Function at 0x1400472e0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
movsxd rax, dword [0x1401bafe8]
mov rbx, rcx
imul rcx, rax, 0x38
mov rax, qword [0x140175020]
test dword [rcx + rax + 0x18], 0x10000
je 0x140047328
mov r8, qword [rcx + rax]
lea rcx, str._s_MONITOR:_s:
mov rdx, qword [section..data]
call fcn.140002310
lea rcx, str.Writing_section_0_n
call fcn.140001fb0
call fcn.140008a90
cmp dword [rbx + 0x100], 0
je 0x140047373
movsxd rax, dword [rbx + 0x4c]
mov edx, 0x40
mov rcx, qword [rbx + 0x28]
add rax, 0x14
lea r8d, [rdx - 0x41]
lea r9, [rbx + rax*4]
call fcn.14007d820
test eax, eax
je 0x1400473bd
lea r8, [0x1401895e0]
mov edx, 1
mov ecx, 0x2b8f
add rsp, 0x60
pop rbx
jmp fcn.140001480
mov rax, qword [rbx + 8]
test dword [rax + 0x68], 0x800
jne 0x1400473bd
movsxd rax, dword [rbx + 0x4c]
mov edx, 0x40
mov rcx, qword [rbx + 0x28]
add rax, 0x14
lea r8d, [rdx - 0x41]
lea r9, [rbx + rax*4]
call fcn.14007d5a0
test eax, eax
je 0x1400473bd
lea r8, [0x140189610]
mov edx, 1
mov ecx, 0x2b8f
add rsp, 0x60
pop rbx
jmp fcn.140001480
mov edx, 2
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x58], rsi
mov rcx, rbx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], r14
lea r9d, [rdx - 3]
lea r8d, [rdx + 2]
call qword [0x1401baf10]
xor r9d, r9d
mov edx, 0x9b
mov rcx, rbx
lea r8d, [r9 - 1]
call qword [0x1401baf60]
mov rax, qword [rbx + 8]
mov ecx, dword [rax + 0x68]
movsxd rax, dword [rbx + 0x4c]
shl ecx, 0xd
not ecx
and ecx, 0x1000000
mov dword [rbx + rax*4 + 0x68], ecx
inc dword [rbx + 0x4c]
mov rax, qword [rbx + 0x18]
mov rdi, qword [rax + 0x10]
test rdi, rdi
je 0x1400474bd
nop dword [rax]
mov rsi, qword [rdi + 0x10]
test rsi, rsi
je 0x1400474b1
mov ebp, 4
call fcn.14001f740
mov ecx, dword [reloc.WS2_32.dll_accept]
lea r9, [rsp + 0x70]
mov edx, eax
mov r8, rsi
call fcn.14001e550
test rax, rax
je 0x140047464
mov ebp, dword [rsp + 0x70]
add ebp, 5
mov r9d, 0xffffffff
mov r8d, ebp
mov rcx, rbx
lea edx, [r9 + 0x2b]
call qword [0x1401baf10]
test eax, eax
jne 0x1400478c4
mov r9, rsi
lea edx, [rax + 0x7d]
lea r8d, [rax - 1]
mov rcx, rbx
call qword [0x1401baf28]
test eax, eax
jne 0x1400478c4
lea edx, [rax + 0x2a]
mov rcx, rbx
call qword [0x1401baf18]
test eax, eax
jne 0x1400478c4
mov rdi, qword [rdi]
test rdi, rdi
jne 0x140047430
mov rax, qword [rbx + 8]
xor esi, esi
xor edi, edi
mov dword [rsp + 0x78], esi
mov dword [rsp + 0x70], esi
mov rdx, qword [rax + 0x1e8]
test rdx, rdx
je 0x1400475ca
mov rdx, qword [rdx + 0x30]
test rdx, rdx
je 0x1400475ca
nop word [rax + rax]
cmp dword [rdx + 0x60], 0xfffffffd
lea eax, [rsi + 1]
cmovle eax, esi
cmp dword [rdx + 0x60], 0xffffffff
movsxd rsi, eax
cmove rdi, rdx
mov rdx, qword [rdx]
test rdx, rdx
jne 0x1400474f0
test eax, eax
je 0x1400475ca
mov rcx, rsi
shl rcx, 3
call fcn.140001bb0
lea ecx, [rsi*4]
mov rbp, rax
movsxd rcx, ecx
shl rcx, 3
call fcn.140001bb0
xor esi, esi
mov r14, rax
test rdi, rdi
je 0x14004756d
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x78]
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, rdi
mov rcx, rbx
mov qword [rsp + 0x20], rbp
call fcn.140040c20
mov esi, 1
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 0x1e8]
mov rdi, qword [rcx + 0x30]
test rdi, rdi
je 0x1400475b8
cmp dword [rdi + 0x60], 0xfffffffe
jne 0x1400475b0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x78]
mov r8d, esi
mov qword [rsp + 0x20], rbp
mov rdx, rdi
mov rcx, rbx
call fcn.140040c20
inc esi
mov rdi, qword [rdi]
test rdi, rdi
jne 0x140047581
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rbx
call fcn.140041ee0
test eax, eax
jne 0x1400478c4
mov rcx, rbx
call fcn.140041050
test eax, eax
jne 0x1400478c4
mov rax, qword [rbx + 0x18]
mov rdi, qword [rax + 0x18]
test rdi, rdi
je 0x140047670
movsxd rax, dword [0x1401bafe8]
imul rdx, rax, 0x38
mov rax, qword [0x140175020]
test dword [rdx + rax + 0x18], 0x20000
je 0x14004765d
mov r8, qword [rdx + rax]
lea rcx, str._s_MONITOR:_s:
mov rdx, qword [section..data]
call fcn.140002310
lea rcx, str.Writing_feature_tree:_n
call fcn.140001fb0
nop word [rax + rax]
mov edx, 4
mov rcx, rdi
call fcn.140082d20
mov rdi, qword [rdi]
test rdi, rdi
jne 0x140047640
mov rax, qword [rbx + 0x18]
mov rdi, qword [rax + 0x18]
mov rdx, rdi
mov rcx, rbx
call fcn.140042470
test eax, eax
jne 0x1400478c4
mov rax, qword [rbx + 8]
test dword [rax + 0x68], 0x800
jne 0x1400476fb
cmp qword [rbx + 0xe8], 0
je 0x1400476fb
mov r8d, dword [rbx + 0xfc]
mov edx, 0xd2
add r8d, 4
mov r9d, 0xffffffff
mov rcx, rbx
call qword [0x1401baf10]
mov r9d, dword [rbx + 0xf8]
mov edx, 0xab
mov r8d, 0xffffffff
mov rcx, rbx
call qword [0x1401baf60]
mov rdi, qword [rbx + 0xe8]
test rdi, rdi
je 0x1400476e5
nop dword [rax]
mov rdx, qword [rdi + 8]
mov rcx, rbx
call qword [0x1401baf20]
mov rdi, qword [rdi]
test rdi, rdi
jne 0x1400476d0
mov edx, 0xd2
mov rcx, rbx
call qword [0x1401baf18]
test eax, eax
jne 0x1400478c4
mov rax, qword [rbx + 8]
test dword [rax + 0x68], 0x40000
je 0x140047718
mov rcx, rbx
call fcn.140045e80
test eax, eax
jne 0x1400478c4
mov rax, qword [rbx + 8]
lea rdx, str.loadAttr
mov r8d, 1
mov rcx, qword [rax]
mov rcx, qword [rcx + 8]
call fcn.1400272a0
test eax, eax
je 0x14004774f
cmp dword [rbx + 0x40], 5
jl 0x14004774f
mov rcx, rbx
call fcn.140049d30
test eax, eax
jne 0x1400478c4
mov rax, qword [rbx + 0x18]
mov r14, qword [rax]
test r14, r14
je 0x1400478b4
mov qword [rsp + 0x40], r15
mov rax, qword [r14 + 0x18]
xor ebp, ebp
test rax, rax
je 0x14004777a
nop
mov rax, qword [rax]
inc ebp
test rax, rax
jne 0x140047770
lea r15, [r14 + 0x38]
mov r8d, 0x40
mov rcx, r15
lea rdx, [0x140158cb0]
lea edi, [rbp*4 + 0x1e]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
lea r8d, [rdi + 0x40]
mov edx, 8
mov rcx, rbx
setne sil
test sil, sil
cmove r8d, edi
lea r9d, [rdx - 9]
call qword [0x1401baf10]
movzx r9d, byte [r14 + 0x7c]
mov edx, reloc.WS2_32.dll_gethostname
mov rcx, rbx
lea r8d, [rdx - 0x3a]
call qword [0x1401baf40]
mov rax, qword [rbx + 0x20]
mov edx, 0x3a
add rax, 0x10
mov rcx, rbx
mov qword [rsp + 0x20], rax
lea r9d, [rdx - 0x34]
lea r8d, [rdx - 0x3b]
call qword [0x1401baf80]
mov edx, 0x76
movzx r9d, sil
mov rcx, rbx
lea r8d, [rdx - 0x77]
call qword [0x1401baf40]
test sil, sil
je 0x14004782d
mov edx, 0x75
mov qword [rsp + 0x20], r15
mov rcx, rbx
lea r9d, [rdx - 0x65]
lea r8d, [rdx - 0x76]
call qword [0x1401baf80]
mov r9d, ebp
mov edx, 0x93
mov r8d, 0xffffffff
mov rcx, rbx
call qword [0x1401baf60]
mov rdi, qword [r14 + 0x18]
test rdi, rdi
je 0x140047877
nop dword [rax]
mov r9d, dword [rbx + 0x80]
mov edx, reloc.WS2_32.dll_inet_addr
mov rcx, rbx
lea r8d, [rdx - 0xc]
call qword [0x1401baf60]
inc dword [rbx + 0x80]
mov rdi, qword [rdi]
test rdi, rdi
jne 0x140047850
lea rdx, [r14 + 0x20]
mov rcx, rbx
call fcn.140040ee0
mov rdx, qword [r14 + 0x30]
test rdx, rdx
je 0x140047894
mov rcx, rbx
call fcn.1400467e0
mov edx, 8
mov rcx, rbx
call qword [0x1401baf18]
mov r14, qword [r14 + 8]
test r14, r14
jne 0x140047764
mov r15, qword [rsp + 0x40]
mov edx, 2
mov rcx, rbx
call qword [0x1401baf18]
jmp 0x1400478c9
mov eax, 0xffffffff
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x80]
mov r14, qword [rsp + 0x48]
add rsp, 0x60
pop rbx
ret