Function at 0x41a4f0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov ebx, dword [rcx + 0x150]
mov rsi, rcx
cmp ebx, 0xffffffff
je 0x41a7d0
mov r12, qword [rcx + 0x180]
mov ecx, ebx
call qword [sym.imp.msvcrt.dll__get_osfhandle]
cmp rax, 0xffffffffffffffff
mov rdi, rax
je 0x41a990
lea rcx, [0x006e2400]
movzx ebp, bl
call sub.KERNEL32.dll_EnterCriticalSection
mov eax, ebp
lea r9, [0x00459400]
mov rcx, rax
shl rcx, 4
add rcx, r9
mov r8, qword [rcx]
mov rdx, r8
and edx, 0xf
jne 0x41a900
test r8, r8
je 0x41a900
mov rax, qword [rcx + 8]
cmp ebx, dword [rax]
je 0x41aae9
mov edx, 0x10
cmp ebx, dword [rax + 0x28]
je 0x41ab8e
cmp rdx, 2
je 0x41a694
cmp ebx, dword [rax + 0x50]
je 0x41ab7d
cmp rdx, 3
je 0x41a694
cmp ebx, dword [rax + 0x78]
je 0x41ab84
cmp rdx, 4
je 0x41a694
cmp ebx, dword [rax + 0xa0]
je 0x41ab61
cmp rdx, 5
je 0x41a694
cmp ebx, dword [rax + 0xc8]
je 0x41ab68
cmp rdx, 6
je 0x41a694
cmp ebx, dword [rax + 0xf0]
je 0x41ab6f
cmp rdx, 7
je 0x41a694
cmp ebx, dword [rax + 0x118]
je 0x41ab76
cmp rdx, 8
je 0x41a694
cmp ebx, dword [rax + 0x140]
je 0x41ab00
cmp rdx, 9
je 0x41a694
cmp ebx, dword [rax + 0x168]
je 0x41ab30
cmp rdx, 0xa
je 0x41a694
cmp ebx, dword [rax + 0x190]
je 0x41ab37
cmp rdx, 0xb
je 0x41a694
cmp ebx, dword [rax + 0x1b8]
je 0x41ab3e
cmp rdx, 0xc
je 0x41a694
cmp ebx, dword [rax + 0x1e0]
je 0x41ab45
cmp rdx, 0xd
je 0x41a694
cmp ebx, dword [rax + 0x208]
je 0x41ab4c
cmp rdx, 0xe
je 0x41a694
cmp ebx, dword [rax + 0x230]
je 0x41ab53
cmp rdx, 0x10
jne 0x41a694
cmp ebx, dword [rax + 0x258]
je 0x41ab5a
mov rax, qword [rax + 0x280]
test rax, rax
jne 0x41a6ad
jmp 0x41a7f0
test cl, cl
je 0x41a777
cmp ebx, dword [rax]
je 0x41a9d0
cmp ebx, dword [rax + 0x28]
je 0x41a9e0
cmp ebx, dword [rax + 0x50]
je 0x41a9f0
cmp ebx, dword [rax + 0x78]
je 0x41aa00
cmp ebx, dword [rax + 0xa0]
je 0x41aa10
cmp ebx, dword [rax + 0xc8]
je 0x41aa20
cmp ebx, dword [rax + 0xf0]
je 0x41aa30
cmp ebx, dword [rax + 0x118]
je 0x41aa40
cmp ebx, dword [rax + 0x140]
je 0x41aa50
cmp ebx, dword [rax + 0x168]
je 0x41aa60
cmp ebx, dword [rax + 0x190]
je 0x41aa70
cmp ebx, dword [rax + 0x1b8]
je 0x41aa80
cmp ebx, dword [rax + 0x1e0]
je 0x41aa90
cmp ebx, dword [rax + 0x208]
je 0x41aaa0
cmp ebx, dword [rax + 0x230]
je 0x41aab0
cmp ebx, dword [rax + 0x258]
je 0x41aac0
mov ecx, 1
xor edx, edx
mov rax, qword [rax + 0x280]
test rax, rax
jne 0x41a6a5
test rdx, rdx
je 0x41a7f0
mov rax, qword [rdx + 8]
lea rcx, [0x006e2400]
mov qword [rsp + 0x50], rax
mov rax, qword [rdx + 0x10]
mov qword [rsp + 0x58], rax
mov rax, qword [rdx + 0x18]
mov qword [rsp + 0x60], rax
mov rax, qword [rdx + 0x20]
mov qword [rsp + 0x68], rax
call sub.KERNEL32.dll_LeaveCriticalSection
lea r8, [rsp + 0x50]
mov rdx, rdi
mov rcx, rsi
call fcn.004192b0
nop
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rcx + 0x88], 0xfffffffffffff00d
mov dword [rcx + 0x14c], 6
jmp 0x41a7bd
lea rcx, [0x006e2400]
call sub.KERNEL32.dll_LeaveCriticalSection
cmp r12, 0xffffffffffffffff
je 0x41a930
mov rax, qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov qword [rsp + 0x50], 0
mov r9d, 1
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
lea r8, [rsp + 0x48]
mov qword [rsp + 0x68], 0
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x38], rax
xor r14d, r14d
xor r15d, r15d
call rax
lea r13, [rsp + 0x50]
mov dword [rsp + 0x34], eax
lea rbp, [rsp + 0x44]
mov rbx, qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x41a872
cmp r14d, dword [rsi + 0x170]
jae 0x41a9b2
mov eax, r15d
mov r9, rbp
mov rcx, rdi
add rax, r12
mov dword [rsp + 0x60], eax
sar rax, 0x20
mov dword [rsp + 0x64], eax
mov eax, r14d
add r14d, 1
shl rax, 4
add rax, qword [rsi + 0x178]
mov rdx, qword [rax + 8]
mov qword [rsp + 0x20], r13
mov r8d, dword [rax]
call rbx
add r15d, dword [rsp + 0x44]
test eax, eax
jne 0x41a865
mov edx, dword [rsp + 0x34]
xor ebx, ebx
test edx, edx
jne 0x41aacf
test r15d, r15d
jne 0x41a9be
test bl, bl
jne 0x41a9be
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
mov ecx, eax
je 0x41aaf1
mov dword [rsi + 0x14c], eax
call fcn.00416500
cdqe
mov qword [rsi + 0x88], rax
jmp 0x41a7bd
shl rax, 4
test rdx, rdx
mov rax, qword [r9 + rax + 8]
je 0x41a694
cmp ebx, dword [rax]
je 0x41aae9
cmp rdx, 1
jne 0x41a579
jmp 0x41a694
xor r12d, r12d
xor r15d, r15d
lea rbp, [rsp + 0x44]
mov rbx, qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x41a94d
cmp dword [rsi + 0x170], r12d
jbe 0x41a9be
mov eax, r12d
mov r9, rbp
mov rcx, rdi
shl rax, 4
add rax, qword [rsi + 0x178]
add r12d, 1
mov rdx, qword [rax + 8]
mov qword [rsp + 0x20], 0
mov r8d, dword [rax]
call rbx
add r15d, dword [rsp + 0x44]
test eax, eax
jne 0x41a944
xor ebx, ebx
jmp 0x41a8c1
mov dword [rsi + 0x14c], 6
mov ecx, 6
call fcn.00416500
cdqe
mov qword [rsi + 0x88], rax
jmp 0x41a7bd
mov eax, dword [rsp + 0x34]
test eax, eax
jne 0x41aaca
mov eax, r15d
mov qword [rsi + 0x88], rax
jmp 0x41a7bd
xor edx, edx
add rdx, rax
sete cl
jmp 0x41a767
mov edx, 0x28
jmp 0x41a9d2
mov edx, 0x50
jmp 0x41a9d2
mov edx, 0x78
jmp 0x41a9d2
mov edx, 0xa0
jmp 0x41a9d2
mov edx, 0xc8
jmp 0x41a9d2
mov edx, 0xf0
jmp 0x41a9d2
mov edx, 0x118
jmp 0x41a9d2
mov edx, 0x140
jmp 0x41a9d2
mov edx, 0x168
jmp 0x41a9d2
mov edx, 0x190
jmp 0x41a9d2
mov edx, 0x1b8
jmp 0x41a9d2
mov edx, 0x1e0
jmp 0x41a9d2
mov edx, 0x208
jmp 0x41a9d2
mov edx, 0x230
jmp 0x41a9d2
mov edx, 0x258
jmp 0x41a9d2
mov ebx, 1
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x48]
mov rcx, rdi
mov rax, qword [rsp + 0x38]
call rax
jmp 0x41a8c1
mov rdx, rax
jmp 0x41a777
mov ecx, 0x3ec
mov eax, 0x3ec
jmp 0x41a8e3
mov edx, 8
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8]
mov rax, qword [rax + 0x280]
test rax, rax
je 0x41a777
test rdx, rdx
je 0x41a6ad
jmp 0x41a777
mov edx, 9
jmp 0x41ab05
mov edx, 0xa
jmp 0x41ab05
mov edx, 0xb
jmp 0x41ab05
mov edx, 0xc
jmp 0x41ab05
mov edx, 0xd
jmp 0x41ab05
mov edx, 0xe
jmp 0x41ab05
mov edx, 0xf
jmp 0x41ab05
mov edx, 4
jmp 0x41ab05
mov edx, 5
jmp 0x41ab05
mov edx, 6
jmp 0x41ab05
mov edx, 7
jmp 0x41ab05
mov edx, 2
jmp 0x41ab05
mov edx, 3
jmp 0x41ab05
mov edx, 1
jmp 0x41ab05