Function at 0x140010890
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, qword [0x140056950]
mov rax, qword [rdi + 0x38]
test rax, rax
je 0x14001097c
cmp byte [rdi + 1], 0
je 0x14001097c
mov byte [rax + 0x18], 0
mov rbx, qword [rdi + 0x38]
test rbx, rbx
je 0x14001097c
mov rcx, rbx
call fcn.140030d70
nop
mov rcx, qword [rbx + 0x80]
test rcx, rcx
je 0x14001090b
mov rax, qword [0x140056950]
test rax, rax
je 0x1400108fe
dec dword [rax + 0xec]
mov rdx, qword [0x140056948]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
nop
mov rcx, qword [rbx + 0x70]
test rcx, rcx
je 0x140010933
mov rax, qword [0x140056950]
test rax, rax
je 0x140010926
dec dword [rax + 0xec]
mov rdx, qword [0x140056948]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
nop
mov rcx, qword [rbx + 0x60]
test rcx, rcx
je 0x14001095b
mov rax, qword [0x140056950]
test rax, rax
je 0x14001094e
dec dword [rax + 0xec]
mov rdx, qword [0x140056948]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
nop
mov rax, qword [0x140056950]
test rax, rax
je 0x14001096d
dec dword [rax + 0xec]
mov rdx, qword [0x140056948]
mov rcx, rbx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
xor r15d, r15d
mov qword [rdi + 0x38], r15
mov rcx, qword [rdi + 0x3c50]
test rcx, rcx
je 0x1400109bb
mov qword [rdi + 0x3c48], r15
mov rax, qword [0x140056950]
test rax, rax
je 0x1400109a8
dec dword [rax + 0xec]
mov rdx, qword [0x140056948]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x3c50], r15
cmp byte [rdi], r15b
je 0x140011316
cmp byte [rdi + 0x5bf9], r15b
je 0x140010a2c
mov rbx, qword [rdi + 0x20]
test rbx, rbx
je 0x140010a2c
mov rax, qword [0x140056950]
mov dword [rax + 0x5bfc], r15d
mov qword [rsp + 0x40], r15
lea rcx, [rsp + 0x40]
call fcn.140023a40
mov rsi, rax
lea rdx, [0x140048784]
mov rcx, rbx
call fcn.14000ea80
mov rbx, rax
test rax, rax
je 0x140010a2c
mov r9, rax
mov r8, qword [rsp + 0x40]
mov edx, 1
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov ebx, r15d
cmp dword [rdi + 0x5c40], r15d
jle 0x140010a70
mov rsi, r15
nop dword [rax + rax]
mov rcx, qword [rdi + 0x5c48]
cmp dword [rsi + rcx + 4], 6
jne 0x140010a62
mov rax, qword [rsi + rcx + 0x10]
movsxd rdx, ebx
shl rdx, 5
add rdx, rcx
mov rcx, rdi
call rax
inc ebx
add rsi, 0x20
cmp ebx, dword [rdi + 0x5c40]
jl 0x140010a40
mov esi, r15d
cmp dword [rdi + 0x3e78], r15d
jle 0x140010ac7
mov r14, r15
nop
mov rax, qword [rdi + 0x3e80]
mov rbx, qword [r14 + rax]
test rbx, rbx
je 0x140010ab9
mov rcx, rbx
call fcn.140011860
mov rax, qword [0x140056950]
test rax, rax
je 0x140010aaa
dec dword [rax + 0xec]
mov rdx, qword [0x140056948]
mov rcx, rbx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
inc esi
add r14, 8
cmp esi, dword [rdi + 0x3e78]
jl 0x140010a80
mov rcx, qword [rdi + 0x3e80]
test rcx, rcx
je 0x140010aff
mov qword [rdi + 0x3e78], r15
mov rax, qword [0x140056950]
test rax, rax
je 0x140010aec
dec dword [rax + 0xec]
mov rdx, qword [0x140056948]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x3e80], r15
mov rcx, qword [rdi + 0x3e90]
test rcx, rcx
je 0x140010b37
mov qword [rdi + 0x3e88], r15
mov rax, qword [0x140056950]
test rax, rax
je 0x140010b24
dec dword [rax + 0xec]
mov rdx, qword [0x140056948]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x3e90], r15
mov rcx, qword [rdi + 0x3ea0]
test rcx, rcx
je 0x140010b6f
mov qword [rdi + 0x3e98], r15
mov rax, qword [0x140056950]
test rax, rax
je 0x140010b5c
dec dword [rax + 0xec]
mov rdx, qword [0x140056948]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x3ea0], r15
mov qword [rdi + 0x3ed8], r15
mov rcx, qword [rdi + 0x3eb0]
test rcx, rcx
je 0x140010bae
mov qword [rdi + 0x3ea8], r15
mov rax, qword [0x140056950]
test rax, rax
je 0x140010b9b
dec dword [rax + 0xec]
mov rdx, qword [0x140056948]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x3eb0], r15
mov rcx, qword [rdi + 0x3ec0]
test rcx, rcx
je 0x140010be6
mov qword [rdi + 0x3eb8], r15
mov rax, qword [0x140056950]
test rax, rax
je 0x140010bd3
dec dword [rax + 0xec]
mov rdx, qword [0x140056948]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x3ec0], r15
mov qword [rdi + 0x48c0], r15
mov qword [rdi + 0x3ee8], r15
mov qword [rdi + 0x3ee0], r15
mov qword [rdi + 0x3f70], r15
mov qword [rdi + 0x3f58], r15
mov qword [rdi + 0x3ef0], r15
lea rcx, [rdi + 0x4610]
call fcn.14000ccf0
mov rcx, qword [rdi + 0x4830]
test rcx, rcx
je 0x140010c54
mov qword [rdi + 0x4828], r15
mov rax, qword [0x140056950]
test rax, rax
je 0x140010c41
dec dword [rax + 0xec]
mov rdx, qword [0x140056948]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x4830], r15
mov rcx, qword [rdi + 0x4840]
test rcx, rcx
je 0x140010c8c
mov qword [rdi + 0x4838], r15
mov rax, qword [0x140056950]
test rax, rax
je 0x140010c79
dec dword [rax + 0xec]
mov rdx, qword [0x140056948]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x4840], r15
mov rcx, qword [rdi + 0x4850]
test rcx, rcx
je 0x140010cc4
mov qword [rdi + 0x4848], r15
mov rax, qword [0x140056950]
test rax, rax
je 0x140010cb1
dec dword [rax + 0xec]
mov rdx, qword [0x140056948]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x4850], r15
mov rcx, qword [rdi + 0x4890]
test rcx, rcx
je 0x140010cfc
mov qword [rdi + 0x4888], r15
mov rax, qword [0x140056950]
test rax, rax
je 0x140010ce9
dec dword [rax + 0xec]
mov rdx, qword [0x140056948]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x4890], r15
mov rcx, qword [rdi + 0x48a0]
test rcx, rcx
je 0x140010d34
mov qword [rdi + 0x4898], r15
mov rax, qword [0x140056950]
test rax, rax
je 0x140010d21
dec dword [rax + 0xec]
mov rdx, qword [0x140056948]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x48a0], r15
mov ebp, r15d
cmp dword [rdi + 0x48b0], r15d
jle 0x140010e4f
mov r14, r15
nop word [rax + rax]
mov rax, qword [rdi + 0x48b8]
mov rbx, qword [r14 + rax]
test rbx, rbx
je 0x140010e3d
mov rsi, qword [rbx + 0x38]
test rsi, rsi
je 0x140010d96
mov rcx, rsi
call fcn.14000cad0
mov rax, qword [0x140056950]
test rax, rax
je 0x140010d87
dec dword [rax + 0xec]
mov rdx, qword [0x140056948]
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rsi, qword [rbx + 0x40]
test rsi, rsi
je 0x140010dc9
mov rcx, rsi
call fcn.14000cad0
mov rax, qword [0x140056950]
test rax, rax
je 0x140010db9
dec dword [rax + 0xec]
mov rdx, qword [0x140056948]
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
nop
mov rcx, qword [rbx + 0xa0]
test rcx, rcx
je 0x140010df4
mov rax, qword [0x140056950]
test rax, rax
je 0x140010de7
dec dword [rax + 0xec]
mov rdx, qword [0x140056948]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
nop
mov rcx, qword [rbx + 0x60]
test rcx, rcx
je 0x140010e1c
mov rax, qword [0x140056950]
test rax, rax
je 0x140010e0f
dec dword [rax + 0xec]
mov rdx, qword [0x140056948]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
nop
mov rax, qword [0x140056950]
test rax, rax
je 0x140010e2e
dec dword [rax + 0xec]
mov rdx, qword [0x140056948]
mov rcx, rbx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
inc ebp
add r14, 8
cmp ebp, dword [rdi + 0x48b0]
jl 0x140010d50
mov rcx, qword [rdi + 0x48b8]
test rcx, rcx
je 0x140010e87
mov qword [rdi + 0x48b0], r15
mov rax, qword [0x140056950]
test rax, rax
je 0x140010e74
dec dword [rax + 0xec]
mov rdx, qword [0x140056948]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x48b8], r15
lea rcx, [rdi + 0x4ba8]
call fcn.140024b50
mov rcx, qword [rdi + 0x4bd8]
test rcx, rcx
je 0x140010ecb
mov qword [rdi + 0x4bd0], r15
mov rax, qword [0x140056950]
test rax, rax
je 0x140010eb8
dec dword [rax + 0xec]
mov rdx, qword [0x140056948]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x4bd8], r15
mov rcx, qword [rdi + 0x4be8]
test rcx, rcx
je 0x140010f03
mov qword [rdi + 0x4be0], r15
mov rax, qword [0x140056950]
test rax, rax
je 0x140010ef0
dec dword [rax + 0xec]
mov rdx, qword [0x140056948]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x4be8], r15
mov ebx, r15d
cmp dword [rdi + 0x4b28], r15d
jle 0x140010f5e
mov rsi, r15
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rdi + 0x4b30]
mov rcx, qword [rsi + rax + 0x20]
test rcx, rcx
je 0x140010f50
mov rax, qword [0x140056950]
test rax, rax
je 0x140010f43
dec dword [rax + 0xec]
mov rdx, qword [0x140056948]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
nop
inc ebx
add rsi, 0x28
cmp ebx, dword [rdi + 0x4b28]
jl 0x140010f20
mov rcx, qword [rdi + 0x4b30]
test rcx, rcx
je 0x140010f96
mov qword [rdi + 0x4b28], r15
mov rax, qword [0x140056950]
test rax, rax
je 0x140010f83
dec dword [rax + 0xec]
mov rdx, qword [0x140056948]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x4b30], r15
lea rcx, [rdi + 0x4b58]
call fcn.140024cf0
mov esi, r15d
cmp dword [rdi + 0x4b48], r15d
jle 0x140010ffc
mov rbp, r15
mov rbx, qword [rdi + 0x4b50]
lea rcx, [rbx + 0x10]
add rcx, rbp
call fcn.140030680
nop
mov rcx, qword [rbx + rbp + 0x20]
test rcx, rcx
je 0x140010fee
mov rax, qword [0x140056950]
test rax, rax
je 0x140010fe1
dec dword [rax + 0xec]
mov rdx, qword [0x140056948]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
nop
inc esi
add rbp, 0x70
cmp esi, dword [rdi + 0x4b48]
jl 0x140010fb1
mov rcx, qword [rdi + 0x4b50]
test rcx, rcx
je 0x140011034
mov qword [rdi + 0x4b48], r15
mov rax, qword [0x140056950]
test rax, rax
je 0x140011021
dec dword [rax + 0xec]
mov rdx, qword [0x140056948]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x4b50], r15
mov rcx, qword [rdi + 0x4b98]
test rcx, rcx
je 0x14001106c
mov qword [rdi + 0x4b90], r15
mov rax, qword [0x140056950]
test rax, rax
je 0x140011059
dec dword [rax + 0xec]
mov rdx, qword [0x140056948]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x4b98], r15
mov rcx, qword [rdi + 0x5bc0]
test rcx, rcx
je 0x1400110a4
mov qword [rdi + 0x5bb8], r15
mov rax, qword [0x140056950]
test rax, rax
je 0x140011091
dec dword [rax + 0xec]
mov rdx, qword [0x140056948]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x5bc0], r15
mov rcx, qword [rdi + 0x5bd0]
test rcx, rcx
je 0x1400110dc
mov qword [rdi + 0x5bc8], r15
mov rax, qword [0x140056950]
test rax, rax
je 0x1400110c9
dec dword [rax + 0xec]
mov rdx, qword [0x140056948]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x5bd0], r15
mov rcx, qword [rdi + 0x4c38]
test rcx, rcx
je 0x140011114
mov qword [rdi + 0x4c30], r15
mov rax, qword [0x140056950]
test rax, rax
je 0x140011101
dec dword [rax + 0xec]
mov rdx, qword [0x140056948]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x4c38], r15
mov rcx, qword [rdi + 0x4c48]
test rcx, rcx
je 0x14001114c
mov qword [rdi + 0x4c40], r15
mov rax, qword [0x140056950]
test rax, rax
je 0x140011139
dec dword [rax + 0xec]
mov rdx, qword [0x140056948]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x4c48], r15
mov rcx, qword [rdi + 0x4c58]
test rcx, rcx
je 0x140011184
mov qword [rdi + 0x4c50], r15
mov rax, qword [0x140056950]
test rax, rax
je 0x140011171
dec dword [rax + 0xec]
mov rdx, qword [0x140056948]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x4c58], r15
mov dword [rdi + 0x5aa8], r15d
mov rcx, qword [rdi + 0x5ab8]
test rcx, rcx
je 0x1400111c3
mov qword [rdi + 0x5ab0], r15
mov rax, qword [0x140056950]
test rax, rax
je 0x1400111b0
dec dword [rax + 0xec]
mov rdx, qword [0x140056948]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x5ab8], r15
mov rcx, qword [rdi + 0x5c28]
test rcx, rcx
je 0x1400111fb
mov qword [rdi + 0x5c20], r15
mov rax, qword [0x140056950]
test rax, rax
je 0x1400111e8
dec dword [rax + 0xec]
mov rdx, qword [0x140056948]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x5c28], r15
mov rcx, qword [rdi + 0x5c18]
test rcx, rcx
je 0x140011233
mov qword [rdi + 0x5c10], r15
mov rax, qword [0x140056950]
test rax, rax
je 0x140011220
dec dword [rax + 0xec]
mov rdx, qword [0x140056948]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x5c18], r15
cmp qword [rdi + 0x5ca0], 0
je 0x140011264
mov rbx, qword [rdi + 0x5ca0]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
cmp rbx, rax
je 0x14001125d
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov qword [rdi + 0x5ca0], r15
mov rcx, qword [rdi + 0x5cb0]
test rcx, rcx
je 0x14001129c
mov qword [rdi + 0x5ca8], r15
mov rax, qword [0x140056950]
test rax, rax
je 0x140011289
dec dword [rax + 0xec]
mov rdx, qword [0x140056948]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x5cb0], r15
mov rcx, qword [rdi + 0x5ce8]
test rcx, rcx
je 0x1400112d4
mov qword [rdi + 0x5ce0], r15
mov rax, qword [0x140056950]
test rax, rax
je 0x1400112c1
dec dword [rax + 0xec]
mov rdx, qword [0x140056948]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x5ce8], r15
mov rcx, qword [rdi + 0x5cf8]
test rcx, rcx
je 0x14001130c
mov qword [rdi + 0x5cf0], r15
mov rax, qword [0x140056950]
test rax, rax
je 0x1400112f9
dec dword [rax + 0xec]
mov rdx, qword [0x140056948]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x5cf8], r15
mov dword [rdi + 0x5d00], r15d
mov byte [rdi], 0
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret