Function at 0x140022820
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x850]
sub rsp, 0x950
mov rax, qword [0x14003c008]
xor rax, rsp
mov qword [rbp + 0x840], rax
mov r13, rdx
mov r15, rcx
mov dil, 1
mov r12d, 0xa
xor r14d, r14d
inc r12w
cmp r12w, 0x64
jbe 0x140022871
movzx r12d, r14w
xor ecx, ecx
lea rdx, [0x140033178]
movzx r8d, r12w
call qword [0x140041ab0]
test ax, ax
jne 0x140022c7d
movzx edx, dil
lea r9, [rsp + 0x30]
lea r8, [rbp + 0x40]
mov rcx, r15
mov esi, r14d
lea rbx, [rbp + 0x440]
call qword [sym.imp.wtli.dll_wsupIterate]
mov ecx, CMFCRibbonInfo::XImage::XImage
cmp ax, cx
je 0x140022c79
movzx ecx, byte [rsp + 0x30]
sub ecx, 1
je 0x140022aaf
sub ecx, 1
je 0x14002292e
test dil, dil
jne 0x1400228e6
mov byte [rbp + 0x440], 0xcc
lea rbx, [rbp + 0x441]
mov esi, 1
movzx eax, word [rbp + 0x40]
lea rcx, [rbp + 0x40]
movzx edx, r14w
test ax, ax
je 0x14002291f
nop word [rax + rax]
mov byte [rbx], 0xf0
lea rcx, [rcx + 2]
mov word [rbx + 1], ax
add dx, 4
movzx eax, word [rcx]
mov byte [rbx + 3], 0xf0
add rbx, 4
test ax, ax
jne 0x140022900
movzx eax, dx
add esi, eax
mov word [rbx], 0
jmp 0x140022c10
movzx ecx, word [rbp + 0x40]
lea rax, [rbp + 0x441]
mov byte [rbp + 0x440], 0xcc
lea rdx, [rbp + 0x40]
movzx r8d, r14w
test cx, cx
je 0x140022970
nop dword [rax]
mov byte [rax], 0xf0
lea rdx, [rdx + 2]
mov word [rax + 1], cx
add r8w, 4
movzx ecx, word [rdx]
mov byte [rax + 3], 0xf0
add rax, 4
test cx, cx
jne 0x140022950
mov word [rax], 0
lea rdi, [rbp + 0x441]
movzx eax, r8w
mov bl, 1
lea esi, [rax + 1]
add rdi, rax
nop dword [rax + rax]
movzx r8d, bl
lea rdx, [rsp + 0x40]
mov rcx, r15
call qword [sym.imp.wtli.dll_wsupGetAlternate]
movzx ecx, word [rsp + 0x40]
mov r14d, eax
mov eax, 0x3fe
cmp cx, ax
jb 0x1400229b6
mov ecx, eax
movzx ebx, cx
lea rdx, [rsp + 0x42]
mov r8d, ebx
lea rcx, [rbp + 0x40]
call qword [sym.imp.VCRUNTIME140.dll_memmove]
xor eax, eax
mov word [rbp + rbx + 0x40], ax
mov eax, CMFCRibbonInfo::XImage::XImage
cmp r14d, eax
je 0x140022c0d
movzx ecx, word [rbp + 0x40]
lea rdx, [rbp + 0x40]
mov word [rdi], 0x5ccc
xor r14d, r14d
mov byte [rdi + 2], 0x7c
xor bl, bl
add rdi, 3
add esi, 3
mov rax, rdi
movzx r8d, r14w
test cx, cx
je 0x140022a30
nop dword [rax]
mov byte [rax], 0xf0
lea rdx, [rdx + 2]
mov word [rax + 1], cx
add r8w, 4
movzx ecx, word [rdx]
mov byte [rax + 3], 0xf0
add rax, 4
test cx, cx
jne 0x140022a10
mov word [rax], r14w
lea rdx, [rbp + 0x40]
movzx eax, r8w
mov rcx, r15
add esi, eax
add rdi, rax
call qword [sym.imp.wtli.dll_wsupGetComment]
test eax, eax
jne 0x140022990
movzx ecx, word [rbp + 0x40]
lea rdx, [rbp + 0x40]
mov word [rdi], 0x5ccc
add esi, 3
mov byte [rdi + 2], 0x23
movzx r8d, r14w
add rdi, 3
mov rax, rdi
test cx, cx
je 0x140022aa0
nop word [rax + rax]
mov byte [rax], 0xf0
lea rdx, [rdx + 2]
mov word [rax + 1], cx
add r8w, 4
movzx ecx, word [rdx]
mov byte [rax + 3], 0xf0
add rax, 4
test cx, cx
jne 0x140022a80
mov word [rax], r14w
movzx eax, r8w
add esi, eax
jmp 0x140022985
movzx ecx, word [rbp + 0x40]
lea rax, [rbp + 0x441]
mov byte [rbp + 0x440], 0xcc
lea rdx, [rbp + 0x40]
movzx r8d, r14w
test cx, cx
je 0x140022af0
nop
mov byte [rax], 0xf0
lea rdx, [rdx + 2]
mov word [rax + 1], cx
add r8w, 4
movzx ecx, word [rdx]
mov byte [rax + 3], 0xf0
add rax, 4
test cx, cx
jne 0x140022ad0
movzx ecx, r8w
lea rdi, [rbp + 0x441]
add rdi, rcx
mov word [rax], 0
mov eax, ecx
lea rdx, [rsp + 0x40]
mov r8d, 1
lea esi, [rcx + 4]
mov rcx, r15
mov word [rdi], 0x5ccc
mov byte [rdi + 2], 0x3d
add rdi, 3
call qword [sym.imp.wtli.dll_wsupGetAlternate]
movzx eax, word [rsp + 0x40]
mov ecx, 0x3fe
cmp ax, cx
jb 0x140022b3a
mov eax, ecx
movzx ebx, ax
lea rdx, [rsp + 0x42]
mov r8d, ebx
lea rcx, [rbp + 0x40]
call qword [sym.imp.VCRUNTIME140.dll_memmove]
xor eax, eax
lea rcx, [rbp + 0x40]
mov word [rbp + rbx + 0x40], ax
movzx r8d, r14w
movzx edx, word [rbp + 0x40]
mov rax, rdi
test dx, dx
je 0x140022b90
nop word [rax + rax]
mov byte [rax], 0xf0
lea rcx, [rcx + 2]
mov word [rax + 1], dx
add r8w, 4
movzx edx, word [rcx]
mov byte [rax + 3], 0xf0
add rax, 4
test dx, dx
jne 0x140022b70
mov word [rax], 0
lea rdx, [rbp + 0x40]
movzx eax, r8w
mov rcx, r15
add esi, eax
add rdi, rax
call qword [sym.imp.wtli.dll_wsupGetComment]
test eax, eax
jne 0x140022c10
movzx ecx, word [rbp + 0x40]
lea rdx, [rbp + 0x40]
mov word [rdi], 0x5ccc
add esi, 3
add rdi, 2
movzx r8d, r14w
mov byte [rdi], 0x23
lea rax, [rdi + 1]
test cx, cx
je 0x140022c00
nop dword [rax]
nop word [rax + rax]
mov byte [rax], 0xf0
lea rdx, [rdx + 2]
mov word [rax + 1], cx
add r8w, 4
movzx ecx, word [rdx]
mov byte [rax + 3], 0xf0
add rax, 4
test cx, cx
jne 0x140022be0
mov word [rax], 0
movzx eax, r8w
add esi, eax
jmp 0x140022c10
xor r14d, r14d
mov rcx, qword [r13]
lea r9, [rsp + 0x34]
mov r8d, esi
mov qword [rsp + 0x20], r14
lea rdx, [rbp + 0x440]
xor dil, dil
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140022862
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x140022c62
mov eax, eax
lea rcx, [0x140030680]
mov byte [0x1400433b0], dil
mov ecx, dword [rcx + rax*4]
mov dword [0x140042de8], ecx
jmp 0x140022862
mov ecx, operator
mov byte [0x1400433b0], 0
mov dword [0x140042de8], ecx
jmp 0x140022862
xor eax, eax
jmp 0x140022c82
mov eax, 6
mov rcx, qword [rbp + 0x840]
xor rcx, rsp
call fcn.14002c160
mov rbx, qword [rsp + 0x9a0]
add rsp, 0x950
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret