Function at 0x1400aa1e0
Capabilities:
Clear file content
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0x90
mov rax, qword [0x140173040]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r13, r9
mov r12, r8
mov qword [rbp - 0x31], r8
mov rdi, rdx
mov rax, qword [rbp + 0x7f]
mov qword [rbp - 0x29], rax
xor eax, eax
mov dword [rbp + 7], eax
mov ebx, eax
nop word [rax + rax]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 1]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x1400aa288
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x1400aa34c
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0x10
lea eax, [r14 + 1]
jl 0x1400aa230
mov word [rbp - 9], 0xfeff
xor edi, edi
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 7]
lea r8d, [rdi + 2]
lea rdx, [rbp - 9]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov qword [rbp + 0xf], rdi
lea rcx, [rbp + 0xf]
call fcn.1400055e0
nop
mov r15d, edi
mov rcx, qword [r12]
mov rax, qword [r12 + 8]
sub rax, rcx
sar rax, 3
lea esi, [rdi - 1]
test rax, rax
je 0x1400aa923
mov ebx, edi
nop dword [rax]
mov qword [rbp - 0x21], rdi
lea rdx, [rcx + rbx*8]
lea rcx, [rbp - 0x21]
call fcn.14003f4f0
nop
mov qword [rbp - 0x11], rdi
mov rax, qword [r13]
lea rdx, [rax + rbx*8]
lea rcx, [rbp - 0x11]
call fcn.14003f4f0
nop
mov qword [rbp - 0x19], rdi
mov rax, qword [rbp - 0x29]
mov rax, qword [rax]
lea rdx, [rax + rbx*8]
lea rcx, [rbp - 0x19]
call fcn.14003f4f0
nop
mov rbx, qword [rbp - 0x21]
movzx eax, word [rbx]
test ax, ax
je 0x1400aa3bb
movzx ecx, ax
call fcn.14010b094
test eax, eax
je 0x1400aa353
mov rax, rbx
test rdi, rdi
cmovne rax, rdi
mov rdi, rax
jmp 0x1400aa355
xor al, al
jmp 0x1400aa964
xor edi, edi
add rbx, 2
movzx eax, word [rbx]
test ax, ax
jne 0x1400aa331
test rdi, rdi
je 0x1400aa3b7
mov rax, qword [rbp - 0x21]
sub rdi, rax
sar rdi, 1
test edi, edi
js 0x1400aaa35
mov edx, 1
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, edi
or ecx, edx
jge 0x1400aa398
mov edx, edi
lea rcx, [rbp - 0x21]
call fcn.140005a20
mov rax, qword [rbp - 0x21]
cmp edi, dword [rax - 0xc]
jg 0x1400aaa35
mov dword [rax - 0x10], edi
movsxd rcx, edi
mov rax, qword [rbp - 0x21]
xor edi, edi
mov word [rax + rcx*2], di
mov rbx, qword [rbp - 0x21]
jmp 0x1400aa3bd
mov rbx, qword [rbp - 0x21]
xor edi, edi
movzx ecx, word [rbx]
call fcn.14010b094
test eax, eax
je 0x1400aa3e0
nop dword [rax]
add rbx, 2
movzx ecx, word [rbx]
call fcn.14010b094
test eax, eax
jne 0x1400aa3d0
mov rax, qword [rbp - 0x21]
cmp rbx, rax
je 0x1400aa483
sub rbx, rax
sar rbx, 1
mov edx, dword [rax - 0x10]
test edx, edx
js 0x1400aaa35
mov r8d, 1
sub r8d, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, edx
or ecx, r8d
jge 0x1400aa41f
lea rcx, [rbp - 0x21]
call fcn.140005a20
mov rax, qword [rbp - 0x21]
movsxd rcx, ebx
lea rdx, [rax + rcx*2]
mov r9d, dword [rax - 0x10]
mov edi, r9d
sub edi, ebx
lea ecx, [rdi + 1]
movsxd r8, ecx
add r8, r8
je 0x1400aa462
test rdx, rdx
je 0x1400aaa25
lea ecx, [r9 + 1]
movsxd r9, ecx
add r9, r9
cmp r9, r8
jb 0x1400aaa18
mov rcx, rax
call fcn.14012c6c0
mov rax, qword [rbp - 0x21]
test edi, edi
js 0x1400aaa35
cmp edi, dword [rax - 0xc]
jg 0x1400aaa35
mov dword [rax - 0x10], edi
movsxd rcx, edi
mov rax, qword [rbp - 0x21]
xor edi, edi
mov word [rax + rcx*2], di
mov rbx, qword [rbp - 0x11]
movzx eax, word [rbx]
test ax, ax
je 0x1400aa51e
xor r12d, r12d
movzx ecx, ax
call fcn.14010b094
test eax, eax
je 0x1400aa4b1
mov rax, rbx
test rdi, rdi
cmovne rax, rdi
mov rdi, rax
jmp 0x1400aa4b4
mov rdi, r12
add rbx, 2
movzx eax, word [rbx]
test ax, ax
jne 0x1400aa496
mov r12, qword [rbp - 0x31]
test rdi, rdi
je 0x1400aa51a
mov rax, qword [rbp - 0x11]
sub rdi, rax
sar rdi, 1
test edi, edi
js 0x1400aaa35
mov edx, 1
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, edi
or ecx, edx
jge 0x1400aa4fb
mov edx, edi
lea rcx, [rbp - 0x11]
call fcn.140005a20
mov rax, qword [rbp - 0x11]
cmp edi, dword [rax - 0xc]
jg 0x1400aaa35
mov dword [rax - 0x10], edi
movsxd rcx, edi
mov rax, qword [rbp - 0x11]
xor edi, edi
mov word [rax + rcx*2], di
mov rbx, qword [rbp - 0x11]
jmp 0x1400aa520
mov rbx, qword [rbp - 0x11]
xor edi, edi
movzx ecx, word [rbx]
call fcn.14010b094
test eax, eax
je 0x1400aa540
nop dword [rax]
add rbx, 2
movzx ecx, word [rbx]
call fcn.14010b094
test eax, eax
jne 0x1400aa530
mov rax, qword [rbp - 0x11]
cmp rbx, rax
je 0x1400aa5e3
sub rbx, rax
sar rbx, 1
mov edx, dword [rax - 0x10]
test edx, edx
js 0x1400aaa35
mov r8d, 1
sub r8d, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, edx
or ecx, r8d
jge 0x1400aa57f
lea rcx, [rbp - 0x11]
call fcn.140005a20
mov rax, qword [rbp - 0x11]
movsxd rcx, ebx
lea rdx, [rax + rcx*2]
mov r9d, dword [rax - 0x10]
mov edi, r9d
sub edi, ebx
lea ecx, [rdi + 1]
movsxd r8, ecx
add r8, r8
je 0x1400aa5c2
test rdx, rdx
je 0x1400aaa25
lea ecx, [r9 + 1]
movsxd r9, ecx
add r9, r9
cmp r9, r8
jb 0x1400aaa18
mov rcx, rax
call fcn.14012c6c0
mov rax, qword [rbp - 0x11]
test edi, edi
js 0x1400aaa35
cmp edi, dword [rax - 0xc]
jg 0x1400aaa35
mov dword [rax - 0x10], edi
movsxd rcx, edi
mov rax, qword [rbp - 0x11]
xor edi, edi
mov word [rax + rcx*2], di
mov rbx, qword [rbp - 0x19]
movzx eax, word [rbx]
test ax, ax
je 0x1400aa67e
xor r12d, r12d
movzx ecx, ax
call fcn.14010b094
test eax, eax
je 0x1400aa611
mov rax, rbx
test rdi, rdi
cmovne rax, rdi
mov rdi, rax
jmp 0x1400aa614
mov rdi, r12
add rbx, 2
movzx eax, word [rbx]
test ax, ax
jne 0x1400aa5f6
mov r12, qword [rbp - 0x31]
test rdi, rdi
je 0x1400aa67a
mov rax, qword [rbp - 0x19]
sub rdi, rax
sar rdi, 1
test edi, edi
js 0x1400aaa35
mov edx, 1
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, edi
or ecx, edx
jge 0x1400aa65b
mov edx, edi
lea rcx, [rbp - 0x19]
call fcn.140005a20
mov rax, qword [rbp - 0x19]
cmp edi, dword [rax - 0xc]
jg 0x1400aaa35
mov dword [rax - 0x10], edi
movsxd rcx, edi
mov rax, qword [rbp - 0x19]
xor edi, edi
mov word [rax + rcx*2], di
mov rbx, qword [rbp - 0x19]
jmp 0x1400aa680
mov rbx, qword [rbp - 0x19]
xor edi, edi
movzx ecx, word [rbx]
call fcn.14010b094
test eax, eax
je 0x1400aa6a0
nop dword [rax]
add rbx, 2
movzx ecx, word [rbx]
call fcn.14010b094
test eax, eax
jne 0x1400aa690
mov rax, qword [rbp - 0x19]
cmp rbx, rax
je 0x1400aa743
sub rbx, rax
sar rbx, 1
mov edx, dword [rax - 0x10]
test edx, edx
js 0x1400aaa35
mov r8d, 1
sub r8d, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, edx
or ecx, r8d
jge 0x1400aa6df
lea rcx, [rbp - 0x19]
call fcn.140005a20
mov rax, qword [rbp - 0x19]
movsxd rcx, ebx
lea rdx, [rax + rcx*2]
mov r9d, dword [rax - 0x10]
mov edi, r9d
sub edi, ebx
lea ecx, [rdi + 1]
movsxd r8, ecx
add r8, r8
je 0x1400aa722
test rdx, rdx
je 0x1400aaa25
lea ecx, [r9 + 1]
movsxd r9, ecx
add r9, r9
cmp r9, r8
jb 0x1400aaa18
mov rcx, rax
call fcn.14012c6c0
mov rax, qword [rbp - 0x19]
test edi, edi
js 0x1400aaa35
cmp edi, dword [rax - 0xc]
jg 0x1400aaa35
mov dword [rax - 0x10], edi
movsxd rcx, edi
mov rax, qword [rbp - 0x19]
xor edi, edi
mov word [rax + rcx*2], di
mov qword [rbp - 1], rdi
lea rcx, [rbp - 1]
call fcn.1400055e0
nop
mov rdx, qword [rbp + 0xf]
test rdx, rdx
je 0x1400aaa40
mov rax, qword [rbp - 0x21]
mov rcx, rax
mov r10, rdx
sub r10, rax
nop dword [rax + rax]
movzx r9d, word [rcx]
movzx r8d, word [rcx + r10]
sub r9d, r8d
jne 0x1400aa787
add rcx, 2
test r8d, r8d
jne 0x1400aa770
test r9d, r9d
je 0x1400aa83a
lea rcx, [rax - 0x18]
lea rbx, [rdx - 0x18]
cmp rcx, rbx
je 0x1400aa7ec
cmp dword [rbx + 0x10], 0
jl 0x1400aa7d8
mov rdx, qword [rbx]
cmp qword [rcx], rdx
jne 0x1400aa7d8
call fcn.140041570
mov rdi, rax
mov ecx, esi
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x1400aa7cc
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [rbp + 0xf], rax
xor edi, edi
jmp 0x1400aa7e8
mov r8d, dword [rax - 0x10]
mov rdx, rax
lea rcx, [rbp + 0xf]
call fcn.140005a90
mov rax, qword [rbp - 0x21]
mov r8, rax
lea rdx, str.__s__r_n
lea rcx, [rbp - 1]
call fcn.140005d70
mov rdx, qword [rbp - 1]
cmp dword [rdx - 8], 1
jle 0x1400aa819
mov edx, dword [rdx - 0x10]
lea rcx, [rbp - 1]
call fcn.140005760
mov rdx, qword [rbp - 1]
mov r8d, dword [rdx - 0x10]
add r8d, r8d
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 7]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400aa98b
mov r9, qword [rbp - 0x19]
mov r8, qword [rbp - 0x11]
lea rdx, str._s_s_r_n
lea rcx, [rbp - 1]
call fcn.140005d70
mov rdx, qword [rbp - 1]
cmp dword [rdx - 8], 1
jle 0x1400aa86c
mov edx, dword [rdx - 0x10]
lea rcx, [rbp - 1]
call fcn.140005760
mov rdx, qword [rbp - 1]
mov r8d, dword [rdx - 0x10]
add r8d, r8d
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 7]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400aa98b
mov rdx, qword [rbp - 1]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400aa8ab
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x19]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400aa8c9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x11]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400aa8e7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x21]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400aa904
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
inc r15d
mov rcx, qword [r12]
mov ebx, r15d
mov rax, qword [r12 + 8]
sub rax, rcx
sar rax, 3
cmp rbx, rax
jb 0x1400aa2e0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test r14, r14
je 0x1400aa943
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
mov rdx, qword [rbp + 0xf]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x1400aa961
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
movzx eax, bl
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1400ff350
mov rbx, qword [rsp + 0xd0]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
test r14, r14
je 0x1400aa99a
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp - 1]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400aa9b8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x19]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400aa9d6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x11]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400aa9f4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x21]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400aaa11
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor bl, bl
jmp 0x1400aa945
call fcn.14010b5c8
mov dword [rax], 0x22
jmp 0x1400aaa30
call fcn.14010b5c8
mov dword [rax], 0x16
call fcn.14010b428
mov ecx, 0x80070057
call fcn.140002b00
nop
mov ecx, 0x80004005
call fcn.140002b00
int3