Function at 0x14000ba90
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1010]
mov eax, 0x1110
call fcn.14003a3b0
sub rsp, rax
mov rax, qword [0x140054040]
xor rax, rsp
mov qword [rbp + 0x1000], rax
mov esi, r8d
mov r15, rdx
mov r14, rcx
mov qword [rsp + 0x58], rcx
xor r12d, r12d
mov qword [rsp + 0x40], r12
mov word [rbp - 0x50], r12w
xor edx, edx
mov r8d, 0x1046
lea rcx, [rbp - 0x4e]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea r8d, [r12 + 0x50]
lea rcx, [rsp + 0x60]
call sub.VCRUNTIME140.dll_memset
mov r13b, r12b
lea edi, [r12 + 1]
cmp esi, 0xffffffff
jne 0x14000bb1a
mov dword [rsp + 0x60], edi
mov ebx, edi
xor esi, esi
jmp 0x14000bb6d
mov ebx, r12d
mov edx, edi
test esi, esi
cmovne edx, esi
lea rsi, [rsp + 0x60]
test edx, edx
jle 0x14000bb61
mov rcx, qword [r14 + 0x26c0]
mov rax, qword [rcx]
mov r9, qword [rax + 0x40]
movsxd rax, ebx
lea r8, [rsp + 0x60]
lea r8, [r8 + rax*4]
mov rax, r9
call qword [case.0x140033a70.0]
test eax, eax
js 0x14000bb61
mov edx, dword [rsi]
add ebx, edi
add rsi, 4
cmp ebx, 0x14
jb 0x14000bb29
xor esi, esi
cmp dword [rsp + 0x60], esi
jle 0x14000bf02
movsxd rax, ebx
mov ecx, dword [rsp + rax*4 + 0x5c]
neg ecx
sbb eax, eax
add eax, 2
sub ebx, eax
movsxd r12, ebx
js 0x14000bf02
mov ebx, dword [rsp + r12*4 + 0x60]
mov rcx, qword [r14 + 0x26c0]
mov rax, qword [rcx]
lea r8, [rsp + 0x40]
mov edx, ebx
mov rax, qword [rax + 0x88]
call qword [case.0x140033a70.0]
test eax, eax
js 0x14000bece
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x50]
mov r8d, ebx
mov edx, ebx
mov rcx, r14
call fcn.14000cf2c
test al, al
je 0x14000bece
test r13b, r13b
jne 0x14000bc04
mov r13b, dil
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x4c]
mov r8d, 0x20
lea rdx, str._t_breadcrumbs__r_n
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000bf3c
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x50]
mov r8d, 0x1a
lea rdx, str._t_t_url_href
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000bf3c
lea r14, [rbp - 0x50]
lea rdx, [rbp - 0x50]
mov r8d, esi
movzx eax, word [rbp - 0x50]
cmp si, ax
je 0x14000bd44
mov rbx, rsi
cmp ax, 0x3e
ja 0x14000bd0d
movabs rcx, 0x500000c400000000
bt rcx, rax
jae 0x14000bd0d
test r8d, r8d
je 0x14000bc86
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000bf3a
movzx ecx, word [r14]
sub ecx, 0x22
je 0x14000bcd1
sub ecx, 4
je 0x14000bcc3
sub ecx, 1
je 0x14000bcba
sub ecx, 0x15
je 0x14000bcac
cmp ecx, 2
jne 0x14000bcdd
lea rbx, str.gt_
jmp 0x14000bcb3
lea rbx, str.lt_
mov esi, 8
jmp 0x14000bcdd
lea rbx, str.apos_
jmp 0x14000bcd8
lea rbx, str.amp_
mov esi, 0xa
jmp 0x14000bcdd
lea rbx, str.quot_
mov esi, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
mov r8d, esi
mov rdx, rbx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor esi, esi
test eax, eax
je 0x14000bf3c
mov r8d, 0xfffffffe
lea rdx, [r14 + 2]
jmp 0x14000bd0f
xor esi, esi
add r14, 2
add r8d, 2
movzx eax, word [r14]
cmp si, ax
jne 0x14000bc44
test r8d, r8d
je 0x14000bd44
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x34]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000bf3c
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x54]
mov r8d, 4
lea rdx, [0x1400429b4]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000bf3c
mov r14, qword [rsp + 0x40]
test r14, r14
je 0x14000be91
mov r8d, esi
movzx eax, word [r14]
cmp si, ax
je 0x14000be91
mov rdx, r14
mov rbx, rsi
cmp ax, 0x3e
ja 0x14000be5a
movabs rcx, 0x500000c400000000
bt rcx, rax
jae 0x14000be5a
xor r9d, r9d
test r8d, r8d
je 0x14000bdd4
mov qword [rsp + 0x20], r9
lea r9, [rsp + 0x38]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor r9d, r9d
test eax, eax
je 0x14000bf3a
movzx ecx, word [r14]
sub ecx, 0x22
je 0x14000be1f
sub ecx, 4
je 0x14000be11
sub ecx, 1
je 0x14000be08
sub ecx, 0x15
je 0x14000bdfa
cmp ecx, 2
jne 0x14000be2b
lea rbx, str.gt_
jmp 0x14000be01
lea rbx, str.lt_
mov esi, 8
jmp 0x14000be2b
lea rbx, str.apos_
jmp 0x14000be26
lea rbx, str.amp_
mov esi, 0xa
jmp 0x14000be2b
lea rbx, str.quot_
mov esi, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov qword [rsp + 0x20], r9
lea r9, [rsp + 0x38]
mov r8d, esi
mov rdx, rbx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor esi, esi
test eax, eax
je 0x14000bf3c
mov r8d, 0xfffffffe
lea rdx, [r14 + 2]
jmp 0x14000be5c
xor esi, esi
add r14, 2
add r8d, 2
movzx eax, word [r14]
cmp si, ax
jne 0x14000bd8d
test r8d, r8d
je 0x14000be91
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x38]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000bf3c
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x48]
mov r8d, reloc.OLEAUT32.dll_SafeArrayGetDim
lea rdx, str.__url__r_n
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000bf3c
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rsp + 0x40], rsi
mov r14, qword [rsp + 0x58]
sub r12, rdi
jns 0x14000bb86
test r13b, r13b
je 0x14000bf02
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x48]
mov r8d, SafeArrayRedim
lea rdx, str._t__breadcrumbs__r_n
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne dil
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov al, dil
mov rcx, qword [rbp + 0x1000]
xor rcx, rsp
call fcn.140038c60
mov rbx, qword [rsp + 0x1168]
add rsp, 0x1110
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor esi, esi
mov dil, sil
jmp 0x14000bf02