Function at 0x1403fc890
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x50
xor ebx, ebx
mov r14, r9
mov word [rsp + 0x40], bx
mov r12, r8
mov dword [rsp + 0x44], ebx
mov r13, rdx
mov r15, rcx
movzx r10d, bx
mov esi, ebx
test r9, r9
jne 0x1403fc8ce
mov ebx, 0x80004005
jmp 0x1403fcc29
mov qword [rsp + 0x80], rbp
test r12, r12
jne 0x1403fc909
mov ebp, ebx
lea r9, [rsp + 0x44]
mov qword [rsp + 0x20], rbx
mov r8d, 2
lea rdx, [rsp + 0x40]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1403fc957
mov ebx, 0x8004e009
jmp 0x1403fcc21
mov ebp, dword [r8]
mov ecx, ebx
test ebp, ebp
je 0x1403fc8dd
mov r8, qword [r8 + 0x10]
nop word [rax + rax]
movsxd rax, ecx
mov rdx, qword [r8 + rax*8]
test rdx, rdx
je 0x1403fc94d
mov eax, dword [rdx + 4]
and eax, 0xf00000
cmp eax, 0x200000
jne 0x1403fc945
inc r10w
mov word [rsp + 0x40], r10w
inc ecx
cmp ecx, ebp
jb 0x1403fc920
jmp 0x1403fc8dd
mov ebx, 0x80004005
jmp 0x1403fcc21
movzx eax, word [rsp + 0x40]
mov qword [rsp + 0x88], rdi
mov edi, ebx
lea ecx, [rax + rax*2]
lea ecx, [rcx*4 + 6]
add dword [r14], ecx
test ebp, ebp
je 0x1403fc9c5
nop word [rax + rax]
mov rax, qword [r12 + 0x10]
movsxd rcx, edi
mov r8, qword [rax + rcx*8]
test r8, r8
je case.0x1403fca8b.1
mov eax, dword [r8 + 4]
and eax, 0xf00000
cmp eax, 0x200000
jne 0x1403fc9bd
mov r9, r14
mov rdx, r13
mov rcx, r15
call sym.ErrorReportClient.exe_private:_long_int___cdecl_CSfExifMetaDataHelper::WriteIFDEntry_void____ptr64__struct_SFMETA_SUM_TAG____ptr64__unsigned_long_int____ptr64____ptr64
mov ebx, eax
test eax, eax
js 0x1403fcc19
inc edi
cmp edi, ebp
jb 0x1403fc980
xor ebx, ebx
lea r9, [rsp + 0x44]
mov dword [rsp + 0x48], ebx
mov r8d, 4
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x48]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1403fc9f5
mov ebx, 0x8004e009
jmp 0x1403fcc19
mov edi, ebx
test ebp, ebp
je 0x1403fcbf0
lea rdx, [0x140000000]
nop word [rax + rax]
mov rax, qword [r12 + 0x10]
movsxd rcx, edi
mov rbx, qword [rax + rcx*8]
test rbx, rbx
je 0x1403fcbeb
mov ecx, dword [rbx + 4]
mov eax, ecx
and eax, 0xf00000
cmp eax, 0x200000
jne 0x1403fcbc4
test rsi, rsi
je 0x1403fca6e
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalFree]
movzx ecx, word [rbx + 4]
lea rdx, [0x140000000]
movzx eax, cx
and eax, 0xf
dec eax
cmp eax, 9
ja case.0x1403fca8b.1
cdqe
mov ecx, dword [rdx + rax*4 + 0x3fcc44]
add rcx, rdx
jmp rcx
mov edx, dword [rbx + 8]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rsi, rax
test rax, rax
je 0x1403fcbdd
movsxd r14, dword [rbx + 8]
lea r8, [rbx + 0xc]
xor r15d, r15d
cmp r15w, word [r8]
jne 0x1403fcac6
mov byte [rax], r15b
jmp 0x1403fcae8
mov qword [rsp + 0x38], r15
xor edx, edx
mov qword [rsp + 0x30], r15
xor ecx, ecx
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rsi
lea r9d, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rcx, rsi
mov byte [r14 + rsi - 1], r15b
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea ebx, [rax + 1]
jmp 0x1403fcb67
cmp dword [rbx + 8], 8
jne case.0x1403fca8b.1
mov edx, 8
jmp 0x1403fcb31
cmp dword [rbx + 8], 2
jne case.0x1403fca8b.1
mov edx, 2
jmp 0x1403fcb31
cmp dword [rbx + 8], 4
jne case.0x1403fca8b.1
mov edx, 4
jmp 0x1403fcb31
mov edx, dword [rbx + 8]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rsi, rax
test rax, rax
je 0x1403fcbdd
mov r8d, dword [rbx + 8]
lea rdx, [rbx + 0xc]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov ebx, dword [rbx + 8]
xor r15d, r15d
cmp ebx, 4
jbe 0x1403fcbc8
lea r9, [rsp + 0x44]
mov qword [rsp + 0x20], r15
mov r8d, ebx
mov rdx, rsi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1403fcbbd
and ebx, 1
test bl, bl
je 0x1403fcbc8
xor ebx, ebx
mov byte [rsp + 0x98], 0
lea r9, [rsp + 0x44]
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x98]
mov rcx, r13
lea r8d, [rbx + 1]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1403fcbca
mov ebx, 0x8004e009
jmp 0x1403fcbf0
xor ebx, ebx
jmp 0x1403fcbd1
xor ebx, ebx
lea rdx, [0x140000000]
inc edi
cmp edi, ebp
jb 0x1403fca10
jmp 0x1403fcbf0
mov ebx, 0x8007000e
jmp 0x1403fcc19
mov ebx, 0x80004005
jmp 0x1403fcc19
mov ebx, 0x80004005
test rsi, rsi
je 0x1403fcc19
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rdi, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x80]
mov eax, ebx
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rsi
ret