Function at 0x1400d4ef0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov r14, r9
mov r13, r8
mov rbp, rdx
mov al, byte [rsp + 0xa8]
mov byte [rsp + 0x2f], al
mov r12, qword [rsp + 0xa0]
mov qword [rsp + 0x30], rcx
mov rsi, qword [rcx]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x1400d4f6b
xor edi, edi
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
nop word [rax + rax]
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add edi, 1
cmp edi, dword [rsi]
jne 0x1400d4f50
mov byte [rsi + 4], 0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rbx]
test rbp, rbp
je 0x1400d4f89
mov rcx, rbp
mov rdx, rsi
call fcn.1400cf180
jmp 0x1400d4fae
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
mov rbp, qword [rbx]
mov rsi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rsi
mov ecx, 0x2c
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
mov ecx, 2
call rsi
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rbp], 0
je 0x1400d500c
xor edi, edi
nop dword [rax]
mov ecx, 2
call rsi
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add edi, 1
cmp edi, dword [rbp]
jne 0x1400d4ff0
mov byte [rbp + 4], 0
test r13, r13
je 0x1400d5022
mov rcx, r13
mov rdx, rbp
call fcn.1400cf180
jmp 0x1400d5047
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rbp + 4], 1
mov rbp, qword [rbx]
mov r13, qword [r14]
mov rdi, qword [r14 + 8]
mov bl, byte [rbp + 4]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
test bl, bl
je 0x1400d50c2
mov ecx, 0x2c
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rbp], 0
je 0x1400d50bc
xor ebx, ebx
nop word cs:[rax + rax]
nop
mov ecx, 2
call rsi
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add ebx, 1
cmp ebx, dword [rbp]
jne 0x1400d50a0
mov byte [rbp + 4], 0
jmp 0x1400d50dc
lea rcx, [0x14010e7b6]
mov edx, 2
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rsp + 0x30]
mov ecx, 2
call rsi
sub edi, r13d
lea rdx, str.__.s_
mov rcx, rax
mov r8d, edi
mov r9, r13
call fcn.1400cafc0
mov rdi, qword [rbx]
mov rbx, qword [r12]
mov r12, qword [r12 + 8]
mov bpl, byte [rdi + 4]
mov ecx, 2
call rsi
test r12, r12
jne 0x1400d513f
test bpl, bpl
jne 0x1400d513f
lea rcx, [0x14010e7b6]
mov edx, 2
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov ebp, dword [rdi]
jmp 0x1400d5193
mov ecx, 0x2c
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rdi], 0
je 0x1400d518d
xor ebp, ebp
nop dword [rax + rax]
mov ecx, 2
call rsi
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add ebp, 1
cmp ebp, dword [rdi]
jne 0x1400d5170
jmp 0x1400d518f
xor ebp, ebp
mov byte [rdi + 4], 0
add ebp, 1
mov dword [rdi], ebp
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x7b
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
test r12, r12
je 0x1400d52db
lea r14, [rbx + r12*8]
mov al, 1
lea r13, str._null_
jmp 0x1400d51f8
mov ecx, 2
call rsi
mov edx, 6
mov r8d, 1
mov rcx, r13
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rdi + 4], 1
add rbx, 8
xor eax, eax
cmp rbx, r14
je 0x1400d52ac
mov rbp, qword [rbx]
test al, 1
je 0x1400d5220
test rbp, rbp
je 0x1400d528a
mov rcx, rbp
mov rdx, rdi
call fcn.1400cf180
jmp 0x1400d51e9
mov ecx, 2
call rsi
mov ecx, 0x2c
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
mov ecx, 2
call rsi
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rdi], 0
je 0x1400d526d
xor r15d, r15d
mov ecx, 2
call rsi
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add r15d, 1
cmp r15d, dword [rdi]
jne 0x1400d5250
mov byte [rdi + 4], 0
test rbp, rbp
je 0x1400d51c8
mov rcx, rbp
mov rdx, rdi
call fcn.1400cf180
jmp 0x1400d51e5
mov ecx, 2
call rsi
mov edx, 6
mov r8d, 1
mov rcx, r13
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
jmp 0x1400d51e9
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x7d
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rdi], 0xffffffff
test r12, r12
mov dl, byte [rsp + 0x2f]
mov rax, qword [rsp + 0x30]
je 0x1400d52ff
mov byte [rdi + 4], 1
jmp 0x1400d52ff
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x7d
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rdi], 0xffffffff
mov dl, byte [rsp + 0x2f]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.1400d4770