Function at 0x140059320
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc0
mov rsi, rdx
mov r14, rcx
xor edi, edi
mov qword [rcx], rdi
cmp qword [rdx + 0x18], 8
jb 0x14005934c
mov rsi, qword [rdx]
mov ecx, 0x30
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonLinkCtrl::XElementButtonLinkCtrl]
mov rbx, rax
test rax, rax
je 0x140059399
mov qword [rax], 0xffffffffffffffff
lea rcx, [rax + 8]
mov qword [rcx], rdi
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], 7
mov r8, 0xffffffffffffffff
inc r8
cmp word [rsi + r8*2], 0
jne 0x140059380
mov rdx, rsi
call fcn.140002ed0
mov byte [rbx + 0x28], 0
jmp 0x14005939c
mov rbx, rdi
lea rax, [rsp + 0x108]
cmp r14, rax
je 0x140059426
mov rsi, qword [r14]
mov qword [r14], rbx
test rsi, rsi
je 0x140059458
mov rdx, qword [rsi + 0x20]
cmp rdx, 8
jb 0x1400593f4
mov rcx, qword [rsi + 8]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x1400593ef
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14005941f
mov rcx, r8
call fcn.140071e50
mov qword [rsi + 0x18], rdi
mov qword [rsi + 0x20], 7
mov word [rsi + 8], di
mov rcx, qword [rsi]
cmp rcx, 0xffffffffffffffff
je 0x14005941a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi], 0xffffffffffffffff
mov rcx, rsi
jmp 0x14005944d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rbx, rbx
je 0x140059458
lea rcx, [rbx + 8]
call fcn.140002de0
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x14005944a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], 0xffffffffffffffff
mov rcx, rbx
mov edx, 0x30
call fcn.140071e50
nop
mov rbx, qword [r14]
cmp qword [rbx + 0x18], 0
je 0x1400595cc
lea rcx, [rbx + 8]
cmp qword [rcx + 0x18], 8
jb 0x140059474
mov rcx, qword [rcx]
mov qword [rsp + 0x30], 0xffffffffffffffff
mov dword [rsp + 0x28], 0x4000000
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
jne 0x1400594d4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x60], eax
lea r13, [0x1401921e8]
mov qword [rsp + 0x68], r13
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x40], xmm0
mov r15, qword [rsp + 0x48]
mov esi, dword [rsp + 0x40]
jmp 0x1400594ed
mov esi, edi
mov dword [rsp + 0x40], edi
lea r15, [0x1401921c0]
mov qword [rsp + 0x48], r15
lea r13, [0x1401921e8]
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x1400594fc
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], r12
cmp r12, 0xffffffffffffffff
je 0x14005959b
mov dword [rsp + 0x20], edi
mov r9d, 4
xor r8d, r8d
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LockFile]
test eax, eax
je 0x140059597
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x110], eax
mov dword [rsp + 0x108], edi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x108]
mov r8d, Ordinal_21
lea rdx, [rsp + 0x110]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14005957b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x58], r13
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x40], xmm0
mov esi, edi
mov dword [rsp + 0x40], edi
lea r15, [0x1401921c0]
mov qword [rsp + 0x48], r15
mov eax, 1
xchg byte [rbx + 0x28], al
jmp 0x14005959b
xchg byte [rbx + 0x28], dil
mov rax, qword [r15 + 8]
cmp qword [0x1401921c8], rax
jne 0x14005960a
test esi, esi
jne 0x14005960a
jmp 0x1400595b6
mov rax, r14
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov edx, 0x57
lea rcx, [rsp + 0x60]
call fcn.14000ab90
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x50], xmm0
lea r8, str.file_path_is_empty
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x70]
call fcn.14000ac20
lea rdx, [0x14018b918]
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll__CxxThrowException
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x50], xmm0
lea r8, str.failed_to_lock
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x98]
call fcn.14000ac20
lea rdx, [0x14018b918]
lea rcx, [rsp + 0x98]
call sub.VCRUNTIME140.dll__CxxThrowException
int3