Function at 0x1400a3150
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov r14d, edx
mov rdi, rcx
mov rax, qword [0x1406de900]
xor rax, rbp
mov qword [rbp], rax
mov eax, dword [0x1406e8378]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete al
cmp dword [0x1406e837c], 0xa
setl cl
or cl, al
nop word cs:[rax + rax]
nop dword [rax]
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.1401fc5d0
sub rsp, rax
mov rsi, rsp
mov eax, reloc.WS2_32.dll_recv
call fcn.1401fc5d0
sub rsp, rax
mov rbx, rsp
test cl, cl
je 0x1400a31a0
mov eax, reloc.WS2_32.dll_recv
call fcn.1401fc5d0
sub rsp, rax
mov r12, rsp
mov eax, reloc.WS2_32.dll_recv
call fcn.1401fc5d0
sub rsp, rax
mov r15, rsp
cmp r14d, 0xffffffff
je 0x1400a3364
mov rax, qword [rdi + 0x40]
cmp qword [rax], 0
je 0x1400a321d
mov rax, qword [rdi + 0x58]
mov ecx, dword [rax]
test ecx, ecx
jle 0x1400a321d
add ecx, 0xffffffff
mov dword [rax], ecx
mov rax, qword [rdi + 0x40]
mov rcx, qword [rax]
lea rdx, [rcx + 1]
mov qword [rax], rdx
mov byte [rcx], r14b
jmp 0x1400a3472
cmp qword [rdi + 0x80], 0
je 0x1400a336c
sub rsp, 0x20
mov rcx, rdi
call fcn.1400a2ec0
add rsp, 0x20
mov rcx, qword [rdi + 0x68]
test rcx, rcx
je 0x1400a3377
mov byte [rbx], r14b
lea rax, [rsi + 0x20]
lea r9, [rbx + 1]
lea rdx, [rdi + 0x74]
mov r10, qword [rcx]
sub rsp, 0x40
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r12
mov r8, rbx
call qword [r10 + gethostname]
add rsp, 0x40
mov ecx, 0xffffffff
cmp eax, 3
jge 0x1400a33a5
cmp eax, 1
ja 0x1400a346f
mov r15, qword [r15]
sub r15, rsi
je 0x1400a3352
mov r9, qword [rdi + 0x80]
sub rsp, 0x20
mov edx, 1
mov rcx, rsi
mov r8, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add rsp, 0x20
cmp dword [0x1406e837c], 0xa
jl 0x1400a3344
mov ecx, dword [0x1406e8378]
lea edx, [rcx - 1]
imul edx, ecx
and edx, 1
je 0x1400a3344
mov r13, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
nop word cs:[rax + rax]
nop dword [rax + rax]
mov r9, qword [rdi + 0x80]
sub rsp, 0x20
mov edx, 1
mov rcx, rsi
mov r8, r15
call r13
add rsp, 0x20
mov r9, qword [rdi + 0x80]
sub rsp, 0x20
mov edx, 1
mov rcx, rsi
mov r8, r15
call r13
add rsp, 0x20
cmp dword [0x1406e837c], 0xa
jl 0x1400a3344
mov ecx, dword [0x1406e8378]
lea edx, [rcx - 1]
imul edx, ecx
and edx, 1
jne 0x1400a32f0
cmp r15, rax
mov ecx, 0xffffffff
jne 0x1400a346f
mov byte [rdi + 0x71], 1
cmp qword [r12], rbx
mov eax, 0xffffffff
jmp 0x1400a3468
xor r14d, r14d
jmp 0x1400a3472
mov r14d, 0xffffffff
jmp 0x1400a3472
mov rsi, qword [rdi + 0x80]
mov ebx, r14d
shl ebx, 0x18
cmp dword [0x1406e837c], 0xa
jl 0x1400a33de
mov eax, dword [0x1406e8378]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x1400a33de
mov edi, ebx
sar edi, 0x18
jmp 0x1400a33cb
jne 0x1400a346f
cmp dword [0x1406e837c], 0xa
jl 0x1400a3419
mov eax, dword [0x1406e8378]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
jne 0x1400a344b
jmp 0x1400a3419
sub rsp, 0x20
mov ecx, edi
mov rdx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add rsp, 0x20
mov edi, ebx
sar edi, 0x18
sub rsp, 0x20
mov ecx, edi
mov rdx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add rsp, 0x20
cmp dword [0x1406e837c], 0xa
jl 0x1400a3410
mov ecx, dword [0x1406e8378]
lea edx, [rcx - 1]
imul edx, ecx
and edx, 1
jne 0x1400a33cb
cmp eax, 0xffffffff
cmove r14d, eax
jmp 0x1400a3472
mov rdx, qword [rdi + 0x80]
movsx ecx, byte [rbx]
sub rsp, 0x20
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add rsp, 0x20
cmp dword [0x1406e837c], 0xa
jl 0x1400a3465
mov ecx, dword [0x1406e8378]
lea edx, [rcx - 1]
imul edx, ecx
and edx, 1
je 0x1400a3465
mov rdx, qword [rdi + 0x80]
movsx ecx, byte [rbx]
sub rsp, 0x20
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add rsp, 0x20
jmp 0x1400a3419
cmp eax, 0xffffffff
cmove r14d, eax
mov ecx, r14d
mov r14d, ecx
mov rcx, qword [rbp]
xor rcx, rbp
sub rsp, 0x20
call fcn.1401fc630
add rsp, 0x20
mov eax, r14d
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret