Function at 0x14004e640
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
xor eax, eax
lea r8, [rbp - 0x10]
mov qword [rbp - 0x10], rax
lea rdx, [0x1400e4738]
mov qword [rbp - 8], rax
mov dword [rbp - 8], 0x80000002
mov dword [rbp - 0x10], 1
call fcn.1400516e0
xor eax, eax
lea r8, [rbp - 0x10]
mov qword [rbp - 0x10], rax
lea rdx, [0x1400e4748]
mov qword [rbp - 8], rax
movzx eax, byte [0x140148e51]
mov dword [rbp - 0x10], eax
mov dword [rbp - 8], 0x80000002
call fcn.1400516e0
xor eax, eax
lea r8, [rbp - 0x10]
mov qword [rbp - 0x10], rax
lea rdx, [0x1400e4760]
mov qword [rbp - 8], rax
movzx eax, byte [0x140148e52]
mov dword [rbp - 0x10], eax
mov dword [rbp - 8], 0x80000002
call fcn.1400516e0
xor eax, eax
lea r8, [rbp - 0x10]
mov qword [rbp - 0x10], rax
lea rdx, [0x1400e4770]
mov qword [rbp - 8], rax
movzx eax, byte [0x140148e53]
mov dword [rbp - 0x10], eax
mov dword [rbp - 8], 0x80000002
call fcn.1400516e0
xor eax, eax
lea r8, [rbp - 0x10]
mov qword [rbp - 0x10], rax
lea rdx, [0x1400e4780]
mov qword [rbp - 8], rax
movzx eax, byte [0x140148e54]
mov dword [rbp - 0x10], eax
mov dword [rbp - 8], 0x80000002
call fcn.1400516e0
xor eax, eax
lea r8, [rbp - 0x10]
mov qword [rbp - 0x10], rax
lea rdx, [0x1400e4790]
mov qword [rbp - 8], rax
movzx eax, byte [0x140148e55]
mov dword [rbp - 0x10], eax
mov dword [rbp - 8], 0x80000002
call fcn.1400516e0
xor eax, eax
lea r8, [rbp - 0x10]
mov qword [rbp - 0x10], rax
lea rdx, [0x1400e47a0]
mov qword [rbp - 8], rax
movzx eax, byte [0x140148e56]
mov dword [rbp - 0x10], eax
mov dword [rbp - 8], 0x80000002
call fcn.1400516e0
xor eax, eax
lea r8, [rbp - 0x10]
mov qword [rbp - 0x10], rax
lea rdx, [0x1400e47b0]
mov qword [rbp - 8], rax
movzx eax, byte [0x140148e57]
mov dword [rbp - 0x10], eax
mov dword [rbp - 8], 0x80000002
call fcn.1400516e0
lea r8, [0x140148e58]
lea rdx, [0x1400e47c0]
call fcn.140051800
lea r8, [0x140148e68]
lea rdx, [0x1400e47e0]
call fcn.140051800
lea r8, [0x140148e78]
lea rdx, [0x1400e4800]
call fcn.140051800
lea r8, [0x140148e88]
lea rdx, [0x1400e4820]
call fcn.140051800
xor eax, eax
lea r8, [rbp - 0x10]
mov qword [rbp - 0x10], rax
lea rdx, [0x1400e4840]
mov qword [rbp - 8], rax
mov eax, dword [0x140148e98]
mov dword [rbp - 0x10], eax
mov dword [rbp - 8], 0x80000301
call fcn.1400516e0
xor eax, eax
lea r8, [rbp - 0x10]
mov qword [rbp - 0x10], rax
lea rdx, [0x1400e4858]
mov qword [rbp - 8], rax
movzx eax, byte [0x140148e9c]
mov dword [rbp - 0x10], eax
mov dword [rbp - 8], 0x80000002
call fcn.1400516e0
xor eax, eax
lea r8, [rbp - 0x10]
mov qword [rbp - 0x10], rax
lea rdx, [0x1400e4870]
mov qword [rbp - 8], rax
movzx eax, byte [0x140148e9d]
mov dword [rbp - 0x10], eax
mov dword [rbp - 8], 0x80000002
call fcn.1400516e0
xor eax, eax
lea r8, [rbp - 0x10]
mov qword [rbp - 0x10], rax
lea rdx, [0x1400e4880]
mov qword [rbp - 8], rax
movzx eax, byte [0x140148e9e]
mov dword [rbp - 0x10], eax
mov dword [rbp - 8], 0x80000002
call fcn.1400516e0
xor eax, eax
lea r8, [rbp - 0x10]
mov qword [rbp - 0x10], rax
lea rdx, [0x1400e4890]
mov qword [rbp - 8], rax
movzx eax, byte [0x140148ee2]
mov dword [rbp - 0x10], eax
mov dword [rbp - 8], 0x80000002
call fcn.1400516e0
xor eax, eax
lea r8, [rbp - 0x10]
mov qword [rbp - 0x10], rax
lea rdx, [0x1400e48a0]
mov qword [rbp - 8], rax
movzx eax, byte [0x140148ee1]
mov dword [rbp - 0x10], eax
mov dword [rbp - 8], 0x80000002
call fcn.1400516e0
xor eax, eax
lea r8, [rbp - 0x10]
mov qword [rbp - 0x10], rax
lea rdx, [0x1400e48b0]
mov qword [rbp - 8], rax
movzx eax, byte [0x140148ee0]
mov dword [rbp - 0x10], eax
mov dword [rbp - 8], 0x80000002
call fcn.1400516e0
xor eax, eax
lea r8, [rbp - 0x10]
mov qword [rbp - 0x10], rax
lea rdx, [0x1400e48c0]
mov qword [rbp - 8], rax
mov eax, dword [0x140148ee4]
mov dword [rbp - 0x10], eax
mov dword [rbp - 8], 0x80000301
call fcn.1400516e0
lea r8, [0x140148ea0]
lea rdx, [0x1400e48d8]
call fcn.140051800
lea r8, [0x140148eb0]
lea rdx, [0x1400e48f8]
call fcn.140051800
lea r8, [0x140148ec0]
lea rdx, [0x1400e4918]
call fcn.140051800
lea r8, [0x140148ed0]
lea rdx, [0x1400e4938]
call fcn.140051800
xor eax, eax
lea r8, [rbp - 0x10]
mov qword [rbp - 0x10], rax
lea rdx, [0x1400e4958]
mov qword [rbp - 8], rax
movzx eax, byte [0x140148ee8]
mov dword [rbp - 0x10], eax
mov dword [rbp - 8], 0x80000002
call fcn.1400516e0
xor eax, eax
lea r8, [rbp - 0x10]
mov qword [rbp - 0x10], rax
lea rdx, [0x1400e4970]
mov qword [rbp - 8], rax
mov eax, dword [0x140148eec]
mov dword [rbp - 0x10], eax
mov dword [rbp - 8], 0x80000301
call fcn.1400516e0
xor eax, eax
lea r8, [rbp - 0x10]
mov qword [rbp - 0x10], rax
lea rdx, [0x1400e4988]
mov qword [rbp - 8], rax
movzx eax, byte [0x140148ef0]
mov dword [rbp - 0x10], eax
mov dword [rbp - 8], 0x80000002
call fcn.1400516e0
xor eax, eax
lea r8, [rbp - 0x10]
mov qword [rbp - 0x10], rax
lea rdx, [0x1400e49a0]
mov qword [rbp - 8], rax
movzx eax, byte [0x140148ef1]
mov dword [rbp - 0x10], eax
mov dword [rbp - 8], 0x80000002
call fcn.1400516e0
xor eax, eax
lea r8, [rbp - 0x10]
mov qword [rbp - 0x10], rax
lea rdx, [0x1400e49c0]
mov qword [rbp - 8], rax
movzx eax, byte [0x140148ef2]
mov dword [rbp - 0x10], eax
mov dword [rbp - 8], 0x80000002
call fcn.1400516e0
xor eax, eax
lea r8, [rbp - 0x10]
mov qword [rbp - 0x10], rax
lea rdx, [0x1400e49d0]
mov qword [rbp - 8], rax
movzx eax, byte [0x140148ef3]
mov dword [rbp - 0x10], eax
mov dword [rbp - 8], 0x80000002
call fcn.1400516e0
xor eax, eax
lea r8, [rbp - 0x10]
mov qword [rbp - 0x10], rax
lea rdx, [0x1400e49e8]
mov qword [rbp - 8], rax
movzx eax, byte [0x140148ef4]
mov dword [rbp - 0x10], eax
mov dword [rbp - 8], 0x80000002
call fcn.1400516e0
xor eax, eax
lea r8, [rbp - 0x10]
mov qword [rbp - 0x10], rax
lea rdx, [0x1400e4a00]
mov qword [rbp - 8], rax
movzx eax, byte [0x140148ef5]
mov dword [rbp - 0x10], eax
mov dword [rbp - 8], 0x80000002
call fcn.1400516e0
xor eax, eax
mov qword [rbp - 8], rax
mov dword [rbp - 8], 0x80000002
mov qword [rbp - 0x10], rax
movzx eax, byte [0x140148ef6]
lea r8, [rbp - 0x10]
lea rdx, [0x1400e4a18]
mov dword [rbp - 0x10], eax
call fcn.1400516e0
xor eax, eax
lea r8, [rbp - 0x10]
mov qword [rbp - 0x10], rax
lea rdx, [0x1400e4a30]
mov qword [rbp - 8], rax
movzx eax, byte [0x140148ef7]
mov dword [rbp - 0x10], eax
mov dword [rbp - 8], 0x80000002
call fcn.1400516e0
xor eax, eax
lea r8, [rbp - 0x10]
mov qword [rbp - 0x10], rax
lea rdx, [0x1400e4a48]
mov qword [rbp - 8], rax
movzx eax, byte [0x140148ef8]
mov dword [rbp - 0x10], eax
mov dword [rbp - 8], 0x80000002
call fcn.1400516e0
xor eax, eax
lea r8, [rbp - 0x10]
mov qword [rbp - 0x10], rax
lea rdx, [0x1400e4a60]
mov qword [rbp - 8], rax
movzx eax, byte [0x140148ef9]
mov dword [rbp - 0x10], eax
mov dword [rbp - 8], 0x80000002
call fcn.1400516e0
xor eax, eax
lea r8, [rbp - 0x10]
mov qword [rbp - 0x10], rax
lea rdx, [0x1400e4a70]
mov qword [rbp - 8], rax
movzx eax, byte [0x140148efa]
mov dword [rbp - 0x10], eax
mov dword [rbp - 8], 0x80000002
call fcn.1400516e0
xor eax, eax
lea r8, [rbp - 0x10]
mov qword [rbp - 0x10], rax
lea rdx, [0x1400e4a80]
mov qword [rbp - 8], rax
movzx eax, byte [0x140148efb]
mov dword [rbp - 0x10], eax
mov dword [rbp - 8], 0x80000002
call fcn.1400516e0
xor eax, eax
lea r8, [rbp - 0x10]
mov qword [rbp - 0x10], rax
lea rdx, [0x1400e4a90]
mov qword [rbp - 8], rax
movzx eax, byte [0x140148efc]
mov dword [rbp - 0x10], eax
mov dword [rbp - 8], 0x80000002
call fcn.1400516e0
movss xmm0, dword [0x140148f00]
lea r8, [rbp - 0x10]
xor eax, eax
lea rdx, [0x1400e4aa0]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
movss dword [rbp - 0x10], xmm0
mov dword [rbp - 8], 0x80000501
call fcn.1400516e0
xor eax, eax
lea r8, [rbp - 0x10]
mov qword [rbp - 0x10], rax
lea rdx, [0x1400e4ab0]
mov qword [rbp - 8], rax
movzx eax, byte [0x140148f14]
mov dword [rbp - 0x10], eax
mov dword [rbp - 8], 0x80000002
call fcn.1400516e0
xor eax, eax
mov qword [rbp - 8], rax
mov dword [rbp - 8], 0x80000301
mov qword [rbp - 0x10], rax
mov eax, dword [0x140148f18]
lea r8, [rbp - 0x10]
lea rdx, [0x1400e4ac8]
mov dword [rbp - 0x10], eax
call fcn.1400516e0
movss xmm0, dword [0x140148f1c]
lea r8, [rbp - 0x10]
xor eax, eax
lea rdx, [0x1400e4ad8]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
movss dword [rbp - 0x10], xmm0
mov dword [rbp - 8], 0x80000501
call fcn.1400516e0
lea r8, [0x140148f04]
lea rdx, [0x1400e4ae8]
call fcn.140051800
xor eax, eax
lea r8, [rbp - 0x10]
mov qword [rbp - 0x10], rax
lea rdx, [0x1400e4af8]
mov qword [rbp - 8], rax
movzx eax, byte [0x140148f20]
mov dword [rbp - 0x10], eax
mov dword [rbp - 8], 0x80000002
call fcn.1400516e0
xor eax, eax
lea r8, [rbp - 0x10]
mov qword [rbp - 0x10], rax
lea rdx, [0x1400e4b08]
mov qword [rbp - 8], rax
mov eax, dword [0x140148f24]
mov dword [rbp - 0x10], eax
mov dword [rbp - 8], 0x80000301
call fcn.1400516e0
xor eax, eax
lea r8, [rbp - 0x10]
mov qword [rbp - 0x10], rax
lea rdx, [0x1400e4b18]
mov qword [rbp - 8], rax
movzx eax, byte [0x140148f28]
mov dword [rbp - 0x10], eax
mov dword [rbp - 8], 0x80000002
call fcn.1400516e0
xor eax, eax
lea r8, [rbp - 0x10]
mov qword [rbp - 0x10], rax
lea rdx, [0x1400e4b28]
mov qword [rbp - 8], rax
mov eax, dword [0x140148f2c]
mov dword [rbp - 0x10], eax
mov dword [rbp - 8], 0x80000301
call fcn.1400516e0
xor eax, eax
lea r8, [rbp - 0x10]
mov qword [rbp - 0x10], rax
lea rdx, [0x1400e4b40]
mov qword [rbp - 8], rax
movzx eax, byte [0x140148f30]
mov dword [rbp - 0x10], eax
mov dword [rbp - 8], 0x80000002
call fcn.1400516e0
xor eax, eax
lea r8, [rbp - 0x10]
mov qword [rbp - 0x10], rax
lea rdx, [0x1400e4b50]
mov qword [rbp - 8], rax
movzx eax, byte [0x140148f31]
mov dword [rbp - 0x10], eax
mov dword [rbp - 8], 0x80000002
call fcn.1400516e0
xor eax, eax
lea r8, [rbp - 0x10]
mov qword [rbp - 0x10], rax
lea rdx, [0x1400e4b60]
mov qword [rbp - 8], rax
movzx eax, byte [0x140148f32]
mov dword [rbp - 0x10], eax
mov dword [rbp - 8], 0x80000002
call fcn.1400516e0
xor eax, eax
mov qword [rbp - 0x10], rax
lea r8, [rbp - 0x10]
mov qword [rbp - 8], rax
lea rdx, [0x1400e4b78]
movzx eax, byte [0x140148f33]
mov dword [rbp - 0x10], eax
mov dword [rbp - 8], 0x80000002
call fcn.1400516e0
xor eax, eax
lea r8, [rbp - 0x10]
mov qword [rbp - 0x10], rax
lea rdx, [0x1400e4b88]
mov qword [rbp - 8], rax
movzx eax, byte [0x140148f34]
mov dword [rbp - 0x10], eax
mov dword [rbp - 8], 0x80000002
call fcn.1400516e0
xor eax, eax
lea r8, [rbp - 0x10]
mov qword [rbp - 0x10], rax
lea rdx, [0x1400e4b98]
mov qword [rbp - 8], rax
mov eax, dword [0x140148f38]
mov dword [rbp - 0x10], eax
mov dword [rbp - 8], 0x80000301
call fcn.1400516e0
xor eax, eax
lea r8, [rbp - 0x10]
mov qword [rbp - 0x10], rax
lea rdx, [0x1400e4ba8]
mov qword [rbp - 8], rax
mov eax, dword [0x140148f3c]
mov dword [rbp - 0x10], eax
mov dword [rbp - 8], 0x80000301
call fcn.1400516e0
add rsp, 0x30
pop rbp
jmp 0x140051020
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xe8]
sub rsp, 0x1c0
mov qword [rbp + 0x70], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x1400f7008]
xor rax, rsp
mov qword [rbp + 0xb8], rax
or edx, 0xffffffff
mov rcx, qword [0x140149a18]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [0x140149a10], 2
jne 0x1400516a1
mov rax, qword [0x140149a30]
cmp qword [rax], 0
je 0x1400516a1
cmp dword [rax + 8], 0
jle 0x1400516a1
mov rbx, qword [rax]
xor r15d, r15d
test rbx, rbx
je 0x1400510a8
cmp dword [rax + 8], r15d
jg 0x1400510ab
mov rbx, r15
mov qword [rbp - 0x28], r15
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x10], xmm0
mov qword [rbp - 0x20], r15
mov qword [rbp], r15
mov dword [rbp - 0x18], 0x200
mov r14, r15
mov qword [rbp - 0x30], r15
test rbx, rbx
je 0x140051652
mov dword [rbp - 0x20], r15d
or r8d, 0xffffffff
mov rdx, rbx
lea rcx, [rbp - 0x28]
call fcn.140053c90
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 3]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r14, rax
mov qword [rbp - 0x30], rax
lea rcx, [rax + 1]
test rcx, 0xfffffffffffffffe
jne 0x14005112d
mov r14, r15
jmp 0x140051652
xor eax, eax
mov qword [rbp + 0x80], rax
mov qword [rbp + 0x88], rax
mov qword [rbp + 0x90], rax
mov qword [rbp + 0x98], rax
mov qword [rbp + 0xa0], rax
mov qword [rbp + 0xa8], rax
mov dword [rbp + 0xb0], eax
movsd xmm0, qword [str.XBConfig]
movsd qword [rbp + 0x78], xmm0
movzx eax, byte [0x1400e5518]
mov byte [rbp + 0x80], al
mov esi, 1
mov dword [rbp + 0x88], esi
mov ebx, r15d
mov dword [rsp + 0x40], r15d
lea rdi, [rbp + 0x78]
mov r8d, 0x3c
sub r8d, ebx
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x40]
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400511c5
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x1400511c5
add ebx, eax
add rdi, rax
cmp ebx, 0x3c
jb 0x140051190
cmp qword [0x140149a38], 0
je 0x140051652
xor edi, edi
mov qword [rbp + 0x10], rdi
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x18], rdi
mov qword [rbp + 0x38], rdi
mov dword [rbp + 0x20], 0x200
mov r15d, edi
mov qword [rbp - 0x78], rdi
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x50], rdi
mov dword [rbp - 0x68], 0x200
mov qword [rbp + 0x40], rdi
movdqu xmmword [rbp + 0x58], xmm0
mov qword [rbp + 0x48], rdi
mov qword [rbp + 0x68], rdi
mov dword [rbp + 0x50], 0x200
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], rdi
mov dword [rbp - 0x80], 0x400
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x68], 0x400
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140.dll_Ordinal_316]
nop
mov ecx, edi
mov dword [rsp + 0x4c], ecx
mov rdx, qword [0x140149a38]
movsxd rax, dword [rdx + 8]
mov dword [rsp + 0x48], edi
mov r9d, edi
mov dword [rsp + 0x44], edi
mov qword [rbp - 0x38], rax
mov r8d, edi
mov qword [rbp - 0x48], rdi
mov r12, qword [rbp - 0x58]
mov r13, qword [rbp - 0x60]
test rax, rax
jle 0x14005156d
nop word [rax + rax]
mov rax, qword [rdx]
test rax, rax
je 0x140051554
test r8, r8
js 0x140051554
cmp r9d, dword [rdx + 8]
jge 0x140051554
mov rax, qword [rax + r8*8]
test rax, rax
je 0x140051554
nop dword [rax]
mov rbx, rax
mov rax, qword [rax + 0x30]
mov qword [rbp - 0x40], rax
test r15, r15
je 0x1400512e0
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r15, rdi
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x70], 0
test r13, r13
je 0x1400512fd
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r13, rdi
mov qword [rbp - 0x60], rdi
mov dword [rbp - 0x50], edi
test r12, r12
je 0x140051315
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r12, rdi
mov qword [rbp - 0x58], rdi
mov dword [rbp - 0x4c], edi
lea rcx, [rsp + 0x50]
cmp dword [rbx + 0x28], 0x80000005
jne 0x14005134d
lea rdx, [0x1400ddeb8]
call qword [sym.imp.mfc140.dll_Ordinal_1507]
mov dword [rsp + 0x48], esi
mov rdi, qword [rbx + 0x20]
test rdi, rdi
je 0x140051349
add rdi, 8
mov esi, dword [rdi - 4]
jmp 0x140051385
xor esi, esi
jmp 0x140051385
mov dword [rsp + 0x48], edi
lea rdx, [0x1400ddeb4]
call qword [sym.imp.mfc140.dll_Ordinal_1507]
lea r8, [rbp - 0x78]
mov rdx, rbx
call fcn.140051a40
mov esi, dword [rbp - 0x70]
mov r15, qword [rbp - 0x78]
test r15, r15
je 0x14005137d
test esi, esi
jle 0x14005137d
mov rdi, r15
mov r12, qword [rbp - 0x58]
mov r13, qword [rbp - 0x60]
cmp qword [rbx + 0x18], 0x10
jb 0x140051391
mov rcx, qword [rbx]
jmp 0x140051394
mov rcx, rbx
lea r9, str.XBName
lea r8, [rsp + 0x70]
mov edx, dword [rbx + 0x10]
call fcn.140055110
lea r9, str.XBValue
lea r8, [rsp + 0x58]
mov edx, esi
mov rcx, rdi
call fcn.140055110
xor ebx, ebx
mov dword [rsp + 0x40], ebx
lea rdi, [rsp + 0x78]
nop dword [rax]
mov r8d, 4
sub r8d, ebx
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140051409
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x140051409
add ebx, eax
add rdi, rax
cmp ebx, 4
jb 0x1400513d0
mov esi, dword [rsp + 0x78]
xor ebx, ebx
mov dword [rsp + 0x40], ebx
mov rdi, qword [rsp + 0x70]
test esi, esi
je 0x140051455
nop dword [rax]
mov r8d, esi
sub r8d, ebx
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140051455
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x140051455
add ebx, eax
add rdi, rax
cmp ebx, esi
jb 0x140051420
xor esi, esi
mov ebx, esi
mov dword [rsp + 0x40], esi
lea rdi, [rsp + 0x60]
mov r8d, 4
sub r8d, ebx
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x40]
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140051497
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x140051497
add ebx, eax
add rdi, rax
cmp ebx, 4
jb 0x140051462
mov ebx, esi
mov dword [rsp + 0x40], esi
lea rdi, [rsp + 0x48]
mov r8d, 4
sub r8d, ebx
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x40]
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400514d7
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x1400514d7
add ebx, eax
add rdi, rax
cmp ebx, 4
jb 0x1400514a2
mov esi, dword [rsp + 0x60]
xor ebx, ebx
mov dword [rsp + 0x40], ebx
mov rdi, qword [rsp + 0x58]
test esi, esi
je 0x140051525
nop word [rax + rax]
mov r8d, esi
sub r8d, ebx
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140051525
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x140051525
add ebx, eax
add rdi, rax
cmp ebx, esi
jb 0x1400514f0
mov ecx, dword [rsp + 0x4c]
inc ecx
mov dword [rsp + 0x4c], ecx
mov rax, qword [rbp - 0x40]
test rax, rax
mov esi, 1
lea edi, [rsi - 1]
jne 0x1400512c0
mov rdx, qword [0x140149a38]
mov r8, qword [rbp - 0x48]
mov r9d, dword [rsp + 0x44]
inc r9d
mov dword [rsp + 0x44], r9d
inc r8
mov qword [rbp - 0x48], r8
cmp r8, qword [rbp - 0x38]
jl 0x140051290
mov dword [rbp + 0xb0], ecx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, edi
mov dword [rsp + 0x44], edi
lea rdi, [rbp + 0x78]
nop
mov r8d, 0x3c
sub r8d, ebx
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400515c9
mov eax, dword [rsp + 0x44]
test eax, eax
je 0x1400515c9
add ebx, eax
add rdi, rax
cmp ebx, 0x3c
jb 0x140051590
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
mov r14d, ebx
mov rcx, qword [0x140149a18]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140.dll_Ordinal_1032]
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140051601
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbx
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14005161b
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbx
test r15, r15
je 0x140051633
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test r13, r13
je 0x140051641
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test r12, r12
je 0x140051650
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
nop
jmp 0x140051662
mov rcx, qword [0x140149a18]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov esi, r15d
test r14, r14
je 0x140051670
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x14005167f
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x14005168e
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x14005169d
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, esi
jmp 0x1400516b0
mov rcx, qword [0x140149a18]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor eax, eax
mov rcx, qword [rbp + 0xb8]
xor rcx, rsp
call fcn.1400bdec0
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret