Function at 0x1401b0c90
Capabilities:
Get system information on windows
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
and rsp, 0xfffffffffffffff0
add rsp, 0xffffffffffffff80
mov qword [rbp + 0x20], r8
test r8, r8
je 0x1401b10b9
mov r12, rdx
test rdx, rdx
je 0x1401b10b9
mov rbx, rcx
mov rcx, qword [rcx + 0x130]
mov rax, qword [rbx + 8]
lea r13, [rbx + 0x10]
cmp byte [rax + 0x31], 0
jne 0x1401b0df0
mov rax, qword [rbx + 0x120]
mov rdi, qword [rbx + 0x128]
sub rdi, rax
sub rax, qword [rbx + 0x118]
mov rsi, rax
call sub.msvcrt.dll_ftell
mov qword [rsp + 0x48], rdi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x38], eax
mov rax, qword [rbp + 0x20]
mov r9d, 3
lea r8, str.dap_chain_cell
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x28], rax
lea rax, str.____Before_writing_an_atom_of_size__lu__stream_pos_of__s_is__lu_and_pos_is__lu__space_left_in_map__lu
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x20], rax
call fcn.14005a0c0
mov r9, qword [rbx + 0x130]
lea rcx, [rbp + 0x20]
mov r8d, 1
mov edx, 8
call sub.msvcrt.dll_fwrite
cmp rax, 1
jne 0x1401b1040
mov r9, qword [rbx + 0x130]
mov rdx, qword [rbp + 0x20]
mov r8d, 1
mov rcx, r12
call sub.msvcrt.dll_fwrite
cmp rax, 1
jne 0x1401b1080
mov rcx, qword [rbx + 0x130]
mov rsi, qword [rbx + 0x120]
sub rsi, qword [rbx + 0x118]
call sub.msvcrt.dll_ftell
mov qword [rsp + 0x40], rsi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x38], eax
mov rax, qword [rbp + 0x20]
mov r9d, 3
lea r8, str.dap_chain_cell
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rax
lea rax, str.____After_writing_an_atom_of_size__lu__stream_pos_of__s_is__lu_and_pos_is__lu
mov qword [rsp + 0x20], rax
call fcn.14005a0c0
xor eax, eax
lea rsp, [rbp - 0x38]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call sub.msvcrt.dll_ftell
mov rdx, qword [rbx + 0x128]
xor ecx, ecx
mov r9d, 3
movsxd rsi, eax
mov rax, qword [rbx + 0x120]
lea r8, str.dap_chain_cell
sub rdx, rax
mov qword [rsp + 0x48], rdx
sub rax, qword [rbx + 0x118]
xor edx, edx
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x20]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x28], rax
lea rax, str.____Before_filling_volume_for_atom_size__lu__stream_pos_of__s_is__lu__map_pos_is__lu__space_left_in_map__lu
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], r13
call fcn.14005a0c0
mov rdx, qword [rbx + 0x128]
mov rax, qword [rbx + 0x120]
mov rcx, qword [rbp + 0x20]
mov rdi, rdx
sub rdi, rax
add rcx, 8
cmp rcx, rdi
jbe 0x1401b0f76
mov eax, dword [0x1403f17d0]
mov ecx, eax
add rcx, 0xfffffff
test eax, eax
je 0x1401b0f88
mov r14d, eax
neg r14d
mov edi, eax
and r14, rcx
neg edi
mov rcx, qword [rbx + 0x130]
sub rdx, qword [rbx + 0x120]
and rdi, rsi
mov r15, rdx
sub rsi, rdi
call sub.msvcrt.dll_ftell
mov qword [rsp + 0x40], rsi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x30], eax
lea rax, str.____Need_to_enlarge_map_of__s__current_stream_pos_is__lu__map_pos_is__lu__offset_of_new_map_is__lu
mov r9d, 3
lea r8, str.dap_chain_cell
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x28], r13
call fcn.14005a0c0
mov rcx, qword [rbx + 0x130]
call sub.msvcrt.dll__fileno
mov qword [rsp + 0x28], rdi
mov rdx, r14
xor ecx, ecx
mov dword [rsp + 0x20], eax
mov r9d, 2
mov r8d, 3
call fcn.14014a350
mov qword [rbx + 0x118], rax
mov rdx, rax
cmp rax, 0xffffffffffffffff
je 0x1401b10ed
add rsi, rax
mov rcx, qword [rbx + 0x148]
mov qword [rbx + 0x120], rsi
call fcn.1400f9220
mov rdx, qword [rbx + 0x118]
mov qword [rbx + 0x148], rax
mov rcx, rax
add rdx, r14
mov qword [rbx + 0x128], rdx
call fcn.1400f9220
mov rdi, qword [rbx + 0x128]
mov qword [rbx + 0x148], rax
mov rax, qword [rbx + 0x120]
sub rdi, rax
mov rcx, qword [rbx + 0x130]
jmp 0x1401b0ced
lea r14, [rsp + 0x50]
mov rdi, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rcx, r14
call rdi
mov eax, dword [rsp + 0x54]
mov dword [0x1403f17d0], eax
test eax, eax
je 0x1401b0fc0
mov ecx, eax
mov rdx, qword [rbx + 0x128]
add rcx, 0xfffffff
jmp 0x1401b0e8b
mov rcx, r14
call rdi
mov eax, dword [rsp + 0x54]
mov dword [0x1403f17d0], eax
test eax, eax
je 0x1401b0ff0
mov r14d, eax
mov rdx, qword [rbx + 0x128]
mov ecx, 0x10000fff
neg r14d
jmp 0x1401b0e91
mov rcx, r14
call rdi
mov edi, dword [rsp + 0x54]
mov dword [0x1403f17d0], edi
test edi, edi
je 0x1401b1020
mov rdx, qword [rbx + 0x128]
neg edi
mov r14d, 0x10000000
jmp 0x1401b0e98
mov rdx, qword [rbx + 0x128]
mov r14d, 0x10000000
mov edi, 0xfffff000
jmp 0x1401b0e98
mov qword [rsp + 0x30], r13
mov rax, qword [rbx]
mov r9d, 7
xor edx, edx
lea r8, str.dap_chain_cell
xor ecx, ecx
mov qword [rsp + 0x28], rax
lea rax, str.Cant_write_atom_data_size_from_cell_0x_016llX_in___s_
mov qword [rsp + 0x20], rax
call fcn.14005a0c0
mov eax, 0xfffffffe
jmp 0x1401b0dd7
mov qword [rsp + 0x30], r13
mov rax, qword [rbx]
mov r9d, 7
xor edx, edx
lea r8, str.dap_chain_cell
xor ecx, ecx
mov qword [rsp + 0x28], rax
lea rax, str.Cant_write_data_from_cell_0x_016llX_to_the_file___s_
mov qword [rsp + 0x20], rax
call fcn.14005a0c0
mov eax, 0xfffffffd
jmp 0x1401b0dd7
lea rax, [0x1402b12c2]
mov r9d, 8
lea r8, str.dap_chain_cell
mov edx, 0x17a
mov qword [rsp + 0x20], rax
lea rcx, str.s_file_atom_add
call fcn.14005a0c0
mov eax, 0xffffffff
jmp 0x1401b0dd7
call qword [sym.imp.msvcrt.dll__errno]
mov r9d, 7
xor edx, edx
xor ecx, ecx
mov eax, dword [rax]
lea r8, str.dap_chain_cell
mov dword [rsp + 0x38], eax
mov rax, qword [rbx]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], rax
lea rax, str.Chain_cell___s__0x_016llX_cannot_be_mapped__errno__d
mov qword [rsp + 0x20], rax
call fcn.14005a0c0
mov rcx, qword [rbx + 0x130]
call sub.msvcrt.dll_fclose
mov eax, 0xfffffffe
jmp 0x1401b0dd7