Function at 0x14006dd60
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, qword [rcx]
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rdi
mov rdi, rcx
mov esi, r8d
mov r8, qword [rbx + 0x18]
mov rax, r8
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x20], r15
mov r15, rdx
cmp r8, qword [rbx + 0x10]
jb 0x14006ddb5
mov rcx, qword [rbx + 8]
cmp r8, rcx
je 0x14006ddb5
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
mov byte [rax], 0x22
mov r12, rsi
inc qword [rbx + 0x18]
test esi, esi
je 0x14006df9c
mov qword [rsp + 0x30], r13
lea r13, [0x140000000]
mov qword [rsp + 0x28], r14
xor r14d, r14d
mov qword [rsp + 0x50], rbp
movzx esi, byte [r15]
lea r15, [r15 + 1]
mov rbx, qword [rdi]
inc r14
cmp byte [rsi + r13 + 0x80b40], 0
mov r8, qword [rbx + 0x18]
mov rax, r8
je 0x14006df55
cmp r8, qword [rbx + 0x10]
jb 0x14006de2c
mov rcx, qword [rbx + 8]
cmp r8, rcx
je 0x14006de2c
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
movzx ebp, byte [rsi + r13 + 0x80b40]
mov byte [rax], 0x5c
inc qword [rbx + 0x18]
mov rbx, qword [rdi]
mov r8, qword [rbx + 0x18]
mov rax, r8
cmp r8, qword [rbx + 0x10]
jb 0x14006de6e
mov rcx, qword [rbx + 8]
cmp r8, rcx
je 0x14006de6e
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
mov byte [rax], bpl
inc qword [rbx + 0x18]
cmp byte [rsi + r13 + 0x80b40], 0x75
jne 0x14006df84
mov rbx, qword [rdi]
mov r8, qword [rbx + 0x18]
mov rax, r8
cmp r8, qword [rbx + 0x10]
jb 0x14006deb6
mov rcx, qword [rbx + 8]
cmp r8, rcx
je 0x14006deb6
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
mov byte [rax], 0x30
inc qword [rbx + 0x18]
mov rbx, qword [rdi]
mov r8, qword [rbx + 0x18]
mov rax, r8
cmp r8, qword [rbx + 0x10]
jb 0x14006deef
mov rcx, qword [rbx + 8]
cmp r8, rcx
je 0x14006deef
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
mov byte [rax], 0x30
mov rax, rsi
inc qword [rbx + 0x18]
mov rbx, qword [rdi]
shr rax, 4
mov r8, qword [rbx + 0x18]
movzx ebp, byte [rax + r13 + 0x80c40]
mov rax, r8
cmp r8, qword [rbx + 0x10]
jb 0x14006df38
mov rcx, qword [rbx + 8]
cmp r8, rcx
je 0x14006df38
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
mov byte [rax], bpl
inc qword [rbx + 0x18]
mov rbx, qword [rdi]
and esi, 0xf
mov r8, qword [rbx + 0x18]
movzx esi, byte [rsi + r13 + 0x80c40]
mov rax, r8
cmp r8, qword [rbx + 0x10]
jb 0x14006df7d
mov rcx, qword [rbx + 8]
cmp r8, rcx
je 0x14006df7d
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
mov byte [rax], sil
inc qword [rbx + 0x18]
cmp r14, r12
jb 0x14006dde0
mov r14, qword [rsp + 0x28]
mov r13, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rdi]
mov r15, qword [rsp + 0x20]
mov r12, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x60]
mov r8, qword [rbx + 0x18]
mov rax, r8
mov rsi, qword [rsp + 0x58]
cmp r8, qword [rbx + 0x10]
jb 0x14006dfe2
mov rcx, qword [rbx + 8]
cmp r8, rcx
je 0x14006dfe2
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
mov byte [rax], 0x22
mov al, 1
inc qword [rbx + 0x18]
add rsp, 0x40
pop rbx
ret