Function at 0x459d04
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x368]
sub rsp, 0x440
mov r14, rdx
mov rbx, rcx
mov r13d, 0x400
lea rcx, [rsp + 0x40]
mov r8d, r13d
xor edx, edx
call fcn.00424830
lea rdi, [r14 + 0x1c]
or r12, 0xffffffffffffffff
xor r15d, r15d
cmp word [rdi], r15w
jne 0x459d77
test rdi, rdi
je 0x459d77
mov r9, r12
lea r8, [0x0049049c]
mov edx, 0x200
mov rcx, rdi
call fcn.00435528
mov r8, rdi
jmp 0x459d7f
mov r8, rdi
test rdi, rdi
je 0x459dc9
mov qword [rsp + 0x38], r15
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], r15
mov r9d, r12d
mov dword [rsp + 0x28], r13d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jg 0x459dc9
jne 0x459dc2
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x459dc2
mov byte [rbp + 0x33f], r15b
mov rcx, rdi
jmp 0x459dd1
mov byte [rsp + 0x40], r15b
jmp 0x459dbd
mov rcx, rdi
test rdi, rdi
je 0x459de0
mov rax, r12
inc rax
cmp word [rcx + rax*2], r15w
jne 0x459dd4
jmp 0x459de3
mov eax, r15d
mov qword [rsp + 0x38], r15
mov r9d, eax
mov qword [rsp + 0x30], r15
mov r8, rdi
mov dword [rsp + 0x28], r15d
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rsi, eax
test rdi, rdi
je 0x459e21
mov rcx, r12
inc rcx
cmp word [rdi + rcx*2], r15w
jne 0x459e15
jmp 0x459e24
mov ecx, r15d
mov qword [rsp + 0x38], r15
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], r15
mov r9d, ecx
mov dword [rsp + 0x28], r13d
mov r8, rdi
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp byte [rbx + 0x240], r15b
je 0x459e61
mov rcx, rbx
call fcn.0045971c
mov rcx, r14
call fcn.00459448
mov dword [rbx + 0x2d8], eax
mov dword [rbx + 0x2c4], 0x800
mov dword [rbx + 0x2dc], r15d
mov dword [rbx + 0x2c8], 8
mov qword [rbx + 0x2a8], r15
mov rax, qword [r14 + 0x420]
mov qword [rbx + 0x2e0], rax
mov dword [rbx + 0x2e8], esi
mov rcx, qword [rbx + 0x228]
cmp rcx, r12
je 0x45a32e
mov edi, 1
mov qword [rbp + 0x370], r15
mov r9d, edi
lea r8, [rbp + 0x374]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov r13d, 0xffffffff
mov dword [rbp + 0x370], eax
cmp eax, r13d
jne 0x459ef2
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x45a32e
cmp qword [rbp + 0x370], r12
je 0x45a32e
mov rcx, qword [rbx + 0x228]
cmp rcx, r12
jne 0x459f10
mov rax, r12
jmp 0x459f48
mov r9d, edi
mov qword [rbp + 0x370], r15
lea r8, [rbp + 0x374]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rbp + 0x370], eax
cmp eax, r13d
jne 0x459f41
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov rax, r12
jne 0x459f48
mov rax, qword [rbp + 0x370]
mov dword [rbx + 0x2b0], eax
cmp qword [r14 + 0x420], r13
jb 0x459f5e
mov byte [rbx + 0x2ec], dil
lea eax, [rsi + 0x2e]
mov ecx, eax
lea rdx, [0x0047b0a0]
mov dword [rbx + 0x2c0], eax
call fcn.0042267c
mov qword [rbx + 0x2b8], rax
test rax, rax
je 0x45a32e
mov edx, 0x2014b50
mov rcx, r15
mov byte [rcx + rax], dl
add rcx, rdi
shr edx, 8
cmp rcx, 4
jl 0x459f8d
mov rdx, qword [rbx + 0x2b8]
mov ecx, r15d
mov rax, r15
mov r13d, 2
mov byte [rax + rdx + 4], cl
add rax, rdi
shr ecx, 8
cmp rax, r13
jl 0x459faf
mov al, byte [rbx + 0x2ec]
mov rdx, qword [rbx + 0x2b8]
neg al
mov rax, r15
sbb ecx, ecx
and ecx, 0x19
add ecx, 0x14
mov byte [rax + rdx + 6], cl
add rax, rdi
shr ecx, 8
cmp rax, r13
jl 0x459fd8
mov ecx, dword [rbx + 0x2c4]
mov rax, r15
mov rdx, qword [rbx + 0x2b8]
mov byte [rdx + rax + 8], cl
add rax, rdi
shr ecx, 8
cmp rax, r13
jl 0x459ff7
mov ecx, dword [rbx + 0x2c8]
mov rax, r15
mov rdx, qword [rbx + 0x2b8]
mov byte [rdx + rax + 0xa], cl
add rax, rdi
shr ecx, 8
cmp rax, r13
jl 0x45a016
mov ecx, dword [rbx + 0x2d8]
mov rax, r15
mov rdx, qword [rbx + 0x2b8]
mov byte [rdx + rax + 0xc], cl
add rax, rdi
shr ecx, 8
cmp rax, 4
jl 0x45a035
mov rdx, qword [rbx + 0x2b8]
mov ecx, r15d
mov rax, r15
mov byte [rax + rdx + 0x10], cl
add rax, rdi
shr ecx, 8
cmp rax, 4
jl 0x45a052
mov rdx, qword [rbx + 0x2b8]
mov r8d, 0xffffffff
mov ecx, r8d
mov rax, r15
mov byte [rax + rdx + 0x14], cl
add rax, rdi
shr ecx, 8
cmp rax, 4
jl 0x45a075
mov rdx, qword [rbx + 0x2b8]
mov ecx, r8d
mov rax, r15
mov byte [rax + rdx + 0x18], cl
add rax, rdi
shr ecx, 8
cmp rax, 4
jl 0x45a092
mov rdx, qword [rbx + 0x2b8]
mov ecx, esi
mov rax, r15
mov byte [rax + rdx + 0x1c], cl
add rax, rdi
shr ecx, 8
cmp rax, r13
jl 0x45a0ae
mov rdx, qword [rbx + 0x2b8]
mov ecx, r15d
mov rax, r15
mov byte [rax + rdx + 0x1e], cl
add rax, rdi
shr ecx, 8
cmp rax, r13
jl 0x45a0ca
mov rdx, qword [rbx + 0x2b8]
mov ecx, r15d
mov rax, r15
mov byte [rax + rdx + 0x20], cl
add rax, rdi
shr ecx, 8
cmp rax, r13
jl 0x45a0e6
mov rdx, qword [rbx + 0x2b8]
mov ecx, r15d
mov rax, r15
mov byte [rax + rdx + 0x22], cl
add rax, rdi
shr ecx, 8
cmp rax, r13
jl 0x45a102
mov ecx, dword [r14 + 0x14]
mov rax, r15
mov rdx, qword [rbx + 0x2b8]
mov byte [rax + rdx + 0x24], cl
add rax, rdi
shr ecx, 8
cmp rax, r13
jl 0x45a11f
mov ecx, dword [r14 + 0x18]
mov rax, r15
mov rdx, qword [rbx + 0x2b8]
mov byte [rax + rdx + 0x26], cl
add rax, rdi
shr ecx, 8
cmp rax, 4
jl 0x45a13c
mov ecx, dword [rbx + 0x2b0]
mov rax, r15
mov rdx, qword [rbx + 0x2b8]
mov byte [rax + rdx + 0x2a], cl
add rax, rdi
shr ecx, 8
cmp rax, 4
jl 0x45a15c
mov rcx, qword [rbx + 0x2b8]
lea rdx, [rsp + 0x40]
add rcx, 0x2e
mov r8, rsi
call fcn.00424180
mov r14d, 4
mov edx, 0x4034b50
mov r8d, r14d
mov rcx, rbx
call fcn.0045a3c8
mov al, byte [rbx + 0x2ec]
mov r8d, r13d
neg al
mov rcx, rbx
sbb edx, edx
and edx, 0x19
add edx, 0x14
call fcn.0045a3c8
mov edx, dword [rbx + 0x2c4]
mov r8d, r13d
mov rcx, rbx
call fcn.0045a3c8
mov edx, dword [rbx + 0x2c8]
mov r8d, r13d
mov rcx, rbx
call fcn.0045a3c8
mov edx, dword [rbx + 0x2d8]
mov r8d, r14d
mov rcx, rbx
call fcn.0045a3c8
mov r8d, r14d
xor edx, edx
mov rcx, rbx
call fcn.0045a3c8
mov r8d, r14d
mov edx, 0xffffffff
mov rcx, rbx
call fcn.0045a3c8
mov r8d, r14d
mov edx, 0xffffffff
mov rcx, rbx
call fcn.0045a3c8
mov r8d, r13d
mov edx, esi
mov rcx, rbx
call fcn.0045a3c8
mov al, byte [rbx + 0x2ec]
mov r8d, r13d
neg al
mov rcx, rbx
sbb edx, edx
and edx, 0x14
call fcn.0045a3c8
mov rcx, qword [rbx + 0x228]
mov eax, r15d
mov dword [rbp + 0x370], eax
cmp rcx, r12
je 0x45a277
test esi, esi
je 0x45a277
lea r9, [rbp + 0x370]
mov qword [rsp + 0x20], r15
mov r8d, esi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, dword [rbp + 0x370]
cmp eax, esi
jne 0x45a32e
cmp byte [rbx + 0x2ec], r15b
je 0x45a2ba
mov rcx, qword [rbx + 0x228]
mov dword [rbp + 0x370], r15d
cmp rcx, r12
je 0x45a2ba
lea r9, [rbp + 0x370]
mov qword [rsp + 0x20], r15
mov r8d, shutdown
lea rdx, str.reserv_for_extra_fld
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rax, qword [rbx + 0x2d0]
mov esi, 0x100000
test rax, rax
jne 0x45a2e5
lea rdx, [0x0047b0a0]
mov ecx, esi
call fcn.0042267c
mov qword [rbx + 0x2d0], rax
test rax, rax
je 0x45a32e
mov edx, dword [rbx]
lea rcx, [rbx + 0x248]
mov dword [rbx + 0x250], r15d
mov dword [rbx + 0x268], esi
mov qword [rbx + 0x260], rax
mov qword [rbx + 0x258], r15
mov qword [rbx + 0x270], r15
call fcn.00466f68
test eax, 0xfffffffd
jne 0x45a32e
mov dword [rbx + 0x2a8], edi
mov al, dil
mov byte [rbx + 0x240], dil
jmp 0x45a330
xor al, al
lea r11, [rsp + 0x440]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret