Function at 0x140069570
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rdi, rcx
mov rax, qword [rcx + 0x8c8]
test rax, rax
je 0x140069643
cmp byte [rcx + 1], 0
je 0x140069643
mov byte [rax + 0x18], 0
mov rbx, qword [rcx + 0x8c8]
test rbx, rbx
je 0x140069643
mov rcx, rbx
call fcn.140086260
mov rcx, qword [rbx + 0x70]
test rcx, rcx
je 0x1400695e6
mov rax, qword [0x1400b2e50]
test rax, rax
je 0x1400695e0
dec dword [rax + 0x9b8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rbx + 0x60]
test rcx, rcx
je 0x140069607
mov rax, qword [0x1400b2e50]
test rax, rax
je 0x140069601
dec dword [rax + 0x9b8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rbx + 0x50]
test rcx, rcx
je 0x140069628
mov rax, qword [0x1400b2e50]
test rax, rax
je 0x140069622
dec dword [rax + 0x9b8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [0x1400b2e50]
test rax, rax
je 0x14006963a
dec dword [rax + 0x9b8]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor r15d, r15d
mov qword [rdi + 0x8c8], r15
cmp byte [rdi], r15b
je 0x140069f98
cmp byte [rdi + 0x3631], r15b
je 0x1400696ce
mov rbx, qword [rdi + 0x840]
test rbx, rbx
je 0x1400696ce
mov rsi, qword [0x1400b2e50]
mov qword [0x1400b2e50], rdi
mov dword [rdi + 0x3634], r15d
mov qword [rsp + 0x50], r15
lea rcx, [rsp + 0x50]
call fcn.140077060
mov rbp, rax
lea rdx, [0x1400a2a08]
mov rcx, rbx
call fcn.140064780
mov rbx, rax
test rax, rax
je 0x1400696c7
mov r9, rax
mov r8, qword [rsp + 0x50]
lea edx, [r15 + 1]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov qword [0x1400b2e50], rsi
mov ebx, r15d
cmp dword [rdi + 0x3678], r15d
jle 0x14006970d
mov rsi, r15
nop dword [rax]
mov rax, qword [rdi + 0x3680]
cmp dword [rax + rsi + 4], 6
jne 0x1400696ff
movsxd rdx, ebx
shl rdx, 5
add rdx, rax
mov rcx, rdi
call qword [rax + rsi + Ordinal_19]
inc ebx
add rsi, 0x20
cmp ebx, dword [rdi + 0x3678]
jl 0x1400696e0
mov r12d, r15d
cmp dword [rdi + 0x21b0], r15d
jle 0x1400698f3
mov r13, r15
mov rax, qword [rdi + 0x21b8]
mov rsi, qword [rax + r13]
test rsi, rsi
je 0x1400698df
mov rcx, qword [rsi]
test rcx, rcx
je 0x140069754
mov rax, qword [0x1400b2e50]
test rax, rax
je 0x14006974e
dec dword [rax + 0x9b8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r14d, r15d
cmp dword [rsi + 0x298], 0
je 0x1400697e0
mov rbp, r15
nop word [rax + rax]
mov r15, qword [rsi + 0x2a0]
lea rbx, [r15 + rbp]
lea rcx, [rbx + 0x70]
call fcn.140085750
mov rcx, qword [rbx + 0x80]
test rcx, rcx
je 0x1400697a8
mov rax, qword [0x1400b2e50]
test rax, rax
je 0x1400697a2
dec dword [rax + 0x9b8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [r15 + rbp + 0x68]
test rcx, rcx
je 0x1400697ca
mov rax, qword [0x1400b2e50]
test rax, rax
je 0x1400697c4
dec dword [rax + 0x9b8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
inc r14d
add rbp, 0x88
cmp r14d, dword [rsi + 0x298]
jne 0x140069770
xor r15d, r15d
lea rcx, [rsi + 0x2b8]
call fcn.140063280
mov rcx, qword [rsi + 0x2a0]
test rcx, rcx
je 0x140069810
mov rax, qword [0x1400b2e50]
test rax, rax
je 0x14006980a
dec dword [rax + 0x9b8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsi + 0x290]
test rcx, rcx
je 0x140069834
mov rax, qword [0x1400b2e50]
test rax, rax
je 0x14006982e
dec dword [rax + 0x9b8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsi + 0x1e8]
test rcx, rcx
je 0x140069858
mov rax, qword [0x1400b2e50]
test rax, rax
je 0x140069852
dec dword [rax + 0x9b8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsi + 0x1d8]
test rcx, rcx
je 0x14006987c
mov rax, qword [0x1400b2e50]
test rax, rax
je 0x140069876
dec dword [rax + 0x9b8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsi + 0x198]
test rcx, rcx
je 0x1400698a0
mov rax, qword [0x1400b2e50]
test rax, rax
je 0x14006989a
dec dword [rax + 0x9b8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsi + 0xd0]
test rcx, rcx
je 0x1400698c4
mov rax, qword [0x1400b2e50]
test rax, rax
je 0x1400698be
dec dword [rax + 0x9b8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [0x1400b2e50]
test rax, rax
je 0x1400698d6
dec dword [rax + 0x9b8]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
inc r12d
add r13, 8
cmp r12d, dword [rdi + 0x21b0]
jl 0x140069720
mov rcx, qword [rdi + 0x21b8]
test rcx, rcx
je 0x140069929
mov qword [rdi + 0x21b0], 0
mov rax, qword [0x1400b2e50]
test rax, rax
je 0x14006991c
dec dword [rax + 0x9b8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x21b8], r15
mov rcx, qword [rdi + 0x21c8]
test rcx, rcx
je 0x14006995f
mov qword [rdi + 0x21c0], 0
mov rax, qword [0x1400b2e50]
test rax, rax
je 0x140069952
dec dword [rax + 0x9b8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x21c8], r15
mov rcx, qword [rdi + 0x21d8]
test rcx, rcx
je 0x140069995
mov qword [rdi + 0x21d0], 0
mov rax, qword [0x1400b2e50]
test rax, rax
je 0x140069988
dec dword [rax + 0x9b8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x21d8], r15
mov qword [rdi + 0x2210], r15
mov rcx, qword [rdi + 0x21e8]
test rcx, rcx
je 0x1400699d2
mov qword [rdi + 0x21e0], 0
mov rax, qword [0x1400b2e50]
test rax, rax
je 0x1400699c5
dec dword [rax + 0x9b8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x21e8], r15
mov rcx, qword [rdi + 0x21f8]
test rcx, rcx
je 0x140069a08
mov qword [rdi + 0x21f0], 0
mov rax, qword [0x1400b2e50]
test rax, rax
je 0x1400699fb
dec dword [rax + 0x9b8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x21f8], r15
mov qword [rdi + 0x23c8], r15
mov qword [rdi + 0x2220], r15
mov qword [rdi + 0x2218], r15
mov qword [rdi + 0x22a0], r15
mov qword [rdi + 0x2288], r15
mov qword [rdi + 0x2228], r15
mov rcx, qword [rdi + 0x2340]
test rcx, rcx
je 0x140069a68
mov qword [rdi + 0x2338], 0
mov rax, qword [0x1400b2e50]
test rax, rax
je 0x140069a5b
dec dword [rax + 0x9b8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x2340], r15
mov rcx, qword [rdi + 0x2350]
test rcx, rcx
je 0x140069a9e
mov qword [rdi + 0x2348], 0
mov rax, qword [0x1400b2e50]
test rax, rax
je 0x140069a91
dec dword [rax + 0x9b8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x2350], r15
mov rcx, qword [rdi + 0x2360]
test rcx, rcx
je 0x140069ad4
mov qword [rdi + 0x2358], 0
mov rax, qword [0x1400b2e50]
test rax, rax
je 0x140069ac7
dec dword [rax + 0x9b8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x2360], r15
mov rcx, qword [rdi + 0x23a0]
test rcx, rcx
je 0x140069b0a
mov qword [rdi + 0x2398], 0
mov rax, qword [0x1400b2e50]
test rax, rax
je 0x140069afd
dec dword [rax + 0x9b8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x23a0], r15
mov rcx, qword [rdi + 0x23b0]
test rcx, rcx
je 0x140069b40
mov qword [rdi + 0x23a8], 0
mov rax, qword [0x1400b2e50]
test rax, rax
je 0x140069b33
dec dword [rax + 0x9b8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x23b0], r15
mov ebp, r15d
cmp dword [rdi + 0x23b8], 0
jle 0x140069c14
mov r14, r15
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rdi + 0x23c0]
mov rbx, qword [r14 + rax]
test rbx, rbx
je 0x140069c02
mov rsi, qword [rbx + 0x30]
test rsi, rsi
je 0x140069ba0
mov rcx, rsi
call fcn.140063280
mov rax, qword [0x1400b2e50]
test rax, rax
je 0x140069b97
dec dword [rax + 0x9b8]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rsi, qword [rbx + 0x38]
test rsi, rsi
je 0x140069bcd
mov rcx, rsi
call fcn.140063280
mov rax, qword [0x1400b2e50]
test rax, rax
je 0x140069bc3
dec dword [rax + 0x9b8]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
nop
lea rcx, [rbx + 0x70]
lea r9, [0x14001a1f0]
mov edx, Ordinal_20
lea r8d, [rdx - 0xe]
call fcn.14008f5ec
nop
mov rax, qword [0x1400b2e50]
test rax, rax
je 0x140069bf9
dec dword [rax + 0x9b8]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
inc ebp
add r14, 8
cmp ebp, dword [rdi + 0x23b8]
jl 0x140069b60
mov rcx, qword [rdi + 0x23c0]
test rcx, rcx
je 0x140069c4a
mov qword [rdi + 0x23b8], 0
mov rax, qword [0x1400b2e50]
test rax, rax
je 0x140069c3d
dec dword [rax + 0x9b8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x23c0], r15
lea rcx, [rdi + 0x2660]
call fcn.1400779d0
mov rcx, qword [rdi + 0x2690]
test rcx, rcx
je 0x140069c8c
mov qword [rdi + 0x2688], 0
mov rax, qword [0x1400b2e50]
test rax, rax
je 0x140069c7f
dec dword [rax + 0x9b8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x2690], r15
mov rcx, qword [rdi + 0x26a0]
test rcx, rcx
je 0x140069cc2
mov qword [rdi + 0x2698], 0
mov rax, qword [0x1400b2e50]
test rax, rax
je 0x140069cb5
dec dword [rax + 0x9b8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x26a0], r15
lea rcx, [rdi + 0x2600]
call fcn.140077ae0
mov ebp, r15d
cmp dword [rdi + 0x2628], 0
jle 0x140069d48
mov rsi, r15
nop dword [rax]
mov rbx, qword [rdi + 0x2630]
mov rcx, qword [rsi + rbx + 0x40]
test rcx, rcx
je 0x140069d09
mov rax, qword [0x1400b2e50]
test rax, rax
je 0x140069d03
dec dword [rax + 0x9b8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, [rbx + 0x10]
add rcx, rsi
call fcn.140085750
mov rcx, qword [rbx + rsi + 0x20]
test rcx, rcx
je 0x140069d37
mov rax, qword [0x1400b2e50]
test rax, rax
je 0x140069d31
dec dword [rax + 0x9b8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
inc ebp
add rsi, 0x90
cmp ebp, dword [rdi + 0x2628]
jl 0x140069ce0
mov rcx, qword [rdi + 0x2630]
test rcx, rcx
je 0x140069d7e
mov qword [rdi + 0x2628], 0
mov rax, qword [0x1400b2e50]
test rax, rax
je 0x140069d71
dec dword [rax + 0x9b8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x2630], r15
mov rcx, qword [rdi + 0x2650]
test rcx, rcx
je 0x140069db4
mov qword [rdi + 0x2648], 0
mov rax, qword [0x1400b2e50]
test rax, rax
je 0x140069da7
dec dword [rax + 0x9b8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x2650], r15
mov rcx, qword [rdi + 0x3608]
test rcx, rcx
je 0x140069dea
mov qword [rdi + 0x3600], 0
mov rax, qword [0x1400b2e50]
test rax, rax
je 0x140069ddd
dec dword [rax + 0x9b8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x3608], r15
mov rcx, qword [rdi + 0x3618]
test rcx, rcx
je 0x140069e20
mov qword [rdi + 0x3610], 0
mov rax, qword [0x1400b2e50]
test rax, rax
je 0x140069e13
dec dword [rax + 0x9b8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x3618], r15
mov rcx, qword [rdi + 0x26c8]
test rcx, rcx
je 0x140069e56
mov qword [rdi + 0x26c0], 0
mov rax, qword [0x1400b2e50]
test rax, rax
je 0x140069e49
dec dword [rax + 0x9b8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x26c8], r15
mov rcx, qword [rdi + 0x26d8]
test rcx, rcx
je 0x140069e8c
mov qword [rdi + 0x26d0], 0
mov rax, qword [0x1400b2e50]
test rax, rax
je 0x140069e7f
dec dword [rax + 0x9b8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x26d8], r15
mov rcx, qword [rdi + 0x26e8]
test rcx, rcx
je 0x140069ec2
mov qword [rdi + 0x26e0], 0
mov rax, qword [0x1400b2e50]
test rax, rax
je 0x140069eb5
dec dword [rax + 0x9b8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x26e8], r15
mov rcx, qword [rdi + 0x3660]
test rcx, rcx
je 0x140069ef8
mov qword [rdi + 0x3658], 0
mov rax, qword [0x1400b2e50]
test rax, rax
je 0x140069eeb
dec dword [rax + 0x9b8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x3660], r15
mov rcx, qword [rdi + 0x3650]
test rcx, rcx
je 0x140069f2e
mov qword [rdi + 0x3648], 0
mov rax, qword [0x1400b2e50]
test rax, rax
je 0x140069f21
dec dword [rax + 0x9b8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x3650], r15
cmp qword [rdi + 0x3698], 0
je 0x140069f5f
mov rbx, qword [rdi + 0x3698]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
cmp rbx, rax
je 0x140069f58
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov qword [rdi + 0x3698], r15
mov rcx, qword [rdi + 0x36a8]
test rcx, rcx
je 0x140069f95
mov qword [rdi + 0x36a0], 0
mov rax, qword [0x1400b2e50]
test rax, rax
je 0x140069f88
dec dword [rax + 0x9b8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x36a8], r15
mov byte [rdi], 0
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret