Function at 0x1403fc440
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x1406836b8]
xor rax, rsp
mov qword [rsp + 0x70], rax
xor edi, edi
mov qword [rsp + 0x58], r9
mov qword [rsp + 0x50], rcx
mov r13, rdx
mov dword [rsp + 0x48], edi
movzx edx, di
mov word [rsp + 0x40], dx
mov r14, r9
mov r15, r8
mov rbx, rcx
mov r12d, edi
mov esi, edi
test r9, r9
jne 0x1403fc49a
mov ebx, 0x80004005
jmp 0x1403fc822
mov qword [rsp + 0xc0], rbp
test r15, r15
jne 0x1403fc4ab
mov ebp, edi
jmp 0x1403fc500
mov ebp, dword [r8]
mov ecx, edi
test ebp, ebp
je 0x1403fc500
mov r9, qword [r8 + 0x10]
nop dword [rax + rax]
movsxd rax, ecx
mov r8, qword [r9 + rax*8]
test r8, r8
je case.0x1403fc68a.1
mov eax, dword [r8 + 4]
and eax, 0xf00000
cmp eax, 0x100000
je 0x1403fc4f2
test r12d, r12d
jne 0x1403fc4fa
cmp eax, 0x200000
jne 0x1403fc4fa
mov r12d, 1
inc dx
mov word [rsp + 0x40], dx
inc ecx
cmp ecx, ebp
jb 0x1403fc4c0
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rdi
mov r8d, 2
lea rdx, [rsp + 0x40]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1403fc5ed
movzx eax, word [rsp + 0x40]
lea ecx, [rax + rax*2]
lea ecx, [rcx*4 + 6]
add dword [r14], ecx
test ebp, ebp
je 0x1403fc587
nop dword [rax]
mov rax, qword [r15 + 0x10]
movsxd rcx, edi
mov r8, qword [rax + rcx*8]
test r8, r8
je case.0x1403fc68a.1
mov eax, dword [r8 + 4]
and eax, 0xf00000
cmp eax, 0x100000
jne 0x1403fc581
mov r9, r14
mov rdx, r13
mov rcx, rbx
call sym.ErrorReportClient.exe_private:_long_int___cdecl_CSfExifMetaDataHelper::WriteIFDEntry_void____ptr64__struct_SFMETA_SUM_TAG____ptr64__unsigned_long_int____ptr64____ptr64
mov ebx, eax
test eax, eax
js 0x1403fc81a
mov rbx, qword [rsp + 0x50]
inc edi
cmp edi, ebp
jb 0x1403fc540
xor ebx, ebx
mov edi, 4
test r12d, r12d
je 0x1403fc5ca
mov eax, dword [r14]
lea r9, [rsp + 0x48]
lea r8d, [rdi + 8]
mov dword [rsp + 0x68], eax
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x4a005
mov rcx, r13
mov dword [rsp + 0x64], 1
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1403fc5ed
lea r9, [rsp + 0x48]
mov dword [rsp + 0x4c], ebx
mov r8d, edi
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x4c]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1403fc5f7
mov ebx, 0x8004e009
jmp 0x1403fc81a
mov edi, ebx
test ebp, ebp
je 0x1403fc7d1
lea rdx, [0x140000000]
nop dword [rax + rax]
mov rax, qword [r15 + 0x10]
movsxd rcx, edi
mov rbx, qword [rax + rcx*8]
test rbx, rbx
je 0x1403fc859
mov ecx, dword [rbx + 4]
mov eax, ecx
and eax, 0xf00000
cmp eax, 0x100000
jne 0x1403fc7c2
test rsi, rsi
je 0x1403fc66d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalFree]
movzx ecx, word [rbx + 4]
lea rdx, [0x140000000]
movzx eax, cx
and eax, 0xf
dec eax
cmp eax, 9
ja case.0x1403fc68a.1
cdqe
mov ecx, dword [rdx + rax*4 + 0x3fc860]
add rcx, rdx
jmp rcx
mov edx, dword [rbx + 8]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rsi, rax
test rax, rax
je 0x1403fc84b
movsxd r14, dword [rbx + 8]
lea r8, [rbx + 0xc]
xor eax, eax
cmp ax, word [r8]
jne 0x1403fc6c3
mov byte [rsi], al
jmp 0x1403fc6e5
mov qword [rsp + 0x38], rax
xor edx, edx
mov qword [rsp + 0x30], rax
xor ecx, ecx
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rsi
lea r9d, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rcx, rsi
mov byte [r14 + rsi - 1], 0
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea ebx, [rax + 1]
jmp 0x1403fc762
cmp dword [rbx + 8], 8
jne case.0x1403fc68a.1
mov edx, 8
jmp 0x1403fc72f
cmp dword [rbx + 8], 2
jne case.0x1403fc68a.1
mov edx, 2
jmp 0x1403fc72f
cmp dword [rbx + 8], 4
jne case.0x1403fc68a.1
mov edx, 4
jmp 0x1403fc72f
mov edx, dword [rbx + 8]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rsi, rax
test rax, rax
je 0x1403fc84b
mov r8d, dword [rbx + 8]
lea rdx, [rbx + 0xc]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov ebx, dword [rbx + 8]
cmp ebx, 4
jbe 0x1403fc7bb
xor r14d, r14d
lea r9, [rsp + 0x48]
mov r8d, ebx
mov qword [rsp + 0x20], r14
mov rdx, rsi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1403fc844
and ebx, 1
test bl, bl
je 0x1403fc7bb
lea r9, [rsp + 0x48]
mov byte [rsp + 0x44], r14b
lea r8d, [r14 + 1]
mov qword [rsp + 0x20], r14
lea rdx, [rsp + 0x44]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1403fc844
lea rdx, [0x140000000]
inc edi
cmp edi, ebp
jb 0x1403fc610
mov r14, qword [rsp + 0x58]
test r12d, r12d
je 0x1403fc7ef
mov rcx, qword [rsp + 0x50]
mov r9, r14
mov r8, r15
mov rdx, r13
call sym.ErrorReportClient.exe_private:_long_int___cdecl_CSfExifMetaDataHelper::WriteInteroperabilityIFD_void____ptr64__struct_tSFLIST____ptr64__unsigned_long_int____ptr64____ptr64
mov ebx, eax
test eax, eax
js 0x1403fc7f1
xor ebx, ebx
test rsi, rsi
je 0x1403fc81a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rbp, qword [rsp + 0xc0]
mov eax, ebx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14039bbb0
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov ebx, 0x8004e009
jmp 0x1403fc7f1
mov ebx, 0x8007000e
jmp 0x1403fc81a
mov ebx, 0x80004005
jmp 0x1403fc81a
mov ebx, 0x80004005
jmp 0x1403fc7f1