Function at 0x1000d77b8
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push r13
push r14
push r15
sub rsp, 0x1c0
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], r12
mov rax, qword [0x10010f190]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
xor r13d, r13d
mov dword [rsp + 0x48], r13d
and dword [rsp + 0x50], r13d
xor r12d, r12d
mov qword [rsp + 0x40], r12
lea rcx, [0x10003bf30]
call qword [sym.imp.msvcrt.dll_void____cdecl___unsigned_int__struct__EXCEPTION_POINTERS____ptr64____cdecl__set_se_translator_void____cdecl___unsigned_int__struct__EXCEPTION_POINTERS____ptr64__]
mov rbx, rax
mov qword [rsp + 0x58], rax
cmp dword [0x10011be1c], r12d
jne 0x1000d783f
lea rcx, [0x10011bc58]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea esi, [r13 + 1]
mov dword [0x10011be1c], esi
mov dword [rsp + 0x50], esi
jmp 0x1000d7844
mov esi, 1
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_void____cdecl___unsigned_int__struct__EXCEPTION_POINTERS____ptr64____cdecl__set_se_translator_void____cdecl___unsigned_int__struct__EXCEPTION_POINTERS____ptr64__]
nop
jmp 0x1000d7883
cmp dword [0x10011be1c], 0
je 0x1000d789c
lea rcx, [0x10011bc58]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r13d, esi
lea r15, [0x10000f6f1]
mov dword [rsp + 0x58], esi
mov r8d, reloc.certcli.dll_Ordinal_260
lea rdx, [rsp + 0xa0]
mov rcx, r15
call fcn.1000b5b6c
test eax, eax
je 0x1000d78d5
xor r9d, r9d
mov r8d, eax
mov edx, 0x1ca0192
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000d78dd
lea r15, [rsp + 0xa0]
xor ebx, ebx
mov ecx, 0x80000000
call sub.certcli.dll_Ordinal_205
mov r14d, eax
test eax, eax
je 0x1000d7a0e
lea rax, [0x10002b524]
lea rdx, [0x10002b528]
cmp dword [rsp + 0x58], 0
cmovne rdx, rax
mov rcx, r15
call qword [sym.imp.msvcrt.dll_fopen]
mov rbx, rax
test rax, rax
je 0x1000d798d
cmp dword [rsp + 0x58], 0
je 0x1000d7a0e
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, rax
call qword [sym.imp.msvcrt.dll_fseek]
test eax, eax
jne 0x1000d7970
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_ftell]
cmp eax, 0x80000
jl 0x1000d7970
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_fclose]
and dword [rsp + 0x58], 0
xor ebx, ebx
mov ecx, 0x80000000
call sub.certcli.dll_Ordinal_205
mov r14d, eax
test eax, eax
jne 0x1000d78f4
jmp 0x1000d7a0e
mov r9, rbx
mov r8, rsi
mov edx, 0x4a
lea rcx, [0x10000be70]
call qword [sym.imp.msvcrt.dll_fwrite]
jmp 0x1000d7a0e
call qword [sym.imp.msvcrt.dll__errno]
mov ebx, dword [rax]
mov r8, r15
lea rdx, [0x10002b530]
xor ecx, ecx
call fcn.1000b5d00
and qword [rsp + 0x40], 0
or r8d, 0xffffffff
mov rdx, r15
lea rcx, [rsp + 0x40]
call fcn.1000b9188
xor r9d, r9d
mov r8d, ebx
mov edx, 0x1de0192
mov rcx, qword [rsp + 0x40]
call fcn.1000b51b8
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ebx, 0x80070002
lea rax, [0x10002b53c]
lea rcx, [0x10002b544]
cmp dword [rsp + 0x58], 0
cmovne rcx, rax
xor r9d, r9d
mov r8d, ebx
mov edx, 0x1e00192
call fcn.1000b51b8
jmp 0x1000d7bc5
mov rcx, qword [0x10011be10]
test rcx, rcx
je 0x1000d7a20
call qword [sym.imp.msvcrt.dll_fclose]
mov qword [0x10011be10], rbx
test r14d, r14d
je 0x1000d7a3e
mov r8, r15
lea rdx, [0x10002b530]
mov cl, sil
call fcn.1000b5d00
lea rcx, [0x10011bc58]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor r13d, r13d
lea rcx, [rsp + 0x40]
call fcn.1000db590
mov edx, 0x1ff
mov r8d, 0x3b4
lea r14d, [rdx - 0x6d]
mov ecx, r14d
call fcn.1000d756c
lea edx, [r13 + 4]
lea rcx, [0x1000d7648]
call fcn.1000d7740
lea r11, [0x1000d7708]
mov qword [0x10011be20], r11
and qword [rsp + 0x38], r13
and qword [rsp + 0x30], r13
mov r12, qword [rsp + 0x40]
mov qword [rsp + 0x28], r12
and dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea edx, [r14 + 0x72]
mov ecx, r14d
call fcn.1000d708c
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CompareFileTime]
test eax, eax
jle 0x1000d7b16
mov rcx, qword [rsp + 0x48]
sub rcx, qword [rsp + 0x40]
movabs rbx, 0xd6bf94d5e57a42bd
mov rax, rbx
mul rcx
shr rdx, 0x17
test edx, edx
jne 0x1000d7b4e
jmp 0x1000d7b20
movabs rbx, 0xd6bf94d5e57a42bd
xor esi, esi
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CompareFileTime]
test eax, eax
jg 0x1000d7b3a
xor edx, edx
jmp 0x1000d7b4e
mov rcx, qword [rsp + 0x40]
sub rcx, qword [rsp + 0x48]
mov rax, rbx
mul rcx
shr rdx, 0x17
mov eax, edx
pxor xmm0, xmm0
cvtsi2ss xmm0, rax
divss xmm0, dword [0x10002e918]
unpcklps xmm0, xmm0
cvtps2pd xmm1, xmm0
lea rax, [0x10000f274]
lea r9, [0x10000f0b4]
test esi, esi
cmovne r9, rax
movsd qword [rsp + 0x20], xmm1
lea r8, [0x10002b550]
mov edx, reloc.Cabinet.dll_FDICreate
lea rcx, [rsp + 0x78]
call fcn.100038358
and qword [rsp + 0x38], r13
and qword [rsp + 0x30], r13
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
mov edx, 0x208
mov ecx, r14d
call fcn.1000d708c
xor ebx, ebx
test r13d, r13d
je 0x1000d7bd7
lea rcx, [0x10011bc58]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
je 0x1000d7bf6
cmp dword [rsp + 0x50], 0
je 0x1000d7bf6
lea rcx, [0x10011bc58]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
and dword [0x10011be1c], 0
test r12, r12
je 0x1000d7c04
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1000ef870
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov r12, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop r13
ret