Function at 0x140031f00
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x1400cb080]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, qword [rcx + 0x728]
mov edx, 2
mov r8d, 2
call fcn.140039940
test rdi, rdi
je 0x14003225a
mov rdi, qword [rsi + 0x728]
mov r13, qword [rsi + 0xaa8]
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x70], 0
test r13, r13
je 0x14003225a
mov rcx, r13
call fcn.140031340
lea rcx, [0x1400c1a87]
mov rdx, rdi
call fcn.140093a10
mov r14d, eax
test eax, eax
je 0x140031fb4
lea r8, [rsp + 0x78]
lea r9, [rsp + 0x70]
mov rcx, rsi
mov rdx, rdi
call fcn.140071110
test eax, eax
je 0x140031fcb
mov r12d, eax
xor ebp, ebp
jmp 0x14003220c
mov ecx, 1
call fcn.140082890
mov r9, rax
mov qword [rsp + 0x78], rax
mov bpl, 1
jmp 0x140031fd2
mov r9, qword [rsp + 0x78]
xor ebp, ebp
lea rcx, str._Netscape_HTTP_Cookie_File_n_https:__curl.se_docs_http_cookies.html_n_This_file_was_generated_by_libcurl__Edit_at_your_own_risk._n_n
mov edx, Ordinal_133
mov r8d, 1
call fcn.140093198
movsxd rdx, dword [r13 + 0x200]
test rdx, rdx
je 0x1400321a7
shl rdx, 3
mov ecx, 1
call qword [case.0x1400315e4.2]
mov r12d, reloc.WLDAP32.dll_Ordinal_27
test rax, rax
je 0x14003220c
mov r15, rax
mov dword [rsp + 0x64], r14d
mov qword [rsp + 0x68], rdi
xor eax, eax
xor r12d, r12d
jmp 0x140032039
inc rax
cmp rax, 0x3f
je 0x140032058
mov rcx, qword [r13 + rax*8]
jmp 0x140032043
mov rcx, qword [rcx]
test rcx, rcx
je 0x140032030
cmp qword [rcx + 0x28], 0
je 0x140032040
mov qword [r15 + r12*8], rcx
inc r12
jmp 0x140032040
mov dword [rsp + 0x60], ebp
mov byte [rsp + 0x5f], bl
lea r9, [0x140032340]
mov r8d, 8
mov rcx, r15
mov rdx, r12
call fcn.140093650
test r12, r12
je 0x14003218b
xor r14d, r14d
lea r13, [0x1400c3031]
lea rdi, str.FALSE
nop word cs:[rax + rax]
mov rax, qword [r15 + r14*8]
movzx edx, byte [rax + 0x38]
mov r9, qword [rax + 0x28]
mov r8, r13
test dl, dl
je 0x1400320cb
mov r8, r13
test r9, r9
je 0x1400320cb
cmp byte [r9], 0x2e
mov r8, r13
je 0x1400320cb
lea r8, [0x1400c1a29]
mov r10, qword [rax + 0x10]
mov rcx, qword [rax + 0x18]
test r9, r9
lea r11, [0x1400bb018]
cmove r9, r11
test rcx, rcx
lea r11, [0x1400c08bf]
cmove rcx, r11
test r10, r10
cmove r10, r13
mov r11, rdi
test dl, dl
je 0x140032104
lea r11, [0x1400bf7ec]
cmp byte [rax + 0x39], 0
mov rbp, rdi
je 0x140032114
lea rbp, [0x1400bf7ec]
cmp byte [rax + 0x3b], 0
mov rdx, r13
je 0x140032124
lea rdx, str.HttpOnly_
mov rbx, qword [rax + 8]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x48], r10
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], r11
lea rcx, str._s_s_s_t_s_t_s_t_s_t_lld_t_s_t_s
call fcn.14003bdb0
test rax, rax
je 0x1400321f4
mov rbp, rax
mov rcx, qword [rsp + 0x78]
lea rdx, [0x1400c28fe]
mov r8, rax
call fcn.14003be00
mov rcx, rbp
call qword [fcn.140092c88]
inc r14d
cmp r12, r14
ja 0x1400320a0
mov rcx, r15
call qword [fcn.140092c88]
movzx ebx, byte [rsp + 0x5f]
mov rdi, qword [rsp + 0x68]
mov ebp, dword [rsp + 0x60]
mov r14d, dword [rsp + 0x64]
test r14d, r14d
je 0x1400321e7
mov rcx, qword [rsp + 0x78]
call fcn.1400922e8
mov qword [rsp + 0x78], 0
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400321e7
mov rdx, rdi
call fcn.140071340
test eax, eax
je 0x1400321e7
mov rcx, qword [rsp + 0x70]
call fcn.14008faac
mov r12d, reloc.WS2_32.dll_socket
jmp 0x14003220c
mov rcx, qword [rsp + 0x70]
call qword [fcn.140092c88]
jmp 0x14003225a
mov rcx, r15
call qword [fcn.140092c88]
movzx ebx, byte [rsp + 0x5f]
mov ebp, dword [rsp + 0x60]
mov r12d, reloc.WLDAP32.dll_Ordinal_27
test bpl, bpl
jne 0x140032220
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140032220
call fcn.1400922e8
mov rcx, qword [rsp + 0x70]
call qword [fcn.140092c88]
test rsi, rsi
je 0x14003225a
cmp byte [rsi + 0xa87], 0
je 0x14003225a
mov ecx, r12d
call fcn.140050c50
mov r8, qword [rsi + 0x728]
lea rdx, str.WARNING:_failed_to_save_cookies_in__s:__s
mov rcx, rsi
mov r9, rax
call fcn.14001cd60
test bl, bl
je 0x14003230c
mov rax, qword [rsi + 0xe8]
mov rdi, qword [rsi + 0xaa8]
test rax, rax
je 0x140032282
cmp rdi, qword [rax + 0xb8]
je 0x14003230c
test rdi, rdi
je 0x140032301
xor r14d, r14d
jmp 0x140032299
inc r14
cmp r14, 0x3f
je 0x1400322f8
mov rbx, qword [rdi + r14*8]
test rbx, rbx
je 0x140032290
nop word cs:[rax + rax]
mov r15, qword [rbx]
mov rcx, qword [rbx + 0x28]
call qword [fcn.140092c88]
mov rcx, qword [rbx + 0x18]
call qword [fcn.140092c88]
mov rcx, qword [rbx + 0x20]
call qword [fcn.140092c88]
mov rcx, qword [rbx + 8]
call qword [fcn.140092c88]
mov rcx, qword [rbx + 0x10]
call qword [fcn.140092c88]
mov rcx, rbx
call qword [fcn.140092c88]
mov rbx, r15
test r15, r15
jne 0x1400322b0
jmp 0x140032290
mov rcx, rdi
call qword [fcn.140092c88]
mov qword [rsi + 0xaa8], 0
mov rcx, rsi
mov edx, 2
call fcn.140039980
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140080da0
nop
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret