Function at 0x513ba0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x398
mov rsi, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rbp, qword [0x005ab200]
mov rax, qword [rsi]
mov qword [rsp + 0x388], rax
xor eax, eax
mov rax, qword [rcx + 0xb8]
mov qword [rsp + 0x60], rbp
mov rbx, rcx
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov r12, qword [rax]
mov r15, qword [rax + 8]
test byte [rcx + 0x8c], 0x40
je 0x514310
mov r14d, dword [rcx + 0xb0]
mov rax, qword [rbx + 0x138]
mov ecx, 0x14
lea r13, [rsp + 0xd0]
mov qword [rbx + 0xb8], 0
mov rdi, r13
mov qword [rsp + 0x48], rax
xor eax, eax
rep stosq qword [rdi], rax
test byte [rbx + 0x85], 0x10
je 0x514410
movzx eax, word [rbx + 0x8c]
and ax, 0x201
cmp ax, 1
je 0x514330
or byte [rbx + 0x8c], 1
mov rcx, qword [rbx + 0x528]
call fcn.00505c60
mov eax, dword [rbx + 0xb4]
lea edx, [rax - 6]
cmp edx, 1
jbe 0x5143d0
cmp eax, 8
jne 0x514028
test byte [rbx + 0x8c], 0x10
jne 0x514190
mov r9d, dword [rbx + 0x88]
test r9d, r9d
jne 0x5142a4
mov r8d, dword [rsp + 0x10c]
test r8d, r8d
js 0x513cbe
mov ecx, dword [rbx + 0x130]
test ecx, ecx
jne 0x5144b8
mov rax, qword [rbx + 0xa0]
movdqu xmm0, xmmword [rbx + 0x90]
mov qword [rsp + 0xf8], rax
movzx eax, byte [rbx + 0x8d]
movups xmmword [rsp + 0xe8], xmm0
mov edx, eax
shr al, 4
and eax, 1
shr dl, 3
mov dword [rsp + 0xe0], eax
mov rax, qword [rbx + 0x990]
and edx, 1
mov ecx, edx
movzx edx, byte [rsp + 0x100]
mov qword [rsp + 0x118], rax
mov eax, dword [rbx + 0xb4]
and edx, 0xfffffffe
mov dword [rsp + 0xd0], eax
mov rax, qword [rbx + 0x158]
or edx, ecx
mov byte [rsp + 0x100], dl
mov edx, dword [rbx + 0x668]
mov qword [rsp + 0x130], rax
mov eax, dword [rbx + 0x624]
mov dword [rsp + 0xd4], edx
mov rdx, qword [rsp + 0x48]
mov dword [rsp + 0x138], eax
mov eax, dword [rbx + 0xa8]
mov qword [rsp + 0xd8], rdx
mov dword [rsp + 0x108], eax
call fcn.00423620
cmp qword [rbx + 0xf8], 0
mov qword [rsp + 0x120], rbx
mov qword [rsp + 0x128], rax
je 0x513da6
cmp qword [rbx + 0xe8], 0
je 0x513da6
lea rax, [rbx + 0xe8]
mov qword [rsp + 0x140], rax
mov rcx, qword [rbx + 0x528]
test rcx, rcx
je 0x513dbe
call fcn.00504910
mov dword [rsp + 0x168], eax
lea r14, [rsp + 0x50]
mov rdx, r12
mov rcx, r13
mov r8, r14
call fcn.005272e0
mov edx, dword [rbx + 0x130]
test edx, edx
jne 0x514380
mov eax, dword [rsp + 0xd0]
cmp eax, 8
je 0x513e21
mov r12, qword [rsp + 0x110]
test r12, r12
je 0x513e21
cmp byte [r12], 0
je 0x513e21
sub eax, 6
cmp eax, 1
jbe 0x514608
mov rcx, r12
call sub.msvcrt.dll_strlen
mov rdx, r12
mov rcx, r14
mov r8, rax
call fcn.00472fb0
mov eax, dword [rbx + 0x154]
mov r8, qword [rsp + 0x58]
mov r9, qword [rbx + 0x6e8]
test eax, eax
jne 0x514350
mov eax, 1
test r8, r8
jne 0x513ed0
lea edx, [rax*4]
movzx eax, byte [rbx + 0x8d]
mov rcx, qword [rbx + 0x528]
mov r8, r14
and eax, 0xfffffffb
or eax, edx
mov rdx, r9
mov byte [rbx + 0x8d], al
call fcn.00505f00
test byte [rbx + 0x8d], 2
jne 0x514398
mov rcx, r14
call fcn.004727a0
mov rcx, qword [rsp + 0x110]
call fcn.004c9260
mov eax, dword [rsp + 0xd0]
sub eax, 6
cmp eax, 1
jbe 0x513ee8
mov rax, qword [rsp + 0x388]
xor rax, qword [rsi]
jne 0x514631
add rsp, 0x398
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsp + 0x60]
cmp byte [rax + r8 - 1], 0xa
setne al
jmp 0x513e49
cmp qword [rbx + 0xa08], 0
je 0x513f5a
mov rdi, qword [0x005aac60]
xor edx, edx
mov rcx, rbx
mov r13, qword [rdi + 8]
mov r12, qword [rdi]
mov qword [rdi + 8], 0
mov qword [rdi], 0
call fcn.00512730
mov rcx, qword [rbx + 0x6e8]
mov r8, qword [rbx + 0xa18]
lea rdx, [0x0059c707]
call fcn.00475020
mov edx, 2
mov rcx, rbx
call fcn.005572c0
mov eax, dword [rsp + 0xd0]
mov qword [rdi], r12
mov qword [rdi + 8], r13
sub eax, 6
cmp eax, 1
ja 0x513ea5
cmp qword [rbx + 0xa20], 0
je 0x513ea5
mov rdi, qword [0x005aac60]
xor edx, edx
mov rcx, rbx
lea rbp, [rsp + 0x170]
mov r13, qword [rdi + 8]
mov r12, qword [rdi]
mov qword [rdi + 8], 0
mov qword [rdi], 0
call fcn.00512730
mov r8, qword [rbx + 0xa38]
mov rcx, qword [rbx + 0x6e8]
lea rdx, [0x0059c707]
call fcn.00475020
mov rax, qword [0x005ab240]
mov rdx, rbp
mov rcx, qword [rax]
call fcn.004f3230
mov rax, qword [rbx + 0x6e8]
mov rcx, rbp
mov qword [rsp + 0x2f8], rax
mov eax, dword [rbx + 0x624]
mov dword [rsp + 0x234], eax
call fcn.004f3420
mov qword [rsp + 0x20], rbp
mov rdx, qword [rbx + 0xa28]
mov r9d, 1
mov qword [rsp + 0x28], 0
mov rcx, qword [rbx + 0xa20]
mov r8d, dword [rbx + 0xa30]
call fcn.00528e50
mov qword [rdi], r12
mov qword [rdi + 8], r13
jmp 0x513ea5
mov ecx, dword [rbx + 0x624]
mov rdi, qword [rbx + 0x6e8]
mov edx, 6
call fcn.004f1e20
mov rdx, rdi
mov rcx, rax
call sub.msvcrt.dll_fputs
cmp dword [rbx + 0xb4], 5
jne 0x5144e0
cmp qword [rbx + 0x528], 0
je 0x514588
mov rax, qword [0x005ab240]
mov rdi, qword [rbx + 0x6e8]
lea rdx, [r12 + 8]
mov r8d, r14d
mov rcx, qword [rax]
call fcn.0046ccf0
mov rdx, rdi
mov rcx, rax
call sub.msvcrt.dll_fputs
test byte [rbx + 0x83], 8
jne 0x514520
cmp qword [rbx + 0x998], 0
je 0x5140b3
mov r8d, r14d
mov rdx, r12
mov rcx, rbx
call fcn.00512890
test r15, r15
je 0x5140e4
mov rax, qword [0x005ab240]
lea rdx, [r15 + 8]
mov r8d, r14d
mov rcx, qword [rax]
call fcn.0046ccf0
mov rcx, qword [rbx + 0x6e8]
lea rdx, str.__from__s_
mov r8, rax
call sub.libintl_8.dll_libintl_fprintf
mov ecx, dword [rbx + 0x624]
xor edx, edx
mov r14, qword [rbx + 0x6e8]
call fcn.004f1e20
mov rdx, r14
mov rcx, rax
call sub.msvcrt.dll_fputs
mov rdx, r12
mov rcx, rbx
call fcn.005134e0
cmp dword [rbx + 0xb4], 5
mov rdx, qword [rbx + 0x6e8]
je 0x514508
mov ecx, 0xa
call sub.msvcrt.dll_putc
mov rcx, qword [rbx + 0x528]
call fcn.00505b20
mov rcx, qword [rbx + 0x990]
test rcx, rcx
je 0x513c86
movzx r9d, byte [rbx + 0x8d]
xor edx, edx
lea r8, [rbx + 0x90]
shr r9b, 3
cmp dword [rbx + 0xb4], 5
sete dl
and r9d, 1
call fcn.0052a230
cmp dword [rbx + 0xb4], 5
je 0x513ea5
test byte [rbx + 0x8c], 0x10
je 0x513c93
nop word [rax + rax]
lea r14, [rsp + 0x90]
lea r15, [rsp + 0x70]
mov rcx, r12
mov qword [rsp + 0x70], 0
mov r8, r14
mov rdx, r15
mov qword [rsp + 0x78], 0
lea rdi, [rsp + 0xb0]
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x98], 0
mov qword [rsp + 0xa0], rbp
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0xb8], 0
mov qword [rsp + 0xc0], rbp
call fcn.004da2a0
test eax, eax
jle 0x51426a
mov qword [rsp + 0x28], 0
mov r9, qword [rsp + 0x98]
mov qword [rsp + 0x20], rdi
mov r8, qword [rsp + 0xa0]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x80]
call fcn.005037d0
mov r9d, eax
test eax, eax
je 0x514257
cmp qword [rsp + 0xb8], 0
je 0x5145e0
mov r8, qword [rsp + 0xc0]
mov edx, r9d
mov rcx, rbx
call fcn.005127a0
mov rcx, rdi
call fcn.004727a0
mov rcx, r15
call fcn.004727a0
mov rcx, r14
call fcn.004727a0
mov r8, rbx
mov rdx, r12
lea rcx, [0x005129c0]
call fcn.004dab90
mov r9d, dword [rbx + 0x88]
test r9d, r9d
je 0x513ca3
xor edi, edi
cmp dword [rbx + 0xb4], 8
lea r14, [rsp + 0xb0]
mov qword [rsp + 0xb0], 0
sete dil
mov qword [rsp + 0xc0], rbp
mov qword [rsp + 0xb8], 0
call fcn.00423620
lea rcx, [r12 + 8]
mov r9d, edi
mov rdx, r14
mov r8, rax
call fcn.0051b210
xor edx, edx
mov rcx, r14
call fcn.004728a0
mov qword [rsp + 0x110], rax
jmp 0x513ca3
mov rax, qword [0x005ab240]
mov rax, qword [rax]
mov rax, qword [rax + 0xc8]
mov r14d, dword [rax + 0x18]
jmp 0x513c0a
mov ecx, dword [rbx + 0x640]
cmp ecx, 0xa
je 0x514540
mov rdx, qword [rbx + 0x6e8]
call sub.msvcrt.dll_putc
jmp 0x513c58
mov rcx, r9
lea rdx, str.log_size__i_n
call sub.libintl_8.dll_libintl_fprintf
mov rcx, qword [rbx + 0x528]
call fcn.00505b20
mov r8, qword [rsp + 0x58]
mov r9, qword [rbx + 0x6e8]
jmp 0x513e3b
mov r8d, 1
xor edx, edx
mov rcx, r14
call fcn.005339e0
jmp 0x513ddf
mov ecx, dword [rbx + 0xb4]
call fcn.00523ff0
test eax, eax
jne 0x513e81
test byte [rbx + 0x8d], 4
je 0x514620
mov rdx, qword [rbx + 0x6e8]
mov ecx, dword [rbx + 0x640]
call sub.msvcrt.dll_putc
jmp 0x513e81
mov dword [rsp + 0x20], 1
lea r8, [rsp + 0x48]
mov rdx, r12
mov rcx, rbx
lea r9, [rsp + 0x10c]
call fcn.00513850
mov qword [rsp + 0x120], rbx
mov dword [rsp + 0x104], 1
jmp 0x513c86
mov rcx, qword [rbx + 0x528]
call fcn.00505c60
cmp qword [rbx + 0x528], 0
je 0x5145c8
mov rax, qword [0x005ab240]
mov r13, qword [rbx + 0x6e8]
lea rdx, [r12 + 8]
mov r8d, r14d
mov rcx, qword [rax]
call fcn.0046ccf0
mov rdx, r13
mov rcx, rax
call sub.msvcrt.dll_fputs
test byte [rbx + 0x83], 8
jne 0x514568
cmp qword [rbx + 0x998], 0
je 0x514478
mov r8d, r14d
mov rdx, r12
mov rcx, rbx
call fcn.00512890
mov rcx, rbx
mov rdx, r12
call fcn.005134e0
mov rcx, qword [rbx + 0x528]
test rcx, rcx
je 0x51449c
call fcn.00505b10
test eax, eax
je 0x5145a0
mov rdx, qword [rbx + 0x6e8]
mov ecx, dword [rbx + 0x640]
call sub.msvcrt.dll_putc
jmp 0x513ea5
mov ecx, 2
call fcn.004283e0
mov rcx, rax
call fcn.005242e0
mov dword [rsp + 0x10c], eax
jmp 0x513cbe
mov r9, qword [rbx + 0x6e8]
mov r8d, 7
mov edx, 1
lea rcx, [0x0059c6e7]
call sub.msvcrt.dll_fwrite
jmp 0x514057
mov ecx, 0x20
call sub.msvcrt.dll_putc
jmp 0x514138
mov rcx, qword [r12 + 0x30]
mov r8, qword [rbx + 0x6e8]
mov edx, r14d
call fcn.00512960
jmp 0x51409b
test byte [rbx + 0x8d], 4
jne 0x51433f
mov rcx, qword [rbx + 0x528]
call fcn.00505bc0
mov ecx, dword [rbx + 0x640]
jmp 0x51433f
mov rcx, qword [r12 + 0x30]
mov r8, qword [rbx + 0x6e8]
mov edx, r14d
call fcn.00512960
jmp 0x514460
mov rdx, r12
mov rcx, rbx
call fcn.0045efd0
jmp 0x514065
mov rdx, qword [rbx + 0x6e8]
mov ecx, 0xa
call sub.msvcrt.dll_putc
mov rcx, qword [rbx + 0x528]
call fcn.00505dc0
jmp 0x51449c
mov rdx, r12
mov rcx, rbx
call fcn.0045efd0
jmp 0x51442a
mov r8d, 0xd
lea rdx, str.No_signature_n
mov rcx, rdi
mov dword [rsp + 0x3c], eax
call fcn.00472fb0
mov r9d, dword [rsp + 0x3c]
jmp 0x514257
mov rdx, r14
mov rcx, rbx
call fcn.00512730
mov r12, qword [rsp + 0x110]
jmp 0x513e0b
mov rcx, qword [rbx + 0x528]
call fcn.00505bc0
jmp 0x5143b8
call sub.libssp_0.dll___stack_chk_fail
nop
nop word [rax + rax]