Function at 0x1400962d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rbx, rcx
mov rdx, qword [rcx + 0xa8]
add rcx, 0xa8
xor r15d, r15d
test rdx, rdx
je 0x14009643c
lea rcx, [rbx + 0xa8]
cmp byte [rbx + 1], r15b
je 0x14009643c
mov byte [rdx + 0x18], r15b
mov rdi, qword [rbx + 0xa8]
lea rcx, [rbx + 0xa8]
test rdi, rdi
je 0x14009643c
mov rcx, rdi
call fcn.1400b0b90
mov rcx, rdi
call fcn.1400b0ce0
mov ebp, r15d
cmp dword [rdi + 0x48], r15d
jle 0x14009638b
mov r14d, r15d
nop dword [rax]
mov rax, qword [rdi + 0x50]
mov rsi, qword [r14 + rax]
test rsi, rsi
je 0x140096380
mov rcx, rsi
call fcn.1400b3550
mov rax, qword [0x1403ca138]
test rax, rax
je 0x140096377
dec dword [rax + 0x3b4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
inc ebp
add r14, 8
cmp ebp, dword [rdi + 0x48]
jl 0x140096350
mov rcx, qword [rdi + 0x50]
test rcx, rcx
je 0x1400963b4
mov qword [rdi + 0x48], r15
mov rax, qword [0x1403ca138]
test rax, rax
je 0x1400963aa
dec dword [rax + 0x3b4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x50], r15
mov rcx, qword [rdi + 0x70]
test rcx, rcx
je 0x1400963d6
mov rax, qword [0x1403ca138]
test rax, rax
je 0x1400963cf
dec dword [rax + 0x3b4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
nop
mov rcx, qword [rdi + 0x60]
test rcx, rcx
je 0x1400963f8
mov rax, qword [0x1403ca138]
test rax, rax
je 0x1400963f1
dec dword [rax + 0x3b4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
nop
mov rcx, qword [rdi + 0x50]
test rcx, rcx
je 0x14009641a
mov rax, qword [0x1403ca138]
test rax, rax
je 0x140096413
dec dword [rax + 0x3b4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
nop
mov rax, qword [0x1403ca138]
test rax, rax
je 0x14009642c
dec dword [rax + 0x3b4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, [rbx + 0xa8]
mov qword [rcx], r15
cmp byte [rbx], 0
je 0x140096b49
cmp byte [rbx + 0x3051], 0
je 0x1400964be
mov rdi, qword [rbx + 0x20]
test rdi, rdi
je 0x1400964be
mov rsi, qword [0x1403ca138]
mov qword [0x1403ca138], rbx
mov dword [rbx + 0x3054], r15d
mov qword [rsp + 0x40], r15
lea rcx, [rsp + 0x40]
call fcn.1400a3c50
mov rbp, rax
lea rdx, [0x1401ba1fc]
mov rcx, rdi
call fcn.14008f680
mov rdi, rax
test rax, rax
je 0x1400964b7
mov r9, rax
mov r8, qword [rsp + 0x40]
mov edx, 1
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov qword [0x1403ca138], rsi
mov edi, r15d
cmp dword [rbx + 0x3098], r15d
jle 0x140096500
mov rsi, r15
nop dword [rax]
mov rcx, qword [rbx + 0x30a0]
cmp dword [rsi + rcx + 4], 6
jne 0x1400964f2
mov rax, qword [rsi + rcx + 0x10]
movsxd rdx, edi
shl rdx, 5
add rdx, rcx
mov rcx, rbx
call rax
inc edi
add rsi, 0x20
cmp edi, dword [rbx + 0x3098]
jl 0x1400964d0
mov esi, r15d
cmp dword [rbx + 0x1bd0], r15d
jle 0x140096551
mov r14, r15
nop
mov rax, qword [rbx + 0x1bd8]
mov rdi, qword [r14 + rax]
test rdi, rdi
je 0x140096543
mov rcx, rdi
call fcn.140093020
mov rax, qword [0x1403ca138]
test rax, rax
je 0x14009653a
dec dword [rax + 0x3b4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
inc esi
add r14, 8
cmp esi, dword [rbx + 0x1bd0]
jl 0x140096510
mov rcx, qword [rbx + 0x1bd8]
test rcx, rcx
je 0x140096583
mov qword [rbx + 0x1bd0], r15
mov rax, qword [0x1403ca138]
test rax, rax
je 0x140096576
dec dword [rax + 0x3b4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x1bd8], r15
mov rcx, qword [rbx + 0x1be8]
test rcx, rcx
je 0x1400965b5
mov qword [rbx + 0x1be0], r15
mov rax, qword [0x1403ca138]
test rax, rax
je 0x1400965a8
dec dword [rax + 0x3b4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x1be8], r15
mov rcx, qword [rbx + 0x1bf8]
test rcx, rcx
je 0x1400965e7
mov qword [rbx + 0x1bf0], r15
mov rax, qword [0x1403ca138]
test rax, rax
je 0x1400965da
dec dword [rax + 0x3b4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x1bf8], r15
mov qword [rbx + 0x1c30], r15
mov rcx, qword [rbx + 0x1c08]
test rcx, rcx
je 0x140096620
mov qword [rbx + 0x1c00], r15
mov rax, qword [0x1403ca138]
test rax, rax
je 0x140096613
dec dword [rax + 0x3b4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x1c08], r15
mov rcx, qword [rbx + 0x1c18]
test rcx, rcx
je 0x140096652
mov qword [rbx + 0x1c10], r15
mov rax, qword [0x1403ca138]
test rax, rax
je 0x140096645
dec dword [rax + 0x3b4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x1c18], r15
mov qword [rbx + 0x1de8], r15
mov qword [rbx + 0x1c40], r15
mov qword [rbx + 0x1c38], r15
mov qword [rbx + 0x1cc0], r15
mov qword [rbx + 0x1ca8], r15
mov qword [rbx + 0x1c48], r15
mov rcx, qword [rbx + 0x1d60]
test rcx, rcx
je 0x1400966ae
mov qword [rbx + 0x1d58], r15
mov rax, qword [0x1403ca138]
test rax, rax
je 0x1400966a1
dec dword [rax + 0x3b4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x1d60], r15
mov rcx, qword [rbx + 0x1d70]
test rcx, rcx
je 0x1400966e0
mov qword [rbx + 0x1d68], r15
mov rax, qword [0x1403ca138]
test rax, rax
je 0x1400966d3
dec dword [rax + 0x3b4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x1d70], r15
mov rcx, qword [rbx + 0x1d80]
test rcx, rcx
je 0x140096712
mov qword [rbx + 0x1d78], r15
mov rax, qword [0x1403ca138]
test rax, rax
je 0x140096705
dec dword [rax + 0x3b4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x1d80], r15
mov rcx, qword [rbx + 0x1dc0]
test rcx, rcx
je 0x140096744
mov qword [rbx + 0x1db8], r15
mov rax, qword [0x1403ca138]
test rax, rax
je 0x140096737
dec dword [rax + 0x3b4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x1dc0], r15
mov rcx, qword [rbx + 0x1dd0]
test rcx, rcx
je 0x140096776
mov qword [rbx + 0x1dc8], r15
mov rax, qword [0x1403ca138]
test rax, rax
je 0x140096769
dec dword [rax + 0x3b4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x1dd0], r15
mov ebp, r15d
cmp dword [rbx + 0x1dd8], r15d
jle 0x140096846
mov r14, r15
nop dword [rax]
mov rax, qword [rbx + 0x1de0]
mov rdi, qword [r14 + rax]
test rdi, rdi
je 0x140096834
mov rsi, qword [rdi + 0x30]
test rsi, rsi
je 0x1400967d0
mov rcx, rsi
call fcn.14008de30
mov rax, qword [0x1403ca138]
test rax, rax
je 0x1400967c7
dec dword [rax + 0x3b4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rsi, qword [rdi + 0x38]
test rsi, rsi
je 0x1400967fd
mov rcx, rsi
call fcn.14008de30
mov rax, qword [0x1403ca138]
test rax, rax
je 0x1400967f3
dec dword [rax + 0x3b4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
nop
lea rcx, [rdi + 0x70]
lea r9, [0x1400a45b0]
mov edx, reloc.WS2_32.dll_recv
mov r8d, 2
call fcn.140177764
nop
mov rax, qword [0x1403ca138]
test rax, rax
je 0x14009682b
dec dword [rax + 0x3b4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
inc ebp
add r14, 8
cmp ebp, dword [rbx + 0x1dd8]
jl 0x140096790
mov rcx, qword [rbx + 0x1de0]
test rcx, rcx
je 0x140096878
mov qword [rbx + 0x1dd8], r15
mov rax, qword [0x1403ca138]
test rax, rax
je 0x14009686b
dec dword [rax + 0x3b4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x1de0], r15
lea rcx, [rbx + 0x2080]
call fcn.1400a46e0
mov rcx, qword [rbx + 0x20b0]
test rcx, rcx
je 0x1400968b6
mov qword [rbx + 0x20a8], r15
mov rax, qword [0x1403ca138]
test rax, rax
je 0x1400968a9
dec dword [rax + 0x3b4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x20b0], r15
mov rcx, qword [rbx + 0x20c0]
test rcx, rcx
je 0x1400968e8
mov qword [rbx + 0x20b8], r15
mov rax, qword [0x1403ca138]
test rax, rax
je 0x1400968db
dec dword [rax + 0x3b4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x20c0], r15
lea rcx, [rbx + 0x2020]
call fcn.1400a4860
mov edi, r15d
cmp dword [rbx + 0x2048], r15d
jle 0x140096921
movsxd rax, edi
lea rcx, [rax + rax*8]
shl rcx, 4
add rcx, qword [rbx + 0x2050]
call fcn.140096b70
inc edi
cmp edi, dword [rbx + 0x2048]
jl 0x140096900
mov rcx, qword [rbx + 0x2050]
test rcx, rcx
je 0x140096953
mov qword [rbx + 0x2048], r15
mov rax, qword [0x1403ca138]
test rax, rax
je 0x140096946
dec dword [rax + 0x3b4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x2050], r15
mov rcx, qword [rbx + 0x2070]
test rcx, rcx
je 0x140096985
mov qword [rbx + 0x2068], r15
mov rax, qword [0x1403ca138]
test rax, rax
je 0x140096978
dec dword [rax + 0x3b4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x2070], r15
mov rcx, qword [rbx + 0x3028]
test rcx, rcx
je 0x1400969b7
mov qword [rbx + 0x3020], r15
mov rax, qword [0x1403ca138]
test rax, rax
je 0x1400969aa
dec dword [rax + 0x3b4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x3028], r15
mov rcx, qword [rbx + 0x3038]
test rcx, rcx
je 0x1400969e9
mov qword [rbx + 0x3030], r15
mov rax, qword [0x1403ca138]
test rax, rax
je 0x1400969dc
dec dword [rax + 0x3b4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x3038], r15
mov rcx, qword [rbx + 0x20e8]
test rcx, rcx
je 0x140096a1b
mov qword [rbx + 0x20e0], r15
mov rax, qword [0x1403ca138]
test rax, rax
je 0x140096a0e
dec dword [rax + 0x3b4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x20e8], r15
mov rcx, qword [rbx + 0x20f8]
test rcx, rcx
je 0x140096a4d
mov qword [rbx + 0x20f0], r15
mov rax, qword [0x1403ca138]
test rax, rax
je 0x140096a40
dec dword [rax + 0x3b4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x20f8], r15
mov rcx, qword [rbx + 0x2108]
test rcx, rcx
je 0x140096a7f
mov qword [rbx + 0x2100], r15
mov rax, qword [0x1403ca138]
test rax, rax
je 0x140096a72
dec dword [rax + 0x3b4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x2108], r15
mov rcx, qword [rbx + 0x3080]
test rcx, rcx
je 0x140096ab1
mov qword [rbx + 0x3078], r15
mov rax, qword [0x1403ca138]
test rax, rax
je 0x140096aa4
dec dword [rax + 0x3b4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x3080], r15
mov rcx, qword [rbx + 0x3070]
test rcx, rcx
je 0x140096ae3
mov qword [rbx + 0x3068], r15
mov rax, qword [0x1403ca138]
test rax, rax
je 0x140096ad6
dec dword [rax + 0x3b4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x3070], r15
cmp qword [rbx + 0x30b8], 0
je 0x140096b14
mov rdi, qword [rbx + 0x30b8]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
cmp rdi, rax
je 0x140096b0d
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov qword [rbx + 0x30b8], r15
mov rcx, qword [rbx + 0x30c8]
test rcx, rcx
je 0x140096b46
mov qword [rbx + 0x30c0], r15
mov rax, qword [0x1403ca138]
test rax, rax
je 0x140096b39
dec dword [rax + 0x3b4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x30c8], r15
mov byte [rbx], 0
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret