Function at 0x140007a80
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x180
lea rbp, [rsp + 0x70]
and rbp, 0xffffffffffffffe0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x100], rax
xor r12d, r12d
mov r15d, r8d
mov qword [rsp + 0x30], r12
mov r14, rdx
mov rbx, rcx
mov dword [rsp + 0x28], r12d
xor r9d, r9d
mov dword [rsp + 0x20], r12d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ktmw32.dll_CreateTransaction]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140007be1
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
movabs rax, 0x766a604f59f65511
mov qword [rbp], rax
movabs r14, 0x24a042a359f3457
mov rax, qword [rbp]
movabs r15, 0xdc19e0c39babcc30
mov qword [rbp + 0x20], rax
movabs r12, 0x9007578402e4a6e1
movabs rax, 0xb96d81a6e9c8ec5f
movabs rbx, 0x39607bf5c964feba
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0xf36624ea6396d2c1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0x39607bd4a70b97ce
mov qword [rbp], rax
mov rax, qword [rbp]
lea rdx, [rbp + 0x20]
mov qword [rbp + 0x38], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
vmovdqu ymm0, ymmword [rbp + 0xa0]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
vzeroupper
call fcn.140003120
lea rdx, [0x1400032f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rax, 0xffffffffffffffff
jmp 0x1400080de
mov qword [rsp + 0x48], r12
xor r9d, r9d
mov qword [rsp + 0x40], r12
xor r8d, r8d
mov qword [rsp + 0x38], rsi
mov edx, 0xc0000000
mov qword [rsp + 0x30], r12
mov rcx, rbx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileTransactedW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140007d85
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
movabs rax, 0x766a604f59f65511
mov qword [rbp], rax
movabs rdx, 0x806322b7f9b231d4
mov rax, qword [rbp]
movabs r14, 0x24a042a359f3457
mov qword [rbp + 0x20], rax
movabs r15, 0xdc19e0c39babcc30
movabs rax, 0xb96d81a6e9c8ec5f
movabs r12, 0x9007578402e4a6e1
mov qword [rbp], rax
movabs rbx, 0x39607bf5c964feba
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0xf36624ea6396d2c1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0x5c0c1293e9009bce
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0x6c5127de8727c6e1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
movabs rax, 0x6c5127de8727e6db
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
mov qword [rbp], rdx
lea rdx, [rbp + 0x20]
mov rax, qword [rbp]
movdqa xmm2, xmmword [rbp + 0x40]
mov qword [rbp + 0xc8], rax
xorps xmm2, xmmword [rbp + 0xc0]
movdqa xmmword [rbp + 0x40], xmm2
vmovdqu ymm0, ymmword [rbp + 0xa0]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
vzeroupper
call fcn.140003120
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
jmp 0x140007bc5
lea r9, [rbp + 0x88]
mov dword [rbp + 0x88], r12d
mov r8d, r15d
mov qword [rsp + 0x20], r12
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140007e7b
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, [rbp + 0x20]
movabs rax, 0x756a604f59f65511
movabs r14, 0x24a042a359f3457
mov qword [rbp], rax
movabs r15, 0xdc19e0c39babcc30
mov rax, qword [rbp]
movabs r12, 0x9007578402e4a6e1
mov qword [rbp + 0x20], rax
movabs rbx, 0x39607bf5c964feba
movabs rax, 0xac3987adf2dfa542
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0xb02633e56d88df80
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0x39404187a6168cff
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
jmp 0x140007d52
mov qword [rsp + 0x30], rdi
lea rcx, [rbp + 0x80]
mov dword [rsp + 0x28], 0x1000000
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0xf001f
mov qword [rbp + 0x80], r12
call qword [sym.imp.ntdll.dll_NtCreateSection]
movabs rbx, 0x39607bf5c964feba
movabs r14, 0x24a042a359f3457
movabs r15, 0xdc19e0c39babcc30
movabs r12, 0x9007578402e4a6e1
test eax, eax
je 0x140007f2d
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
movabs rax, 0x673e654f47dc4019
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0xfc778faaefc8a963
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0x900733e16e8dc787
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], rbx
jmp 0x140007b63
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rbp + 0x60]
movabs rax, 0x632f766915c21e0c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
movabs rax, 0xa44dc0a2bbcfa944
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
movabs rax, 0xf17439e5709086a7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x70], rax
movabs rax, 0x3960719ba60d8ad9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
vmovdqu ymm0, ymmword [rbp + 0xe0]
vpxor ymm1, ymm0, ymmword [rbp + 0x60]
vmovdqa ymmword [rbp + 0x60], ymm1
vzeroupper
call fcn.140003120
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.ktmw32.dll_RollbackTransaction]
test eax, eax
jne 0x1400080ce
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, [rbp + 0x60]
movabs rax, 0x6929654859f35b05
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
movabs rax, 0xa87a81b0f5cabe64
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
movabs rax, 0xfc6e36e2228ac988
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x70], rax
movabs rax, 0x39607bf5e95e9adf
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
vmovdqu ymm0, ymmword [rbp + 0xa0]
vpxor ymm1, ymm0, ymmword [rbp + 0x60]
vmovdqa ymmword [rbp + 0x60], ymm1
vzeroupper
call fcn.140003120
lea rdx, [0x140001fb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
jmp 0x140007d6c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp + 0x80]
mov rcx, qword [rbp + 0x100]
xor rcx, rsp
call fcn.14000a1a0
add rsp, 0x180
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret