Function at 0x14004a0a0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xe8
mov qword [rsp + 0x68], 0
mov rdi, rcx
mov rbx, rdx
mov rbp, r8
test rdx, rdx
je 0x14004a21e
mov eax, dword [rdx + 0x28]
and eax, 2
test r8, r8
je 0x14004a2a0
xor esi, esi
test eax, eax
jne 0x14004a118
xor esi, esi
cmp byte [rbp], 0
je 0x14004a118
lea r9, [rsp + 0x68]
lea r8, [rsp + 0x60]
mov rdx, rbp
mov rcx, rdi
call fcn.140073520
mov esi, eax
test eax, eax
je 0x14004a2c0
mov rcx, qword [rsp + 0x68]
mov rax, qword [0x140184840]
call qword [rax]
cmp qword [rdi + 0x2d0], 0
je 0x14004a1b2
mov qword [rsp + 0x70], 0
mov rax, qword [rbx + 0x18]
mov rbx, qword [rbx]
mov qword [rsp + 0x78], rax
test rbx, rbx
je 0x14004a1b2
movabs rbp, 0x7fffffffffffffff
lea r12, [rsp + 0x80]
movabs r13, 0x6574696d696c6e75
nop dword [rax]
mov rsi, qword [rbx]
mov rbx, qword [rbx + 0x10]
mov rcx, qword [rsi + 0x18]
mov qword [rsp + 0xb0], rcx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
movzx edx, byte [rsi + 0x20]
mov qword [rsp + 0xb8], rax
movzx eax, byte [rsp + 0xc0]
and edx, 1
and eax, 0xfffffffe
or eax, edx
mov byte [rsp + 0xc0], al
mov rcx, qword [rsi + 0x28]
cmp rcx, rbp
je 0x14004a1d0
mov rdx, r12
call fcn.140055090
mov esi, eax
test eax, eax
je 0x14004a228
mov eax, esi
add rsp, 0xe8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov eax, 0x64
mov qword [rsp + 0xc4], r13
mov word [rsp + 0xcc], ax
mov r9, qword [rdi + 0x2d8]
lea rdx, [rsp + 0xb0]
lea r8, [rsp + 0x70]
mov rcx, rdi
call qword [rdi + 0x2d0]
cmp eax, 2
je 0x14004a290
test eax, eax
jne 0x14004a21e
add qword [rsp + 0x70], 1
test rbx, rbx
jne 0x14004a160
xor esi, esi
jmp 0x14004a1b2
mov eax, dword [rsp + 0x80]
lea rcx, [rsp + 0xc4]
mov edx, 0x12
lea r8, str._d_02d_02d__02d:_02d:_02d
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x84]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x8c]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x90]
add eax, 1
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x94]
lea r9d, [rax + 0x76c]
call fcn.14004e240
jmp 0x14004a1e5
mov esi, 0x2b
jmp 0x14004a1b2
mov rbp, qword [rdx + 0x20]
test rbp, rbp
je 0x14004a2b1
test eax, eax
je 0x14004a0e3
xor esi, esi
jmp 0x14004a118
mov r9, qword [rsp + 0x60]
mov r8d, 0x6f
mov edx, 1
lea rcx, str._Your_HSTS_cache._https:__curl.se_docs_hsts.html_n_This_file_was_generated_by_libcurl__Edit_at_your_own_risk._n
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov r12, qword [rbx]
test r12, r12
je 0x14004a414
movabs r13, 0x7fffffffffffffff
jmp 0x14004a392
lea rdx, [rsp + 0xb0]
call fcn.140055090
test eax, eax
jne 0x14004a3e8
mov eax, dword [rsp + 0xc0]
mov ecx, dword [rsp + 0xb0]
lea r8, [0x1401734c8]
mov r9, qword [r15 + 0x18]
lea edx, [rax + 1]
mov eax, dword [rsp + 0xc4]
add eax, 0x76c
cmp byte [r15 + 0x20], 0
mov dword [rsp + 0x48], ecx
mov ecx, dword [rsp + 0xb4]
mov dword [rsp + 0x28], edx
lea rdx, str._s_s___d_02d_02d__02d:_02d:_02d__n
mov dword [rsp + 0x20], eax
lea rax, [0x1401734ca]
mov dword [rsp + 0x40], ecx
mov ecx, dword [rsp + 0xb8]
cmove r8, rax
mov dword [rsp + 0x38], ecx
mov ecx, dword [rsp + 0xbc]
mov dword [rsp + 0x30], ecx
mov rcx, r14
call fcn.14004f9f0
test r12, r12
je 0x14004a414
mov r15, qword [r12]
mov r14, qword [rsp + 0x60]
mov r12, qword [r12 + 0x10]
mov rcx, qword [r15 + 0x28]
cmp rcx, r13
jne 0x14004a300
lea rax, str.unlimited
cmp byte [r15 + 0x20], 0
mov r9, qword [r15 + 0x18]
lea r8, [0x1401734c8]
mov qword [rsp + 0x20], rax
lea rax, [0x1401734ca]
lea rdx, str._s_s___s__n
mov rcx, r14
cmove r8, rax
call fcn.14004f9f0
jmp 0x14004a389
mov rcx, qword [rsp + 0x60]
mov dword [rsp + 0x5c], eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
mov edx, dword [rsp + 0x5c]
mov rcx, qword [rsp + 0x68]
mov esi, edx
test rcx, rcx
je 0x14004a10f
call sub.api_ms_win_crt_filesystem_l1_1_0.dll__unlink
jmp 0x14004a10a
mov rcx, qword [rsp + 0x60]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14004a10f
mov rdx, rbp
call fcn.1400563c0
test eax, eax
je 0x14004a10a
mov edx, 0x17
jmp 0x14004a3fa