Function at 0x401ae0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.00402b40
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.00402b40
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x00408ec4]
mov r12, rcx
mov rsi, rdx
mov rbx, r8
test edi, edi
jle 0x401ce5
mov rax, qword [0x00408ec8]
xor ecx, ecx
add rax, 0x18
mov rdx, qword [rax]
cmp r12, rdx
jb 0x401b9b
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x401c26
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x401b7f
mov rcx, r12
call fcn.00402760
mov rbp, rax
test rax, rax
je 0x401d14
mov rax, qword [0x00408ec8]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call fcn.00402880
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x00408ec8]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x401d23
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x401c1f
sub eax, 4
and eax, 0xfffffffb
jne 0x401ca1
add dword [0x00408ec4], 1
cmp ebx, 8
jae 0x401c53
test bl, 4
jne 0x401cec
test ebx, ebx
je 0x401c48
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x401d02
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x401c48
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x401c85
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
add rdi, qword [0x00408ec8]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x401c1f
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.00401ae0
xor edi, edi
jmp 0x401ba6
mov eax, dword [rsi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x401c48
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x401c48
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.00401ae0
mov rax, qword [0x00408ec8]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call fcn.00401ae0
nop
nop
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x80]
mov esi, dword [0x00408ec0]
test esi, esi
je 0x401d73
lea rsp, [rbp - 0x48]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov dword [0x00408ec0], 1
call fcn.004027e0
cdqe
lea rax, [rax + rax*4]
lea rax, [rax*8 + 0xf]
and rax, 0xfffffffffffffff0
call fcn.004029f0
mov r12, qword [0x00405900]
mov rbx, qword [0x00405910]
mov dword [0x00408ec4], 0
sub rsp, rax
lea rax, [rsp + 0x20]
mov qword [0x00408ec8], rax
mov rax, r12
sub rax, rbx
cmp rax, 7
jle 0x401d62
mov edx, dword [rbx]
cmp rax, 0xb
jg 0x401f0b
test edx, edx
jne 0x401f85
mov eax, dword [rbx + 4]
test eax, eax
jne 0x401f85
mov edx, dword [rbx + 8]
cmp edx, 1
jne 0x401fe9
add rbx, 0xc
lea r15, [rbp - 0x58]
mov r13, qword [0x00405930]
movabs r14, 0xffffffff00000000
cmp rbx, r12
jb 0x401e53
jmp 0x401d62
movzx r8d, byte [rcx]
mov rdi, r15
mov r10, r8
or r10, 0xffffffffffffff00
test r8b, r8b
cmovs r8, r10
sub r8, rdx
mov rdx, r15
add r8, r9
mov qword [rbp - 0x58], r8
mov r8d, 1
call 0x401b50
add rbx, 0xc
cmp rbx, r12
jae 0x401ec0
mov edx, dword [rbx]
mov ecx, dword [rbx + 4]
movzx r8d, byte [rbx + 8]
add rdx, r13
add rcx, r13
mov r9, qword [rdx]
cmp r8d, 0x20
je 0x401f56
ja 0x401f29
cmp r8d, 8
je 0x401e1a
cmp r8d, 0x10
jne 0x401fd2
movzx r8d, word [rcx]
mov rdi, r15
mov r10, r8
or r10, 0xffffffffffff0000
test r8w, r8w
cmovs r8, r10
add rbx, 0xc
sub r8, rdx
mov rdx, r15
add r8, r9
mov qword [rbp - 0x58], r8
mov r8d, 2
call 0x401b50
cmp rbx, r12
jb 0x401e53
mov eax, dword [0x00408ec4]
test eax, eax
jle 0x401d62
mov r12, qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor ebx, ebx
mov rax, qword [0x00408ec8]
add rax, rbx
mov r8d, dword [rax]
test r8d, r8d
je 0x401ef7
mov rdx, qword [rax + 0x10]
mov rcx, qword [rax + 8]
mov r9, rdi
call r12
add esi, 1
add rbx, 0x28
cmp esi, dword [0x00408ec4]
jl 0x401ed7
jmp 0x401d62
test edx, edx
jne 0x401f85
mov eax, dword [rbx + 4]
mov edi, eax
or edi, dword [rbx + 8]
jne 0x401de3
mov edx, dword [rbx + 0xc]
add rbx, 0xc
jmp 0x401dd8
cmp r8d, 0x40
jne 0x401fd2
mov rax, qword [rcx]
mov r8d, 8
mov rdi, r15
sub rax, rdx
mov rdx, r15
add rax, r9
mov qword [rbp - 0x58], rax
call 0x401b50
jmp 0x401e4a
mov eax, dword [rcx]
mov rdi, r15
mov r8, rax
or rax, r14
test r8d, r8d
cmovns rax, r8
mov r8d, 4
sub rax, rdx
mov rdx, r15
add rax, r9
mov qword [rbp - 0x58], rax
call 0x401b50
jmp 0x401e4a
cmp rbx, r12
jae 0x401d62
sub r12, 1
mov r13, qword [0x00405930]
lea rdi, [rbp - 0x58]
sub r12, rbx
shr r12, 3
lea r12, [rbx + r12*8 + 8]
mov ecx, dword [rbx + 4]
mov eax, dword [rbx]
mov r8d, 4
mov rdx, rdi
add rbx, 8
add rcx, r13
add eax, dword [rcx]
mov dword [rbp - 0x58], eax
call 0x401b50
cmp rbx, r12
jne 0x401fa9
jmp 0x401ec0
mov edx, r8d
lea rcx, str.__Unknown_pseudo_relocation_bit_size__d._n
mov qword [rbp - 0x58], 0
call fcn.00401ae0
lea rcx, str.__Unknown_pseudo_relocation_protocol_version__d._n
call fcn.00401ae0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
sub rsp, 0x28
mov eax, dword [rcx]
cmp eax, 0xc0000096
ja 0x402124
cmp eax, 0xc000008b
jbe 0x402067
add eax, 0x3fffff73
cmp eax, 9
ja case.0x402030.1073741678
lea rdx, [0x00405870]
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
xor edx, edx
mov ecx, 8
call sub.msvcrt.dll_signal
cmp rax, 1
jne 0x4020e0
mov edx, 1
mov ecx, 8
call sub.msvcrt.dll_signal
call fcn.00401ab0
xor r8d, r8d
mov eax, r8d
add rsp, 0x28
ret
cmp eax, 0xc0000005
je 0x4020fe
jbe 0x4020ba
xor r8d, r8d
cmp eax, 0xc0000008
je 0x40205f
cmp eax, 0xc000001d
jne 0x402124
xor edx, edx
mov ecx, 4
call sub.msvcrt.dll_signal
cmp rax, 1
je 0x40213a
test rax, rax
je 0x40212f
mov ecx, 4
call rax
xor r8d, r8d
mov eax, r8d
add rsp, 0x28
ret
xor r8d, r8d
cmp eax, 0x80000002
setne r8b
mov eax, r8d
add rsp, 0x28
ret
xor edx, edx
mov ecx, 8
call sub.msvcrt.dll_signal
cmp rax, 1
je 0x402151
mov r8d, 1
test rax, rax
je 0x40205f
mov ecx, 8
call rax
xor r8d, r8d
jmp 0x40205f
xor edx, edx
mov ecx, 0xb
call sub.msvcrt.dll_signal
cmp rax, 1
je 0x402168
test rax, rax
je 0x40212f
mov ecx, 0xb
call rax
xor r8d, r8d
jmp 0x40205f
mov r8d, 1
jmp 0x40205f
mov r8d, 4
jmp 0x40205f
mov edx, 1
mov ecx, 4
call sub.msvcrt.dll_signal
xor r8d, r8d
jmp 0x40205f
mov edx, 1
mov ecx, 8
call sub.msvcrt.dll_signal
xor r8d, r8d
jmp 0x40205f
mov edx, 1
mov ecx, 0xb
call sub.msvcrt.dll_signal
xor r8d, r8d
jmp 0x40205f