Function at 0x14000acd0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x688
movaps xmmword [rsp + 0x670], xmm7
movaps xmmword [rsp + 0x660], xmm6
mov r15, rcx
mov rax, qword [0x1402c9798]
xor rax, rsp
mov qword [rsp + 0x658], rax
movabs r12, 0x7fffffffffffffef
lea r14, [rcx + 0x18]
lea rdi, [rsp + 0x48]
mov rcx, r14
mov rdx, rdi
call fcn.14000dad0
cmp byte [rdi + 0x17], 0
jns 0x14000ad31
mov rdi, qword [rsp + 0x48]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov rcx, rdi
call fcn.140014954
cmp rax, r12
ja 0x14000b61b
mov rbx, rax
cmp rax, 0xb
jae 0x14000ad7f
mov byte [rsp + 0x77], bl
lea rbp, [rsp + 0x60]
test rbx, rbx
je 0x14000adbb
cmp rbx, 3
jne 0x14000adaa
movzx eax, word [rdi + 4]
mov word [rbp + 4], ax
mov eax, dword [rdi]
mov dword [rbp], eax
jmp 0x14000adbb
lea rsi, [rbx + 8]
and rsi, 0xfffffffffffffff8
lea rcx, [rsi + rsi]
call fcn.140014820
mov rbp, rax
mov qword [rsp + 0x60], rax
lea rax, [r12 + 0x11]
or rax, rsi
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x68], rbx
mov r8, rbx
add r8, rbx
mov rcx, rbp
mov rdx, rdi
call fcn.1401c1840
mov word [rbp + rbx*2], 0
call fcn.14001fccc
test rax, rax
je 0x14000b611
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rsi, rax
lea rdi, [rsp + 0x450]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.1401c1ca0
mov rcx, rdi
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
lea rdi, [rsp + 0x240]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.1401c1ca0
xor ecx, ecx
mov rdx, rdi
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x220], xmm0
mov qword [rsp + 0x230], 0
mov rcx, rdi
call fcn.140014954
cmp rax, r12
ja 0x14000b625
mov rdi, rax
cmp rax, 0xb
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], rsi
jae 0x14000ae9c
mov byte [rsp + 0x237], dil
lea r14, [rsp + 0x220]
cmp rdi, 3
jne 0x14000b600
movzx eax, word [rsp + 0x244]
mov word [r14 + 4], ax
mov eax, dword [rsp + 0x240]
mov dword [r14], eax
mov rbx, r14
jmp 0x14000aee0
lea rsi, [rdi + 8]
and rsi, 0xfffffffffffffff8
lea rcx, [rsi + rsi]
call fcn.140014820
mov rbx, rax
lea r14, [rsp + 0x220]
mov qword [r14], rax
add r12, 0x11
or r12, rsi
mov qword [r14 + 0x10], r12
mov qword [r14 + 8], rdi
mov r8, rdi
add r8, rdi
lea rdx, [rsp + 0x240]
mov rcx, rbx
call fcn.1401c1840
mov word [rbx + rdi*2], 0
lea rbp, [rsp + 0x220]
mov rcx, rbp
mov dx, 0x5c
mov r8, 0xffffffffffffffff
call fcn.1400147d0
lea r8, [rax + 1]
lea rax, [rsp + 0x238]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0xb0]
mov rdx, rbp
mov r9, 0xffffffffffffffff
call fcn.1400117f0
cmp byte [r14 + 0x17], 0
js 0x14000af37
mov byte [r14 + 0x17], 0
jmp 0x14000af5b
mov rax, qword [rsp + 0x220]
mov word [rax], 0
mov qword [rsp + 0x228], 0
cmp byte [r14 + 0x17], 0
js 0x14000b225
lea rbx, [rsp + 0xb0]
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x230], rax
movups xmm0, xmmword [rbx]
movaps xmmword [rsp + 0x220], xmm0
movabs rdi, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x210], rdi
movaps xmm6, xmmword [section..rdata]
movaps xmmword [rsp + 0x200], xmm6
mov ecx, 0x40
call fcn.140014820
lea r12, [rsp + 0x1e0]
mov qword [r12], rax
movaps xmm0, xmmword [reloc.OLEAUT32.dll_SafeArrayGetElement]
movups xmmword [r12 + 8], xmm0
movups xmm0, xmmword [str.TempComodo_LogsFolder_]
movups xmmword [rax], xmm0
movups xmm0, xmmword [0x140210922]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [0x140210932]
movups xmmword [rax + 0x20], xmm0
mov word [rax + 0x30], 0
xor esi, esi
lea r8, [rsp + 0x450]
mov rcx, r12
xor edx, edx
call fcn.140006610
mov rdx, qword [rax + 0x10]
lea rcx, [rsp + 0x80]
mov qword [rcx + 0x10], rdx
movups xmm0, xmmword [rax]
movaps xmmword [rcx], xmm0
xorps xmm7, xmm7
movups xmmword [rax], xmm7
mov qword [rax + 0x10], rsi
movzx r8d, byte [r14 + 0x17]
test r8b, r8b
cmovs r8, qword [rsp + 0x228]
cmovs rbp, qword [rsp + 0x220]
mov rdx, rbp
call fcn.1400136c0
movups xmm0, xmmword [rax]
movaps xmmword [rbx], xmm0
mov rcx, qword [rax + 0x10]
mov qword [rbx + 0x10], rcx
mov qword [rax + 0x10], rsi
movups xmmword [rax], xmm7
lea rdx, str..log
mov rcx, rbx
call fcn.140001a30
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x210], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x200], xmm0
movups xmmword [rax], xmm7
mov qword [rax + 0x10], rsi
cmp byte [rbx + 0x17], 0
jns 0x14000b08f
mov rcx, qword [rsp + 0xb0]
call fcn.140014884
cmp byte [rsp + 0x97], 0
jns 0x14000b0a6
mov rcx, qword [rsp + 0x80]
call fcn.140014884
cmp byte [rsp + 0x1f7], 0
jns 0x14000b0bd
mov rcx, qword [rsp + 0x1e0]
call fcn.140014884
cmp byte [rsp + 0x217], 0
jns 0x14000b0d1
mov rcx, qword [rsp + 0x200]
jmp 0x14000b0d9
lea rcx, [rsp + 0x200]
lea rbp, [r15 + 0x118]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
mov edx, 0x40000000
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x14000b237
cmp byte [rsp + 0x217], 0
jns 0x14000b12e
mov rcx, qword [rsp + 0x200]
call fcn.140014884
cmp byte [r14 + 0x17], 0
mov rdi, qword [rsp + 0x38]
jns 0x14000b147
mov rcx, qword [rsp + 0x220]
call fcn.140014884
mov eax, 0xffffffff
lock xadd dword [rdi + 0x10], eax
dec eax
test eax, eax
mov rsi, qword [rsp + 0x40]
jg 0x14000b168
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp byte [rsp + 0x77], 0
jns 0x14000b179
mov rcx, qword [rsp + 0x60]
call fcn.140014884
cmp byte [rsp + 0x5f], 0
jns 0x14000b18a
mov rcx, qword [rsp + 0x48]
call fcn.140014884
cmp byte [rbp + 0x17], 0
jns 0x14000b199
mov rcx, qword [rbp]
call fcn.140014884
lea rdi, [r15 + 0x80]
mov rax, qword [r15]
movsxd rax, dword [rax + 4]
lea rcx, [0x140210888]
mov qword [r15 + rax], rcx
lea rax, [0x1402108a0]
mov qword [r15 + 0x18], rax
cmp byte [r15 + 0x6f], 0
jns 0x14000b1cd
mov rcx, qword [r15 + 0x58]
call fcn.140014884
mov rcx, rsi
call fcn.1401eb9d0
mov rcx, rsi
call fcn.1401eb850
add r15, 0x10
mov rcx, r15
call fcn.1401eb850
mov rcx, rdi
call fcn.1401eb860
mov rcx, qword [rsp + 0x658]
xor rcx, rsp
call fcn.14003e9d0
movaps xmm6, xmmword [rsp + 0x660]
movaps xmm7, xmmword [rsp + 0x670]
add rsp, 0x688
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x220]
call fcn.140014884
jmp 0x14000af30
mov r13, rax
lea rcx, [rsp + 0x1d0]
movaps xmmword [rcx], xmm6
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea rsi, [rsp + 0xc8]
mov r8d, 0x100
mov rcx, rsi
mov dl, 0xaa
call fcn.1401c1ca0
lea rax, [0x140210874]
mov qword [rsi - 0x18], rax
mov rdx, rsi
lea rcx, [rsp + 0xc0]
lea rax, [0x14021087c]
mov qword [rcx], rax
lea rsi, [rsp + 0x130]
lea rax, vtable.std::__1::basic_istream_wchar_t__struct_std::__1::char_traits_wchar_t__.0
mov qword [rsi], rax
xor eax, eax
mov qword [rsi - 0x78], rax
mov rcx, rsi
call fcn.140013180
xor eax, eax
mov qword [rsi + 0x88], rax
mov word [rsi + 0x90], 0xffff
mov rax, qword [rsi - 0x70]
movsxd rax, dword [rax + 4]
lea rcx, vtable.std::__1::basic_ostream_wchar_t__struct_std::__1::char_traits_wchar_t__.0
mov qword [rsp + rax + 0xc0], rcx
mov rax, qword [rsi - 0x80]
movsxd rax, dword [rax + 4]
lea rcx, [0x140210890]
mov qword [rsp + rax + 0xb0], rcx
mov rax, qword [rsi - 0x80]
movsxd rax, dword [rax + 4]
lea rcx, [0x140210888]
mov qword [rsp + rax + 0xb0], rcx
lea rcx, [rsp + 0xc8]
call fcn.140005560
lea rax, [0x1402108a0]
mov qword [rsi - 0x68], rax
xorps xmm7, xmm7
movups xmmword [rsi - 0x28], xmm7
movups xmmword [rsi - 0x18], xmm7
mov dword [rsi - 8], 0x18
mov rax, qword [rsi - 0x80]
movsxd rax, dword [rax + 4]
mov word [rsp + rax + 0x140], 0x30
lea rdx, str.___:
lea rcx, [rsp + 0xc0]
call fcn.14000d8b0
lea rsi, [rsp + 0x1d0]
movzx edx, word [rsi]
mov rcx, rax
call fcn.140010330
lea rdx, [0x140210946]
mov rcx, rax
call fcn.14000d8b0
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
mov edx, 2
mov qword [rax + rcx + 0x18], rdx
movzx edx, word [rsi + 2]
mov rcx, rax
call fcn.140010330
mov rcx, rax
lea rdx, [0x140210946]
call fcn.14000d8b0
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
mov edx, 2
mov qword [rax + rcx + 0x18], rdx
movzx edx, word [rsi + 6]
mov rcx, rax
call fcn.140010330
lea rdx, [0x140210948]
mov rcx, rax
call fcn.14000d8b0
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
mov edx, 2
mov qword [rax + rcx + 0x18], rdx
movzx edx, word [rsi + 8]
mov rcx, rax
call fcn.140010330
lea rdx, [0x14021094a]
mov rcx, rax
call fcn.14000d8b0
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
mov edx, 2
mov qword [rax + rcx + 0x18], rdx
movzx edx, word [rsi + 0xa]
mov rcx, rax
call fcn.140010330
mov rcx, rax
lea rdx, [0x14021094a]
call fcn.14000d8b0
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
mov edx, 2
mov qword [rax + rcx + 0x18], rdx
movzx edx, word [rsi + 0xc]
mov rcx, rax
call fcn.140010330
lea rsi, [0x14021094c]
mov rcx, rax
mov rdx, rsi
call fcn.14000d8b0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rcx, [rsp + 0x130]
mov rcx, qword [rcx - 0x70]
movsxd rcx, dword [rcx + 4]
mov qword [rsp + rcx + 0xd8], 4
lea rcx, [rsp + 0xc0]
mov edx, eax
call fcn.140010580
mov rcx, rax
mov rdx, rsi
call fcn.14000d8b0
movzx r8d, byte [r15 + 0x12f]
mov rdx, rbp
test r8b, r8b
jns 0x14000b4a5
mov r8, qword [r15 + 0x120]
mov rdx, qword [r15 + 0x118]
mov rcx, rax
call fcn.1401ebbd0
lea rdx, [0x140210950]
mov rcx, rax
call fcn.14000d8b0
lea rdx, [rsp + 0x60]
movzx r8d, byte [rdx + 0x17]
test r8b, r8b
cmovs r8, qword [rdx + 8]
cmovs rdx, qword [rdx]
mov rcx, rax
call fcn.1401ebbd0
lea rdx, [0x140210953]
mov rcx, rax
call fcn.14000d8b0
mov qword [rsp + 0x1f0], rdi
movaps xmmword [rsp + 0x1e0], xmm6
lea rcx, [rsp + 0xc8]
mov rdx, r12
call fcn.14000dad0
mov dword [rsp + 0xac], 0
movaps xmmword [rsp + 0x90], xmm7
movaps xmmword [rsp + 0x80], xmm7
mov qword [rsp + 0x90], 0xffffffffffffffff
movzx r8d, byte [rsp + 0x1f7]
test r8b, r8b
jns 0x14000b54e
mov r8d, dword [rsp + 0x1e8]
mov r12, qword [rsp + 0x1e0]
add r8d, r8d
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xac]
mov rcx, r13
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [rsp + 0x1f7], 0
jns 0x14000b592
mov rcx, qword [rsp + 0x1e0]
call fcn.140014884
lea r12, [rsp + 0x130]
mov rax, qword [r12 - 0x80]
movsxd rax, dword [rax + 4]
lea rcx, [0x140210888]
mov qword [rsp + rax + 0xb0], rcx
lea rdi, [rsp + 0xc8]
lea rax, [0x1402108a0]
mov qword [rdi], rax
cmp byte [rdi + 0x57], 0
jns 0x14000b5d7
mov rcx, qword [rsp + 0x108]
call fcn.140014884
mov rcx, rdi
call fcn.1401eb9d0
mov rcx, rdi
call fcn.1401eb850
add rbx, 0x10
mov rcx, rbx
call fcn.1401eb850
mov rcx, r12
call fcn.1401eb860
jmp 0x14000b117
test rdi, rdi
je 0x14000ae97
mov rbx, r14
jmp 0x14000aeca
mov ecx, 0x80004005
call fcn.14000dcd0
lea rcx, [rsp + 0x60]
call fcn.1401eb7f0
lea rcx, [rsp + 0x220]
call fcn.1401eb7f0
int3