Function at 0x405e0d
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov ecx, 1
mov rax, qword [fcn.00407e90]
call rax
mov r8, qword [rbp + 0x10]
lea rdx, str.usage:__s___write_C:WindowsTempdoc.docx____valid_____write_dll_C:WindowsTemp_ssp.dll_____load_dll_C:WindowsTemp_ssp.dll_____help_
mov rcx, rax
call sub.msvcrt.dll_fprintf
mov ecx, 1
mov rax, qword [fcn.00407e90]
call rax
mov rdx, rax
mov ecx, 0xa
call sub.msvcrt.dll_fputc
mov ecx, 1
mov rax, qword [fcn.00407e90]
call rax
mov r9, rax
mov r8d, 0x11
mov edx, 1
lea rcx, str.Dumpfile_options:
call sub.msvcrt.dll_fwrite
mov ecx, 1
mov rax, qword [fcn.00407e90]
call rax
mov rdx, rax
mov ecx, 0xa
call sub.msvcrt.dll_fputc
mov ecx, 1
mov rax, qword [fcn.00407e90]
call rax
mov r9, rax
mov r8d, 0x23
mov edx, 1
lea rcx, str.______write_DUMP_PATH___w_DUMP_PATH
call sub.msvcrt.dll_fwrite
mov ecx, 1
mov rax, qword [fcn.00407e90]
call rax
mov rdx, rax
mov ecx, 0xa
call sub.msvcrt.dll_fputc
mov ecx, 1
mov rax, qword [fcn.00407e90]
call rax
mov r9, rax
mov r8d, 0x20
mov edx, 1
lea rcx, str.____________filename_of_the_dump
call sub.msvcrt.dll_fwrite
mov ecx, 1
mov rax, qword [fcn.00407e90]
call rax
mov rdx, rax
mov ecx, 0xa
call sub.msvcrt.dll_fputc
mov ecx, 1
mov rax, qword [fcn.00407e90]
call rax
mov r9, rax
mov r8d, 0xf
mov edx, 1
lea rcx, str.______valid___v
call sub.msvcrt.dll_fwrite
mov ecx, 1
mov rax, qword [fcn.00407e90]
call rax
mov rdx, rax
mov ecx, 0xa
call sub.msvcrt.dll_fputc
mov ecx, 1
mov rax, qword [fcn.00407e90]
call rax
mov r9, rax
mov r8d, 0x30
mov edx, 1
lea rcx, str.____________create_a_dump_with_a_valid_signature
call sub.msvcrt.dll_fwrite
mov ecx, 1
mov rax, qword [fcn.00407e90]
call rax
mov rdx, rax
mov ecx, 0xa
call sub.msvcrt.dll_fputc
mov ecx, 1
mov rax, qword [fcn.00407e90]
call rax
mov r9, rax
mov r8d, 0x10
mov edx, 1
lea rcx, str.SSP_DLL_options:
call sub.msvcrt.dll_fwrite
mov ecx, 1
mov rax, qword [fcn.00407e90]
call rax
mov rdx, rax
mov ecx, 0xa
call sub.msvcrt.dll_fputc
mov ecx, 1
mov rax, qword [fcn.00407e90]
call rax
mov r9, rax
mov r8d, 0x16
mov edx, 1
lea rcx, str.______write_dll___wdll
call sub.msvcrt.dll_fwrite
mov ecx, 1
mov rax, qword [fcn.00407e90]
call rax
mov rdx, rax
mov ecx, 0xa
call sub.msvcrt.dll_fputc
mov ecx, 1
mov rax, qword [fcn.00407e90]
call rax
mov r9, rax
mov r8d, 0x5d
mov edx, 1
lea rcx, str.____________path_where_to_write_the_SSP_DLL_from_nanodump__randomly_generated_if_not_defined_
call sub.msvcrt.dll_fwrite
mov ecx, 1
mov rax, qword [fcn.00407e90]
call rax
mov rdx, rax
mov ecx, 0xa
call sub.msvcrt.dll_fputc
mov ecx, 1
mov rax, qword [fcn.00407e90]
call rax
mov r9, rax
mov r8d, 0x15
mov edx, 1
lea rcx, str.______load_dll___ldll
call sub.msvcrt.dll_fwrite
mov ecx, 1
mov rax, qword [fcn.00407e90]
call rax
mov rdx, rax
mov ecx, 0xa
call sub.msvcrt.dll_fputc
mov ecx, 1
mov rax, qword [fcn.00407e90]
call rax
mov r9, rax
mov r8d, 0x24
mov edx, 1
lea rcx, str.____________load_an_existing_SSP_DLL
call sub.msvcrt.dll_fwrite
mov ecx, 1
mov rax, qword [fcn.00407e90]
call rax
mov rdx, rax
mov ecx, 0xa
call sub.msvcrt.dll_fputc
mov ecx, 1
mov rax, qword [fcn.00407e90]
call rax
mov r9, rax
mov r8d, 5
mov edx, 1
lea rcx, str.Help:
call sub.msvcrt.dll_fwrite
mov ecx, 1
mov rax, qword [fcn.00407e90]
call rax
mov rdx, rax
mov ecx, 0xa
call sub.msvcrt.dll_fputc
mov ecx, 1
mov rax, qword [fcn.00407e90]
call rax
mov r9, rax
mov r8d, 0xe
mov edx, 1
lea rcx, str.______help___h
call sub.msvcrt.dll_fwrite
mov ecx, 1
mov rax, qword [fcn.00407e90]
call rax
mov rdx, rax
mov ecx, 0xa
call sub.msvcrt.dll_fputc
mov ecx, 1
mov rax, qword [fcn.00407e90]
call rax
mov r9, rax
mov r8d, 0x2d
mov edx, 1
lea rcx, str.____________print_this_help_message_and_leave
call sub.msvcrt.dll_fwrite
mov ecx, 1
mov rax, qword [fcn.00407e90]
call rax
mov rdx, rax
mov ecx, 0xa
call sub.msvcrt.dll_fputc
nop
add rsp, 0x20
pop rbp
ret