Function at 0x1403fc000
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x1406836b8]
xor rax, rsp
mov qword [rsp + 0x70], rax
xor edi, edi
mov qword [rsp + 0x58], r9
mov qword [rsp + 0x50], rcx
mov r13, rdx
mov dword [rsp + 0x48], edi
movzx edx, di
mov word [rsp + 0x40], dx
mov r14, r9
mov r15, r8
mov rbx, rcx
mov r12d, edi
mov esi, edi
test r9, r9
jne 0x1403fc05a
mov ebx, 0x80004005
jmp 0x1403fc3cd
mov qword [rsp + 0xc0], rbp
test r15, r15
jne 0x1403fc06b
mov ebp, edi
jmp 0x1403fc0c0
mov ebp, dword [r8]
mov ecx, edi
test ebp, ebp
je 0x1403fc0c0
mov r9, qword [r8 + 0x10]
nop dword [rax + rax]
movsxd rax, ecx
mov r8, qword [r9 + rax*8]
test r8, r8
je case.0x1403fc235.1
mov eax, dword [r8 + 4]
and eax, 0xf00000
je 0x1403fc0b2
test r12d, r12d
jne 0x1403fc0ba
add eax, 0xfff00000
test eax, 0xffefffff
jne 0x1403fc0ba
mov r12d, 1
inc dx
mov word [rsp + 0x40], dx
inc ecx
cmp ecx, ebp
jb 0x1403fc080
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rdi
mov r8d, 2
lea rdx, [rsp + 0x40]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1403fc1a7
movzx eax, word [rsp + 0x40]
lea ecx, [rax + rax*2]
lea ecx, [rcx*4 + 6]
add dword [r14], ecx
test ebp, ebp
je 0x1403fc141
nop dword [rax]
mov rax, qword [r15 + 0x10]
movsxd rcx, edi
mov r8, qword [rax + rcx*8]
test r8, r8
je case.0x1403fc235.1
test dword [r8 + 4], 0xf00000
jne 0x1403fc13b
mov r9, r14
mov rdx, r13
mov rcx, rbx
call sym.ErrorReportClient.exe_private:_long_int___cdecl_CSfExifMetaDataHelper::WriteIFDEntry_void____ptr64__struct_SFMETA_SUM_TAG____ptr64__unsigned_long_int____ptr64____ptr64
mov ebx, eax
test eax, eax
js 0x1403fc3c5
mov rbx, qword [rsp + 0x50]
inc edi
cmp edi, ebp
jb 0x1403fc100
xor ebx, ebx
mov edi, 4
test r12d, r12d
je 0x1403fc184
mov eax, dword [r14]
lea r9, [rsp + 0x48]
lea r8d, [rdi + 8]
mov dword [rsp + 0x68], eax
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x48769
mov rcx, r13
mov dword [rsp + 0x64], 1
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1403fc1a7
lea r9, [rsp + 0x48]
mov dword [rsp + 0x4c], ebx
mov r8d, edi
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x4c]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1403fc1b1
mov ebx, 0x8004e009
jmp 0x1403fc3c5
mov edi, ebx
test ebp, ebp
je 0x1403fc37c
lea rdx, [0x140000000]
mov rax, qword [r15 + 0x10]
movsxd rcx, edi
mov rbx, qword [rax + rcx*8]
test rbx, rbx
je 0x1403fc404
mov eax, dword [rbx + 4]
test eax, 0xf00000
jne 0x1403fc36d
test rsi, rsi
je 0x1403fc218
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalFree]
movzx eax, word [rbx + 4]
lea rdx, [0x140000000]
movzx eax, ax
and eax, 0xf
dec eax
cmp eax, 9
ja case.0x1403fc235.1
cdqe
mov ecx, dword [rdx + rax*4 + 0x3fc40c]
add rcx, rdx
jmp rcx
mov edx, dword [rbx + 8]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rsi, rax
test rax, rax
je 0x1403fc3f6
movsxd r14, dword [rbx + 8]
lea r8, [rbx + 0xc]
xor eax, eax
cmp ax, word [r8]
jne 0x1403fc26e
mov byte [rsi], al
jmp 0x1403fc290
mov qword [rsp + 0x38], rax
xor edx, edx
mov qword [rsp + 0x30], rax
xor ecx, ecx
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rsi
lea r9d, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rcx, rsi
mov byte [r14 + rsi - 1], 0
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea ebx, [rax + 1]
jmp 0x1403fc30d
cmp dword [rbx + 8], 8
jne case.0x1403fc235.1
mov edx, 8
jmp 0x1403fc2da
cmp dword [rbx + 8], 2
jne case.0x1403fc235.1
mov edx, 2
jmp 0x1403fc2da
cmp dword [rbx + 8], 4
jne case.0x1403fc235.1
mov edx, 4
jmp 0x1403fc2da
mov edx, dword [rbx + 8]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rsi, rax
test rax, rax
je 0x1403fc3f6
mov r8d, dword [rbx + 8]
lea rdx, [rbx + 0xc]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov ebx, dword [rbx + 8]
cmp ebx, 4
jbe 0x1403fc366
xor r14d, r14d
lea r9, [rsp + 0x48]
mov r8d, ebx
mov qword [rsp + 0x20], r14
mov rdx, rsi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1403fc3ef
and ebx, 1
test bl, bl
je 0x1403fc366
lea r9, [rsp + 0x48]
mov byte [rsp + 0x44], r14b
lea r8d, [r14 + 1]
mov qword [rsp + 0x20], r14
lea rdx, [rsp + 0x44]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1403fc3ef
lea rdx, [0x140000000]
inc edi
cmp edi, ebp
jb 0x1403fc1c2
mov r14, qword [rsp + 0x58]
test r12d, r12d
je 0x1403fc39a
mov rcx, qword [rsp + 0x50]
mov r9, r14
mov r8, r15
mov rdx, r13
call sym.ErrorReportClient.exe_private:_long_int___cdecl_CSfExifMetaDataHelper::WriteExifIFD_void____ptr64__struct_tSFLIST____ptr64__unsigned_long_int____ptr64____ptr64
mov ebx, eax
test eax, eax
js 0x1403fc39c
xor ebx, ebx
test rsi, rsi
je 0x1403fc3c5
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rbp, qword [rsp + 0xc0]
mov eax, ebx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14039bbb0
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov ebx, 0x8004e009
jmp 0x1403fc39c
mov ebx, 0x8007000e
jmp 0x1403fc3c5
mov ebx, 0x80004005
jmp 0x1403fc3c5
mov ebx, 0x80004005
jmp 0x1403fc39c