Function at 0x7ff7bfff4d10
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rax, qword [0x7ff7c01ca008]
xor rax, rsp
mov qword [rbp + 0xc0], rax
mov r15d, 5
xor r12d, r12d
test byte [0x7ff7c01d8960], 1
lea r13, [r15 - 6]
jne 0x7ff7bfff5025
mov rcx, qword [0x7ff7c01d8968]
test rcx, rcx
je 0x7ff7bfff4d92
mov rcx, qword [rcx + 8]
lea r8, [rsp + 0x78]
xor edx, edx
call fcn.7ff7c00bf0f0
mov rcx, qword [rsp + 0x78]
test eax, eax
cmovs rcx, r12
mov qword [0x7ff7c01d30c0], rcx
jmp 0x7ff7bfff4d99
mov rcx, qword [0x7ff7c01d30c0]
test rcx, rcx
jne 0x7ff7bfff4ea9
xor eax, eax
lock cmpxchg qword [0x7ff7c01d69a0], r12
mov rdi, rax
je 0x7ff7bfff4db8
lock inc dword [rax - 8]
jmp 0x7ff7bfff4de3
mov rcx, qword [sym.ProcessHacker.exe_PhInstanceHandle]
xor edx, edx
call sym.ProcessHacker.exe_PhGetDllFileName
mov rdi, rax
xor eax, eax
lock cmpxchg qword [0x7ff7c01d69a0], rdi
jne 0x7ff7bfff4dda
lock inc dword [rdi - 8]
test rdi, rdi
je 0x7ff7bfff4e7e
mov rbx, qword [0x7ff7c01cd620]
add rbx, qword [rdi]
mov rdx, qword [0x7ff7c01d3b58]
lea rcx, [rbx + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rsi, rax
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov word [rcx + rbx], r12w
mov r8, qword [rdi]
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
call fcn.7ff7c0125120
mov rcx, qword [rdi]
add rcx, qword [rsi + 8]
mov r8, qword [0x7ff7c01cd620]
mov rdx, qword [0x7ff7c01cd628]
call fcn.7ff7c0125120
mov rcx, qword [rsi + 8]
call sym.ProcessHacker.exe_PhDoesFileExistsWin32
test al, al
je 0x7ff7bfff4e52
mov qword [0x7ff7c01d30c0], rsi
nop
jmp 0x7ff7bfff4e68
lea rcx, [rsi - 0x10]
mov eax, r13d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x7ff7bfff4e68
call fcn.7ff7c00c6290
lea rcx, [rdi - 0x10]
mov eax, r13d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x7ff7bfff4e7e
call fcn.7ff7c00c6290
mov rcx, qword [0x7ff7c01d30c0]
test rcx, rcx
jne 0x7ff7bfff4ea9
lea rcx, [0x7ff7c01cd5d0]
call sym.ProcessHacker.exe_PhExpandEnvironmentStrings
mov qword [0x7ff7c01d30c0], rax
mov rcx, rax
test rax, rax
je 0x7ff7bfff5025
mov rcx, qword ds:[rcx + 8]
call sym.ProcessHacker.exe_PhLoadSettings
cmp eax, 0xc0000102
jne 0x7ff7bfff5025
lea rax, [0x7ff7c0179ac0]
mov edx, 6
lea r9, [0x7ff7c0179b50]
mov qword [rsp + 0x20], rax
xor ecx, ecx
mov r8d, 0xffff
call sym.ProcessHacker.exe_PhShowMessage2
cmp eax, 6
jne 0x7ff7bfff5001
mov eax, dword [0x7ff7c0179be8]
lea rdx, ds:[rbp - 0x78]
movups xmm0, xmmword [0x7ff7c0179bd8]
mov dword [rbp + 0xb8], eax
xor r9d, r9d
movzx eax, word [0x7ff7c0179bec]
xor r8d, r8d
mov word [rbp + 0xbc], ax
mov rax, qword [0x7ff7c01d30c0]
movups xmmword [rbp + 0xa8], xmm0
mov rcx, qword [rax + 8]
call qword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U_WithStatus]
test eax, eax
js 0x7ff7bfff5025
mov dword [rsp + 0x50], r12d
lea rax, [rbp - 0x78]
mov qword [rsp + 0x48], r12
lea r9, [rbp - 0x38]
mov dword [rsp + 0x40], 0x60
lea r8, [rbp - 0x68]
mov dword [rsp + 0x38], 4
lea rcx, [rbp - 0x80]
mov dword [rsp + 0x30], r15d
xorps xmm0, xmm0
mov dword [rsp + 0x28], 0x80
mov edx, 0x120116
mov qword [rsp + 0x20], r12
mov dword [rbp - 0x68], 0x30
mov qword [rbp - 0x60], r12
mov dword [rbp - 0x50], 0x40
mov qword [rbp - 0x58], rax
movdqu xmmword [rbp - 0x48], xmm0
call qword [sym.imp.ntdll.dll_NtCreateFile]
lea rcx, [rbp - 0x78]
mov ebx, eax
call qword [sym.imp.ntdll.dll_RtlFreeAnsiString]
nop
test ebx, ebx
js 0x7ff7bfff5025
mov rbx, qword ds:[rbp - 0x80]
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x40], r12
xor r9d, r9d
mov qword [rsp + 0x38], r12
xor r8d, r8d
mov dword [rsp + 0x30], 0x15
xor edx, edx
mov qword [rsp + 0x28], rax
mov rcx, rbx
lea rax, [rbp - 0x28]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtWriteFile]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x7ff7bfff5025
mov rcx, qword [0x7ff7c01d30c0]
mov eax, r13d
add rcx, 0xfffffffffffffff0
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x7ff7bfff501e
call fcn.7ff7c00c6290
mov qword [0x7ff7c01d30c0], r12
lea rax, [0x7ff7c0179bf0]
mov qword [rsp + 0x68], 0x1a
mov qword [rsp + 0x70], rax
xor eax, eax
lock cmpxchg qword [0x7ff7c01d3dc0], r15
je 0x7ff7bfff5055
lea rcx, [0x7ff7c01d3dc0]
nop
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rsi, qword [0x7ff7c01d78b0]
lea rcx, ds:[rbp - 0x18]
movups xmm0, xmmword [rsp + 0x68]
mov rax, qword [rsi + 0x10]
movups xmmword [rbp - 0x10], xmm0
call qword [case.0x7ff7c00c1f48.0]
mov ecx, dword ds:[rsi + 0x18]
btr eax, 0x1f
mov r14d, eax
dec ecx
mov rax, qword [rsi + 0x20]
and rcx, r14
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x7ff7bfff50d6
nop word [rax + rax]
mov ebx, dword ds:[rsi]
add ebx, 8
imul ebx, edx
add rbx, qword [rsi + 0x30]
cmp dword [rbx], r14d
jne 0x7ff7bfff50ce
mov rax, qword [rsi + 8]
lea rdi, [rbx + 8]
mov rcx, rdi
lea rdx, [rbp - 0x18]
call qword [case.0x7ff7c00c1f48.0]
test al, al
jne 0x7ff7bfff5108
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x7ff7bfff50a0
mov ebx, dword [rsp + 0x60]
mov rdi, r12
mov rax, r15
lock cmpxchg qword [0x7ff7c01d3dc0], r12
je 0x7ff7bfff50f7
lea rcx, [0x7ff7c01d3dc0]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rdi, rdi
jne 0x7ff7bfff5117
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test rdi, rdi
je 0x7ff7bfff50d6
cmp dword [rdi], 1
jne 0x7ff7bfff50d6
mov ebx, dword [rdi + 0x28]
jmp 0x7ff7bfff50dd
test ebx, ebx
mov qword [rsp + 0x68], 0x16
lea rax, [0x7ff7c0179c10]
setne byte [0x7ff7c01d2e24]
mov qword [rsp + 0x70], rax
xor eax, eax
lock cmpxchg qword [0x7ff7c01d3dc0], r15
je 0x7ff7bfff514e
lea rcx, [0x7ff7c01d3dc0]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rsi, qword [0x7ff7c01d78b0]
lea rcx, [rbp + 0x18]
movups xmm0, xmmword [rsp + 0x68]
mov rax, qword [rsi + 0x10]
movups xmmword [rbp + 0x20], xmm0
call qword [case.0x7ff7c00c1f48.0]
mov ecx, dword [rsi + 0x18]
btr eax, 0x1f
mov r14d, eax
dec ecx
mov rax, qword [rsi + 0x20]
and rcx, r14
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x7ff7bfff51c2
nop word [rax + rax]
mov ebx, dword [rsi]
add ebx, 8
imul ebx, edx
add rbx, qword [rsi + 0x30]
cmp dword [rbx], r14d
jne 0x7ff7bfff51ba
mov rax, qword [rsi + 8]
lea rdi, [rbx + 8]
mov rcx, rdi
lea rdx, [rbp + 0x18]
call qword [case.0x7ff7c00c1f48.0]
test al, al
jne 0x7ff7bfff51f7
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x7ff7bfff5190
mov ebx, dword [rsp + 0x60]
mov rdi, r12
mov rax, r15
lock cmpxchg qword [0x7ff7c01d3dc0], r12
je 0x7ff7bfff51e3
lea rcx, [0x7ff7c01d3dc0]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rdi, rdi
jne 0x7ff7bfff5206
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test rdi, rdi
je 0x7ff7bfff51c2
cmp dword [rdi], 1
jne 0x7ff7bfff51c2
mov ebx, dword [rdi + 0x28]
jmp 0x7ff7bfff51c9
lea rax, [0x7ff7c0179c28]
mov dword [0x7ff7c01d1968], ebx
mov qword [rsp + 0x70], rax
xor eax, eax
mov qword [rsp + 0x68], 0x28
lock cmpxchg qword [0x7ff7c01d3dc0], r15
je 0x7ff7bfff523a
lea rcx, [0x7ff7c01d3dc0]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockShared
mov rsi, qword [0x7ff7c01d78b0]
lea rcx, [rbp + 0x48]
movups xmm0, xmmword [rsp + 0x68]
mov rax, qword [rsi + 0x10]
movups xmmword [rbp + 0x50], xmm0
call qword [case.0x7ff7c00c1f48.0]
mov ecx, dword ds:[rsi + 0x18]
btr eax, 0x1f
mov r14d, eax
dec ecx
mov rax, qword [rsi + 0x20]
and rcx, r14
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x7ff7bfff52b6
nop word [rax + rax]
mov ebx, dword ds:[rsi]
add ebx, 8
imul ebx, edx
add rbx, qword [rsi + 0x30]
cmp dword [rbx], r14d
jne 0x7ff7bfff52ae
mov rax, qword [rsi + 8]
lea rdi, [rbx + 8]
mov rcx, rdi
lea rdx, [rbp + 0x48]
call qword [case.0x7ff7c00c1f48.0]
test al, al
jne 0x7ff7bfff52e8
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x7ff7bfff5280
mov ebx, dword [rsp + 0x60]
mov rdi, r12
mov rax, r15
lock cmpxchg qword [0x7ff7c01d3dc0], r12
je 0x7ff7bfff52d7
lea rcx, [0x7ff7c01d3dc0]
call sym.ProcessHacker.exe_PhfReleaseQueuedLockShared
test rdi, rdi
jne 0x7ff7bfff52f7
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test rdi, rdi
je 0x7ff7bfff52b6
cmp dword [rdi], 1
jne 0x7ff7bfff52b6
mov ebx, dword [rdi + 0x28]
jmp 0x7ff7bfff52bd
test ebx, ebx
je 0x7ff7bfff5418
mov ecx, 0x4e
call qword [sym.imp.USER32.dll_GetSystemMetrics]
inc eax
mov qword [rsp + 0x68], 0x16
cdq
sub eax, edx
sar eax, 1
mov r15d, eax
mov eax, 0x800
cmp r15d, eax
cmova r15d, eax
lea rax, [0x7ff7c0179c58]
lock bts qword [0x7ff7c01d3dc0], 0
mov qword [rsp + 0x70], rax
jae 0x7ff7bfff534d
lea rcx, [0x7ff7c01d3dc0]
call sym.ProcessHacker.exe_PhfAcquireQueuedLockExclusive
mov rsi, qword [0x7ff7c01d78b0]
lea rcx, [rbp + 0x78]
movups xmm0, xmmword [rsp + 0x68]
mov rax, qword [rsi + 0x10]
movups xmmword [rbp + 0x80], xmm0
call qword [case.0x7ff7c00c1f48.0]
mov ecx, dword [rsi + 0x18]
btr eax, 0x1f
mov r14d, eax
dec ecx
mov rax, qword [rsi + 0x20]
and rcx, r14
mov edx, dword [rax + rcx*4]
cmp edx, 0xffffffff
je 0x7ff7bfff53c2
nop dword [rax]
mov ebx, dword [rsi]
add ebx, 8
imul ebx, edx
add rbx, qword [rsi + 0x30]
cmp dword [rbx], r14d
jne 0x7ff7bfff53ba
mov rax, qword [rsi + 8]
lea rdi, [rbx + 8]
mov rcx, rdi
lea rdx, [rbp + 0x78]
call qword [case.0x7ff7c00c1f48.0]
test al, al
jne 0x7ff7bfff5408
mov edx, dword [rbx + 4]
cmp edx, 0xffffffff
jne 0x7ff7bfff5390
mov rdi, r12
lock xadd qword [0x7ff7c01d3dc0], r13
movzx eax, r13b
and al, 6
cmp al, 2
jne 0x7ff7bfff53f7
lea rax, [r13 - 1]
lea rdx, [rax + 4]
lock cmpxchg qword [0x7ff7c01d3dc0], rdx
jne 0x7ff7bfff53f7
lea rcx, [0x7ff7c01d3dc0]
call fcn.7ff7c00e3de0
test rdi, rdi
jne 0x7ff7bfff5418
mov ecx, 0xc0000225
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
test rdi, rdi
je 0x7ff7bfff53c5
cmp dword [rdi], 1
jne 0x7ff7bfff53c5
mov dword [rdi + 0x28], r15d
jmp 0x7ff7bfff53c5
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.7ff7c0121390
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret