Function at 0x140042770
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, qword [0x140369a98]
mov rax, qword [rdi + 0x38]
test rax, rax
je 0x140042844
cmp byte [rdi + 1], 0
je 0x140042844
mov byte [rax + 0x18], 0
mov rbx, qword [rdi + 0x38]
test rbx, rbx
je 0x140042844
mov rcx, rbx
call fcn.1400a8840
nop
mov rcx, qword [rbx + 0x80]
test rcx, rcx
je 0x1400427e5
mov rax, qword [0x140369a98]
test rax, rax
je 0x1400427de
dec dword [rax + 0xf8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
nop
mov rcx, qword [rbx + 0x70]
test rcx, rcx
je 0x140042807
mov rax, qword [0x140369a98]
test rax, rax
je 0x140042800
dec dword [rax + 0xf8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
nop
mov rcx, qword [rbx + 0x60]
test rcx, rcx
je 0x140042829
mov rax, qword [0x140369a98]
test rax, rax
je 0x140042822
dec dword [rax + 0xf8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
nop
mov rax, qword [0x140369a98]
test rax, rax
je 0x14004283b
dec dword [rax + 0xf8]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor r15d, r15d
mov qword [rdi + 0x38], r15
mov rcx, qword [rdi + 0x3d90]
test rcx, rcx
je 0x14004287d
mov qword [rdi + 0x3d88], r15
mov rax, qword [0x140369a98]
test rax, rax
je 0x140042870
dec dword [rax + 0xf8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x3d90], r15
cmp byte [rdi], r15b
je 0x1400430e1
cmp byte [rdi + 0x5ee0], r15b
je 0x1400428ee
mov rbx, qword [rdi + 0x20]
test rbx, rbx
je 0x1400428ee
mov rax, qword [0x140369a98]
mov dword [rax + 0x5ee4], r15d
mov qword [rsp + 0x40], r15
lea rcx, [rsp + 0x40]
call fcn.14005a620
mov rsi, rax
lea rdx, [0x1402106b0]
mov rcx, rbx
call fcn.14003d9b0
mov rbx, rax
test rax, rax
je 0x1400428ee
mov r9, rax
mov r8, qword [rsp + 0x40]
mov edx, 1
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x140369a98]
mov rbx, qword [rax + 0x4a30]
movsxd rax, dword [rax + 0x4a28]
lea rsi, [rbx + rax*8]
cmp rbx, rsi
je 0x140042921
nop dword [rax]
mov rcx, qword [rbx]
call fcn.14005cdf0
add rbx, 8
cmp rbx, rsi
jne 0x140042910
mov esi, r15d
cmp dword [rdi + 0x5ea0], r15d
jle 0x140042972
mov rbp, r15
mov rax, qword [rdi + 0x5ea8]
mov rbx, qword [rax + rbp + 8]
test rbx, rbx
je 0x140042964
mov rcx, rbx
call fcn.14005e710
mov rax, qword [0x140369a98]
test rax, rax
je 0x14004295b
dec dword [rax + 0xf8]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
inc esi
add rbp, 0x10
cmp esi, dword [rdi + 0x5ea0]
jl 0x140042930
mov rbx, qword [rdi + 0x5f30]
movsxd rsi, dword [rdi + 0x5f28]
shl rsi, 5
add rsi, rbx
cmp rbx, rsi
je 0x1400429ab
nop dword [rax]
cmp dword [rbx + 4], 6
jne 0x1400429a2
mov rax, qword [rbx + 0x10]
mov rdx, rbx
mov rcx, rdi
call rax
add rbx, 0x20
cmp rbx, rsi
jne 0x140042990
mov ebx, r15d
cmp dword [rdi + 0x3fb8], r15d
jle 0x1400429de
mov rsi, r15
nop word [rax + rax]
mov rcx, qword [rdi + 0x3fc0]
mov rcx, qword [rcx + rsi]
call fcn.140072650
inc ebx
lea rsi, [rsi + 8]
cmp ebx, dword [rdi + 0x3fb8]
jl 0x1400429c0
mov rcx, qword [rdi + 0x3fc0]
test rcx, rcx
je 0x140042a10
mov qword [rdi + 0x3fb8], r15
mov rax, qword [0x140369a98]
test rax, rax
je 0x140042a03
dec dword [rax + 0xf8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x3fc0], r15
mov rcx, qword [rdi + 0x3fd0]
test rcx, rcx
je 0x140042a42
mov qword [rdi + 0x3fc8], r15
mov rax, qword [0x140369a98]
test rax, rax
je 0x140042a35
dec dword [rax + 0xf8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x3fd0], r15
mov rcx, qword [rdi + 0x3fe0]
test rcx, rcx
je 0x140042a74
mov qword [rdi + 0x3fd8], r15
mov rax, qword [0x140369a98]
test rax, rax
je 0x140042a67
dec dword [rax + 0xf8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x3fe0], r15
mov qword [rdi + 0x4018], r15
mov rcx, qword [rdi + 0x3ff0]
test rcx, rcx
je 0x140042aad
mov qword [rdi + 0x3fe8], r15
mov rax, qword [0x140369a98]
test rax, rax
je 0x140042aa0
dec dword [rax + 0xf8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x3ff0], r15
mov rcx, qword [rdi + 0x4000]
test rcx, rcx
je 0x140042adf
mov qword [rdi + 0x3ff8], r15
mov rax, qword [0x140369a98]
test rax, rax
je 0x140042ad2
dec dword [rax + 0xf8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x4000], r15
mov qword [rdi + 0x4aa0], r15
mov qword [rdi + 0x4028], r15
mov qword [rdi + 0x4020], r15
mov qword [rdi + 0x40b0], r15
mov qword [rdi + 0x4098], r15
mov qword [rdi + 0x4030], r15
lea rcx, [rdi + 0x4750]
call fcn.14003b100
mov rcx, qword [rdi + 0x4998]
test rcx, rcx
je 0x140042b47
mov qword [rdi + 0x4990], r15
mov rax, qword [0x140369a98]
test rax, rax
je 0x140042b3a
dec dword [rax + 0xf8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x4998], r15
mov rcx, qword [rdi + 0x49a8]
test rcx, rcx
je 0x140042b79
mov qword [rdi + 0x49a0], r15
mov rax, qword [0x140369a98]
test rax, rax
je 0x140042b6c
dec dword [rax + 0xf8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x49a8], r15
mov rcx, qword [rdi + 0x49b8]
test rcx, rcx
je 0x140042bab
mov qword [rdi + 0x49b0], r15
mov rax, qword [0x140369a98]
test rax, rax
je 0x140042b9e
dec dword [rax + 0xf8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x49b8], r15
mov rcx, qword [rdi + 0x49f8]
test rcx, rcx
je 0x140042bdd
mov qword [rdi + 0x49f0], r15
mov rax, qword [0x140369a98]
test rax, rax
je 0x140042bd0
dec dword [rax + 0xf8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x49f8], r15
mov rcx, qword [rdi + 0x4a08]
test rcx, rcx
je 0x140042c0f
mov qword [rdi + 0x4a00], r15
mov rax, qword [0x140369a98]
test rax, rax
je 0x140042c02
dec dword [rax + 0xf8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x4a08], r15
mov rcx, qword [rdi + 0x4a18]
test rcx, rcx
je 0x140042c41
mov qword [rdi + 0x4a10], r15
mov rax, qword [0x140369a98]
test rax, rax
je 0x140042c34
dec dword [rax + 0xf8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x4a18], r15
mov qword [rdi + 0x4a50], r15
mov qword [rdi + 0x4a48], r15
mov qword [rdi + 0x4a40], r15
mov ebx, r15d
cmp dword [rdi + 0x4a28], r15d
jle 0x140042c8e
mov rsi, r15
nop word [rax + rax]
mov rcx, qword [rdi + 0x4a30]
mov rcx, qword [rcx + rsi]
call fcn.140072560
inc ebx
lea rsi, [rsi + 8]
cmp ebx, dword [rdi + 0x4a28]
jl 0x140042c70
mov rcx, qword [rdi + 0x4a30]
test rcx, rcx
je 0x140042cc0
mov qword [rdi + 0x4a28], r15
mov rax, qword [0x140369a98]
test rax, rax
je 0x140042cb3
dec dword [rax + 0xf8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x4a30], r15
lea rcx, [rdi + 0x4de0]
call fcn.140071430
mov rcx, qword [rdi + 0x4e10]
test rcx, rcx
je 0x140042cfe
mov qword [rdi + 0x4e08], r15
mov rax, qword [0x140369a98]
test rax, rax
je 0x140042cf1
dec dword [rax + 0xf8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x4e10], r15
mov rcx, qword [rdi + 0x4e20]
test rcx, rcx
je 0x140042d30
mov qword [rdi + 0x4e18], r15
mov rax, qword [0x140369a98]
test rax, rax
je 0x140042d23
dec dword [rax + 0xf8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x4e20], r15
mov ebx, r15d
cmp dword [rdi + 0x4d60], r15d
jle 0x140042d78
mov rsi, r15
nop
mov rax, qword [rdi + 0x4d68]
mov rcx, qword [rsi + rax + 0x20]
test rcx, rcx
je 0x140042d6a
mov rax, qword [0x140369a98]
test rax, rax
je 0x140042d63
dec dword [rax + 0xf8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
nop
inc ebx
add rsi, 0x28
cmp ebx, dword [rdi + 0x4d60]
jl 0x140042d40
mov rcx, qword [rdi + 0x4d68]
test rcx, rcx
je 0x140042daa
mov qword [rdi + 0x4d60], r15
mov rax, qword [0x140369a98]
test rax, rax
je 0x140042d9d
dec dword [rax + 0xf8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x4d68], r15
lea rcx, [rdi + 0x4d90]
call fcn.1400715a0
mov esi, r15d
cmp dword [rdi + 0x4d80], r15d
jle 0x140042e15
mov rbp, r15
nop word [rax + rax]
mov rbx, qword [rdi + 0x4d88]
lea rcx, [rbx + 0x10]
add rcx, rbp
call fcn.1400a7be0
nop
mov rcx, qword [rbx + rbp + 0x20]
test rcx, rcx
je 0x140042e07
mov rax, qword [0x140369a98]
test rax, rax
je 0x140042e00
dec dword [rax + 0xf8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
nop
inc esi
add rbp, 0x70
cmp esi, dword [rdi + 0x4d80]
jl 0x140042dd0
mov rcx, qword [rdi + 0x4d88]
test rcx, rcx
je 0x140042e47
mov qword [rdi + 0x4d80], r15
mov rax, qword [0x140369a98]
test rax, rax
je 0x140042e3a
dec dword [rax + 0xf8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x4d88], r15
mov rcx, qword [rdi + 0x4dd0]
test rcx, rcx
je 0x140042e79
mov qword [rdi + 0x4dc8], r15
mov rax, qword [0x140369a98]
test rax, rax
je 0x140042e6c
dec dword [rax + 0xf8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x4dd0], r15
mov rcx, qword [rdi + 0x5df8]
test rcx, rcx
je 0x140042eab
mov qword [rdi + 0x5df0], r15
mov rax, qword [0x140369a98]
test rax, rax
je 0x140042e9e
dec dword [rax + 0xf8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x5df8], r15
mov rcx, qword [rdi + 0x5e08]
test rcx, rcx
je 0x140042edd
mov qword [rdi + 0x5e00], r15
mov rax, qword [0x140369a98]
test rax, rax
je 0x140042ed0
dec dword [rax + 0xf8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x5e08], r15
mov rcx, qword [rdi + 0x4e70]
test rcx, rcx
je 0x140042f0f
mov qword [rdi + 0x4e68], r15
mov rax, qword [0x140369a98]
test rax, rax
je 0x140042f02
dec dword [rax + 0xf8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x4e70], r15
mov rcx, qword [rdi + 0x4e80]
test rcx, rcx
je 0x140042f41
mov qword [rdi + 0x4e78], r15
mov rax, qword [0x140369a98]
test rax, rax
je 0x140042f34
dec dword [rax + 0xf8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x4e80], r15
mov rcx, qword [rdi + 0x4e90]
test rcx, rcx
je 0x140042f73
mov qword [rdi + 0x4e88], r15
mov rax, qword [0x140369a98]
test rax, rax
je 0x140042f66
dec dword [rax + 0xf8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x4e90], r15
mov dword [rdi + 0x5ce0], r15d
mov rcx, qword [rdi + 0x5cf0]
test rcx, rcx
je 0x140042fac
mov qword [rdi + 0x5ce8], r15
mov rax, qword [0x140369a98]
test rax, rax
je 0x140042f9f
dec dword [rax + 0xf8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x5cf0], r15
mov rcx, qword [rdi + 0x5f10]
test rcx, rcx
je 0x140042fde
mov qword [rdi + 0x5f08], r15
mov rax, qword [0x140369a98]
test rax, rax
je 0x140042fd1
dec dword [rax + 0xf8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x5f10], r15
mov rcx, qword [rdi + 0x5f00]
test rcx, rcx
je 0x140043010
mov qword [rdi + 0x5ef8], r15
mov rax, qword [0x140369a98]
test rax, rax
je 0x140043003
dec dword [rax + 0xf8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x5f00], r15
cmp qword [rdi + 0x5f98], 0
je 0x140043041
mov rbx, qword [rdi + 0x5f98]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
cmp rbx, rax
je 0x14004303a
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov qword [rdi + 0x5f98], r15
mov rcx, qword [rdi + 0x5fa8]
test rcx, rcx
je 0x140043073
mov qword [rdi + 0x5fa0], r15
mov rax, qword [0x140369a98]
test rax, rax
je 0x140043066
dec dword [rax + 0xf8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x5fa8], r15
mov rcx, qword [rdi + 0x5fe0]
test rcx, rcx
je 0x1400430a5
mov qword [rdi + 0x5fd8], r15
mov rax, qword [0x140369a98]
test rax, rax
je 0x140043098
dec dword [rax + 0xf8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x5fe0], r15
mov rcx, qword [rdi + 0x5ff0]
test rcx, rcx
je 0x1400430d7
mov qword [rdi + 0x5fe8], r15
mov rax, qword [0x140369a98]
test rax, rax
je 0x1400430ca
dec dword [rax + 0xf8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x5ff0], r15
mov dword [rdi + 0x5ff8], r15d
mov byte [rdi], 0
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret