Function at 0x1400069a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, qword [0x14015e318]
mov rax, qword [rdi + 0x58]
test rax, rax
je 0x140006a8c
cmp byte [rdi + 1], 0
je 0x140006a8c
mov byte [rax + 0x18], 0
mov rbx, qword [rdi + 0x58]
test rbx, rbx
je 0x140006a8c
mov rcx, rbx
call fcn.140028260
nop
mov rcx, qword [rbx + 0x80]
test rcx, rcx
je 0x140006a1b
mov rax, qword [0x14015e318]
test rax, rax
je 0x140006a0e
dec dword [rax + 0xf4]
mov rdx, qword [0x14015e308]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
nop
mov rcx, qword [rbx + 0x70]
test rcx, rcx
je 0x140006a43
mov rax, qword [0x14015e318]
test rax, rax
je 0x140006a36
dec dword [rax + 0xf4]
mov rdx, qword [0x14015e308]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
nop
mov rcx, qword [rbx + 0x60]
test rcx, rcx
je 0x140006a6b
mov rax, qword [0x14015e318]
test rax, rax
je 0x140006a5e
dec dword [rax + 0xf4]
mov rdx, qword [0x14015e308]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
nop
mov rax, qword [0x14015e318]
test rax, rax
je 0x140006a7d
dec dword [rax + 0xf4]
mov rdx, qword [0x14015e308]
mov rcx, rbx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
xor r15d, r15d
mov qword [rdi + 0x58], r15
mov rcx, qword [rdi + 0x3c58]
test rcx, rcx
je 0x140006acb
mov qword [rdi + 0x3c50], r15
mov rax, qword [0x14015e318]
test rax, rax
je 0x140006ab8
dec dword [rax + 0xf4]
mov rdx, qword [0x14015e308]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x3c58], r15
cmp byte [rdi], r15b
je 0x1400073a7
cmp byte [rdi + 0x5b99], r15b
je 0x140006b3c
mov rbx, qword [rdi + 0x20]
test rbx, rbx
je 0x140006b3c
mov rax, qword [0x14015e318]
mov dword [rax + 0x5b9c], r15d
mov qword [rsp + 0x40], r15
lea rcx, [rsp + 0x40]
call fcn.14001a530
mov rsi, rax
lea rdx, [0x1400aebec]
mov rcx, rbx
call fcn.1400046b0
mov rbx, rax
test rax, rax
je 0x140006b3c
mov r9, rax
mov r8, qword [rsp + 0x40]
mov edx, 1
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov ebx, r15d
cmp dword [rdi + 0x5be0], r15d
jle 0x140006b80
mov rsi, r15
nop dword [rax + rax]
mov rcx, qword [rdi + 0x5be8]
cmp dword [rsi + rcx + 4], 6
jne 0x140006b72
mov rax, qword [rsi + rcx + 0x10]
movsxd rdx, ebx
shl rdx, 5
add rdx, rcx
mov rcx, rdi
call rax
inc ebx
add rsi, 0x20
cmp ebx, dword [rdi + 0x5be0]
jl 0x140006b50
mov esi, r15d
cmp dword [rdi + 0x3e58], r15d
jle 0x140006bd7
mov r14, r15
nop
mov rax, qword [rdi + 0x3e60]
mov rbx, qword [r14 + rax]
test rbx, rbx
je 0x140006bc9
mov rcx, rbx
call fcn.1400078b0
mov rax, qword [0x14015e318]
test rax, rax
je 0x140006bba
dec dword [rax + 0xf4]
mov rdx, qword [0x14015e308]
mov rcx, rbx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
inc esi
add r14, 8
cmp esi, dword [rdi + 0x3e58]
jl 0x140006b90
mov rcx, qword [rdi + 0x3e60]
test rcx, rcx
je 0x140006c0f
mov qword [rdi + 0x3e58], r15
mov rax, qword [0x14015e318]
test rax, rax
je 0x140006bfc
dec dword [rax + 0xf4]
mov rdx, qword [0x14015e308]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x3e60], r15
mov rcx, qword [rdi + 0x3e70]
test rcx, rcx
je 0x140006c47
mov qword [rdi + 0x3e68], r15
mov rax, qword [0x14015e318]
test rax, rax
je 0x140006c34
dec dword [rax + 0xf4]
mov rdx, qword [0x14015e308]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x3e70], r15
mov rcx, qword [rdi + 0x3e80]
test rcx, rcx
je 0x140006c7f
mov qword [rdi + 0x3e78], r15
mov rax, qword [0x14015e318]
test rax, rax
je 0x140006c6c
dec dword [rax + 0xf4]
mov rdx, qword [0x14015e308]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x3e80], r15
mov qword [rdi + 0x3eb8], r15
mov rcx, qword [rdi + 0x3e90]
test rcx, rcx
je 0x140006cbe
mov qword [rdi + 0x3e88], r15
mov rax, qword [0x14015e318]
test rax, rax
je 0x140006cab
dec dword [rax + 0xf4]
mov rdx, qword [0x14015e308]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x3e90], r15
mov rcx, qword [rdi + 0x3ea0]
test rcx, rcx
je 0x140006cf6
mov qword [rdi + 0x3e98], r15
mov rax, qword [0x14015e318]
test rax, rax
je 0x140006ce3
dec dword [rax + 0xf4]
mov rdx, qword [0x14015e308]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x3ea0], r15
mov qword [rdi + 0x4898], r15
mov qword [rdi + 0x3ec8], r15
mov qword [rdi + 0x3ec0], r15
mov qword [rdi + 0x3f50], r15
mov qword [rdi + 0x3f38], r15
mov qword [rdi + 0x3ed0], r15
lea rcx, [rdi + 0x45f0]
call fcn.140002740
mov rcx, qword [rdi + 0x4808]
test rcx, rcx
je 0x140006d64
mov qword [rdi + 0x4800], r15
mov rax, qword [0x14015e318]
test rax, rax
je 0x140006d51
dec dword [rax + 0xf4]
mov rdx, qword [0x14015e308]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x4808], r15
mov rcx, qword [rdi + 0x4818]
test rcx, rcx
je 0x140006d9c
mov qword [rdi + 0x4810], r15
mov rax, qword [0x14015e318]
test rax, rax
je 0x140006d89
dec dword [rax + 0xf4]
mov rdx, qword [0x14015e308]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x4818], r15
mov rcx, qword [rdi + 0x4828]
test rcx, rcx
je 0x140006dd4
mov qword [rdi + 0x4820], r15
mov rax, qword [0x14015e318]
test rax, rax
je 0x140006dc1
dec dword [rax + 0xf4]
mov rdx, qword [0x14015e308]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x4828], r15
mov rcx, qword [rdi + 0x4868]
test rcx, rcx
je 0x140006e0c
mov qword [rdi + 0x4860], r15
mov rax, qword [0x14015e318]
test rax, rax
je 0x140006df9
dec dword [rax + 0xf4]
mov rdx, qword [0x14015e308]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x4868], r15
mov rcx, qword [rdi + 0x4878]
test rcx, rcx
je 0x140006e44
mov qword [rdi + 0x4870], r15
mov rax, qword [0x14015e318]
test rax, rax
je 0x140006e31
dec dword [rax + 0xf4]
mov rdx, qword [0x14015e308]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x4878], r15
mov ebp, r15d
cmp dword [rdi + 0x4888], r15d
jle 0x140006f26
mov r14, r15
nop word [rax + rax]
mov rax, qword [rdi + 0x4890]
mov rbx, qword [r14 + rax]
test rbx, rbx
je 0x140006f14
mov rsi, qword [rbx + 0x38]
test rsi, rsi
je 0x140006ea6
mov rcx, rsi
call fcn.140002510
mov rax, qword [0x14015e318]
test rax, rax
je 0x140006e97
dec dword [rax + 0xf4]
mov rdx, qword [0x14015e308]
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rsi, qword [rbx + 0x40]
test rsi, rsi
je 0x140006ed9
mov rcx, rsi
call fcn.140002510
mov rax, qword [0x14015e318]
test rax, rax
je 0x140006ec9
dec dword [rax + 0xf4]
mov rdx, qword [0x14015e308]
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
nop
lea rcx, [rbx + 0x78]
lea r9, [0x14001b5d0]
mov edx, sendto
lea r8d, [rdx - 0xe]
call fcn.14008dccc
nop
mov rax, qword [0x14015e318]
test rax, rax
je 0x140006f05
dec dword [rax + 0xf4]
mov rdx, qword [0x14015e308]
mov rcx, rbx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
inc ebp
add r14, 8
cmp ebp, dword [rdi + 0x4888]
jl 0x140006e60
mov rcx, qword [rdi + 0x4890]
test rcx, rcx
je 0x140006f5e
mov qword [rdi + 0x4888], r15
mov rax, qword [0x14015e318]
test rax, rax
je 0x140006f4b
dec dword [rax + 0xf4]
mov rdx, qword [0x14015e308]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x4890], r15
lea rcx, [rdi + 0x4b70]
call fcn.14001b610
mov rcx, qword [rdi + 0x4ba0]
test rcx, rcx
je 0x140006fa2
mov qword [rdi + 0x4b98], r15
mov rax, qword [0x14015e318]
test rax, rax
je 0x140006f8f
dec dword [rax + 0xf4]
mov rdx, qword [0x14015e308]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x4ba0], r15
mov rcx, qword [rdi + 0x4bb0]
test rcx, rcx
je 0x140006fda
mov qword [rdi + 0x4ba8], r15
mov rax, qword [0x14015e318]
test rax, rax
je 0x140006fc7
dec dword [rax + 0xf4]
mov rdx, qword [0x14015e308]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x4bb0], r15
mov ebx, r15d
cmp dword [rdi + 0x4af0], r15d
jle 0x14000702e
mov rsi, r15
nop dword [rax]
mov rax, qword [rdi + 0x4af8]
mov rcx, qword [rsi + rax + 0x20]
test rcx, rcx
je 0x140007020
mov rax, qword [0x14015e318]
test rax, rax
je 0x140007013
dec dword [rax + 0xf4]
mov rdx, qword [0x14015e308]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
nop
inc ebx
add rsi, 0x28
cmp ebx, dword [rdi + 0x4af0]
jl 0x140006ff0
mov rcx, qword [rdi + 0x4af8]
test rcx, rcx
je 0x140007066
mov qword [rdi + 0x4af0], r15
mov rax, qword [0x14015e318]
test rax, rax
je 0x140007053
dec dword [rax + 0xf4]
mov rdx, qword [0x14015e308]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x4af8], r15
lea rcx, [rdi + 0x4b20]
call fcn.14001b7b0
mov esi, r15d
cmp dword [rdi + 0x4b10], r15d
jle 0x1400070cc
mov rbp, r15
mov rbx, qword [rdi + 0x4b18]
lea rcx, [rbx + 0x10]
add rcx, rbp
call fcn.1400277a0
nop
mov rcx, qword [rbx + rbp + 0x20]
test rcx, rcx
je 0x1400070be
mov rax, qword [0x14015e318]
test rax, rax
je 0x1400070b1
dec dword [rax + 0xf4]
mov rdx, qword [0x14015e308]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
nop
inc esi
add rbp, 0x70
cmp esi, dword [rdi + 0x4b10]
jl 0x140007081
mov rcx, qword [rdi + 0x4b18]
test rcx, rcx
je 0x140007104
mov qword [rdi + 0x4b10], r15
mov rax, qword [0x14015e318]
test rax, rax
je 0x1400070f1
dec dword [rax + 0xf4]
mov rdx, qword [0x14015e308]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x4b18], r15
mov rcx, qword [rdi + 0x4b60]
test rcx, rcx
je 0x14000713c
mov qword [rdi + 0x4b58], r15
mov rax, qword [0x14015e318]
test rax, rax
je 0x140007129
dec dword [rax + 0xf4]
mov rdx, qword [0x14015e308]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x4b60], r15
mov rcx, qword [rdi + 0x5b60]
test rcx, rcx
je 0x140007174
mov qword [rdi + 0x5b58], r15
mov rax, qword [0x14015e318]
test rax, rax
je 0x140007161
dec dword [rax + 0xf4]
mov rdx, qword [0x14015e308]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x5b60], r15
mov rcx, qword [rdi + 0x5b70]
test rcx, rcx
je 0x1400071ac
mov qword [rdi + 0x5b68], r15
mov rax, qword [0x14015e318]
test rax, rax
je 0x140007199
dec dword [rax + 0xf4]
mov rdx, qword [0x14015e308]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x5b70], r15
mov rcx, qword [rdi + 0x4bf0]
test rcx, rcx
je 0x1400071e4
mov qword [rdi + 0x4be8], r15
mov rax, qword [0x14015e318]
test rax, rax
je 0x1400071d1
dec dword [rax + 0xf4]
mov rdx, qword [0x14015e308]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x4bf0], r15
mov rcx, qword [rdi + 0x4c00]
test rcx, rcx
je 0x14000721c
mov qword [rdi + 0x4bf8], r15
mov rax, qword [0x14015e318]
test rax, rax
je 0x140007209
dec dword [rax + 0xf4]
mov rdx, qword [0x14015e308]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x4c00], r15
mov rcx, qword [rdi + 0x4c10]
test rcx, rcx
je 0x140007254
mov qword [rdi + 0x4c08], r15
mov rax, qword [0x14015e318]
test rax, rax
je 0x140007241
dec dword [rax + 0xf4]
mov rdx, qword [0x14015e308]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x4c10], r15
mov rcx, qword [rdi + 0x5bc8]
test rcx, rcx
je 0x14000728c
mov qword [rdi + 0x5bc0], r15
mov rax, qword [0x14015e318]
test rax, rax
je 0x140007279
dec dword [rax + 0xf4]
mov rdx, qword [0x14015e308]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x5bc8], r15
mov rcx, qword [rdi + 0x5bb8]
test rcx, rcx
je 0x1400072c4
mov qword [rdi + 0x5bb0], r15
mov rax, qword [0x14015e318]
test rax, rax
je 0x1400072b1
dec dword [rax + 0xf4]
mov rdx, qword [0x14015e308]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x5bb8], r15
cmp qword [rdi + 0x5c38], 0
je 0x1400072f5
mov rbx, qword [rdi + 0x5c38]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
cmp rbx, rax
je 0x1400072ee
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov qword [rdi + 0x5c38], r15
mov rcx, qword [rdi + 0x5c48]
test rcx, rcx
je 0x14000732d
mov qword [rdi + 0x5c40], r15
mov rax, qword [0x14015e318]
test rax, rax
je 0x14000731a
dec dword [rax + 0xf4]
mov rdx, qword [0x14015e308]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x5c48], r15
mov rcx, qword [rdi + 0x5c80]
test rcx, rcx
je 0x140007365
mov qword [rdi + 0x5c78], r15
mov rax, qword [0x14015e318]
test rax, rax
je 0x140007352
dec dword [rax + 0xf4]
mov rdx, qword [0x14015e308]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x5c80], r15
mov rcx, qword [rdi + 0x5c90]
test rcx, rcx
je 0x14000739d
mov qword [rdi + 0x5c88], r15
mov rax, qword [0x14015e318]
test rax, rax
je 0x14000738a
dec dword [rax + 0xf4]
mov rdx, qword [0x14015e308]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x5c90], r15
mov dword [rdi + 0x5c98], r15d
mov byte [rdi], 0
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret