Function at 0x1400290d0
Capabilities:
Clear file content
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xb0
mov rax, qword [0x14007f080]
xor rax, rsp
mov qword [rbp + 0xf], rax
mov r15, r9
mov qword [rbp - 0x31], r9
mov rsi, r8
mov qword [rbp - 0x39], r8
mov rdi, rdx
mov rax, qword [rbp + 0x7f]
mov qword [rbp - 0x41], rax
xor r13d, r13d
mov dword [rbp - 0x19], r13d
mov ebx, r13d
nop dword [rax]
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 1]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
mov qword [rbp - 0x49], rax
cmp rax, 0xffffffffffffffff
jne 0x140029178
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x14002925b
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0x10
jl 0x140029120
mov word [rbp - 0x29], 0xfeff
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x19]
mov r8d, 2
lea rdx, [rbp - 0x29]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
call fcn.140001a70
mov rcx, rax
test rax, rax
je 0x1400296f7
mov rax, qword [rax]
call qword [rax + 0x18]
lea r14, [rax + 0x18]
mov qword [rbp + 7], r14
mov dword [rbp - 0x51], r13d
mov rcx, qword [rsi]
mov rax, qword [rsi + 8]
sub rax, rcx
sar rax, 3
mov r13d, 0xffffffff
test rax, rax
je 0x140029686
xor edx, edx
mov esi, edx
nop
mov rcx, qword [rcx + rsi*8]
sub rcx, 0x18
call fcn.140004a00
lea rbx, [rax + 0x18]
mov qword [rbp - 0x11], rbx
mov rax, qword [r15]
mov rcx, qword [rax + rsi*8]
sub rcx, 0x18
call fcn.140004a00
lea rdi, [rax + 0x18]
mov qword [rbp - 1], rdi
mov rax, qword [rbp - 0x41]
mov rax, qword [rax]
mov rcx, qword [rax + rsi*8]
sub rcx, 0x18
call fcn.140004a00
lea rsi, [rax + 0x18]
mov qword [rbp - 9], rsi
xor eax, eax
mov r15d, eax
movzx eax, word [rbx]
test ax, ax
je 0x1400292ca
mov r12, rbx
xor r13d, r13d
movzx ecx, ax
call fcn.14004cfe0
test eax, eax
je 0x140029262
mov rax, r12
test r15, r15
cmovne rax, r15
mov r15, rax
jmp 0x140029265
xor al, al
jmp 0x1400296c5
mov r15, r13
add r12, 2
movzx eax, word [r12]
test ax, ax
jne 0x140029240
mov r13d, 0xffffffff
test r15, r15
je 0x1400292c6
sub r15, rbx
sar r15, 1
test r15d, r15d
js 0x140029702
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r15d
or eax, ecx
jge 0x1400292af
mov edx, r15d
lea rcx, [rbp - 0x11]
call fcn.140002b00
mov rbx, qword [rbp - 0x11]
cmp r15d, dword [rbx - 0xc]
jg 0x140029702
mov dword [rbx - 0x10], r15d
movsxd rax, r15d
xor edx, edx
mov word [rbx + rax*2], dx
mov r12, qword [rbp - 0x49]
lea rcx, [rbp - 0x11]
call fcn.140005e70
mov r15, rdi
xor eax, eax
mov ebx, eax
movzx eax, word [rdi]
test ax, ax
je 0x140029360
xor r12d, r12d
movzx ecx, ax
call fcn.14004cfe0
test eax, eax
je 0x140029300
mov rax, r15
test rbx, rbx
cmovne rax, rbx
mov rbx, rax
jmp 0x140029303
mov rbx, r12
add r15, 2
movzx eax, word [r15]
test ax, ax
jne 0x1400292e5
mov r12, qword [rbp - 0x49]
test rbx, rbx
je 0x140029360
sub rbx, rdi
sar rbx, 1
test ebx, ebx
js 0x140029702
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, ebx
or eax, ecx
jge 0x140029347
mov edx, ebx
lea rcx, [rbp - 1]
call fcn.140002b00
mov rdi, qword [rbp - 1]
cmp ebx, dword [rdi - 0xc]
jg 0x140029702
mov dword [rdi - 0x10], ebx
movsxd rax, ebx
xor r15d, r15d
mov word [rdi + rax*2], r15w
jmp 0x140029363
xor r15d, r15d
lea rcx, [rbp - 1]
call fcn.140005e70
mov rdi, rsi
mov rbx, r15
movzx eax, word [rsi]
test ax, ax
je 0x1400293f1
nop word [rax + rax]
movzx ecx, ax
call fcn.14004cfe0
test eax, eax
je 0x14002939b
mov rax, rdi
test rbx, rbx
cmovne rax, rbx
mov rbx, rax
jmp 0x14002939e
mov rbx, r15
add rdi, 2
movzx eax, word [rdi]
test ax, ax
jne 0x140029380
test rbx, rbx
je 0x1400293f1
sub rbx, rsi
sar rbx, 1
test ebx, ebx
js 0x140029702
mov ecx, 1
sub ecx, dword [rsi - 8]
mov eax, dword [rsi - 0xc]
sub eax, ebx
or eax, ecx
jge 0x1400293dd
mov edx, ebx
lea rcx, [rbp - 9]
call fcn.140002b00
mov rsi, qword [rbp - 9]
cmp ebx, dword [rsi - 0xc]
jg 0x140029702
mov dword [rsi - 0x10], ebx
movsxd rax, ebx
mov word [rsi + rax*2], r15w
lea rcx, [rbp - 9]
call fcn.140005e70
call fcn.140001a70
mov rcx, rax
test rax, rax
je 0x1400296ec
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x21], rax
test r14, r14
je 0x14002970d
mov rbx, qword [rbp - 0x11]
mov rax, rbx
mov r8, r14
sub r8, rbx
nop
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140029444
add rax, 2
test ecx, ecx
jne 0x140029430
test edx, edx
je 0x1400294f9
lea rcx, [rbx - 0x18]
add r14, 0xffffffffffffffe8
cmp rcx, r14
je 0x1400294a9
cmp dword [r14 + 0x10], 0
jl 0x140029499
mov rax, qword [r14]
cmp qword [rcx], rax
jne 0x140029499
call fcn.140004a00
mov rbx, rax
mov ecx, r13d
lock xadd dword [r14 + 0x10], ecx
sub ecx, 1
jg 0x14002948b
mov rcx, qword [r14]
mov r8, qword [rcx]
mov rdx, r14
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
mov qword [rbp + 7], rax
mov rbx, qword [rbp - 0x11]
jmp 0x1400294a9
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rbp + 7]
call fcn.140002da0
mov r8, rbx
lea rdx, str.__s__r_n
lea rcx, [rbp - 0x21]
call fcn.140002f70
mov rbx, qword [rbp - 0x21]
mov edi, dword [rbx - 0x10]
cmp dword [rbx - 8], 1
jle 0x1400294d8
mov edx, edi
lea rcx, [rbp - 0x21]
call fcn.140002cd0
mov rbx, qword [rbp - 0x21]
lea r8d, [rdi + rdi]
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x19]
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400295f8
mov r9, qword [rbp - 9]
mov r8, qword [rbp - 1]
lea rdx, str._s_s_r_n
lea rcx, [rbp - 0x21]
call fcn.140002f70
mov rbx, qword [rbp - 0x21]
cmp dword [rbx - 8], 1
jle 0x14002952b
mov edx, dword [rbx - 0x10]
lea rcx, [rbp - 0x21]
call fcn.140002cd0
mov rbx, qword [rbp - 0x21]
mov r8d, dword [rbx - 0x10]
add r8d, r8d
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x19]
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400295f8
lea rdx, [rbx - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002956a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 9]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140029589
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 1]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400295a8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x11]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400295c6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edx, dword [rbp - 0x51]
inc edx
mov dword [rbp - 0x51], edx
mov rax, qword [rbp - 0x39]
mov rcx, qword [rax]
mov rax, qword [rax + 8]
sub rax, rcx
sar rax, 3
mov esi, edx
mov r14, qword [rbp + 7]
cmp rsi, rax
jae 0x140029686
mov r15, qword [rbp - 0x31]
jmp 0x1400291e0
test r12, r12
je 0x140029607
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rdx, [rbx - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140029622
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 9]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140029641
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 1]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140029660
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x11]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002967e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor bl, bl
mov r14, qword [rbp + 7]
jmp 0x1400296a8
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test r12, r12
je 0x1400296a6
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
lea rdx, [r14 - 0x18]
lock xadd dword [rdx + 0x10], r13d
sub r13d, 1
jg 0x1400296c2
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
movzx eax, bl
mov rcx, qword [rbp + 0xf]
xor rcx, rsp
call fcn.14003f1d0
mov rbx, qword [rsp + 0xf0]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.1400018b0
nop
mov ecx, 0x80004005
call fcn.1400018b0
nop
mov ecx, 0x80070057
call fcn.1400018b0
nop
mov ecx, 0x80004005
call fcn.1400018b0
int3