Function at 0x14004fd40
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x90
mov rax, qword [0x140155040]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov qword [rsp + 0xa0], rsi
call fcn.14004de80
call fcn.140070ba0
xor ebp, ebp
mov rsi, rax
mov edi, 0xffffffff
test rax, rax
je 0x14004fe45
mov rbx, qword [rax]
mov rdx, qword [0x140159180]
add rbx, 0x1a
mov qword [rsp + 0xa8], r14
lea rcx, [rbx + 0x12]
call fcn.1400601a0
mov r14, rax
mov qword [rax], rbx
lea rcx, [rax + 0x10]
mov qword [rax + 8], rcx
mov word [rcx + rbx], bp
mov r8, qword [rsi]
mov rdx, qword [rsi + 8]
mov rcx, qword [rax + 8]
call fcn.1400e6ce0
mov rcx, qword [rsi]
movups xmm0, xmmword [str..settings.xml]
mov rdx, qword [r14 + 8]
movups xmmword [rdx + rcx], xmm0
movsd xmm0, qword [0x14013de38]
movsd qword [rdx + rcx + 0x10], xmm0
movzx eax, word [0x14013de40]
mov word [rdx + rcx + 0x18], ax
mov rcx, r14
call fcn.140077260
nop
test al, al
je 0x14004fe0d
mov qword [0x140159530], r14
jmp 0x14004fe25
lea rcx, [r14 - 0x10]
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14004fe25
nop dword [rax]
call fcn.1400602c0
lea rcx, [rsi - 0x10]
mov eax, edi
lock xadd dword [rcx + 8], eax
mov r14, qword [rsp + 0xa8]
cmp eax, 1
jne 0x14004fe45
nop dword [rax]
call fcn.1400602c0
mov rbx, qword [0x140159530]
test rbx, rbx
je 0x14004fe56
cmp qword [rbx], rbp
jne 0x14004feb3
lea rax, str.peview.xml
mov qword [rsp + 0x60], 0x14
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x50]
lea rax, str.SystemInformer_
mov qword [rsp + 0x50], 0x20
mov qword [rsp + 0x58], rax
mov rbx, rbp
call fcn.140071060
mov rsi, rax
test rax, rax
je 0x14004feac
lea rdx, ds:[rsp + 0x60]
mov rcx, rax
call fcn.140061dc0
mov rbx, rax
lock inc dword [rsi - 8]
mov qword [0x140159530], rbx
mov rsi, qword ss:[rsp + 0xa0]
test rbx, rbx
je 0x14004ffdb
cmp qword [rbx], rbp
je 0x14004ffdb
call fcn.1400683a0
nop word [rax + rax]
cmp eax, 0xc0000102
jne 0x14004ffdb
lea rax, str.If_you_select_No__the_settings_system_will_not_function_properly.
mov edx, 6
lea r9, str.PE_Views_settings_file_is_corrupt._Do_you_want_to_reset_it_
mov qword [rsp + 0x20], rax
xor ecx, ecx
mov r8d, 0xffff
call fcn.14006eba0
cmp eax, 6
jne 0x14004ffba
mov eax, dword [0x14013df80]
lea rcx, [rsp + 0x50]
movups xmm0, xmmword [str._settings___settings_]
mov rdx, qword [0x140159530]
mov r8d, 0x120116
mov dword [rsp + 0x80], eax
movzx eax, word [0x14013df84]
mov dword [rsp + 0x30], 0x60
mov dword [rsp + 0x28], 4
movups xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x84], ax
mov dword [rsp + 0x20], 5
call fcn.140076fe0
test eax, eax
js 0x14004ffdb
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rbp
xor r9d, r9d
mov qword [rsp + 0x38], rbp
xor r8d, r8d
mov dword [rsp + 0x30], 0x15
xor edx, edx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtWriteFile]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x14004ffdb
mov rcx, qword [0x140159530]
add rcx, 0xfffffffffffffff0
lock xadd dword [rcx + 8], edi
cmp edi, 1
jne 0x14004ffd4
call fcn.1400602c0
mov qword [0x140159530], rbp
nop dword [rax + rax]
call fcn.14004fb00
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1400c6a20
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret