Function at 0x140064c30
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc0
mov rsi, rdx
mov r14, rcx
xor edi, edi
mov qword [rcx], rdi
cmp qword [rdx + 0x18], 8
jb 0x140064c5c
mov rsi, qword [rdx]
mov ecx, 0x30
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonLinkCtrl::XElementButtonLinkCtrl]
mov rbx, rax
test rax, rax
je 0x140064ca9
mov qword [rax], 0xffffffffffffffff
lea rcx, [rax + 8]
mov qword [rcx], rdi
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], 7
mov r8, 0xffffffffffffffff
inc r8
cmp word [rsi + r8*2], 0
jne 0x140064c90
mov rdx, rsi
call fcn.140002f20
mov byte [rbx + 0x28], 0
jmp 0x140064cac
mov rbx, rdi
lea rax, [rsp + 0x108]
cmp r14, rax
je 0x140064d36
mov rsi, qword [r14]
mov qword [r14], rbx
test rsi, rsi
je 0x140064d68
mov rdx, qword [rsi + 0x20]
cmp rdx, 8
jb 0x140064d04
mov rcx, qword [rsi + 8]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140064cff
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140064d2f
mov rcx, r8
call fcn.14007e2a0
mov qword [rsi + 0x18], rdi
mov qword [rsi + 0x20], 7
mov word [rsi + 8], di
mov rcx, qword [rsi]
cmp rcx, 0xffffffffffffffff
je 0x140064d2a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi], 0xffffffffffffffff
mov rcx, rsi
jmp 0x140064d5d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rbx, rbx
je 0x140064d68
lea rcx, [rbx + 8]
call fcn.140002e30
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x140064d5a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], 0xffffffffffffffff
mov rcx, rbx
mov edx, 0x30
call fcn.14007e2a0
nop
mov rbx, qword [r14]
cmp qword [rbx + 0x18], 0
je 0x140064edc
lea rcx, [rbx + 8]
cmp qword [rcx + 0x18], 8
jb 0x140064d84
mov rcx, qword [rcx]
mov qword [rsp + 0x30], 0xffffffffffffffff
mov dword [rsp + 0x28], 0x4000000
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
jne 0x140064de4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x60], eax
lea r13, [0x1401b9210]
mov qword [rsp + 0x68], r13
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x40], xmm0
mov r15, qword [rsp + 0x48]
mov esi, dword [rsp + 0x40]
jmp 0x140064dfd
mov esi, edi
mov dword [rsp + 0x40], edi
lea r15, [0x1401b91d8]
mov qword [rsp + 0x48], r15
lea r13, [0x1401b9210]
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x140064e0c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], r12
cmp r12, 0xffffffffffffffff
je 0x140064eab
mov dword [rsp + 0x20], edi
mov r9d, 4
xor r8d, r8d
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LockFile]
test eax, eax
je 0x140064ea7
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x110], eax
mov dword [rsp + 0x108], edi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x108]
mov r8d, 0x10
lea rdx, [rsp + 0x110]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140064e8b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x58], r13
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x40], xmm0
mov esi, edi
mov dword [rsp + 0x40], edi
lea r15, [0x1401b91d8]
mov qword [rsp + 0x48], r15
mov eax, 1
xchg byte [rbx + 0x28], al
jmp 0x140064eab
xchg byte [rbx + 0x28], dil
mov rax, qword [r15 + 8]
cmp qword [0x1401b91e0], rax
jne 0x140064f1a
test esi, esi
jne 0x140064f1a
jmp 0x140064ec6
mov rax, r14
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov edx, 0x57
lea rcx, [rsp + 0x60]
call fcn.140008060
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x50], xmm0
lea r8, str.file_path_is_empty
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x70]
call fcn.14000bc50
lea rdx, [0x1401b2018]
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll__CxxThrowException
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x50], xmm0
lea r8, str.failed_to_lock
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x98]
call fcn.14000bc50
lea rdx, [0x1401b2018]
lea rcx, [rsp + 0x98]
call sub.VCRUNTIME140.dll__CxxThrowException
int3