Function at 0x140016f30
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rbx, rcx
mov rax, qword [rcx + 0xa8]
test rax, rax
je 0x140016f8f
cmp byte [rcx + 1], 0
je 0x140016f8f
mov byte [rax], 0
mov rdi, qword [rcx + 0xa8]
test rdi, rdi
je 0x140016f8f
mov rcx, rdi
call fcn.14003f3b0
mov rax, qword [0x140099548]
test rax, rax
je 0x140016f86
dec dword [rax + 0x3b0]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor r15d, r15d
mov qword [rbx + 0xa8], r15
cmp byte [rbx], r15b
je 0x140017703
cmp byte [rbx + 0x30a8], r15b
je 0x140017012
mov rdi, qword [rbx + 0x20]
test rdi, rdi
je 0x140017012
mov rsi, qword [0x140099548]
mov qword [0x140099548], rbx
mov dword [rbx + 0x30ac], r15d
mov qword [rsp + 0x40], r15
lea rcx, [rsp + 0x40]
call fcn.1400263e0
mov rbp, rax
lea rdx, [0x14008cc44]
mov rcx, rdi
call fcn.140011420
mov rdi, rax
test rax, rax
je 0x140017019
mov r9, rax
mov r8, qword [rsp + 0x40]
lea edx, [r15 + 1]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x140017019
mov rsi, qword [0x140099548]
mov qword [0x140099548], rbx
call fcn.1400284b0
mov qword [0x140099548], rsi
mov esi, r15d
cmp dword [rbx + 0x3070], r15d
jle 0x140017082
mov rbp, r15
nop dword [rax + rax]
mov rax, qword [rbx + 0x3078]
mov rdi, qword [rax + rbp + 8]
test rdi, rdi
je 0x140017074
mov rcx, rdi
call fcn.140029b80
mov rax, qword [0x140099548]
test rax, rax
je 0x14001706b
dec dword [rax + 0x3b0]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
inc esi
add rbp, 0x10
cmp esi, dword [rbx + 0x3070]
jl 0x140017040
mov edi, r15d
cmp dword [rbx + 0x30f0], r15d
jle 0x1400170be
mov rsi, r15
mov rax, qword [rbx + 0x30f8]
cmp dword [rax + rsi + 4], 6
jne 0x1400170b0
movsxd rdx, edi
shl rdx, 5
add rdx, rax
mov rcx, rbx
call qword [rax + rsi + 0x10]
inc edi
add rsi, 0x20
cmp edi, dword [rbx + 0x30f0]
jl 0x140017091
mov esi, r15d
cmp dword [rbx + 0x1b90], r15d
jle 0x140017111
mov r14, r15
nop dword [rax]
mov rax, qword [rbx + 0x1b98]
mov rdi, qword [r14 + rax]
test rdi, rdi
je 0x140017103
mov rcx, rdi
call fcn.1400327a0
mov rax, qword [0x140099548]
test rax, rax
je 0x1400170fa
dec dword [rax + 0x3b0]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
inc esi
add r14, 8
cmp esi, dword [rbx + 0x1b90]
jl 0x1400170d0
mov rcx, qword [rbx + 0x1b98]
test rcx, rcx
je 0x140017143
mov qword [rbx + 0x1b90], r15
mov rax, qword [0x140099548]
test rax, rax
je 0x140017136
dec dword [rax + 0x3b0]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x1b98], r15
mov rcx, qword [rbx + 0x1ba8]
test rcx, rcx
je 0x140017175
mov qword [rbx + 0x1ba0], r15
mov rax, qword [0x140099548]
test rax, rax
je 0x140017168
dec dword [rax + 0x3b0]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x1ba8], r15
mov rcx, qword [rbx + 0x1bb8]
test rcx, rcx
je 0x1400171a7
mov qword [rbx + 0x1bb0], r15
mov rax, qword [0x140099548]
test rax, rax
je 0x14001719a
dec dword [rax + 0x3b0]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x1bb8], r15
mov qword [rbx + 0x1be8], r15
mov rcx, qword [rbx + 0x1bc8]
test rcx, rcx
je 0x1400171e0
mov qword [rbx + 0x1bc0], r15
mov rax, qword [0x140099548]
test rax, rax
je 0x1400171d3
dec dword [rax + 0x3b0]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x1bc8], r15
mov rcx, qword [rbx + 0x1bd8]
test rcx, rcx
je 0x140017212
mov qword [rbx + 0x1bd0], r15
mov rax, qword [0x140099548]
test rax, rax
je 0x140017205
dec dword [rax + 0x3b0]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x1bd8], r15
mov qword [rbx + 0x1e00], r15
mov qword [rbx + 0x1c00], r15
mov qword [rbx + 0x1bf8], r15
mov qword [rbx + 0x1bf0], r15
mov qword [rbx + 0x1c88], r15
mov qword [rbx + 0x1c70], r15
mov qword [rbx + 0x1c10], r15
mov rcx, qword [rbx + 0x1d50]
test rcx, rcx
je 0x140017275
mov qword [rbx + 0x1d48], r15
mov rax, qword [0x140099548]
test rax, rax
je 0x140017268
dec dword [rax + 0x3b0]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x1d50], r15
mov rcx, qword [rbx + 0x1d60]
test rcx, rcx
je 0x1400172a7
mov qword [rbx + 0x1d58], r15
mov rax, qword [0x140099548]
test rax, rax
je 0x14001729a
dec dword [rax + 0x3b0]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x1d60], r15
mov rcx, qword [rbx + 0x1d70]
test rcx, rcx
je 0x1400172d9
mov qword [rbx + 0x1d68], r15
mov rax, qword [0x140099548]
test rax, rax
je 0x1400172cc
dec dword [rax + 0x3b0]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x1d70], r15
mov rcx, qword [rbx + 0x1db0]
test rcx, rcx
je 0x14001730b
mov qword [rbx + 0x1da8], r15
mov rax, qword [0x140099548]
test rax, rax
je 0x1400172fe
dec dword [rax + 0x3b0]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x1db0], r15
mov rcx, qword [rbx + 0x1dc0]
test rcx, rcx
je 0x14001733d
mov qword [rbx + 0x1db8], r15
mov rax, qword [0x140099548]
test rax, rax
je 0x140017330
dec dword [rax + 0x3b0]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x1dc0], r15
mov qword [rbx + 0x1df0], r15
mov qword [rbx + 0x1de8], r15
mov qword [rbx + 0x1de0], r15
mov ebp, r15d
cmp dword [rbx + 0x1dc8], r15d
jle 0x14001742d
mov r14, r15
nop word [rax + rax]
mov rax, qword [rbx + 0x1dd0]
mov rdi, qword [r14 + rax]
test rdi, rdi
je 0x14001741b
mov rsi, qword [rdi + 0x98]
test rsi, rsi
je 0x1400173b3
mov rcx, rsi
call fcn.14000fa90
mov rax, qword [0x140099548]
test rax, rax
je 0x1400173aa
dec dword [rax + 0x3b0]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rsi, qword [rdi + 0xa0]
test rsi, rsi
je 0x1400173e3
mov rcx, rsi
call fcn.14000fa90
mov rax, qword [0x140099548]
test rax, rax
je 0x1400173d9
dec dword [rax + 0x3b0]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
nop
lea rcx, [rdi + 0xe0]
lea r9, [0x1400316e0]
mov edx, 0x10
lea r8d, [rdx - 0xe]
call fcn.14007b880
nop
mov rax, qword [0x140099548]
test rax, rax
je 0x140017412
dec dword [rax + 0x3b0]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
inc ebp
add r14, 8
cmp ebp, dword [rbx + 0x1dc8]
jl 0x140017370
mov rcx, qword [rbx + 0x1dd0]
test rcx, rcx
je 0x14001745f
mov qword [rbx + 0x1dc8], r15
mov rax, qword [0x140099548]
test rax, rax
je 0x140017452
dec dword [rax + 0x3b0]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x1dd0], r15
lea rcx, [rbx + 0x2090]
call fcn.140031970
mov rcx, qword [rbx + 0x20c0]
test rcx, rcx
je 0x14001749d
mov qword [rbx + 0x20b8], r15
mov rax, qword [0x140099548]
test rax, rax
je 0x140017490
dec dword [rax + 0x3b0]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x20c0], r15
mov rcx, qword [rbx + 0x20d0]
test rcx, rcx
je 0x1400174cf
mov qword [rbx + 0x20c8], r15
mov rax, qword [0x140099548]
test rax, rax
je 0x1400174c2
dec dword [rax + 0x3b0]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x20d0], r15
lea rcx, [rbx + 0x2030]
call fcn.140031a80
mov rcx, qword [rbx + 0x2060]
test rcx, rcx
je 0x14001750d
mov qword [rbx + 0x2058], r15
mov rax, qword [0x140099548]
test rax, rax
je 0x140017500
dec dword [rax + 0x3b0]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x2060], r15
mov rcx, qword [rbx + 0x2080]
test rcx, rcx
je 0x14001753f
mov qword [rbx + 0x2078], r15
mov rax, qword [0x140099548]
test rax, rax
je 0x140017532
dec dword [rax + 0x3b0]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x2080], r15
mov rcx, qword [rbx + 0x3038]
test rcx, rcx
je 0x140017571
mov qword [rbx + 0x3030], r15
mov rax, qword [0x140099548]
test rax, rax
je 0x140017564
dec dword [rax + 0x3b0]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x3038], r15
mov rcx, qword [rbx + 0x3048]
test rcx, rcx
je 0x1400175a3
mov qword [rbx + 0x3040], r15
mov rax, qword [0x140099548]
test rax, rax
je 0x140017596
dec dword [rax + 0x3b0]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x3048], r15
mov rcx, qword [rbx + 0x20f8]
test rcx, rcx
je 0x1400175d5
mov qword [rbx + 0x20f0], r15
mov rax, qword [0x140099548]
test rax, rax
je 0x1400175c8
dec dword [rax + 0x3b0]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x20f8], r15
mov rcx, qword [rbx + 0x2108]
test rcx, rcx
je 0x140017607
mov qword [rbx + 0x2100], r15
mov rax, qword [0x140099548]
test rax, rax
je 0x1400175fa
dec dword [rax + 0x3b0]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x2108], r15
mov rcx, qword [rbx + 0x2118]
test rcx, rcx
je 0x140017639
mov qword [rbx + 0x2110], r15
mov rax, qword [0x140099548]
test rax, rax
je 0x14001762c
dec dword [rax + 0x3b0]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x2118], r15
mov rcx, qword [rbx + 0x30d8]
test rcx, rcx
je 0x14001766b
mov qword [rbx + 0x30d0], r15
mov rax, qword [0x140099548]
test rax, rax
je 0x14001765e
dec dword [rax + 0x3b0]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x30d8], r15
mov rcx, qword [rbx + 0x30c8]
test rcx, rcx
je 0x14001769d
mov qword [rbx + 0x30c0], r15
mov rax, qword [0x140099548]
test rax, rax
je 0x140017690
dec dword [rax + 0x3b0]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x30c8], r15
cmp qword [rbx + 0x3110], 0
je 0x1400176ce
mov rdi, qword [rbx + 0x3110]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
cmp rdi, rax
je 0x1400176c7
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov qword [rbx + 0x3110], r15
mov rcx, qword [rbx + 0x3120]
test rcx, rcx
je 0x140017700
mov qword [rbx + 0x3118], r15
mov rax, qword [0x140099548]
test rax, rax
je 0x1400176f3
dec dword [rax + 0x3b0]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x3120], r15
mov byte [rbx], 0
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret