Function at 0x1400f6bb0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x1f0
mov qword [rsp + 0xc0], 0xfffffffffffffffe
mov qword [rsp + 0x238], rbx
mov rax, qword [0x1402e0068]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
mov r10d, r8d
mov r9, rdx
mov r12, rcx
mov rsi, qword [rsp + 0x240]
test rsi, rsi
je case.0x1400f6c58.3
mov ebx, dword [rsi + 0x10]
cmp ebx, 1
jb case.0x1400f6c58.3
mov rsi, qword [rsi + 8]
xor ebp, ebp
mov edi, ebp
mov rdx, rbx
cmp rbx, 1
jb 0x1400f6c26
movzx eax, byte [rsi]
mov edi, 1
jmp 0x1400f6c2a
mov al, byte [rsp + 0x40]
movzx eax, al
add eax, 0xfffffffe
cmp eax, 0xfd
ja case.0x1400f6c58.3
cdqe
lea r8, [0x140000000]
movzx eax, byte [r8 + rax + 0xf75b4]
mov ecx, dword [r8 + rax*4 + 0xf7584]
add rcx, r8
jmp rcx
mov r8d, edi
add r8, rsi
lea ecx, [rdi + 1]
cmp ecx, ebx
ja case.0x1400f6c58.3
nop dword [rax + rax]
mov eax, edi
inc edi
inc ecx
cmp byte [rax + rsi], bpl
je 0x1400f6c85
cmp ecx, ebx
jbe 0x1400f6c70
jmp case.0x1400f6c58.3
lea rcx, [r12 + 0x150]
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov edx, r10d
call fcn.1400fd900
jmp case.0x1400f6c58.3
cmp dword [0x1402e47d8], ebp
jne case.0x1400f6c58.3
movzx r11d, byte [r12 + 0x252]
movzx ebx, byte [r12 + 0x253]
lea rax, [rdi + 1]
cmp rax, rdx
ja 0x1400f6ced
movzx eax, byte [rsi + rdi]
inc edi
test al, al
je 0x1400f6ced
cmp al, 1
jne case.0x1400f6c58.3
lea rcx, [r12 - 0x58]
call fcn.1400ef740
jmp case.0x1400f6c58.3
lea rax, [rdi + 1]
cmp rax, rdx
ja 0x1400f6cfc
mov r11b, byte [rsi + rdi]
inc edi
lea rax, [rdi + 1]
cmp rax, rdx
ja 0x1400f6d0a
mov bl, byte [rsi + rdi]
inc edi
lea rax, [rdi + 2]
cmp rax, rdx
ja 0x1400f6d25
movzx r9d, word [rsi + rdi]
mov word [0x1402dff44], r9w
add edi, 2
jmp 0x1400f6d2d
mov r9w, word [0x1402dff44]
lea rax, [rdi + 1]
cmp rax, rdx
ja 0x1400f6d46
movzx r8d, byte [rsi + rdi]
mov byte [reloc.WS2_32.dll_accept], r8b
inc edi
jmp 0x1400f6d4d
mov r8b, byte [reloc.WS2_32.dll_accept]
mov ecx, edi
lea rax, [rdi + 1]
cmp rax, rdx
ja 0x1400f6d66
movzx ecx, byte [rsi + rdi]
mov byte [reloc.WS2_32.dll_htonl], cl
inc edi
jmp 0x1400f6d6c
mov cl, byte [reloc.WS2_32.dll_htonl]
lea rax, [rdi + 4]
cmp rax, rdx
ja 0x1400f6d82
mov r10d, dword [rsi + rdi]
mov dword [0x1402dff48], r10d
jmp 0x1400f6d89
mov r10d, dword [0x1402dff48]
movzx eax, cl
movzx edi, r8b
movzx r9d, r9w
movzx r8d, bl
movzx edx, r11b
lea rcx, [r12 - 0x58]
mov dword [rsp + 0x30], r10d
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], edi
call fcn.1400f2270
jmp case.0x1400f6c58.3
cmp dword [0x1402e47d8], ebp
jne case.0x1400f6c58.3
mov ebp, edi
add rbp, rsi
lea ecx, [rdi + 1]
cmp ecx, ebx
ja case.0x1400f6c58.3
mov eax, edi
inc edi
inc ecx
cmp byte [rax + rsi], 0
je 0x1400f6de9
cmp ecx, ebx
jbe 0x1400f6dd4
jmp case.0x1400f6c58.3
lea r8, str.gotohttp.ck
mov edx, 0x104
lea rcx, [rsp + 0xd0]
call fcn.1400044a0
lea rdx, [0x14029fcf4]
lea rcx, [rsp + 0xd0]
call fcn.1401e97ac
mov rbx, rax
test rax, rax
je case.0x1400f6c58.3
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbp
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
mov r9, rbx
lea r8d, [rax + 1]
mov rcx, rbp
call fcn.1401e9984
mov rcx, rbx
call fcn.1401e95fc
jmp case.0x1400f6c58.3
cmp dword [0x1402e47d8], ebp
jne case.0x1400f6c58.3
lea rcx, [r12 - 0x58]
mov r8d, r10d
mov rdx, r9
call fcn.1400f5520
jmp case.0x1400f6c58.3
mov rdx, rbp
mov r13d, edi
add r13, rsi
lea ecx, [rdi + 1]
cmp ecx, ebx
ja 0x1400f6eb5
mov eax, edi
inc edi
inc ecx
cmp byte [rax + rsi], dl
je 0x1400f6e92
cmp ecx, ebx
jbe 0x1400f6e81
jmp 0x1400f6eb5
mov edx, edi
add rdx, rsi
lea ecx, [rdi + 1]
cmp ecx, ebx
ja 0x1400f6eb0
nop
mov eax, edi
inc edi
inc ecx
cmp byte [rax + rsi], bpl
je 0x1400f6eb8
cmp ecx, ebx
jbe 0x1400f6ea0
mov rdx, rbp
jmp 0x1400f6eb8
mov r13, rbp
mov rcx, rdx
call fcn.140001d00
mov r8d, eax
lea rcx, [r12 - 0x58]
mov rdx, r13
call fcn.1400ef680
jmp case.0x1400f6c58.3
lea rcx, [r12 + 0x150]
mov edx, r10d
call fcn.1400fb6c0
jmp case.0x1400f6c58.3
mov r12d, edi
add r12, rsi
lea ecx, [rdi + 1]
cmp ecx, ebx
ja case.0x1400f6c58.3
nop dword [rax + rax]
mov eax, edi
inc edi
inc ecx
cmp byte [rax + rsi], bpl
je 0x1400f6f15
cmp ecx, ebx
jbe 0x1400f6f00
jmp case.0x1400f6c58.3
lea rcx, [rsp + 0x48]
call fcn.140004bb0
nop
mov rdx, r12
lea rcx, [rsp + 0x48]
call fcn.1400064e0
xor r8d, r8d
lea rdx, [0x14023e750]
lea rcx, [rsp + 0x48]
call fcn.140004e60
mov rbx, rax
test rax, rax
je 0x1400f6f9c
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp rcx, 0x11
jb 0x1400f6f9c
movzx ecx, byte [rbx]
call fcn.140001840
mov edi, eax
shl dil, 4
movzx ecx, byte [rbx + 1]
call fcn.140001840
add al, dil
mov byte [rsp + rbp + 0xc8], al
inc rbp
add rbx, 3
cmp rbp, 6
jl 0x1400f6f60
lea rcx, [rsp + 0xc8]
call fcn.1400085f0
nop
lea rcx, [rsp + 0x48]
call fcn.140004d80
jmp case.0x1400f6c58.3
lea rcx, [rsp + 0x70]
call fcn.1400e7a60
nop
mov edx, edi
add rdx, rsi
lea ecx, [rdi + 1]
cmp ecx, ebx
ja 0x1400f6fe0
mov eax, edi
inc edi
inc ecx
cmp byte [rax + rsi], 0
je 0x1400f6fd4
cmp ecx, ebx
jbe 0x1400f6fc2
jmp 0x1400f6fe0
lea rcx, [rsp + 0x70]
call fcn.1400e4430
jmp 0x1400f6fec
xor edx, edx
lea rcx, [rsp + 0x70]
call fcn.1400e4430
lea rcx, [r12 - 0x58]
xor r8d, r8d
mov edx, 0x8b
call fcn.1400f13c0
mov rax, qword [r12 + 0xf8]
test rax, rax
je 0x1400f7016
cmp qword [rax], 0
je 0x1400f7016
mov rdx, qword [rax]
jmp 0x1400f7019
mov rdx, rbp
mov rcx, qword [r12 + 8]
mov rax, qword [rcx]
call qword [rax + 0x18]
nop
cmp dword [rsp + 0xb4], 0
je 0x1400f7115
mov dword [rsp + 0xb4], ebp
xor r8d, r8d
lea rdx, str.general
lea rcx, [rsp + 0x70]
call fcn.140002bc0
mov rdi, rax
test rax, rax
je 0x1400f70c2
lea rdx, [0x14023cfd0]
mov rcx, rax
call fcn.140001f40
test eax, eax
js 0x1400f70c2
movsxd rcx, eax
add rcx, rcx
mov rax, qword [rdi + 8]
mov rcx, qword [rax + rcx*8 + 8]
test rcx, rcx
je 0x1400f70c2
movzx eax, byte [rcx]
cmp al, 0x23
jne 0x1400f7094
inc rcx
xor edx, edx
lea r8d, [rdx + 0x10]
call fcn.1401e7480
jmp 0x1400f70c4
cmp al, 0x30
jne 0x1400f70b5
movzx eax, byte [rcx + 1]
cmp al, 0x78
je 0x1400f70a4
cmp al, 0x58
jne 0x1400f70b5
add rcx, 2
xor edx, edx
lea r8d, [rdx + 0x10]
call fcn.1401e7480
jmp 0x1400f70c4
xor edx, edx
lea r8d, [rdx + 0xa]
call fcn.1401e7480
jmp 0x1400f70c4
mov eax, ebp
and al, 9
cmp al, 1
jne 0x1400f70f3
mov rax, qword [0x1402e4808]
test rax, rax
je 0x1400f70de
mov rdx, qword [rax]
test rdx, rdx
jne 0x1400f70e1
mov rdx, rbp
mov r8d, 1
lea rcx, [rsp + 0x70]
call fcn.140002830
jmp 0x1400f7115
mov rax, qword [0x1402e4808]
test rax, rax
je 0x1400f7107
mov rdx, qword [rax]
test rdx, rdx
jne 0x1400f710a
mov rdx, rbp
lea rcx, [rsp + 0x70]
call fcn.1400027b0
nop
lea rcx, [rsp + 0x70]
call fcn.1400026d0
jmp case.0x1400f6c58.3
cmp r10d, dword [r12 + 0x324]
jne case.0x1400f6c58.3
cmp ebx, 5
jbe case.0x1400f6c58.3
mov edx, edi
add rdx, rsi
lea ecx, [rdi + 1]
cmp ecx, ebx
ja case.0x1400f6c58.3
nop dword [rax + rax]
mov eax, edi
inc edi
inc ecx
cmp byte [rax + rsi], bpl
je 0x1400f7165
cmp ecx, ebx
jbe 0x1400f7150
jmp case.0x1400f6c58.3
lea rcx, [rsp + 0x48]
call fcn.140004d00
nop
xor r8d, r8d
lea rdx, str.server
lea rcx, [rsp + 0x48]
call fcn.140004e60
mov rbx, rax
test rax, rax
je 0x1400f71e4
mov ecx, gethostbyaddr
call fcn.1401e65ec
mov rdi, rax
mov qword [rsp + 0xc8], rax
test rax, rax
je 0x1400f71d3
mov qword [rax + 8], rbp
mov dword [rax + 0x10], ebp
mov qword [rax + 0x18], rax
lea rax, vtable.._AVTChangeServer__DM___on_send_data_indication_CMainDlg__MEAAXPEBDIIPEBVTBuffer__H_Z_.0
mov qword [rdi], rax
lea rax, [r12 - 0x58]
mov qword [rdi + 0x20], rax
lea rcx, [rdi + 0x28]
mov rdx, rbx
call fcn.140004240
nop
jmp 0x1400f71d6
mov rdi, rbp
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.1400010a0
nop
lea rcx, [rsp + 0x48]
call fcn.140004d80
jmp case.0x1400f6c58.3
cmp r10d, dword [r12 + 0x324]
jne 0x1400f7515
cmp ebx, 5
jbe 0x1400f7515
mov edx, edi
add rdx, rsi
lea ecx, [rdi + 1]
cmp ecx, ebx
ja 0x1400f7515
nop word [rax + rax]
mov eax, edi
inc edi
inc ecx
cmp byte [rax + rsi], bpl
je 0x1400f7235
cmp ecx, ebx
jbe 0x1400f7220
jmp 0x1400f7515
lea rcx, [rsp + 0x48]
call fcn.140004d00
nop
xor r8d, r8d
lea rdx, [0x14023df04]
lea rcx, [rsp + 0x48]
call fcn.140004ec0
cmp eax, 1
jne 0x1400f729d
cmp dword [0x1402e47d8], 0
je 0x1400f7271
lea rcx, [rsp + 0x48]
call fcn.140004d80
jmp case.0x1400f6c58.3
mov dword [0x1402e47d8], 1
mov r8d, 1
lea rdx, str.cursor
lea rcx, [rsp + 0x48]
call fcn.140004ec0
mov dword [0x1402e49f0], eax
jmp 0x1400f74fd
cmp dword [0x1402e47d8], 0
je 0x1400f7509
lea rcx, [rsp + 0x70]
call fcn.1400e7a60
nop
xor r9d, r9d
lea r8, [0x14023df04]
lea rdx, str.general
lea rcx, [rsp + 0x70]
call fcn.140008a50
test eax, eax
je 0x1400f73e2
cmp dword [rsp + 0xb4], 0
je 0x1400f73c8
mov dword [rsp + 0xb4], ebp
xor r8d, r8d
lea rdx, str.general
lea rcx, [rsp + 0x70]
call fcn.140002bc0
mov rdi, rax
test rax, rax
je 0x1400f7375
lea rdx, [0x14023cfd0]
mov rcx, rax
call fcn.140001f40
test eax, eax
js 0x1400f7375
movsxd rcx, eax
add rcx, rcx
mov rax, qword [rdi + 8]
mov rcx, qword [rax + rcx*8 + 8]
test rcx, rcx
je 0x1400f7375
movzx eax, byte [rcx]
cmp al, 0x23
jne 0x1400f7347
inc rcx
xor edx, edx
lea r8d, [rdx + 0x10]
call fcn.1401e7480
jmp 0x1400f7377
cmp al, 0x30
jne 0x1400f7368
movzx eax, byte [rcx + 1]
cmp al, 0x78
je 0x1400f7357
cmp al, 0x58
jne 0x1400f7368
add rcx, 2
xor edx, edx
lea r8d, [rdx + 0x10]
call fcn.1401e7480
jmp 0x1400f7377
xor edx, edx
lea r8d, [rdx + 0xa]
call fcn.1401e7480
jmp 0x1400f7377
mov eax, ebp
and al, 9
cmp al, 1
jne 0x1400f73a6
mov rax, qword [0x1402e4808]
test rax, rax
je 0x1400f7391
mov rdx, qword [rax]
test rdx, rdx
jne 0x1400f7394
mov rdx, rbp
mov r8d, 1
lea rcx, [rsp + 0x70]
call fcn.140002830
jmp 0x1400f73c8
mov rax, qword [0x1402e4808]
test rax, rax
je 0x1400f73ba
mov rdx, qword [rax]
test rdx, rdx
jne 0x1400f73bd
mov rdx, rbp
lea rcx, [rsp + 0x70]
call fcn.1400027b0
nop
lea rcx, [rsp + 0x70]
call fcn.1400026d0
nop
lea rcx, [rsp + 0x48]
call fcn.140004d80
jmp case.0x1400f6c58.3
mov dword [0x1402e47d8], ebp
xor r8d, r8d
lea rdx, str.cursor
lea rcx, [rsp + 0x48]
call fcn.140004ec0
mov dword [0x1402e49f0], eax
cmp dword [rsp + 0xb4], 0
je 0x1400f74f2
mov dword [rsp + 0xb4], ebp
xor r8d, r8d
lea rdx, str.general
lea rcx, [rsp + 0x70]
call fcn.140002bc0
mov rdi, rax
test rax, rax
je 0x1400f749f
lea rdx, [0x14023cfd0]
mov rcx, rax
call fcn.140001f40
test eax, eax
js 0x1400f749f
movsxd rcx, eax
add rcx, rcx
mov rax, qword [rdi + 8]
mov rcx, qword [rax + rcx*8 + 8]
test rcx, rcx
je 0x1400f749f
movzx eax, byte [rcx]
cmp al, 0x23
jne 0x1400f7471
inc rcx
xor edx, edx
lea r8d, [rdx + 0x10]
call fcn.1401e7480
jmp 0x1400f74a1
cmp al, 0x30
jne 0x1400f7492
movzx eax, byte [rcx + 1]
cmp al, 0x78
je 0x1400f7481
cmp al, 0x58
jne 0x1400f7492
add rcx, 2
xor edx, edx
lea r8d, [rdx + 0x10]
call fcn.1401e7480
jmp 0x1400f74a1
xor edx, edx
lea r8d, [rdx + 0xa]
call fcn.1401e7480
jmp 0x1400f74a1
mov eax, ebp
and al, 9
cmp al, 1
jne 0x1400f74d0
mov rax, qword [0x1402e4808]
test rax, rax
je 0x1400f74bb
mov rdx, qword [rax]
test rdx, rdx
jne 0x1400f74be
mov rdx, rbp
mov r8d, 1
lea rcx, [rsp + 0x70]
call fcn.140002830
jmp 0x1400f74f2
mov rax, qword [0x1402e4808]
test rax, rax
je 0x1400f74e4
mov rdx, qword [rax]
test rdx, rdx
jne 0x1400f74e7
mov rdx, rbp
lea rcx, [rsp + 0x70]
call fcn.1400027b0
nop
lea rcx, [rsp + 0x70]
call fcn.1400026d0
nop
lea rcx, [rsp + 0x48]
call fcn.140004d80
jmp 0x1400f7515
lea rcx, [rsp + 0x48]
call fcn.140004d80
jmp case.0x1400f6c58.3
mov rdx, qword [r12 + 0xf8]
test rdx, rdx
je 0x1400f752a
mov rdx, qword [rdx]
test rdx, rdx
jne 0x1400f752d
mov rdx, rbp
mov rcx, qword [r12 + 8]
mov rax, qword [rcx]
call qword [rax + 0x18]
jmp case.0x1400f6c58.3
cmp dword [reloc.WS2_32.dll_accept], ebp
je case.0x1400f6c58.3
xor r9d, r9d
mov edx, VarUI4FromDisp
mov r8d, 0xe140
mov rcx, qword [r12 - 0x50]
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.1401e6720
mov rbx, qword [rsp + 0x238]
add rsp, 0x1f0
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret