Function at 0x140006690
Capabilities:
Write file on windows

Disassembly:
jmp 0x140023ee0
push rbp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x98
lea rbp, [rsp + 0x40]
mov r14, r8
mov r10, rsp
mov r12, rdx
mov edx, 0x40000000
xor r8d, r8d
xor r9d, r9d
mov r13, rcx
mov dword [rbp + 0x48], 0xa0d
mov dword [r10 + 0x20], 2
mov dword [r10 + 0x28], 0x80
mov qword [r10 + 0x30], 0
call sub.KERNEL32.dll_CreateFileA
mov rdi, rax
cmp rdi, 0xffffffffffffffff
je 0x14002412c
mov edx, 0xffffffeb
mov rcx, qword [r12]
call sub.USER32.dll_GetWindowLongPtrA
mov r15, rax
test r15, r15
jne 0x140023f8a
mov rdx, rsp
lea r10, [0x1404a8128]
lea r11, [0x1404a8134]
mov ecx, 0x10100009
mov r8d, 3
mov r9d, 9
mov qword [rdx + 0x20], r10
mov qword [rdx + 0x28], r11
lea rdx, [0x1404a80c0]
call fcn.140002199
mov r15d, dword [r15 + 0xa4]
mov dword [rbp + 0x4c], 1
test r15d, r15d
jle 0x140024001
mov r8, r12
lea rcx, [rbp + 0x4c]
lea rdx, [rbp + 0x44]
call fcn.14000542a
mov r10, rsp
mov rcx, rdi
mov rdx, rax
lea r9, [rbp + 0x54]
mov r8d, dword [rbp + 0x44]
mov qword [r10 + 0x20], 0
call sub.KERNEL32.dll_WriteFile
mov r10, rsp
mov rcx, rdi
mov r8d, 2
lea rdx, [rbp + 0x48]
lea r9, [rbp + 0x54]
mov qword [r10 + 0x20], 0
call sub.KERNEL32.dll_WriteFile
test eax, eax
je 0x14002408a
mov edx, dword [rbp + 0x4c]
inc edx
mov dword [rbp + 0x4c], edx
cmp edx, r15d
jle 0x140023f9d
mov rcx, rdi
call sub.KERNEL32.dll_CloseHandle
mov rcx, r13
lea rdx, [0x1404a8140]
mov r8, r14
mov r9d, 1
call fcn.140005461
mov rax, r14
mov rdi, rsp
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.140001e38
sub rsp, rax
lea rax, [rsp + 0x40]
mov r12, rax
mov edx, r14d
mov rcx, r12
mov r8, r13
mov r9d, r14d
call fcn.140002c52
movsxd rax, eax
lea rcx, str.Saved_analysis_window
mov rdx, r12
mov r8d, 0x16
mov r9, rax
call fcn.1400058b7
mov rax, rdi
mov rsp, rax
mov dword [0x140763008], 0xffffffff
lea rsp, [rbp + 0x58]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret
mov edx, 2
lea rcx, [rbp]
lea r8, [0x14056e6cc]
mov r9d, 0x20
lea r10, str.I_O_error_while_writing_file
lea r11, [rbp + 0x40]
mov qword [rcx], r10
mov qword [rbp + 8], 0x1c
mov byte [r11], 0
mov qword [rbp + 0x10], r11
mov qword [rbp + 0x18], 1
call fcn.1400048cc
mov edx, 2
lea rcx, [rbp + 0x20]
lea r8, [0x14056e6ec]
mov r9d, 5
lea r10, [0x1404a817c]
lea r11, [rbp + 0x50]
mov qword [rcx], r10
mov qword [rbp + 0x28], 4
mov byte [r11], 0
mov qword [rbp + 0x30], r11
mov qword [rbp + 0x38], 1
call fcn.1400048cc
xor ecx, ecx
lea rdx, [0x14056e6cc]
lea r8, [0x14056e6ec]
mov r9d, 0x30
call sub.USER32.dll_MessageBoxA
jmp 0x140024001
call sub.KERNEL32.dll_GetLastError
lea r8, [0x14056e6cc]
lea rdx, [rbp + 0x40]
mov qword [rbp + 0x10], rdx
lea rcx, [rbp]
mov edx, 2
mov r9d, 0x20
mov dword [rbp + 0x44], eax
lea rax, str.Cannot_create_file
mov qword [rcx], rax
mov qword [rbp + 8], 0x12
mov byte [rbp + 0x40], 0
mov qword [rbp + 0x18], 1
call fcn.1400048cc
lea r8, [0x14056e6ec]
lea rdx, [rbp + 0x50]
mov qword [rbp + 0x30], rdx
lea rcx, [rbp + 0x20]
mov edx, 2
mov r9d, 5
lea rax, [0x1404a8198]
mov qword [rcx], rax
mov qword [rbp + 0x28], 4
mov byte [rbp + 0x50], 0
mov qword [rbp + 0x38], 1
call fcn.1400048cc
xor ecx, ecx
lea rdx, [0x14056e6cc]
lea r8, [0x14056e6ec]
mov r9d, 0x30
call sub.USER32.dll_MessageBoxA
jmp 0x14002407b