Function at 0x140039460
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x4f8]
sub rsp, 0x5f8
mov rax, qword [0x1401b6838]
xor rax, rsp
mov qword [rbp + 0x4e0], rax
xor esi, esi
mov dword [rsp + 0x40], esi
mov ecx, dword [0x1401c5cd8]
mov rax, qword gs:[0x58]
mov edx, 0x10
mov rdi, qword [rax + rcx*8]
add rdi, rdx
mov rcx, rdi
call fcn.14003e5c0
cmp rax, 0xffffffffffffffff
je 0x1400397c1
xor ecx, ecx
call fcn.1401033d8
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.140103388
lea rdx, str._04d__02d__02d__02d:_02d:_02d
test rax, rax
je 0x140039528
mov r9d, dword [rax + 0x10]
inc r9d
mov r8d, dword [rax + 0x14]
add r8d, 0x76c
mov ecx, dword [rax]
mov dword [rsp + 0x38], ecx
mov ecx, dword [rax + 4]
mov dword [rsp + 0x30], ecx
mov ecx, dword [rax + 8]
mov dword [rsp + 0x28], ecx
mov eax, dword [rax + 0xc]
mov dword [rsp + 0x20], eax
lea rcx, [rbp + 0x80]
call fcn.1400392f0
jmp 0x14003954e
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea rcx, [rbp + 0x80]
call fcn.1400392f0
xor edx, edx
mov r8d, 0xf8
lea rcx, [rbp - 0x80]
call fcn.140123210
mov edx, 3
lea r8d, [rdx - 2]
lea rcx, [rbp - 0x80]
call fcn.14001bb60
nop
mov rcx, rdi
call fcn.14003e5c0
test rax, rax
jne 0x140039633
mov rbx, rsi
mov r8, rbx
mov rdx, qword [str.MW_DEBUG_LOG__04d.txt]
lea rcx, [rbp + 0xa0]
call fcn.140039350
inc rbx
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
lea rcx, [rbp + 0xa0]
call qword [sym.imp.KERNEL32.DLL_CreateFileA]
mov rdx, rax
mov rcx, rdi
call fcn.14003e5e0
mov rcx, rdi
cmp rbx, 0x64
je 0x1400396e3
call fcn.14003e5c0
test rax, rax
je 0x140039586
mov rcx, rdi
call fcn.14003e5c0
cmp rax, 0xffffffffffffffff
je 0x140039586
lea rdx, [0x140150228]
lea rcx, [rbp - 0x70]
call fcn.140014760
mov rcx, rax
lea rdx, [rbp + 0x80]
call fcn.140014760
mov rcx, rax
mov dl, 9
call fcn.140038fe0
mov rcx, rax
lea rdx, str._Log_start__r_n
call fcn.140014760
lea rbx, [rbp + 0x528]
call fcn.1400089e0
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rsi
mov r9, qword [rbp + 0x520]
mov r8d, 0x400
lea rdx, [rbp + 0xe0]
mov rcx, qword [rax]
call fcn.140102de0
lea rdx, [rbp + 0x80]
lea rcx, [rbp - 0x70]
call fcn.140014760
mov rcx, rax
mov dl, 9
call fcn.140038fe0
mov rcx, rax
lea rdx, [rbp + 0xe0]
call fcn.140014760
mov rcx, rax
lea rdx, [0x140150228]
call fcn.140014760
nop
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], 0xf
mov byte [rsp + 0x48], 0
mov dword [rsp + 0x40], 2
mov rcx, qword [rbp + 8]
test cl, 2
jne 0x1400396f4
mov rax, qword [rbp - 0x28]
mov r8, qword [rax]
test r8, r8
je 0x1400396f4
mov rax, qword [rbp - 0x48]
mov rdx, qword [rax]
cmp r8, qword [rbp]
cmovb r8, qword [rbp]
sub r8, rdx
jmp 0x140039719
mov rdx, 0xffffffffffffffff
call fcn.14003e5e0
jmp 0x1400397b8
test cl, 4
jne 0x140039724
mov rax, qword [rbp - 0x30]
mov rcx, qword [rax]
test rcx, rcx
je 0x140039724
mov rax, qword [rbp - 0x50]
mov rdx, qword [rax]
mov rax, qword [rbp - 0x18]
movsxd r8, dword [rax]
sub r8, rdx
add r8, rcx
lea rcx, [rsp + 0x48]
call fcn.140012010
nop
lea rbx, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae rbx, qword [rsp + 0x48]
mov rcx, rdi
call fcn.14003e5c0
mov rcx, rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x68]
mov r8d, dword [rsp + 0x58]
mov rdx, rbx
call qword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
jne 0x14003976c
mov rdx, 0xffffffffffffffff
mov rcx, rdi
call fcn.14003e5e0
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x1400397a5
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400397a0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400397dc
call fcn.14012e940
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], 0xf
mov byte [rsp + 0x48], 0
lea rcx, [rbp - 0x80]
call fcn.14001b200
mov rcx, qword [rbp + 0x4e0]
xor rcx, rsp
call fcn.14012e910
add rsp, 0x5f8
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1400fec40
nop
int3