Function at 0x1400062d0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x118
mov rbx, rcx
mov rcx, qword [rcx]
call fcn.140006a60
movsd xmm0, qword [0x14001de68]
ucomisd xmm0, qword [rbx + 8]
mov rbp, rax
jp 0x140006306
je 0x140006708
mov rcx, qword [rbx]
call fcn.140006b50
cmp byte [rbx + 0x40], 0
mov r12, rax
jne 0x1400065b0
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x1400063b8
cmp qword [rbx + 0x38], 0
je 0x1400063b8
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
pxor xmm0, xmm0
cvtsi2sd xmm0, eax
mov rdi, rax
call sub.api_ms_win_crt_math_l1_1_0.dll_log10
addsd xmm0, qword [0x14001de70]
cvttsd2si ecx, xmm0
movsxd rcx, ecx
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov r8d, edi
lea rdx, [0x14001ddf9]
mov rcx, rax
mov rsi, rax
call fcn.14000e0d0
lea rax, str.Content_Type
mov rcx, rbx
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
mov rax, qword [rbx + 0x38]
mov r9d, 1
mov r8d, 2
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x48], rax
lea rax, str.Content_Length
mov qword [rsp + 0x50], rax
call fcn.140006970
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
lea rax, [0x14001de18]
lea rdx, [rsp + 0x30]
mov r9d, 1
mov r8d, 1
mov rcx, rbx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], r12
call fcn.140006970
movsd xmm0, qword [rbx + 8]
comisd xmm0, xmmword [0x14001de78]
jbe 0x140006429
mov rax, qword [rbx + 0x30]
test rax, rax
je 0x140006429
lea rdi, str.Connection
lea rdx, [rsp + 0x40]
mov r9d, 1
mov r8d, 1
mov rcx, rbx
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rax
call fcn.140006970
movsd xmm0, qword [rbx + 8]
mov qword [rsp + 0x20], rbp
xor edx, edx
lea r8, str._s__s_HTTP__.1f_r_n
xor ecx, ecx
movsd qword [rsp + 0x28], xmm0
mov r9, qword [rbx + 0x10]
call fcn.14000e130
mov edx, dword [rbx + 0x28]
mov r13d, eax
test edx, edx
jle 0x14000649b
xor esi, esi
lea rdi, str._s:__s_r_n
nop dword [rax + rax]
mov rax, rsi
shl rax, 4
add rax, qword [rbx + 0x20]
mov r9, qword [rax]
test r9, r9
je 0x140006493
mov rax, qword [rax + 8]
test rax, rax
je 0x140006493
mov qword [rsp + 0x20], rax
xor edx, edx
mov r8, rdi
xor ecx, ecx
call fcn.14000e130
mov edx, dword [rbx + 0x28]
add r13d, eax
add rsi, 1
cmp edx, esi
jg 0x140006460
mov r9, qword [rbx + 0x18]
lea esi, [r13 + 2]
test r9, r9
je 0x1400064bc
lea r8, str._r_n_s_r_n
xor edx, edx
xor ecx, ecx
call fcn.14000e130
lea esi, [rax + r13]
movsxd r14, esi
lea r13, [r14 + 1]
mov rcx, r13
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rdi, rax
test rax, rax
je 0x140006771
movsd xmm0, qword [rbx + 8]
mov qword [rsp + 0x20], rbp
mov rdx, r13
mov rcx, rax
lea r8, str._s__s_HTTP__.1f_r_n
add esi, 1
movsd qword [rsp + 0x28], xmm0
mov r9, qword [rbx + 0x10]
call fcn.14000e130
mov edx, dword [rbx + 0x28]
mov r13d, eax
test edx, edx
jle 0x14000655a
xor r15d, r15d
nop dword [rax]
mov rax, r15
shl rax, 4
add rax, qword [rbx + 0x20]
mov r9, qword [rax]
test r9, r9
je 0x140006551
mov rax, qword [rax + 8]
test rax, rax
je 0x140006551
mov qword [rsp + 0x20], rax
mov edx, esi
movsxd rcx, r13d
lea r8, str._s:__s_r_n
sub edx, r13d
add rcx, rdi
movsxd rdx, edx
call fcn.14000e130
mov edx, dword [rbx + 0x28]
add r13d, eax
add r15, 1
cmp edx, r15d
jg 0x140006510
mov r9, qword [rbx + 0x18]
sub esi, r13d
movsxd rcx, r13d
movsxd rdx, esi
add rcx, rdi
test r9, r9
je 0x140006760
lea r8, str._r_n_s_r_n
call fcn.14000e130
mov rcx, rbp
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rcx, r12
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov byte [rdi + r14], 0
mov rax, rdi
add rsp, 0x118
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rdi, str.X_Forwarded_Proto
lea rax, str.Http
mov rcx, rbx
mov r9d, 1
movq xmm0, rdi
movq xmm1, rax
lea rdi, str.X_Forward_For
mov r8d, 0xd
mov qword [rsp + 0x70], rdi
lea rdi, [0x14001dd7c]
punpcklqdq xmm0, xmm1
lea rax, str.X_Forwarded_Host
mov qword [rsp + 0x80], rdi
lea rdi, str.X_Originating_IP
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x90], rdi
lea rdi, str.X_Forwarder_For
mov qword [rsp + 0xa0], rdi
lea rdi, str.X_Real_Ip
mov qword [rsp + 0xb0], rdi
lea rdi, str.X_Client_IP
mov qword [rsp + 0xc0], rdi
lea rdi, str.X_True_IP
mov qword [rsp + 0xd0], rdi
lea rdi, str.X_Remote_Addr
mov qword [rsp + 0x50], rax
lea rax, str.X_Forwarded_For
mov qword [rsp + 0xe0], rdi
lea rdi, str.Cf_Connecting_Ip
mov qword [rsp + 0x60], rax
lea rax, str._RAND_IPV4_
mov qword [rsp + 0xf0], rdi
lea rdi, str.X_Forwarded_For_Original
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0xd8], rax
mov qword [rsp + 0xe8], rax
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x100], rdi
mov qword [rsp + 0x108], rax
movaps xmmword [rsp + 0x40], xmm0
call fcn.140006970
mov rcx, qword [rbx + 0x18]
test rcx, rcx
jne 0x140006328
jmp 0x1400063b8
mov rax, qword [rbx]
mov rcx, qword [rax + 0x28]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
lea rsi, [rax + 7]
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov r9, rbp
lea r8, str.GET___s_r_n
mov rdx, rsi
mov rcx, rax
mov rdi, rax
call fcn.14000e130
mov rax, qword [rbx]
mov rcx, qword [rax + 0x28]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rcx, rbp
mov byte [rdi + rax + 6], 0
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
jmp 0x140006594
lea r8, [0x14001de65]
call fcn.14000e130
jmp 0x14000657f
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, 0x1a
mov edx, 1
lea rcx, str.Failed_to_allocate_memory_n
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
jmp 0x140006594