Function at 0x14004a860
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x408]
sub rsp, 0x508
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov r15d, r8d
mov r13, rdx
mov r14, rcx
call fcn.1400491b0
lea rax, vtable.CSABString.0
mov qword [rsp + 0x70], rax
xor r12d, r12d
mov ebx, r12d
mov dword [rbp - 0x80], ebx
lea ecx, [r12 + 0x10]
call fcn.140247068
mov rdi, rax
mov qword [rsp + 0x78], rax
xor eax, eax
mov qword [rdi], rax
mov qword [rdi + 8], rax
mov dword [rbp - 0x7c], 1
mov esi, r12d
mov rcx, qword [r13 + 8]
call qword [sym.imp.SHLWAPI.dll_PathGetDriveNumberA]
cmp eax, 0xffffffff
jne 0x14004a973
lea rsi, [r14 + 0xc]
test rdi, rdi
je 0x14004a903
mov rcx, rdi
call fcn.140247060
mov qword [rsp + 0x78], r12
test rsi, rsi
je 0x14004a94f
mov rbx, 0xffffffffffffffff
nop
inc rbx
cmp byte [rsi + rbx], 0
jne 0x14004a910
mov dword [rbp - 0x80], ebx
lea eax, [rbx + 1]
mov r15d, eax
mov ecx, eax
call fcn.140247068
mov rdi, rax
mov qword [rsp + 0x78], rax
test rax, rax
je 0x14004a944
mov r8d, r15d
mov rdx, rsi
mov rcx, rax
call fcn.1402496a0
mov esi, ebx
mov r15d, dword [rbp + 0x460]
jmp 0x14004a973
mov ebx, r12d
mov dword [rbp - 0x80], ebx
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov rdi, rax
mov qword [rsp + 0x78], rax
xor eax, eax
mov qword [rdi], rax
mov qword [rdi + 8], rax
mov esi, r12d
mov ecx, dword [r13 + 0x10]
inc ecx
add ecx, esi
call fcn.140247068
mov r12, rax
test rdi, rdi
je 0x14004a9bd
mov qword [rbp - 0x58], rax
mov rcx, rdi
mov rdx, rax
sub rdx, rdi
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x14004a9a0
mov rcx, rdi
call fcn.140247060
mov qword [rsp + 0x78], r12
jmp 0x14004a9c6
mov qword [rbp - 0x58], rax
mov qword [rsp + 0x78], rax
test r12, r12
je 0x14004a9fd
mov r8d, dword [r13 + 0x10]
inc r8d
mov ecx, ebx
add rcx, r12
mov rdx, qword [r13 + 8]
call fcn.1402496a0
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [r12 + rax], 0
jne 0x14004a9f0
mov dword [rbp - 0x80], eax
xor edi, edi
mov dword [r14 + 0x18], edi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.14004c760
mov qword [rsp + 0x50], rax
lea r8, [rsp + 0x50]
mov rdx, r13
mov rcx, r14
call fcn.140049660
mov esi, edi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14004aa98
mov qword [rbp + 0x450], rdi
lea r9d, [rdi + 2]
lea r8, [rbp + 0x454]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rbp + 0x450], eax
mov rsi, qword [rbp + 0x450]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, vtable.CSABFileStreamInfo.0
mov qword [rbp - 0x20], rax
mov byte [rbp - 0x18], 0
mov qword [rbp + 0x3f8], rdi
lea rdx, [0x140286ae1]
lea rcx, [rbp - 0x18]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov qword [rbp + 0x3f8], rsi
mov rax, qword [rsp + 0x50]
mov rbx, qword [rax]
mov rsi, qword [rbx + 8]
lea r9, [rbp - 0x20]
mov r8, rsi
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.1400487d0
mov rdx, rax
movabs rax, 0x3d226357e16ecd
mov rcx, qword [rsp + 0x58]
sub rax, rcx
cmp rax, 1
jb 0x14004b012
inc rcx
mov qword [rsp + 0x58], rcx
mov qword [rbx + 8], rdx
mov qword [rsi], rdx
mov r8, rdi
mov rsi, qword [rsp + 0x50]
mov rcx, qword [rsi]
cmp rcx, rsi
je 0x14004ab4a
mov r9d, dword [r14 + 0x14]
nop dword [rax + rax]
xor edx, edx
mov rax, qword [rcx + 0x428]
div r9
inc r8
add r8, rax
mov rcx, qword [rcx]
cmp rcx, rsi
jne 0x14004ab30
mov rcx, qword [rbp + 0x470]
mov rax, qword [rcx]
imul r8d, r15d
xor edx, edx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov dword [rbp + 0x450], edi
mov rbx, qword [rsi]
mov qword [rbp - 0x60], rbx
cmp rbx, rsi
je 0x14004af62
nop dword [rax]
nop word [rax + rax]
lea rax, vtable.CSABString.0
mov qword [rbp - 0x78], rax
mov esi, edi
mov dword [rbp - 0x68], edi
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov r12, rax
mov qword [rbp - 0x70], rax
xor eax, eax
mov qword [r12], rax
mov qword [r12 + 8], rax
mov dword [rbp - 0x64], 1
mov rcx, qword [r13 + 8]
call qword [sym.imp.SHLWAPI.dll_PathGetDriveNumberA]
cmp eax, 0xffffffff
jne 0x14004ac25
lea r15, [r14 + 0xc]
test r15, r15
je 0x14004ac00
mov rax, 0xffffffffffffffff
inc rax
cmp byte [r15 + rax], 0
jne 0x14004abd2
inc eax
mov r13d, eax
mov ecx, eax
call fcn.140247068
mov rdi, rax
test rax, rax
je 0x14004ac23
mov r8d, r13d
mov rdx, r15
mov rcx, rax
call fcn.1402496a0
jmp 0x14004ac16
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov rdi, rax
xor eax, eax
mov qword [rdi], rax
mov qword [rdi + 8], rax
test rdi, rdi
je 0x14004ac23
mov rcx, rdi
call fcn.140247060
xor edi, edi
mov r13, qword [rbp + 0x458]
mov ecx, dword [r13 + 0x10]
inc ecx
call fcn.140247068
mov r15, rax
test r12, r12
je 0x14004ac6c
mov rcx, r12
mov rdx, rax
sub rdx, r12
nop dword [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x14004ac50
mov rcx, r12
call fcn.140247060
mov qword [rbp - 0x70], r15
jmp 0x14004ac70
mov qword [rbp - 0x70], rax
test r15, r15
je 0x14004ac9d
mov r8d, dword [r13 + 0x10]
inc r8d
mov rdx, qword [r13 + 8]
mov rcx, r15
call fcn.1402496a0
mov rsi, 0xffffffffffffffff
nop
inc rsi
cmp byte [r15 + rsi], 0
jne 0x14004ac90
mov dword [rbp - 0x68], esi
lea r12, [rbx + 0x18]
lea rax, vtable.CSABString.0
mov qword [rbp - 0x48], rax
test r12, r12
je 0x14004acfc
mov rdi, 0xffffffffffffffff
nop dword [rax + rax]
inc rdi
cmp byte [r12 + rdi], 0
jne 0x14004acc0
mov dword [rbp - 0x38], edi
lea eax, [rdi + 1]
mov qword [rsp + 0x48], rax
mov ecx, eax
call fcn.140247068
mov r13, rax
mov qword [rbp - 0x40], rax
test rax, rax
je 0x14004acf8
mov r8, qword [rsp + 0x48]
mov rdx, r12
mov rcx, rax
call fcn.1402496a0
mov eax, edi
jmp 0x14004ad1a
mov dword [rbp - 0x38], edi
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov r13, rax
mov qword [rbp - 0x40], rax
xor eax, eax
mov qword [r13], rax
mov qword [r13 + 8], rax
xor r12d, r12d
mov dword [rbp - 0x34], 1
lea ecx, [rax + 1]
add ecx, esi
call fcn.140247068
mov qword [rsp + 0x68], rax
test r15, r15
je 0x14004ad62
mov rcx, r15
mov rdx, rax
sub rdx, r15
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x14004ad41
mov rcx, r15
call fcn.140247060
mov r15, qword [rsp + 0x68]
mov qword [rbp - 0x70], r15
jmp 0x14004ad69
mov r15, rax
mov qword [rbp - 0x70], rax
test r15, r15
je 0x14004ad93
lea r8d, [rdi + 1]
mov ecx, esi
add rcx, r15
mov rdx, r13
call fcn.1402496a0
mov rax, 0xffffffffffffffff
inc rax
cmp byte [r15 + rax], 0
jne 0x14004ad86
mov dword [rbp - 0x68], eax
test r13, r13
je 0x14004ada0
mov rcx, r13
call fcn.140247060
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x14004afe6
mov qword [rsp + 0x48], r12
mov r9d, 2
lea r8, [rsp + 0x4c]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x48], eax
mov rdi, qword [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [r14 + 0x14]
xor edx, edx
mov rax, rdi
div rcx
lea esi, [rax + 1]
call fcn.140250fe4
mov r13, rax
test rax, rax
je 0x14004afe6
xor edi, edi
mov r12d, edi
mov dword [rsp + 0x40], edi
cmp dword [rbp + 0x460], edi
jbe 0x14004aeea
mov ebx, dword [rbp + 0x450]
nop word [rax + rax]
mov rcx, qword [rbp + 0x468]
mov rax, qword [rcx]
mov r9d, dword [r14 + 0x14]
mov r8, r13
mov edx, r12d
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
test esi, esi
je 0x14004aecc
xor r12d, r12d
nop
cmp dword [r14 + 0x18], r12d
jne 0x14004aec1
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x50]
mov r8d, dword [r14 + 0x14]
mov rdx, r13
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
inc ebx
mov rcx, qword [rbp + 0x470]
mov rax, qword [rcx]
mov r8d, esi
imul r8d, dword [rbp + 0x460]
mov edx, ebx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
inc edi
cmp edi, esi
jb 0x14004ae80
mov dword [rbp + 0x450], ebx
mov r12d, dword [rsp + 0x40]
inc r12d
mov dword [rsp + 0x40], r12d
cmp r12d, dword [rbp + 0x460]
mov edi, 0
jb 0x14004ae50
mov rbx, qword [rbp - 0x60]
mov rcx, r13
call fcn.14024c3e8
mov qword [rsp + 0x60], 1
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x60]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetFileTime]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x14004af49
mov rcx, rax
call fcn.140247060
mov rbx, qword [rbx]
mov qword [rbp - 0x60], rbx
cmp rbx, qword [rsp + 0x50]
mov r13, qword [rbp + 0x458]
jne 0x14004ab80
mov r12d, 1
lea rax, vtable.CSABFileStreamInfo.0
mov qword [rbp - 0x20], rax
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsi]
mov qword [rsi], rsi
mov qword [rsi + 8], rsi
cmp rdi, rsi
je 0x14004afb3
nop word [rax + rax]
mov rbx, qword [rdi]
lea rcx, [rdi + 0x10]
mov rax, qword [rcx]
xor edx, edx
call qword [rax]
mov edx, 0x430
mov rcx, rdi
call fcn.140247060
mov rdi, rbx
cmp rbx, rsi
jne 0x14004af90
mov edx, 0x430
mov rcx, rsi
call fcn.140247060
nop
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x14004afcf
call fcn.140247060
mov eax, r12d
add rsp, 0x508
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rax, qword [rbp - 0x68]
shr rax, 0x20
cmp eax, 1
jne 0x14004af68
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x14004af68
mov rcx, rax
call fcn.140247060
jmp 0x14004af68
lea rcx, str.list_T__too_long
call fcn.1402453d0
int3