Function at 0x459c30
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x368]
sub rsp, 0x440
mov r14, rdx
mov rbx, rcx
mov r13d, 0x400
lea rcx, [rsp + 0x40]
mov r8d, r13d
xor edx, edx
call fcn.00424830
lea rdi, [r14 + 0x1c]
or r12, 0xffffffffffffffff
xor r15d, r15d
cmp word [rdi], r15w
jne 0x459ca3
test rdi, rdi
je 0x459ca3
mov r9, r12
lea r8, [0x0049049c]
mov edx, 0x200
mov rcx, rdi
call fcn.00435528
mov r8, rdi
jmp 0x459cab
mov r8, rdi
test rdi, rdi
je 0x459cf5
mov qword [rsp + 0x38], r15
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], r15
mov r9d, r12d
mov dword [rsp + 0x28], r13d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jg 0x459cf5
jne 0x459cee
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x459cee
mov byte [rbp + 0x33f], r15b
mov rcx, rdi
jmp 0x459cfd
mov byte [rsp + 0x40], r15b
jmp 0x459ce9
mov rcx, rdi
test rdi, rdi
je 0x459d0c
mov rax, r12
inc rax
cmp word [rcx + rax*2], r15w
jne 0x459d00
jmp 0x459d0f
mov eax, r15d
mov qword [rsp + 0x38], r15
mov r9d, eax
mov qword [rsp + 0x30], r15
mov r8, rdi
mov dword [rsp + 0x28], r15d
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rsi, eax
test rdi, rdi
je 0x459d4d
mov rcx, r12
inc rcx
cmp word [rdi + rcx*2], r15w
jne 0x459d41
jmp 0x459d50
mov ecx, r15d
mov qword [rsp + 0x38], r15
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], r15
mov r9d, ecx
mov dword [rsp + 0x28], r13d
mov r8, rdi
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp byte [rbx + 0x240], r15b
je 0x459d8d
mov rcx, rbx
call fcn.00459648
mov rcx, r14
call fcn.00459374
mov dword [rbx + 0x2d8], eax
mov dword [rbx + 0x2c4], 0x800
mov dword [rbx + 0x2dc], r15d
mov dword [rbx + 0x2c8], 8
mov qword [rbx + 0x2a8], r15
mov rax, qword [r14 + 0x420]
mov qword [rbx + 0x2e0], rax
mov dword [rbx + 0x2e8], esi
mov rcx, qword [rbx + 0x228]
cmp rcx, r12
je 0x45a25a
mov edi, 1
mov qword [rbp + 0x370], r15
mov r9d, edi
lea r8, [rbp + 0x374]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov r13d, 0xffffffff
mov dword [rbp + 0x370], eax
cmp eax, r13d
jne 0x459e1e
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x45a25a
cmp qword [rbp + 0x370], r12
je 0x45a25a
mov rcx, qword [rbx + 0x228]
cmp rcx, r12
jne 0x459e3c
mov rax, r12
jmp 0x459e74
mov r9d, edi
mov qword [rbp + 0x370], r15
lea r8, [rbp + 0x374]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rbp + 0x370], eax
cmp eax, r13d
jne 0x459e6d
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov rax, r12
jne 0x459e74
mov rax, qword [rbp + 0x370]
mov dword [rbx + 0x2b0], eax
cmp qword [r14 + 0x420], r13
jb 0x459e8a
mov byte [rbx + 0x2ec], dil
lea eax, [rsi + 0x2e]
mov ecx, eax
lea rdx, [0x0047b0a0]
mov dword [rbx + 0x2c0], eax
call fcn.0042267c
mov qword [rbx + 0x2b8], rax
test rax, rax
je 0x45a25a
mov edx, 0x2014b50
mov rcx, r15
mov byte [rcx + rax], dl
add rcx, rdi
shr edx, 8
cmp rcx, 4
jl 0x459eb9
mov rdx, qword [rbx + 0x2b8]
mov ecx, r15d
mov rax, r15
mov r13d, 2
mov byte [rax + rdx + 4], cl
add rax, rdi
shr ecx, 8
cmp rax, r13
jl 0x459edb
mov al, byte [rbx + 0x2ec]
mov rdx, qword [rbx + 0x2b8]
neg al
mov rax, r15
sbb ecx, ecx
and ecx, 0x19
add ecx, 0x14
mov byte [rax + rdx + 6], cl
add rax, rdi
shr ecx, 8
cmp rax, r13
jl 0x459f04
mov ecx, dword [rbx + 0x2c4]
mov rax, r15
mov rdx, qword [rbx + 0x2b8]
mov byte [rdx + rax + 8], cl
add rax, rdi
shr ecx, 8
cmp rax, r13
jl 0x459f23
mov ecx, dword [rbx + 0x2c8]
mov rax, r15
mov rdx, qword [rbx + 0x2b8]
mov byte [rdx + rax + 0xa], cl
add rax, rdi
shr ecx, 8
cmp rax, r13
jl 0x459f42
mov ecx, dword [rbx + 0x2d8]
mov rax, r15
mov rdx, qword [rbx + 0x2b8]
mov byte [rdx + rax + 0xc], cl
add rax, rdi
shr ecx, 8
cmp rax, 4
jl 0x459f61
mov rdx, qword [rbx + 0x2b8]
mov ecx, r15d
mov rax, r15
mov byte [rax + rdx + 0x10], cl
add rax, rdi
shr ecx, 8
cmp rax, 4
jl 0x459f7e
mov rdx, qword [rbx + 0x2b8]
mov r8d, 0xffffffff
mov ecx, r8d
mov rax, r15
mov byte [rax + rdx + 0x14], cl
add rax, rdi
shr ecx, 8
cmp rax, 4
jl 0x459fa1
mov rdx, qword [rbx + 0x2b8]
mov ecx, r8d
mov rax, r15
mov byte [rax + rdx + 0x18], cl
add rax, rdi
shr ecx, 8
cmp rax, 4
jl 0x459fbe
mov rdx, qword [rbx + 0x2b8]
mov ecx, esi
mov rax, r15
mov byte [rax + rdx + 0x1c], cl
add rax, rdi
shr ecx, 8
cmp rax, r13
jl 0x459fda
mov rdx, qword [rbx + 0x2b8]
mov ecx, r15d
mov rax, r15
mov byte [rax + rdx + 0x1e], cl
add rax, rdi
shr ecx, 8
cmp rax, r13
jl 0x459ff6
mov rdx, qword [rbx + 0x2b8]
mov ecx, r15d
mov rax, r15
mov byte [rax + rdx + 0x20], cl
add rax, rdi
shr ecx, 8
cmp rax, r13
jl 0x45a012
mov rdx, qword [rbx + 0x2b8]
mov ecx, r15d
mov rax, r15
mov byte [rax + rdx + 0x22], cl
add rax, rdi
shr ecx, 8
cmp rax, r13
jl 0x45a02e
mov ecx, dword [r14 + 0x14]
mov rax, r15
mov rdx, qword [rbx + 0x2b8]
mov byte [rax + rdx + 0x24], cl
add rax, rdi
shr ecx, 8
cmp rax, r13
jl 0x45a04b
mov ecx, dword [r14 + 0x18]
mov rax, r15
mov rdx, qword [rbx + 0x2b8]
mov byte [rax + rdx + 0x26], cl
add rax, rdi
shr ecx, 8
cmp rax, 4
jl 0x45a068
mov ecx, dword [rbx + 0x2b0]
mov rax, r15
mov rdx, qword [rbx + 0x2b8]
mov byte [rax + rdx + 0x2a], cl
add rax, rdi
shr ecx, 8
cmp rax, 4
jl 0x45a088
mov rcx, qword [rbx + 0x2b8]
lea rdx, [rsp + 0x40]
add rcx, 0x2e
mov r8, rsi
call fcn.00424180
mov r14d, 4
mov edx, 0x4034b50
mov r8d, r14d
mov rcx, rbx
call fcn.0045a2f4
mov al, byte [rbx + 0x2ec]
mov r8d, r13d
neg al
mov rcx, rbx
sbb edx, edx
and edx, 0x19
add edx, 0x14
call fcn.0045a2f4
mov edx, dword [rbx + 0x2c4]
mov r8d, r13d
mov rcx, rbx
call fcn.0045a2f4
mov edx, dword [rbx + 0x2c8]
mov r8d, r13d
mov rcx, rbx
call fcn.0045a2f4
mov edx, dword [rbx + 0x2d8]
mov r8d, r14d
mov rcx, rbx
call fcn.0045a2f4
mov r8d, r14d
xor edx, edx
mov rcx, rbx
call fcn.0045a2f4
mov r8d, r14d
mov edx, 0xffffffff
mov rcx, rbx
call fcn.0045a2f4
mov r8d, r14d
mov edx, 0xffffffff
mov rcx, rbx
call fcn.0045a2f4
mov r8d, r13d
mov edx, esi
mov rcx, rbx
call fcn.0045a2f4
mov al, byte [rbx + 0x2ec]
mov r8d, r13d
neg al
mov rcx, rbx
sbb edx, edx
and edx, 0x14
call fcn.0045a2f4
mov rcx, qword [rbx + 0x228]
mov eax, r15d
mov dword [rbp + 0x370], eax
cmp rcx, r12
je 0x45a1a3
test esi, esi
je 0x45a1a3
lea r9, [rbp + 0x370]
mov qword [rsp + 0x20], r15
mov r8d, esi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, dword [rbp + 0x370]
cmp eax, esi
jne 0x45a25a
cmp byte [rbx + 0x2ec], r15b
je 0x45a1e6
mov rcx, qword [rbx + 0x228]
mov dword [rbp + 0x370], r15d
cmp rcx, r12
je 0x45a1e6
lea r9, [rbp + 0x370]
mov qword [rsp + 0x20], r15
mov r8d, shutdown
lea rdx, str.reserv_for_extra_fld
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rax, qword [rbx + 0x2d0]
mov esi, 0x100000
test rax, rax
jne 0x45a211
lea rdx, [0x0047b0a0]
mov ecx, esi
call fcn.0042267c
mov qword [rbx + 0x2d0], rax
test rax, rax
je 0x45a25a
mov edx, dword [rbx]
lea rcx, [rbx + 0x248]
mov dword [rbx + 0x250], r15d
mov dword [rbx + 0x268], esi
mov qword [rbx + 0x260], rax
mov qword [rbx + 0x258], r15
mov qword [rbx + 0x270], r15
call fcn.00466e94
test eax, 0xfffffffd
jne 0x45a25a
mov dword [rbx + 0x2a8], edi
mov al, dil
mov byte [rbx + 0x240], dil
jmp 0x45a25c
xor al, al
lea r11, [rsp + 0x440]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret