Function at 0x100046a7c
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
mov rax, qword [0x10009f140]
xor rax, rsp
mov qword [rsp + 0xa8], rax
xor ebp, ebp
lea rcx, [r11 - 0x74]
xor edx, edx
lea r8d, [rbp + 0x28]
mov dword [rsp + 0x60], ebp
call sub.msvcrt.dll_memset
mov rcx, qword [0x1000aac60]
lea rdx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_GetWindowPlacement]
mov r12d, 0x98
mov rcx, r12
call fcn.10008f098
cmp rax, rbp
je 0x100046af4
mov rcx, rax
call fcn.10005e1d4
mov rbx, rax
jmp 0x100046af7
mov rbx, rbp
lea rdx, [0x10001af38]
mov rcx, rbx
call fcn.10005fb00
mov rcx, r12
call fcn.10008f098
cmp rax, rbp
je 0x100046b20
mov rcx, rax
call fcn.10005e1d4
mov r13, rax
jmp 0x100046b23
mov r13, rbp
lea rdx, [0x10001af48]
mov rcx, r13
call fcn.10005fb00
mov r9d, dword [rsp + 0x7c]
lea rsi, [0x100014e54]
mov r14d, 0xa
lea rcx, [rsp + 0x90]
mov r8, rsi
mov rdx, r14
call sub.msvcrt.dll_swprintf_s
lea rdx, [rsp + 0x90]
mov rcx, r13
call fcn.10005fd08
mov rcx, r12
call fcn.10008f098
cmp rax, rbp
je 0x100046b81
mov rcx, rax
call fcn.10005e1d4
mov rdi, rax
jmp 0x100046b84
mov rdi, rbp
lea rdx, [0x10001af58]
mov rcx, rdi
mov qword [rsp + 0x58], rdi
call fcn.10005fb00
mov r9d, dword [rsp + 0x80]
lea rcx, [rsp + 0x90]
mov r8, rsi
mov rdx, r14
call sub.msvcrt.dll_swprintf_s
lea rdx, [rsp + 0x90]
mov rcx, rdi
call fcn.10005fd08
mov rcx, qword [0x1000aac60]
lea rdx, [rsp + 0x48]
call qword [sym.imp.USER32.dll_GetClientRect]
mov rax, qword [0x1000aaca8]
mov edx, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x50]
sub edx, dword [rsp + 0x4c]
mov qword [rsp + 0x28], rax
mov rax, qword [0x1000aac60]
sub ecx, dword [rsp + 0x48]
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x44]
mov qword [rsp + 0x20], rax
call fcn.100060fc8
mov r11d, dword [rsp + 0x50]
mov eax, dword [rsp + 0x54]
sub r11d, dword [rsp + 0x48]
sub eax, dword [rsp + 0x4c]
mov rcx, r12
sub r11d, dword [rsp + 0x44]
sub eax, dword [rsp + 0x38]
add dword [rsp + 0x84], r11d
add dword [rsp + 0x88], eax
call fcn.10008f098
cmp rax, rbp
je 0x100046c50
mov rcx, rax
call fcn.10005e1d4
mov r15, rax
jmp 0x100046c53
mov r15, rbp
lea rdx, [0x10001af68]
mov rcx, r15
call fcn.10005fb00
mov r9d, dword [rsp + 0x84]
lea rcx, [rsp + 0x90]
sub r9d, dword [rsp + 0x7c]
mov r8, rsi
mov rdx, r14
call sub.msvcrt.dll_swprintf_s
lea rdx, [rsp + 0x90]
mov rcx, r15
call fcn.10005fd08
mov rcx, r12
call fcn.10008f098
cmp rax, rbp
je 0x100046cac
mov rcx, rax
call fcn.10005e1d4
mov r14, rax
jmp 0x100046caf
mov r14, rbp
lea rdx, [0x10001af80]
mov rcx, r14
call fcn.10005fb00
mov r9d, dword [rsp + 0x88]
lea rcx, [rsp + 0x90]
sub r9d, dword [rsp + 0x80]
mov r8, rsi
mov edx, 0xa
call sub.msvcrt.dll_swprintf_s
lea rdx, [rsp + 0x90]
mov rcx, r14
call fcn.10005fd08
mov rcx, r12
call fcn.10008f098
cmp rax, rbp
je 0x100046d0d
mov rcx, rax
call fcn.10005e1d4
mov rsi, rax
jmp 0x100046d10
mov rsi, rbp
lea rdx, [0x10001afa0]
mov rcx, rsi
call fcn.10005fb00
mov rcx, qword [0x1000aac60]
call qword [sym.imp.USER32.dll_IsIconic]
cmp eax, ebp
je 0x100046d41
test byte [rsp + 0x64], 2
je 0x100046d41
mov edi, 1
mov cl, dil
jmp 0x100046d5c
mov rcx, qword [0x1000aac60]
call qword [sym.imp.USER32.dll_IsZoomed]
movzx ecx, bpl
mov edi, 1
cmp eax, ebp
cmovne ecx, edi
cmp cl, bpl
lea rax, [0x10001afb4]
lea rdx, [0x1000146e0]
cmovne rdx, rax
mov rcx, rsi
call fcn.10005fd08
mov rcx, r12
call fcn.10008f098
cmp rax, rbp
je 0x100046d93
mov rcx, rax
call fcn.10005e1d4
mov r12, rax
jmp 0x100046d96
mov r12, rbp
lea rdx, [0x10001afb8]
mov rcx, r12
call fcn.10005fb00
mov r9d, dword [0x1000a656c]
lea r8, [0x100014e54]
lea rcx, [rsp + 0x90]
mov edx, 0xa
call sub.msvcrt.dll_swprintf_s
lea rdx, [rsp + 0x90]
mov rcx, r12
call fcn.10005fd08
mov ecx, 0x98
call fcn.10008f098
cmp rax, rbp
je 0x100046def
mov rcx, rax
call fcn.10005e1d4
mov rbp, rax
lea rdx, [0x10001afc8]
mov rcx, rbp
call fcn.10005fb00
mov r9d, dword [0x1000a6ca0]
lea r8, [0x100014e54]
lea rcx, [rsp + 0x90]
mov edx, 0xa
call sub.msvcrt.dll_swprintf_s
lea rdx, [rsp + 0x90]
mov rcx, rbp
call fcn.10005fd08
mov ecx, 0x98
call fcn.10008f098
test rax, rax
je 0x100046e47
mov rcx, rax
call fcn.10005e1d4
jmp 0x100046e49
xor eax, eax
lea rdx, [0x10001afd8]
mov rcx, rax
mov qword [rsp + 0x38], rax
call fcn.10005fb00
mov r11, qword [0x1000aac18]
mov rcx, qword [rsp + 0x38]
cmp byte [r11 + 0x12c], 0
lea rax, [0x100014e68]
lea rdx, [0x100014e78]
cmovne rdx, rax
call fcn.10005fd08
or r8d, 0xffffffff
mov rdx, r13
mov rcx, rbx
call fcn.10005fda4
mov rdx, qword [rsp + 0x58]
or r13d, 0xffffffff
mov r8d, r13d
mov rcx, rbx
call fcn.10005fda4
mov r8d, r13d
mov rdx, r15
mov rcx, rbx
call fcn.10005fda4
mov r8d, r13d
mov rdx, r14
mov rcx, rbx
call fcn.10005fda4
mov r8d, r13d
mov rdx, rsi
mov rcx, rbx
call fcn.10005fda4
mov rdx, qword [rsp + 0x38]
mov r8d, r13d
mov rcx, rbx
call fcn.10005fda4
mov r8d, r13d
mov rdx, r12
mov rcx, rbx
call fcn.10005fda4
mov r8d, r13d
mov rdx, rbp
mov rcx, rbx
call fcn.10005fda4
xor r12d, r12d
lea r8, [rsp + 0x44]
lea rdx, [rsp + 0x38]
mov rcx, rbx
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x44], r12d
call fcn.10005fe58
cmp rbx, r12
je 0x100046f35
mov rcx, rbx
call fcn.10005e260
mov rcx, rbx
call sub.msvcrt.dll_free
cmp byte [0x1000aacb8], r12b
lea rax, [0x10001b028]
lea rcx, [0x10001b000]
cmove rcx, rax
xor r9d, r9d
xor edx, edx
lea r13d, [r9 + 0x1c]
mov dword [rsp + 0x20], r12d
mov r8d, r13d
call fcn.100048738
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x100046f99
mov rcx, qword [rsp + 0x38]
call sub.msvcrt.dll_free
lea r9, [0x10001b050]
lea r8, [0x10001ad18]
mov edx, 0x94b
mov ecx, 0x800
call fcn.100061370
jmp 0x10004705f
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x30]
mov r8d, 2
mov rcx, rax
mov dword [rsp + 0x40], r12d
mov byte [rsp + 0x30], 0xff
mov byte [rsp + 0x31], 0xfe
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, r12d
je 0x10004702a
cmp dword [rsp + 0x40], 2
jne 0x10004702a
mov ebp, dword [rsp + 0x44]
mov rsi, qword [rsp + 0x38]
lea r9, [rsp + 0x40]
lea r8d, [rbp + rbp]
mov rdx, rsi
mov rcx, rbx
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, r12d
je 0x100047014
mov eax, dword [rsp + 0x40]
mov r9, rbp
add r9, r9
cmp rax, r9
jne 0x100047014
mov rcx, rsi
call sub.msvcrt.dll_free
jmp 0x100047051
mov rcx, rsi
call sub.msvcrt.dll_free
lea r9, [0x10001b140]
mov edx, 0x962
jmp 0x100047040
mov rcx, qword [rsp + 0x38]
call sub.msvcrt.dll_free
lea r9, [0x10001b0c0]
mov edx, 0x958
lea r8, [0x10001ad18]
mov ecx, 0x800
call fcn.100061370
mov r8b, dil
mov edx, r13d
mov rcx, rbx
call fcn.100048424
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.10008f560
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret