Function at 0x14004e460
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x478
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x28], 0xfffffffffffffffe
mov r14, rdx
mov r13, rcx
lea rsi, [rcx + 0x280]
mov qword [rbp + 0x20], rsi
cmp dword [rsi], 0
jne 0x14004e4a7
xor eax, eax
jmp 0x14004ea83
mov byte [rbp + 0x30], 0
xor edx, edx
mov r8d, 0x3ff
lea rcx, [rbp + 0x31]
call fcn.14010a9a0
mov qword [rbp + 0x18], 0xf
xor r15d, r15d
mov qword [rbp + 0x10], r15
mov byte [rbp], r15b
lea rdx, [r13 + 0x288]
cmp qword [rdx + 0x18], 8
jb 0x14004e4e0
mov rdx, qword [rdx]
movabs rbx, 0xffffffffffffff0
or r12, 0xffffffffffffffff
test rdx, rdx
jne 0x14004e4f8
mov rax, r15
jmp 0x14004e54c
mov rax, r12
nop dword [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x14004e500
inc eax
cmp eax, 0x3fffffff
jle 0x14004e518
mov rax, r15
jmp 0x14004e54c
lea r8d, [rax + rax]
cdqe
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14004e52d
mov rcx, rbx
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.14010cf70
sub rsp, rcx
lea rcx, [rsp + 0x40]
mov r9d, 3
call fcn.14004fc80
mov r8, rax
mov rdx, qword [str.__xml_version_1.0_______________________________________________________________________________applications_xmlns_http:__schemas.microsoft.com_windows_cpltasks_v1______________________________________xmlns:sh_http:__schemas.microsoft.com_windows_tasks_v1_______________________________application_id__s__]
lea rcx, [rbp + 0x30]
call fcn.140110db4
cmp byte [rbp + 0x30], 0
jne 0x14004e56a
mov r8, r15
jmp 0x14004e57b
lea rax, [rbp + 0x30]
mov r8, r12
inc r8
cmp byte [rax + r8], 0
jne 0x14004e571
lea rdx, [rbp + 0x30]
lea rcx, [rbp]
call fcn.140005390
mov dword [rbp + 0x490], r15d
cmp dword [rsi], 0
jle 0x14004e862
lea rdi, [r13 + 0x58]
xor r13d, r13d
nop
cmp qword [rdi + 0x20], 8
jb 0x14004e5ad
mov r8, qword [rdi + 8]
jmp 0x14004e5b1
lea r8, [rdi + 8]
test r8, r8
je 0x14004e62e
mov rcx, r12
nop dword [rax]
inc rcx
cmp word [r8 + rcx*2], r13w
jne 0x14004e5c0
inc ecx
cmp ecx, 0x3fffffff
jg 0x14004e62e
movsxd rax, ecx
add rax, rax
lea rdx, [rax + 0xf]
cmp rdx, rax
ja 0x14004e5e6
mov rdx, rbx
and rdx, 0xfffffffffffffff0
mov rax, rdx
call fcn.14010cf70
sub rsp, rdx
lea r15, [rsp + 0x40]
test r15, r15
je 0x14004e62e
mov byte [r15], r13b
lea eax, [rcx + rcx]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r15
mov r9d, r12d
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
cmove r15, r13
jmp 0x14004e631
mov r15, r13
cmp qword [rdi], 8
jb 0x14004e63d
mov r8, qword [rdi - 0x18]
jmp 0x14004e641
lea r8, [rdi - 0x18]
test r8, r8
je 0x14004e6be
mov rcx, r12
nop dword [rax]
inc rcx
cmp word [r8 + rcx*2], r13w
jne 0x14004e650
inc ecx
cmp ecx, 0x3fffffff
jg 0x14004e6be
movsxd rax, ecx
add rax, rax
lea rdx, [rax + 0xf]
cmp rdx, rax
ja 0x14004e676
mov rdx, rbx
and rdx, 0xfffffffffffffff0
mov rax, rdx
call fcn.14010cf70
sub rsp, rdx
lea r14, [rsp + 0x40]
test r14, r14
je 0x14004e6be
mov byte [r14], r13b
lea eax, [rcx + rcx]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r14
mov r9d, r12d
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
cmove r14, r13
jmp 0x14004e6c1
mov r14, r13
cmp qword [rdi - 0x20], 8
jb 0x14004e6ce
mov r8, qword [rdi - 0x38]
jmp 0x14004e6d2
lea r8, [rdi - 0x38]
test r8, r8
je 0x14004e74e
mov rcx, r12
nop word [rax + rax]
inc rcx
cmp word [r8 + rcx*2], r13w
jne 0x14004e6e0
inc ecx
cmp ecx, 0x3fffffff
jg 0x14004e74e
movsxd rax, ecx
add rax, rax
lea rdx, [rax + 0xf]
cmp rdx, rax
ja 0x14004e706
mov rdx, rbx
and rdx, 0xfffffffffffffff0
mov rax, rdx
call fcn.14010cf70
sub rsp, rdx
lea rsi, [rsp + 0x40]
test rsi, rsi
je 0x14004e74e
mov byte [rsi], r13b
lea eax, [rcx + rcx]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov r9d, r12d
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
cmove rsi, r13
jmp 0x14004e751
mov rsi, r13
cmp qword [rdi - 0x40], 8
jb 0x14004e75e
mov r8, qword [rdi - 0x58]
jmp 0x14004e762
lea r8, [rdi - 0x58]
test r8, r8
je 0x14004e7de
mov rcx, r12
nop word [rax + rax]
inc rcx
cmp word [r8 + rcx*2], r13w
jne 0x14004e770
inc ecx
cmp ecx, 0x3fffffff
jg 0x14004e7de
movsxd rax, ecx
add rax, rax
lea rdx, [rax + 0xf]
cmp rdx, rax
ja 0x14004e796
mov rdx, rbx
and rdx, 0xfffffffffffffff0
mov rax, rdx
call fcn.14010cf70
sub rsp, rdx
lea rbx, [rsp + 0x40]
test rbx, rbx
je 0x14004e7de
mov byte [rbx], r13b
lea eax, [rcx + rcx]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, r12d
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
cmove rbx, r13
jmp 0x14004e7e1
mov rbx, r13
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
mov r9, rsi
mov r8, rbx
mov rdx, qword [str._sh:task_id__s________________________________________________sh:name__s__sh:name________________________________________sh:keywords__s__sh:keywords________________________________sh:command__s__sh:command______________________________sh:task_]
lea rcx, [rbp + 0x30]
call fcn.140110db4
cmp byte [rbp + 0x30], r13b
jne 0x14004e80c
mov r8, r13
jmp 0x14004e81c
lea rax, [rbp + 0x30]
mov r8, r12
inc r8
cmp byte [rax + r8], r13b
jne 0x14004e813
lea rdx, [rbp + 0x30]
lea rcx, [rbp]
call fcn.14000c2d0
mov eax, dword [rbp + 0x490]
inc eax
mov dword [rbp + 0x490], eax
sub rdi, 0xffffffffffffff80
mov rsi, qword [rbp + 0x20]
cmp eax, dword [rsi]
movabs rbx, 0xffffffffffffff0
jl 0x14004e5a0
mov r13, qword [rbp + 0x480]
mov r14, qword [rbp + 0x488]
xor r15d, r15d
mov r8, qword [0x14022fb80]
mov rdx, qword [str._category_id__s__]
lea rcx, [rbp + 0x30]
call fcn.140110db4
cmp byte [rbp + 0x30], 0
jne 0x14004e884
mov r8, r15
jmp 0x14004e89a
lea rax, [rbp + 0x30]
mov r8, r12
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14004e890
lea rdx, [rbp + 0x30]
lea rcx, [rbp]
call fcn.14000c2d0
mov edi, r15d
cmp dword [rsi], 0
jle 0x14004e99f
cmp qword [r13 + 0x18], 8
jb 0x14004e8c0
mov r8, qword [r13]
jmp 0x14004e8c3
mov r8, r13
test r8, r8
je 0x14004e93f
mov rcx, r12
nop dword [rax + rax]
inc rcx
cmp word [r8 + rcx*2], 0
jne 0x14004e8d0
inc ecx
cmp ecx, 0x3fffffff
jg 0x14004e93f
movsxd rax, ecx
add rax, rax
lea rdx, [rax + 0xf]
cmp rdx, rax
ja 0x14004e8f7
mov rdx, rbx
and rdx, 0xfffffffffffffff0
mov rax, rdx
call fcn.14010cf70
sub rsp, rdx
lea rbx, [rsp + 0x40]
test rbx, rbx
je 0x14004e93f
mov byte [rbx], 0
lea eax, [rcx + rcx]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, r12d
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
cmove rbx, r15
jmp 0x14004e942
mov rbx, r15
mov r8, rbx
mov rdx, qword [str._sh:task_idref__s___]
lea rcx, [rbp + 0x30]
call fcn.140110db4
cmp byte [rbp + 0x30], 0
jne 0x14004e960
mov r8, r15
jmp 0x14004e97a
lea rax, [rbp + 0x30]
mov r8, r12
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14004e970
lea rdx, [rbp + 0x30]
lea rcx, [rbp]
call fcn.14000c2d0
inc edi
sub r13, 0xffffffffffffff80
cmp edi, dword [rsi]
movabs rbx, 0xffffffffffffff0
jl 0x14004e8b3
mov rdx, qword [str.__category_]
cmp byte [rdx], 0
jne 0x14004e9b0
mov r8, r15
jmp 0x14004e9bd
mov r8, r12
inc r8
cmp byte [rdx + r8], 0
jne 0x14004e9b3
lea rcx, [rbp]
call fcn.14000c2d0
mov rdx, qword [str.__application___applications_]
cmp byte [rdx], 0
jne 0x14004e9d7
mov r8, r15
jmp 0x14004e9ea
mov r8, r12
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x14004e9e0
lea rcx, [rbp]
call fcn.14000c2d0
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 1]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14004ea70
mov dword [rbp + 0x498], r15d
mov ebx, dword [rbp + 0x10]
lea rdx, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae rdx, qword [rbp]
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x498]
mov r8d, ebx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rbp + 0x498], ebx
mov r12d, 0xfffffffe
jb 0x14004ea70
mov r12d, r15d
cmp qword [rbp + 0x18], 0x10
jb 0x14004ea80
mov rcx, qword [rbp]
call fcn.14010a7dc
mov eax, r12d
lea rsp, [rbp + 0x438]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret