Function at 0x14001afd0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
mov rax, qword [rcx + 0xa8]
mov rbx, rcx
test rax, rax
je 0x14001b020
cmp byte [rcx + 1], 0
je 0x14001b020
mov byte [rax], 0
mov rdi, qword [rcx + 0xa8]
test rdi, rdi
je 0x14001b020
mov rcx, rdi
call fcn.140035750
mov rax, qword [0x14019de08]
test rax, rax
je 0x14001b017
dec dword [rax + 0x3b4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor r15d, r15d
mov qword [rbx + 0xa8], r15
cmp byte [rbx], r15b
je 0x14001b691
mov qword [rsp + 0x50], rsi
cmp byte [rbx + 0x30e1], r15b
je 0x14001b0b7
mov rdi, qword [rbx + 0x20]
test rdi, rdi
je 0x14001b0b7
mov rsi, qword [0x14019de08]
lea rcx, [rsp + 0x40]
mov qword [0x14019de08], rbx
mov qword [rsp + 0x48], rbp
mov dword [rbx + 0x30e4], r15d
mov qword [rsp + 0x40], r15
call fcn.140028680
lea rdx, [0x1400d2a0c]
mov rcx, rdi
mov rbp, rax
call fcn.1400168d0
mov rdi, rax
test rax, rax
je 0x14001b0ab
mov r8, qword [rsp + 0x40]
lea edx, [r15 + 1]
mov r9, rax
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbp, qword [rsp + 0x48]
mov qword [0x14019de08], rsi
mov edi, r15d
cmp dword [rbx + 0x3128], r15d
jle 0x14001b0ff
mov rsi, r15
nop word [rax + rax]
mov r8, qword [rbx + 0x3130]
cmp dword [r8 + rsi], 6
jne 0x14001b0f1
movsxd rax, edi
lea rcx, [rax + rax*2]
lea rdx, [r8 + rcx*8]
mov rcx, rbx
call qword [rreloc.WS2_32.dll_htonl + rsi + 8]
inc edi
add rsi, 0x18
cmp edi, dword [rbx + 0x3128]
jl 0x14001b0d0
mov esi, r15d
cmp dword [rbx + 0x1a88], r15d
jle 0x14001b166
mov qword [rsp + 0x58], r14
mov r14, r15
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rbx + 0x1a90]
mov rdi, qword [r14 + rax]
test rdi, rdi
je 0x14001b153
mov rcx, rdi
call fcn.140018380
mov rax, qword [0x14019de08]
test rax, rax
je 0x14001b14a
dec dword [rax + 0x3b4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
inc esi
add r14, 8
cmp esi, dword [rbx + 0x1a88]
jl 0x14001b120
mov r14, qword [rsp + 0x58]
mov rcx, qword [rbx + 0x1a90]
test rcx, rcx
je 0x14001b198
mov rax, qword [0x14019de08]
mov qword [rbx + 0x1a88], r15
test rax, rax
je 0x14001b18b
dec dword [rax + 0x3b4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x1a90], r15
mov rcx, qword [rbx + 0x1aa0]
test rcx, rcx
je 0x14001b1ca
mov rax, qword [0x14019de08]
mov qword [rbx + 0x1a98], r15
test rax, rax
je 0x14001b1bd
dec dword [rax + 0x3b4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x1aa0], r15
mov rcx, qword [rbx + 0x1ab0]
test rcx, rcx
je 0x14001b1fc
mov rax, qword [0x14019de08]
mov qword [rbx + 0x1aa8], r15
test rax, rax
je 0x14001b1ef
dec dword [rax + 0x3b4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x1ab0], r15
mov qword [rbx + 0x1ae0], r15
mov rcx, qword [rbx + 0x1ac0]
test rcx, rcx
je 0x14001b235
mov rax, qword [0x14019de08]
mov qword [rbx + 0x1ab8], r15
test rax, rax
je 0x14001b228
dec dword [rax + 0x3b4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x1ac0], r15
mov rcx, qword [rbx + 0x1ad0]
test rcx, rcx
je 0x14001b267
mov rax, qword [0x14019de08]
mov qword [rbx + 0x1ac8], r15
test rax, rax
je 0x14001b25a
dec dword [rax + 0x3b4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x1ad0], r15
mov qword [rbx + 0x1c90], r15
mov qword [rbx + 0x1af8], r15
mov qword [rbx + 0x1af0], r15
mov qword [rbx + 0x1ae8], r15
mov qword [rbx + 0x1b78], r15
mov qword [rbx + 0x1b60], r15
mov qword [rbx + 0x1b00], r15
mov rcx, qword [rbx + 0x1c18]
test rcx, rcx
je 0x14001b2ca
mov rax, qword [0x14019de08]
mov qword [rbx + 0x1c10], r15
test rax, rax
je 0x14001b2bd
dec dword [rax + 0x3b4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x1c18], r15
mov rcx, qword [rbx + 0x1c28]
test rcx, rcx
je 0x14001b2fc
mov rax, qword [0x14019de08]
mov qword [rbx + 0x1c20], r15
test rax, rax
je 0x14001b2ef
dec dword [rax + 0x3b4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x1c28], r15
mov rcx, qword [rbx + 0x1c38]
test rcx, rcx
je 0x14001b32e
mov rax, qword [0x14019de08]
mov qword [rbx + 0x1c30], r15
test rax, rax
je 0x14001b321
dec dword [rax + 0x3b4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x1c38], r15
mov rcx, qword [rbx + 0x1c78]
test rcx, rcx
je 0x14001b360
mov rax, qword [0x14019de08]
mov qword [rbx + 0x1c70], r15
test rax, rax
je 0x14001b353
dec dword [rax + 0x3b4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x1c78], r15
mov rcx, qword [rbx + 0x1c88]
test rcx, rcx
je 0x14001b392
mov rax, qword [0x14019de08]
mov qword [rbx + 0x1c80], r15
test rax, rax
je 0x14001b385
dec dword [rax + 0x3b4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x1c88], r15
lea rdi, [rbx + 0x1e50]
mov esi, 2
nop
mov rcx, qword [rdi]
test rcx, rcx
je 0x14001b3c7
mov rax, qword [0x14019de08]
mov qword [rdi - 8], r15
test rax, rax
je 0x14001b3be
dec dword [rax + 0x3b4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi], r15
add rdi, 0x10
sub rsi, 1
jne 0x14001b3a0
lea rcx, [rbx + 0x1e70]
call fcn.140031c30
lea rcx, [rbx + 0x1f38]
call fcn.140031c30
lea rcx, [rbx + 0x2110]
call fcn.140029190
mov rcx, qword [rbx + 0x2140]
mov rsi, qword [rsp + 0x50]
test rcx, rcx
je 0x14001b42c
mov rax, qword [0x14019de08]
mov qword [rbx + 0x2138], r15
test rax, rax
je 0x14001b41f
dec dword [rax + 0x3b4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x2140], r15
mov rcx, qword [rbx + 0x2150]
test rcx, rcx
je 0x14001b45e
mov rax, qword [0x14019de08]
mov qword [rbx + 0x2148], r15
test rax, rax
je 0x14001b451
dec dword [rax + 0x3b4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x2150], r15
lea rcx, [rbx + 0x20b0]
call fcn.140029300
mov rcx, qword [rbx + 0x20e0]
test rcx, rcx
je 0x14001b49c
mov rax, qword [0x14019de08]
mov qword [rbx + 0x20d8], r15
test rax, rax
je 0x14001b48f
dec dword [rax + 0x3b4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x20e0], r15
mov rcx, qword [rbx + 0x2100]
test rcx, rcx
je 0x14001b4ce
mov rax, qword [0x14019de08]
mov qword [rbx + 0x20f8], r15
test rax, rax
je 0x14001b4c1
dec dword [rax + 0x3b4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x2100], r15
mov rcx, qword [rbx + 0x30b8]
test rcx, rcx
je 0x14001b500
mov rax, qword [0x14019de08]
mov qword [rbx + 0x30b0], r15
test rax, rax
je 0x14001b4f3
dec dword [rax + 0x3b4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x30b8], r15
mov rcx, qword [rbx + 0x30c8]
test rcx, rcx
je 0x14001b532
mov rax, qword [0x14019de08]
mov qword [rbx + 0x30c0], r15
test rax, rax
je 0x14001b525
dec dword [rax + 0x3b4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x30c8], r15
mov rcx, qword [rbx + 0x2178]
test rcx, rcx
je 0x14001b564
mov rax, qword [0x14019de08]
mov qword [rbx + 0x2170], r15
test rax, rax
je 0x14001b557
dec dword [rax + 0x3b4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x2178], r15
mov rcx, qword [rbx + 0x2188]
test rcx, rcx
je 0x14001b596
mov rax, qword [0x14019de08]
mov qword [rbx + 0x2180], r15
test rax, rax
je 0x14001b589
dec dword [rax + 0x3b4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x2188], r15
mov rcx, qword [rbx + 0x2198]
test rcx, rcx
je 0x14001b5c8
mov rax, qword [0x14019de08]
mov qword [rbx + 0x2190], r15
test rax, rax
je 0x14001b5bb
dec dword [rax + 0x3b4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x2198], r15
mov rcx, qword [rbx + 0x3110]
test rcx, rcx
je 0x14001b5fa
mov rax, qword [0x14019de08]
mov qword [rbx + 0x3108], r15
test rax, rax
je 0x14001b5ed
dec dword [rax + 0x3b4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x3110], r15
mov rcx, qword [rbx + 0x3100]
test rcx, rcx
je 0x14001b62c
mov rax, qword [0x14019de08]
mov qword [rbx + 0x30f8], r15
test rax, rax
je 0x14001b61f
dec dword [rax + 0x3b4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x3100], r15
cmp qword [rbx + 0x3140], r15
je 0x14001b65c
mov rdi, qword [rbx + 0x3140]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
cmp rdi, rax
je 0x14001b655
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov qword [rbx + 0x3140], r15
mov rcx, qword [rbx + 0x3150]
test rcx, rcx
je 0x14001b68e
mov rax, qword [0x14019de08]
mov qword [rbx + 0x3148], r15
test rax, rax
je 0x14001b681
dec dword [rax + 0x3b4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x3150], r15
mov byte [rbx], r15b
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret