Function at 0x140018070
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rbx, rcx
mov rax, qword [rcx + 0xa8]
test rax, rax
je 0x14001815a
cmp byte [rcx + 1], 0
je 0x14001815a
mov byte [rax], 0
mov rdi, qword [rcx + 0xa8]
test rdi, rdi
je 0x14001815a
mov rcx, rdi
call fcn.1400323a0
nop
mov rcx, qword [rdi + 0x68]
test rcx, rcx
je 0x1400180e9
mov rax, qword [0x14014a270]
test rax, rax
je 0x1400180dc
dec dword [rax + 0x3b4]
mov rdx, qword [0x14014a260]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
nop
mov rcx, qword [rdi + 0x58]
test rcx, rcx
je 0x140018111
mov rax, qword [0x14014a270]
test rax, rax
je 0x140018104
dec dword [rax + 0x3b4]
mov rdx, qword [0x14014a260]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
nop
mov rcx, qword [rdi + 0x48]
test rcx, rcx
je 0x140018139
mov rax, qword [0x14014a270]
test rax, rax
je 0x14001812c
dec dword [rax + 0x3b4]
mov rdx, qword [0x14014a260]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
nop
mov rax, qword [0x14014a270]
test rax, rax
je 0x14001814b
dec dword [rax + 0x3b4]
mov rdx, qword [0x14014a260]
mov rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
xor r15d, r15d
mov qword [rbx + 0xa8], r15
cmp byte [rbx], r15b
je 0x14001882a
cmp byte [rbx + 0x30e1], r15b
je 0x1400181e2
mov rdi, qword [rbx + 0x20]
test rdi, rdi
je 0x1400181e2
mov rsi, qword [0x14014a270]
mov qword [0x14014a270], rbx
mov dword [rbx + 0x30e4], r15d
mov qword [rsp + 0x40], r15
lea rcx, [rsp + 0x40]
call fcn.1400256d0
mov rbp, rax
lea rdx, [0x14011de8c]
mov rcx, rdi
call fcn.140013950
mov rdi, rax
test rax, rax
je 0x1400181db
mov r9, rax
mov r8, qword [rsp + 0x40]
lea edx, [r15 + 1]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov qword [0x14014a270], rsi
mov edi, r15d
cmp dword [rbx + 0x3128], r15d
jle 0x140018220
mov rsi, r15
mov r8, qword [rbx + 0x3130]
cmp dword [r8 + rsi], 6
jne 0x140018212
movsxd rax, edi
lea rcx, [rax + rax*2]
lea rdx, [r8 + rcx*8]
mov rcx, rbx
call qword [rreloc.WS2_32.dll_htonl + rsi + 8]
inc edi
add rsi, 0x18
cmp edi, dword [rbx + 0x3128]
jl 0x1400181f1
mov esi, r15d
cmp dword [rbx + 0x1a88], r15d
jle 0x140018277
mov r14, r15
nop
mov rax, qword [rbx + 0x1a90]
mov rdi, qword [r14 + rax]
test rdi, rdi
je 0x140018269
mov rcx, rdi
call fcn.140015480
mov rax, qword [0x14014a270]
test rax, rax
je 0x14001825a
dec dword [rax + 0x3b4]
mov rdx, qword [0x14014a260]
mov rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
inc esi
add r14, 8
cmp esi, dword [rbx + 0x1a88]
jl 0x140018230
mov rcx, qword [rbx + 0x1a90]
test rcx, rcx
je 0x1400182af
mov qword [rbx + 0x1a88], r15
mov rax, qword [0x14014a270]
test rax, rax
je 0x14001829c
dec dword [rax + 0x3b4]
mov rdx, qword [0x14014a260]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rbx + 0x1a90], r15
mov rcx, qword [rbx + 0x1aa0]
test rcx, rcx
je 0x1400182e7
mov qword [rbx + 0x1a98], r15
mov rax, qword [0x14014a270]
test rax, rax
je 0x1400182d4
dec dword [rax + 0x3b4]
mov rdx, qword [0x14014a260]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rbx + 0x1aa0], r15
mov rcx, qword [rbx + 0x1ab0]
test rcx, rcx
je 0x14001831f
mov qword [rbx + 0x1aa8], r15
mov rax, qword [0x14014a270]
test rax, rax
je 0x14001830c
dec dword [rax + 0x3b4]
mov rdx, qword [0x14014a260]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rbx + 0x1ab0], r15
mov qword [rbx + 0x1ae0], r15
mov rcx, qword [rbx + 0x1ac0]
test rcx, rcx
je 0x14001835e
mov qword [rbx + 0x1ab8], r15
mov rax, qword [0x14014a270]
test rax, rax
je 0x14001834b
dec dword [rax + 0x3b4]
mov rdx, qword [0x14014a260]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rbx + 0x1ac0], r15
mov rcx, qword [rbx + 0x1ad0]
test rcx, rcx
je 0x140018396
mov qword [rbx + 0x1ac8], r15
mov rax, qword [0x14014a270]
test rax, rax
je 0x140018383
dec dword [rax + 0x3b4]
mov rdx, qword [0x14014a260]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rbx + 0x1ad0], r15
mov qword [rbx + 0x1c90], r15
mov qword [rbx + 0x1af8], r15
mov qword [rbx + 0x1af0], r15
mov qword [rbx + 0x1ae8], r15
mov qword [rbx + 0x1b78], r15
mov qword [rbx + 0x1b60], r15
mov qword [rbx + 0x1b00], r15
mov rcx, qword [rbx + 0x1c18]
test rcx, rcx
je 0x1400183ff
mov qword [rbx + 0x1c10], r15
mov rax, qword [0x14014a270]
test rax, rax
je 0x1400183ec
dec dword [rax + 0x3b4]
mov rdx, qword [0x14014a260]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rbx + 0x1c18], r15
mov rcx, qword [rbx + 0x1c28]
test rcx, rcx
je 0x140018437
mov qword [rbx + 0x1c20], r15
mov rax, qword [0x14014a270]
test rax, rax
je 0x140018424
dec dword [rax + 0x3b4]
mov rdx, qword [0x14014a260]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rbx + 0x1c28], r15
mov rcx, qword [rbx + 0x1c38]
test rcx, rcx
je 0x14001846f
mov qword [rbx + 0x1c30], r15
mov rax, qword [0x14014a270]
test rax, rax
je 0x14001845c
dec dword [rax + 0x3b4]
mov rdx, qword [0x14014a260]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rbx + 0x1c38], r15
mov rcx, qword [rbx + 0x1c78]
test rcx, rcx
je 0x1400184a7
mov qword [rbx + 0x1c70], r15
mov rax, qword [0x14014a270]
test rax, rax
je 0x140018494
dec dword [rax + 0x3b4]
mov rdx, qword [0x14014a260]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rbx + 0x1c78], r15
mov rcx, qword [rbx + 0x1c88]
test rcx, rcx
je 0x1400184df
mov qword [rbx + 0x1c80], r15
mov rax, qword [0x14014a270]
test rax, rax
je 0x1400184cc
dec dword [rax + 0x3b4]
mov rdx, qword [0x14014a260]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rbx + 0x1c88], r15
lea rdi, [rbx + 0x1e50]
mov esi, 2
nop dword [rax + rax]
mov rcx, qword [rdi]
test rcx, rcx
je 0x14001851d
mov qword [rdi - 8], r15
mov rax, qword [0x14014a270]
test rax, rax
je 0x14001850e
dec dword [rax + 0x3b4]
mov rdx, qword [0x14014a260]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi], r15
add rdi, 0x10
sub rsi, 1
jne 0x1400184f0
lea rcx, [rbx + 0x1e70]
call fcn.14002e6c0
lea rcx, [rbx + 0x1f38]
call fcn.14002e6c0
lea rcx, [rbx + 0x2110]
call fcn.140026120
mov rcx, qword [rbx + 0x2140]
test rcx, rcx
je 0x140018583
mov qword [rbx + 0x2138], r15
mov rax, qword [0x14014a270]
test rax, rax
je 0x140018570
dec dword [rax + 0x3b4]
mov rdx, qword [0x14014a260]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rbx + 0x2140], r15
mov rcx, qword [rbx + 0x2150]
test rcx, rcx
je 0x1400185bb
mov qword [rbx + 0x2148], r15
mov rax, qword [0x14014a270]
test rax, rax
je 0x1400185a8
dec dword [rax + 0x3b4]
mov rdx, qword [0x14014a260]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rbx + 0x2150], r15
lea rcx, [rbx + 0x20b0]
call fcn.1400262c0
mov rcx, qword [rbx + 0x20e0]
test rcx, rcx
je 0x1400185ff
mov qword [rbx + 0x20d8], r15
mov rax, qword [0x14014a270]
test rax, rax
je 0x1400185ec
dec dword [rax + 0x3b4]
mov rdx, qword [0x14014a260]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rbx + 0x20e0], r15
mov rcx, qword [rbx + 0x2100]
test rcx, rcx
je 0x140018637
mov qword [rbx + 0x20f8], r15
mov rax, qword [0x14014a270]
test rax, rax
je 0x140018624
dec dword [rax + 0x3b4]
mov rdx, qword [0x14014a260]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rbx + 0x2100], r15
mov rcx, qword [rbx + 0x30b8]
test rcx, rcx
je 0x14001866f
mov qword [rbx + 0x30b0], r15
mov rax, qword [0x14014a270]
test rax, rax
je 0x14001865c
dec dword [rax + 0x3b4]
mov rdx, qword [0x14014a260]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rbx + 0x30b8], r15
mov rcx, qword [rbx + 0x30c8]
test rcx, rcx
je 0x1400186a7
mov qword [rbx + 0x30c0], r15
mov rax, qword [0x14014a270]
test rax, rax
je 0x140018694
dec dword [rax + 0x3b4]
mov rdx, qword [0x14014a260]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rbx + 0x30c8], r15
mov rcx, qword [rbx + 0x2178]
test rcx, rcx
je 0x1400186df
mov qword [rbx + 0x2170], r15
mov rax, qword [0x14014a270]
test rax, rax
je 0x1400186cc
dec dword [rax + 0x3b4]
mov rdx, qword [0x14014a260]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rbx + 0x2178], r15
mov rcx, qword [rbx + 0x2188]
test rcx, rcx
je 0x140018717
mov qword [rbx + 0x2180], r15
mov rax, qword [0x14014a270]
test rax, rax
je 0x140018704
dec dword [rax + 0x3b4]
mov rdx, qword [0x14014a260]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rbx + 0x2188], r15
mov rcx, qword [rbx + 0x2198]
test rcx, rcx
je 0x14001874f
mov qword [rbx + 0x2190], r15
mov rax, qword [0x14014a270]
test rax, rax
je 0x14001873c
dec dword [rax + 0x3b4]
mov rdx, qword [0x14014a260]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rbx + 0x2198], r15
mov rcx, qword [rbx + 0x3110]
test rcx, rcx
je 0x140018787
mov qword [rbx + 0x3108], r15
mov rax, qword [0x14014a270]
test rax, rax
je 0x140018774
dec dword [rax + 0x3b4]
mov rdx, qword [0x14014a260]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rbx + 0x3110], r15
mov rcx, qword [rbx + 0x3100]
test rcx, rcx
je 0x1400187bf
mov qword [rbx + 0x30f8], r15
mov rax, qword [0x14014a270]
test rax, rax
je 0x1400187ac
dec dword [rax + 0x3b4]
mov rdx, qword [0x14014a260]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rbx + 0x3100], r15
cmp qword [rbx + 0x3140], r15
je 0x1400187ef
mov rdi, qword [rbx + 0x3140]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
cmp rdi, rax
je 0x1400187e8
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov qword [rbx + 0x3140], r15
mov rcx, qword [rbx + 0x3150]
test rcx, rcx
je 0x140018827
mov qword [rbx + 0x3148], r15
mov rax, qword [0x14014a270]
test rax, rax
je 0x140018814
dec dword [rax + 0x3b4]
mov rdx, qword [0x14014a260]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rbx + 0x3150], r15
mov byte [rbx], r15b
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret