Function at 0x140007160
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rbx, rcx
mov rax, qword [rcx + 0xa8]
test rax, rax
je 0x1400071c6
cmp byte [rcx + 1], 0
je 0x1400071c6
mov byte [rax + 0x18], 0
mov rdi, qword [rcx + 0xa8]
test rdi, rdi
je 0x1400071c6
mov rcx, rdi
call fcn.140022850
mov rax, qword [0x140161e70]
test rax, rax
je 0x1400071b7
dec dword [rax + 0x3b4]
mov rdx, qword [0x140161e60]
mov rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
xor r15d, r15d
mov qword [rbx + 0xa8], r15
cmp byte [rbx], r15b
je 0x140007961
cmp byte [rbx + 0x3079], r15b
je 0x14000724e
mov rdi, qword [rbx + 0x20]
test rdi, rdi
je 0x14000724e
mov rsi, qword [0x140161e70]
mov qword [0x140161e70], rbx
mov dword [rbx + 0x307c], r15d
mov qword [rsp + 0x40], r15
lea rcx, [rsp + 0x40]
call fcn.140014cb0
mov rbp, rax
lea rdx, [0x1400374a4]
mov rcx, rdi
call fcn.140002760
mov rdi, rax
test rax, rax
je 0x140007247
mov r9, rax
mov r8, qword [rsp + 0x40]
lea edx, [r15 + 1]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov qword [0x140161e70], rsi
mov edx, 6
mov rcx, rbx
call fcn.140004640
mov ebp, r15d
mov eax, dword [rbx + 0x1c08]
test eax, eax
jle 0x1400072db
mov rsi, r15
nop dword [rax + rax]
test rsi, rsi
js 0x140007279
cmp ebp, eax
jl 0x140007293
mov r8d, 0x689
lea rdx, str.C:Users10643DownloadsTelegram_Desktophwiidhx_hwidimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rbx + 0x1c10]
mov rdi, qword [rax + rsi*8]
test rdi, rdi
je 0x1400072cc
mov rcx, rdi
call fcn.140003f00
mov rax, qword [0x140161e70]
test rax, rax
je 0x1400072bd
dec dword [rax + 0x3b4]
mov rdx, qword [0x140161e60]
mov rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
inc ebp
inc rsi
mov eax, dword [rbx + 0x1c08]
cmp ebp, eax
jl 0x140007270
mov rcx, qword [rbx + 0x1c10]
test rcx, rcx
je 0x140007313
mov qword [rbx + 0x1c08], r15
mov rax, qword [0x140161e70]
test rax, rax
je 0x140007300
dec dword [rax + 0x3b4]
mov rdx, qword [0x140161e60]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rbx + 0x1c10], r15
mov rcx, qword [rbx + 0x1c20]
test rcx, rcx
je 0x14000734b
mov qword [rbx + 0x1c18], r15
mov rax, qword [0x140161e70]
test rax, rax
je 0x140007338
dec dword [rax + 0x3b4]
mov rdx, qword [0x140161e60]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rbx + 0x1c20], r15
mov rcx, qword [rbx + 0x1c30]
test rcx, rcx
je 0x140007383
mov qword [rbx + 0x1c28], r15
mov rax, qword [0x140161e70]
test rax, rax
je 0x140007370
dec dword [rax + 0x3b4]
mov rdx, qword [0x140161e60]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rbx + 0x1c30], r15
mov qword [rbx + 0x1c60], r15
mov rcx, qword [rbx + 0x1c40]
test rcx, rcx
je 0x1400073c2
mov qword [rbx + 0x1c38], r15
mov rax, qword [0x140161e70]
test rax, rax
je 0x1400073af
dec dword [rax + 0x3b4]
mov rdx, qword [0x140161e60]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rbx + 0x1c40], r15
mov rcx, qword [rbx + 0x1c50]
test rcx, rcx
je 0x1400073fa
mov qword [rbx + 0x1c48], r15
mov rax, qword [0x140161e70]
test rax, rax
je 0x1400073e7
dec dword [rax + 0x3b4]
mov rdx, qword [0x140161e60]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rbx + 0x1c50], r15
mov qword [rbx + 0x1e18], r15
mov qword [rbx + 0x1c70], r15
mov qword [rbx + 0x1c68], r15
mov qword [rbx + 0x1cf0], r15
mov qword [rbx + 0x1cd8], r15
mov qword [rbx + 0x1c78], r15
mov rcx, qword [rbx + 0x1d90]
test rcx, rcx
je 0x14000745c
mov qword [rbx + 0x1d88], r15
mov rax, qword [0x140161e70]
test rax, rax
je 0x140007449
dec dword [rax + 0x3b4]
mov rdx, qword [0x140161e60]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rbx + 0x1d90], r15
mov rcx, qword [rbx + 0x1da0]
test rcx, rcx
je 0x140007494
mov qword [rbx + 0x1d98], r15
mov rax, qword [0x140161e70]
test rax, rax
je 0x140007481
dec dword [rax + 0x3b4]
mov rdx, qword [0x140161e60]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rbx + 0x1da0], r15
mov rcx, qword [rbx + 0x1db0]
test rcx, rcx
je 0x1400074cc
mov qword [rbx + 0x1da8], r15
mov rax, qword [0x140161e70]
test rax, rax
je 0x1400074b9
dec dword [rax + 0x3b4]
mov rdx, qword [0x140161e60]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rbx + 0x1db0], r15
mov rcx, qword [rbx + 0x1df0]
test rcx, rcx
je 0x140007504
mov qword [rbx + 0x1de8], r15
mov rax, qword [0x140161e70]
test rax, rax
je 0x1400074f1
dec dword [rax + 0x3b4]
mov rdx, qword [0x140161e60]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rbx + 0x1df0], r15
mov rcx, qword [rbx + 0x1e00]
test rcx, rcx
je 0x14000753c
mov qword [rbx + 0x1df8], r15
mov rax, qword [0x140161e70]
test rax, rax
je 0x140007529
dec dword [rax + 0x3b4]
mov rdx, qword [0x140161e60]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rbx + 0x1e00], r15
mov r14d, r15d
mov eax, dword [rbx + 0x1e08]
test eax, eax
jle 0x14000763d
mov rbp, r15
test rbp, rbp
js 0x14000755a
cmp r14d, eax
jl 0x140007574
mov r8d, 0x689
lea rdx, str.C:Users10643DownloadsTelegram_Desktophwiidhx_hwidimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rbx + 0x1e10]
mov rdi, qword [rax + rbp*8]
test rdi, rdi
je 0x140007628
mov rsi, qword [rdi + 0x30]
test rsi, rsi
je 0x1400075ba
mov rcx, rsi
call fcn.140001070
mov rax, qword [0x140161e70]
test rax, rax
je 0x1400075ab
dec dword [rax + 0x3b4]
mov rdx, qword [0x140161e60]
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rsi, qword [rdi + 0x38]
test rsi, rsi
je 0x1400075ed
mov rcx, rsi
call fcn.140001070
mov rax, qword [0x140161e70]
test rax, rax
je 0x1400075dd
dec dword [rax + 0x3b4]
mov rdx, qword [0x140161e60]
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
nop
lea rcx, [rdi + 0x70]
lea r9, [0x140015770]
mov edx, 0x10
lea r8d, [rdx - 0xe]
call fcn.1400326ec
nop
mov rax, qword [0x140161e70]
test rax, rax
je 0x140007619
dec dword [rax + 0x3b4]
mov rdx, qword [0x140161e60]
mov rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
inc r14d
inc rbp
mov eax, dword [rbx + 0x1e08]
cmp r14d, eax
jl 0x140007550
mov rcx, qword [rbx + 0x1e10]
test rcx, rcx
je 0x140007675
mov qword [rbx + 0x1e08], r15
mov rax, qword [0x140161e70]
test rax, rax
je 0x140007662
dec dword [rax + 0x3b4]
mov rdx, qword [0x140161e60]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rbx + 0x1e10], r15
lea rcx, [rbx + 0x20a8]
call fcn.1400158c0
mov rcx, qword [rbx + 0x20d8]
test rcx, rcx
je 0x1400076b9
mov qword [rbx + 0x20d0], r15
mov rax, qword [0x140161e70]
test rax, rax
je 0x1400076a6
dec dword [rax + 0x3b4]
mov rdx, qword [0x140161e60]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rbx + 0x20d8], r15
mov rcx, qword [rbx + 0x20e8]
test rcx, rcx
je 0x1400076f1
mov qword [rbx + 0x20e0], r15
mov rax, qword [0x140161e70]
test rax, rax
je 0x1400076de
dec dword [rax + 0x3b4]
mov rdx, qword [0x140161e60]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rbx + 0x20e8], r15
lea rcx, [rbx + 0x2048]
call fcn.140015ab0
mov rcx, qword [rbx + 0x2078]
test rcx, rcx
je 0x140007735
mov qword [rbx + 0x2070], r15
mov rax, qword [0x140161e70]
test rax, rax
je 0x140007722
dec dword [rax + 0x3b4]
mov rdx, qword [0x140161e60]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rbx + 0x2078], r15
mov rcx, qword [rbx + 0x2098]
test rcx, rcx
je 0x14000776d
mov qword [rbx + 0x2090], r15
mov rax, qword [0x140161e70]
test rax, rax
je 0x14000775a
dec dword [rax + 0x3b4]
mov rdx, qword [0x140161e60]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rbx + 0x2098], r15
mov rcx, qword [rbx + 0x3050]
test rcx, rcx
je 0x1400077a5
mov qword [rbx + 0x3048], r15
mov rax, qword [0x140161e70]
test rax, rax
je 0x140007792
dec dword [rax + 0x3b4]
mov rdx, qword [0x140161e60]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rbx + 0x3050], r15
mov rcx, qword [rbx + 0x3060]
test rcx, rcx
je 0x1400077dd
mov qword [rbx + 0x3058], r15
mov rax, qword [0x140161e70]
test rax, rax
je 0x1400077ca
dec dword [rax + 0x3b4]
mov rdx, qword [0x140161e60]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rbx + 0x3060], r15
mov rcx, qword [rbx + 0x2110]
test rcx, rcx
je 0x140007815
mov qword [rbx + 0x2108], r15
mov rax, qword [0x140161e70]
test rax, rax
je 0x140007802
dec dword [rax + 0x3b4]
mov rdx, qword [0x140161e60]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rbx + 0x2110], r15
mov rcx, qword [rbx + 0x2120]
test rcx, rcx
je 0x14000784d
mov qword [rbx + 0x2118], r15
mov rax, qword [0x140161e70]
test rax, rax
je 0x14000783a
dec dword [rax + 0x3b4]
mov rdx, qword [0x140161e60]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rbx + 0x2120], r15
mov rcx, qword [rbx + 0x2130]
test rcx, rcx
je 0x140007885
mov qword [rbx + 0x2128], r15
mov rax, qword [0x140161e70]
test rax, rax
je 0x140007872
dec dword [rax + 0x3b4]
mov rdx, qword [0x140161e60]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rbx + 0x2130], r15
mov rcx, qword [rbx + 0x30a8]
test rcx, rcx
je 0x1400078bd
mov qword [rbx + 0x30a0], r15
mov rax, qword [0x140161e70]
test rax, rax
je 0x1400078aa
dec dword [rax + 0x3b4]
mov rdx, qword [0x140161e60]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rbx + 0x30a8], r15
mov rcx, qword [rbx + 0x3098]
test rcx, rcx
je 0x1400078f5
mov qword [rbx + 0x3090], r15
mov rax, qword [0x140161e70]
test rax, rax
je 0x1400078e2
dec dword [rax + 0x3b4]
mov rdx, qword [0x140161e60]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rbx + 0x3098], r15
cmp qword [rbx + 0x30e0], 0
je 0x140007926
mov rdi, qword [rbx + 0x30e0]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
cmp rdi, rax
je 0x14000791f
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov qword [rbx + 0x30e0], r15
mov rcx, qword [rbx + 0x30f0]
test rcx, rcx
je 0x14000795e
mov qword [rbx + 0x30e8], r15
mov rax, qword [0x140161e70]
test rax, rax
je 0x14000794b
dec dword [rax + 0x3b4]
mov rdx, qword [0x140161e60]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rbx + 0x30f0], r15
mov byte [rbx], 0
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret