, r13
mov rcx, qword [r14 + rax]
mov rbx, qword [r14 + rax + 8]
mov qword [rdx + rax], rcx
mov qword [rdx + rax + 8], rbx
add rax, 0x10
cmp rdi, rax
jne 0x428574
mov rax, qword [rsp + 0x3e0]
mov dword [rbp + 8], 3
mov qword [rbp + 0x80], r12
mov qword [rbp + 0x78], 0
mov dword [rbp + 0x88], 0
mov qword [rbp + 0xa0], 0
mov qword [rbp + 0x70], rax
mov qword [rbp + 0xa8], 0xffffffffffffffff
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x58], 0
test dword [r12 + 0x58], 0x180000
jne 0x428899
cmp qword [rsp + 0x30], 0
mov dword [rbp + 0x90], 0
mov qword [rbp + 0x98], 0
je 0x428704
xor edx, edx
xor ebx, ebx
xor eax, eax
shl rax, 4
mov eax, dword [r13 + rax]
add rbx, rax
lea eax, [rdx + 1]
cmp qword [rsp + 0x30], rax
mov rdx, rax
ja 0x428627
mov eax, 0xffffffff
mov esi, 0x2747
cmp rbx, rax
jbe 0x428ac2
lea rax, [rsp + 0x80]
cmp r13, rax
je 0x42843d
mov rcx, r13
call fcn.00410a10
jmp 0x42843d
lea rax, [rdi + 1]
cmp rax, 5
mov qword [rsp + 0x30], rax
jbe 0x428b87
mov rcx, rax
mov edx, 0x10
call fcn.00410a40
test rax, rax
mov r13, rax
je 0x4286fa
lea rax, [rsp + 0x50]
lea rdx, [rsp + 0x70]
mov r8d, 0x10
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov rcx, rax
mov qword [rsp + 0x38], rax
call fcn.00410be0
mov rdx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
mov qword [r13 + 8], rdx
mov qword [r13], rax
mov edx, 1
jmp 0x428554
cmp qword [rsp + 0x3d8], 0
je 0x428b7c
xor ebx, ebx
jmp 0x428462
mov esi, 8
jmp 0x42843d
xor edx, edx
xor ebx, ebx
mov eax, dword [r12 + 0x58]
mov ecx, eax
and ecx, 0x1100000
cmp ecx, 0x1100000
je 0x42894a
test eax, 0x1000000
je 0x428845
movabs rax, 0xffffffff00000000
and rax, qword [rsp + 0x48]
mov qword [rbp + 0x98], rdx
mov qword [rbp + 0x68], 0
or rax, rbx
mov qword [rbp + 0x90], rax
mov rax, qword [r12 + 0x208]
test rax, rax
je 0x428a79
mov rax, qword [rax + 0x68]
mov qword [rbp + 0x68], rax
mov rax, qword [r12 + 0x208]
mov qword [rax + 0x68], rbp
mov qword [r12 + 0x208], rbp
mov eax, dword [r12 + 0x100]
test eax, eax
je 0x4289f0
mov qword [rbp + 0x60], rbx
add qword [r12 + 0x60], rbx
mov eax, dword [r12 + 0x7c]
lea edx, [rax + 1]
test eax, eax
mov dword [r12 + 0x7c], edx
jne 0x4287cb
mov eax, dword [r12 + 0x58]
test al, 4
jne 0x4287cb
mov edx, eax
or edx, 4
test al, 8
mov dword [r12 + 0x58], edx
je 0x4287cb
mov rax, qword [r12 + 8]
add dword [rax + 8], 1
add dword [r15 + 0x20], 1
add dword [r12 + 0x78], 1
add dword [r12 + 0x100], 1
xor esi, esi
jmp 0x428653
mov rcx, rax
mov edx, 0x10
call fcn.00410a40
test rax, rax
mov r13, rax
je 0x4286fa
lea rax, [rsp + 0x50]
lea rdx, [rsp + 0x70]
mov r8d, 0x10
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov rcx, rax
mov qword [rsp + 0x38], rax
call fcn.00410be0
mov rax, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov qword [r13], rax
mov qword [r13 + 8], rdx
jmp 0x428511
test eax, 0x100000
lea rax, [rbp + 0x40]
mov rcx, qword [r12 + 0x118]
mov r9d, 0
mov r8d, ebx
mov qword [rsp + 0x20], rax
je 0x4288e5
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x428a25
mov qword [rbp + 0x60], 0
mov rcx, qword [rbp + 0xa0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0xa0], 0
jmp 0x42879a
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
test rax, rax
mov qword [rbp + 0xa0], rax
je 0x428b68
or rax, 1
mov qword [rbp + 0x58], rax
jmp 0x428600
or dword [rsp + 0x70], 6
jmp 0x428528
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
mov dword [r12 + 0x1e0], eax
jmp 0x428485
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x428a8a
mov qword [rbp + 0x60], 0
test byte [r12 + 0x5a], 8
je 0x42879a
mov rdx, qword [rbp + 0xa0]
lea rcx, [rbp + 0xa8]
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0xffffffff
mov r9, rbp
lea r8, [0x00426280]
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
test eax, eax
jne 0x42879a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x428653
mov rcx, qword [r12 + 0x118]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x6c]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x42893d
mov qword [rbp + 0x60], 0
mov eax, dword [r12 + 0x7c]
lea edx, [rax + 1]
test eax, eax
mov dword [r12 + 0x7c], edx
jne 0x4289a6
mov eax, dword [r12 + 0x58]
test al, 4
jne 0x4289a6
mov edx, eax
or edx, 4
test al, 8
mov dword [r12 + 0x58], edx
je 0x4289a6
mov rax, qword [r12 + 8]
add dword [rax + 8], 1
add dword [r15 + 0x20], 1
xor r8d, r8d
xor edx, edx
add dword [r12 + 0x78], 1
lea r9, [rbp + 0x40]
add dword [r12 + 0x100], 1
mov rcx, qword [r15 + 0x38]
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
jne 0x4287df
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x0044e6b0]
mov ecx, eax
call fcn.00416440
nop dword [rax]
mov rdx, qword [rbp + 0x68]
cmp rdx, rbp
je 0x428aa8
mov rax, qword [rdx + 0x68]
mov qword [rbp + 0x68], rax
mov r8d, 0x10
lea rcx, [0x00426350]
call qword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
test eax, eax
jne 0x428791
call fcn.0044a680
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rsi
cmp eax, 0x3e5
jne 0x428a58
mov qword [rbp + 0x60], rbx
add qword [r12 + 0x60], rbx
mov edx, 0xffffffff
mov rcx, qword [rbp + 0xa0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x42887c
call rsi
mov rcx, qword [rbp + 0xa0]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0xa0], 0
jmp 0x428653
mov qword [rbp + 0x68], rbp
mov qword [r12 + 0x208], rbp
jmp 0x428781
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rsi
cmp eax, 0x3e5
jne 0x428ab9
mov qword [rbp + 0x60], rbx
add qword [r12 + 0x60], rbx
jmp 0x4288fb
mov qword [r12 + 0x208], 0
jmp 0x428a05
call rsi
mov esi, eax
jmp 0x428653
lea rcx, [rbx + 0xb8]
call fcn.004109f0
test rax, rax
mov r14, rax
je 0x428b5e
mov rdi, rax
mov rsi, rbp
lea rax, [rax + 0xb8]
mov ecx, 0x16
rep movsq qword [rdi], qword [rsi]
mov qword [rax - 8], rbp
mov dword [rax - 0x30], 1
xor esi, esi
mov qword [rsp + 0x40], rax
mov ebp, 0xb8
xor eax, eax
shl rax, 4
lea rcx, [r14 + rbp]
lea rdi, [r13 + rax]
mov r8d, dword [rdi]
mov rdx, qword [rdi + 8]
call sub.msvcrt.dll_memcpy
mov eax, dword [rdi]
add rbp, rax
lea eax, [rsi + 1]
cmp qword [rsp + 0x30], rax
mov rsi, rax
ja 0x428b08
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
mov r8d, ebx
mov rbp, r14
call fcn.00410be0
mov rax, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x48], rax
mov ebx, eax
jmp 0x428708
mov esi, 8
jmp 0x428653
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x0044e712]
mov ecx, eax
call fcn.00416440
mov qword [rsp + 0x30], 1
xor ebx, ebx
lea rax, [rsp + 0x50]
lea rdx, [rsp + 0x70]
mov r8d, 0x10
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
lea r13, [rsp + 0x80]
mov rcx, rax
mov qword [rsp + 0x38], rax
call fcn.00410be0
mov rdx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x88], rdx
mov qword [rsp + 0x80], rax
mov edx, 1
jmp 0x428554