Function at 0x180014140
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xf0
mov rax, qword [0x18006f730]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov eax, 0x53
mov word [rbp - 0x19], ax
movzx eax, word [0x1800542a4]
mov word [rbp - 0x18], ax
movzx eax, byte [0x1800542a6]
mov byte [rbp - 0x16], al
mov r8d, 1
lea rdx, [0x1800542a8]
lea rcx, [rbp - 0x19]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov eax, 0x47
mov word [rbp - 0x15], ax
lea r8d, [rax - 0x41]
lea rdx, str.etDns
lea rcx, [rbp - 0x14]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov dword [rbp - 0xf], 0x6d6f44
movzx eax, word [0x1800542b4]
mov word [rbp - 0xc], ax
mov ebx, 0x6e
mov word [rbp - 0xa], bx
lea r8d, [rbx - 0x6d]
lea rdx, [0x1800542b8]
lea rcx, [rbp - 0x19]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
lea rcx, [rbp - 0x19]
dec rcx
nop dword [rax]
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x180014200
movzx eax, word [0x18005257c]
mov word [rcx], ax
mov ecx, 0x6d
mov word [rbp - 7], cx
mov eax, dword [str.eFro]
mov dword [rbp - 6], eax
mov word [rbp - 2], cx
mov edi, 0x49
mov word [rbp - 1], di
lea r8d, [rcx - 0x6a]
lea rdx, [0x1800542c4]
lea rcx, [rbp]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov esi, 0x65
mov word [rbp + 2], si
mov r12d, 0x78
mov word [rbp + 3], r12w
lea r8d, [rdi + 0x1d]
lea rdx, [0x18005b420]
xor ecx, ecx
call fcn.180015370
mov r15b, 1
xor r14d, r14d
mov qword [rbp - 0x41], r14
mov qword [rbp - 0x39], 0xf
mov byte [rbp - 0x51], r14b
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x38], 0xa
lea edx, [rsi + 0x67]
lea rcx, [rbp - 0x51]
call fcn.18000b690
test al, al
jne 0x180014428
mov eax, 0x63
mov word [rbp + 7], ax
mov dword [rbp + 8], 0x74536262
mov edx, 0x61
mov word [rbp + 0xc], dx
mov r8d, 0x74
mov word [rbp + 0xd], r8w
mov word [rbp + 0xe], si
mov eax, 0x6142
mov word [rbp + 0xf], ax
mov dword [rbp + 0x11], 0x6f54646e
mov word [rbp + 0x15], di
mov word [rbp + 0x16], bx
mov dword [rbp + 0x17], 0x786564
mov eax, 0x2e
mov word [rbp + 0x1a], ax
mov word [rbp + 0x1b], si
mov dword [rbp + 0x1c], 0x736978
lea ecx, [rdi + 0x2a]
mov word [rbp + 0x1f], r8w
mov edi, 0x28
mov word [rbp + 0x20], di
mov eax, 0x29
mov word [rbp + 0x21], ax
mov eax, 0x4d
mov word [rbp - 0x31], ax
mov word [rbp - 0x30], dx
mov word [rbp - 0x2f], cx
mov word [rbp - 0x2e], cx
mov dword [rbp - 0x2d], 0x666f20
mov eax, 0x20
mov word [rbp - 0x2a], ax
mov dword [rbp - 0x29], 0x702061
mov word [rbp - 0x26], dx
mov eax, 0x72
mov word [rbp - 0x25], ax
mov word [rbp - 0x24], r8w
mov dword [rbp - 0x23], 0x6c6369
mov word [rbp - 0x20], si
movzx ebx, r15b
movzx r15d, bl
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetEnhMetaFileBits]
mov esi, eax
movzx ebx, bl
test eax, eax
cmove ebx, r14d
lea rax, [rbp + 7]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x100
xor r9d, r9d
xor edx, edx
lea rcx, [rdi - 0x29]
lea r8d, [r12 - 0x74]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rdi, rax
test bl, bl
je 0x1800143df
mov ecx, esi
call fcn.18003c3fc
mov rbx, rax
mov r8, rax
mov edx, esi
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetEnhMetaFileBits]
test eax, eax
je 0x1800143d7
mov rdx, rbx
mov ecx, esi
call qword [sym.imp.GDI32.dll_SetEnhMetaFileBits]
mov rcx, rbx
call fcn.18003c3f4
mov ebx, r15d
test rdi, rdi
cmove ebx, r14d
mov edx, 4
xor ecx, ecx
call sub.IMM32.dll_ImmGetProperty
test bl, bl
je 0x1800145f1
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x30]
mov r8d, 0x13
lea rdx, [rbp - 0x31]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800145f1
mov dword [rbp - 0x7d], 0x14
mov qword [rbp - 0x61], r14
mov qword [rbp - 0x59], 0xf
mov byte [rbp - 0x71], 0
mov edi, 0x28
mov dword [rbp - 0x79], edi
mov dword [rbp - 0x75], 0x32
movsd xmm0, qword [0x18005b4c8]
mulsd xmm0, qword [0x180055738]
addsd xmm0, qword [0x1800555e8]
cvttsd2si rax, xmm0
mov dword [rsp + 0x30], eax
lea rax, [0x18005b448]
mov qword [rsp + 0x20], rax
mov r9d, 0x10a
lea r8, [rbp - 0x71]
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x51]
call fcn.180031910
lea rax, [rbp - 0x19]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x100
xor r9d, r9d
xor edx, edx
lea rcx, [rdi - 0x29]
lea r8d, [rdi - 0x24]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rbx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
mov rsi, rax
lea r8, [rbp - 0x71]
xor edx, edx
lea ecx, [rdi + 0x77]
call fcn.180012390
test al, al
jne 0x18001452b
xor r8d, r8d
xor edx, edx
lea rcx, [rdi - 0x29]
call qword [sym.imp.dbghelp.dll_SymInitialize]
test eax, eax
je 0x1800145a3
mov dword [rsp + 0x30], r14d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 7], xmm0
movups xmmword [rbp + 0x17], xmm0
mov qword [rbp + 0x27], rax
mov dword [rbp + 7], edi
lea r9, [rbp + 7]
lea r8, [rsp + 0x30]
xor edx, edx
lea rcx, [rdi - 0x29]
call qword [sym.imp.dbghelp.dll_SymGetLineFromAddr64]
lea rcx, [rdi - 0x29]
call qword [sym.imp.dbghelp.dll_SymCleanup]
jmp 0x1800145a3
movzx edi, r15b
test rbx, rbx
cmove edi, r14d
test rsi, rsi
je 0x180014544
mov rcx, rsi
call qword [sym.imp.GDI32.dll_DeleteObject]
test dil, dil
je 0x180014596
mov qword [rsp + 0x20], 0x100
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf001f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
test rax, rax
je 0x18001458d
mov r8d, 9
lea r9, [rsp + 0x30]
xor edx, edx
mov rcx, rax
call qword [sym.imp.dbghelp.dll_ImageDirectoryEntryToData]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0xda
xor ecx, ecx
call fcn.1800332f0
nop
mov rdx, qword [rbp - 0x59]
cmp rdx, 0x10
jb 0x1800145e1
inc rdx
mov rcx, qword [rbp - 0x71]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800145dc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800145dc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003c3f4
mov qword [rbp - 0x61], r14
mov qword [rbp - 0x59], 0xf
mov byte [rbp - 0x71], 0
mov rdx, qword [rbp - 0x39]
cmp rdx, 0x10
jb 0x18001462f
inc rdx
mov rcx, qword [rbp - 0x51]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001462a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18001462a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003c3f4
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.18003c900
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret