Function at 0x140002a20
Capabilities:
Contain obfuscated stackstrings
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x140
mov qword [rsp + 0xc0], 0xfffffffffffffffe
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov esi, r9d
mov rdi, r8
mov r12, rdx
xor ebx, ebx
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x34], 0xffffffff
lea rax, [0x1400024f0]
mov qword [rsp + 0x80], rax
lea rax, [0x140002550]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x98], rcx
lea edx, [rbx + 0x10]
mov ecx, 0x1b00
call qword [sym.imp.MSVCR120.dll__aligned_malloc]
mov r14, rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x140002aca
lea rdx, [rsp + 0x80]
mov rcx, rax
call sym.tta.exe_public:_void___cdecl_tta::tta_decoder::constructor_struct__tag_TTA_io_callback____ptr64____ptr64
mov rbx, rax
mov qword [rsp + 0x38], rbx
test rdi, rdi
je 0x140002ae7
test esi, esi
je 0x140002ae7
mov r8d, esi
mov rdx, rdi
mov rcx, rbx
call sym.tta.exe_public:_void___cdecl_tta::tta_decoder::set_password_void_const____ptr64__unsigned_int____ptr64
nop
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, rbx
call sym.tta.exe_public:_void___cdecl_tta::tta_decoder::init_get_info_struct_TTA_info____ptr64__unsigned_long_long_unsigned___int64_____ptr64
nop
mov r13d, dword [rsp + 0x68]
lea esi, [r13 + 7]
shr esi, 3
imul esi, dword [rsp + 0x64]
lea r15d, [rsi + rsi*4]
shl r15d, 0xa
lea ecx, [r15 + 4]
mov edx, 0x10
call qword [sym.imp.MSVCR120.dll__aligned_malloc]
mov rdi, rax
mov qword [rsp + 0x48], rax
test rax, rax
jne 0x140002b50
call qword [sym.imp.MSVCR120.dll___iob_func]
lea rcx, [rax + 0x60]
mov r8, qword [0x1400106a0]
lea rdx, str._r_s:_insufficient_memory_available_n
call qword [sym.imp.MSVCR120.dll_fwprintf]
jmp 0x140002d27
mov ecx, dword [rsp + 0x70]
imul ecx, esi
xor eax, eax
mov qword [rsp + 0x108], rax
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x118], rax
mov qword [rsp + 0x120], rax
mov dword [rsp + 0x128], eax
mov dword [rsp + 0x108], 0x46464952
lea eax, [rcx + 0x24]
mov dword [rsp + 0x10c], eax
mov dword [rsp + 0x110], 0x45564157
mov dword [rsp + 0x114], 0x20746d66
mov dword [rsp + 0x118], 0x10
mov eax, 1
mov word [rsp + 0x11c], ax
mov eax, dword [rsp + 0x64]
mov word [rsp + 0x11e], ax
mov eax, dword [rsp + 0x6c]
mov dword [rsp + 0x120], eax
mov word [rsp + 0x12a], r13w
imul eax, esi
mov dword [rsp + 0x124], eax
mov word [rsp + 0x128], si
mov dword [rsp + 0x50], 0x61746164
mov dword [rsp + 0x54], ecx
xor r13d, r13d
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x30]
lea r8d, [r13 + 0x24]
lea rdx, [rsp + 0x108]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140002cf8
cmp dword [rsp + 0x30], 0x24
jne 0x140002cf8
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x30]
lea r8d, [r13 + 8]
lea rdx, [rsp + 0x50]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140002cf8
cmp dword [rsp + 0x30], 8
jne 0x140002cf8
nop word [rax + rax]
lea r9, [0x140002480]
mov r8d, r15d
mov rdx, rdi
mov rcx, rbx
call sym.tta.exe_public:_int___cdecl_tta::tta_decoder::process_stream_unsigned_char____ptr64__unsigned_int__void____cdecl___unsigned_int__unsigned_int__unsigned_int_____ptr64
test eax, eax
je 0x140002cef
imul eax, esi
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x40]
mov r8d, eax
mov rdx, rdi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140002cb2
cmp dword [rsp + 0x40], 0
je 0x140002cb2
jmp 0x140002c70
lea rcx, [rsp + 0xa0]
call qword [sym.imp.MSVCR120.dll_public:_void___cdecl_std::exception::constructor_void____ptr64]
nop
lea rax, vtable.tta::tta_exception.0
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0xb8], 5
lea rdx, [0x14000e2b0]
lea rcx, [rsp + 0xa0]
call sub.MSVCR120.dll__CxxThrowException
mov dword [rsp + 0x34], r13d
jmp 0x140002d27
call qword [sym.imp.MSVCR120.dll___iob_func]
lea rcx, [rax + 0x60]
mov r8, qword [0x1400106a0]
lea rdx, str._r_s:_cant_write_to_output_file_n
call qword [sym.imp.MSVCR120.dll_fwprintf]
jmp 0x140002d27
mov rax, qword [rbx]
xor edx, edx
mov rcx, rbx
call qword [rax]
mov rcx, r14
call qword [sym.imp.MSVCR120.dll__aligned_free]
test rdi, rdi
je 0x140002d48
mov rcx, rdi
call qword [sym.imp.MSVCR120.dll__aligned_free]
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140009190
add rsp, 0x140
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret