Function at 0x18006399c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x90
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x40], 0xfffffffffffffffe
mov qword [rbp + 0x80], rbx
mov qword [rbp + 0x90], rsi
mov qword [rbp + 0x98], rdi
mov rax, qword [0x1801563c0]
xor rax, rbp
mov qword [rbp + 0x48], rax
mov r13, rdx
mov r14, rcx
mov rax, qword [rcx]
cmp dword [rax - 8], 0
jne 0x180063a2e
mov rcx, qword [rdx]
add rcx, 0xfffffffffffffff4
lea rsi, [0x18015f758]
cmp rcx, rsi
je 0x180063fc4
or r12, 0xffffffffffffffff
mov eax, r12d
lock xadd dword [rcx], eax
add eax, r12d
test eax, eax
jg 0x180063fc4
mov rcx, qword [rdx]
sub rcx, 0xc
call fcn.1800d1434
jmp 0x180063fc4
cmp qword [rcx + 0x70], 0
jne 0x180063a78
test r8d, r8d
jne 0x180063a78
mov rcx, qword [rdx]
add rcx, 0xfffffffffffffff4
lea rsi, [0x18015f758]
cmp rcx, rsi
je 0x180063fc4
or r12, 0xffffffffffffffff
mov eax, r12d
lock xadd dword [rcx], eax
add eax, r12d
test eax, eax
jg 0x180063fc4
mov rcx, qword [rdx]
sub rcx, 0xc
call fcn.1800d1434
jmp 0x180063fc4
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 1]
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r15, rax
mov qword [rbp + 0x28], rax
or r12, 0xffffffffffffffff
cmp rax, r12
jne 0x180063af0
mov rcx, qword [r13]
add rcx, 0xfffffffffffffff4
lea rsi, [0x18015f758]
cmp rcx, rsi
je 0x180063fc4
mov eax, r12d
lock xadd dword [rcx], eax
add eax, r12d
test eax, eax
jg 0x180063fc4
mov rcx, qword [r13]
sub rcx, 0xc
call fcn.1800d1434
jmp 0x180063fc4
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
and dword [rbp], 0
mov rax, qword [0x18015f768]
mov qword [rbp + 8], rax
lea rdx, [0x180129390]
lea rcx, [rbp + 0x18]
call fcn.1800041c0
nop
lea rdx, [r14 + 8]
lea r9, [rbp + 8]
lea r8, [rbp + 0x18]
lea rcx, [0x18015f720]
call fcn.1800cea30
movabs rsi, 0xffffffffffffff0
mov rdi, qword [rbp + 8]
test rdi, rdi
jne 0x180063b50
xor edx, edx
jmp 0x180063bce
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r9d, [rax + 1]
cmp r9d, 0x3fffffff
jle 0x180063b6a
xor edx, edx
jmp 0x180063bce
movsxd rax, r9d
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x180063b7c
mov rcx, rsi
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1800f12f0
sub rsp, rcx
lea rbx, [rsp + 0x40]
test rbx, rbx
je 0x180063bcc
mov byte [rbx], 0
lea eax, [r9 + r9]
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, r12d
mov r8, rdi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb rdx, rdx
and rdx, rbx
jmp 0x180063bce
xor edx, edx
and qword [rsp + 0x20], 0
lea r9, [rbp]
mov r8d, dword [rdi - 8]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rbp + 0x18]
test rbx, rbx
jne 0x180063bf5
xor edx, edx
jmp 0x180063c86
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r9d, [rax + 1]
cmp r9d, 0x3fffffff
jle 0x180063c0f
xor edx, edx
jmp 0x180063c86
movsxd rax, r9d
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x180063c21
mov rcx, rsi
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1800f12f0
sub rsp, rcx
lea rsi, [rsp + 0x40]
xor ecx, ecx
cmp rsi, rcx
je 0x180063c7a
mov byte [rsi], cl
lea eax, [r9 + r9]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov r9d, r12d
mov r8, rbx
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb rdx, rdx
and rdx, rsi
movabs rsi, 0xffffffffffffff0
jmp 0x180063c86
xor edx, edx
movabs rsi, 0xffffffffffffff0
and qword [rsp + 0x20], 0
lea r9, [rbp]
mov r8d, dword [rbx - 8]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r9d, [rax + 1]
cmp r9d, 0x3fffffff
jle 0x180063cb7
xor edx, edx
jmp 0x180063d1a
movsxd rax, r9d
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x180063cc9
mov rcx, rsi
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1800f12f0
sub rsp, rcx
lea rsi, [rsp + 0x40]
xor ecx, ecx
cmp rsi, rcx
je 0x180063d18
mov byte [rsi], cl
lea eax, [r9 + r9]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov r9d, r12d
mov r8, rbx
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb rdx, rdx
and rdx, rsi
jmp 0x180063d1a
xor edx, edx
and qword [rsp + 0x20], 0
lea r9, [rbp]
mov r8d, dword [rbx - 8]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
add r14, 0x38
mov qword [rbp + 0x20], r14
jne 0x180063d40
call fcn.1800d15f4
mov rsi, qword [0x18015f768]
mov qword [rbp + 0x10], rsi
mov rdi, qword [rbp + 0x20]
mov rax, qword [rdi + 0x30]
mov r15, qword [rax]
mov qword [rbp + 0x38], r15
mov r14, qword [rdi]
mov qword [rbp + 0x30], r14
mov rbx, qword [rbp + 0x28]
movabs r13, 0xffffffffffffff0
mov rax, qword [rdi + 0x30]
mov qword [rbp + 0x20], rax
test r14, r14
je 0x180063d81
cmp r14, qword [rdi]
je 0x180063d8a
call fcn.1800d15f4
mov rax, qword [rbp + 0x20]
cmp r15, rax
je 0x180063f0b
lea rcx, str.user_pref__
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r8, str.user_pref__
mov edx, eax
lea rcx, [rbp + 0x10]
call fcn.180003e28
test r14, r14
jne 0x180063dc1
call fcn.1800d15f4
xor r11d, r11d
jmp 0x180063dc4
mov r11, qword [r14]
cmp r15, qword [r11 + 0x30]
jne 0x180063dcf
call fcn.1800d15f4
mov rax, qword [r15 + 0x18]
mov r8, rax
mov edx, dword [rax - 8]
lea rcx, [rbp + 0x10]
call fcn.180008324
lea rcx, [0x1801293b0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r8, [0x1801293b0]
mov edx, eax
lea rcx, [rbp + 0x10]
call fcn.180008324
test r14, r14
jne 0x180063e10
call fcn.1800d15f4
xor r11d, r11d
jmp 0x180063e13
mov r11, qword [r14]
cmp r15, qword [r11 + 0x30]
jne 0x180063e1e
call fcn.1800d15f4
mov rax, qword [r15 + 0x20]
mov r8, rax
mov edx, dword [rax - 8]
lea rcx, [rbp + 0x10]
call fcn.180008324
lea rcx, str.___r_n
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r8, str.___r_n
mov edx, eax
lea rcx, [rbp + 0x10]
call fcn.180008324
mov rsi, qword [rbp + 0x10]
xor r15d, r15d
cmp rsi, r15
jne 0x180063e61
mov rdx, r15
jmp 0x180063edf
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r9d, [rax + 1]
cmp r9d, 0x3fffffff
jle 0x180063e7c
mov rdx, r15
jmp 0x180063edf
movsxd rax, r9d
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x180063e8e
mov rcx, r13
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1800f12f0
sub rsp, rcx
lea r14, [rsp + 0x40]
cmp r14, r15
je 0x180063edc
mov byte [r14], r15b
lea eax, [r9 + r9]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r14
mov r9d, r12d
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb rdx, rdx
and rdx, r14
jmp 0x180063edf
mov rdx, r15
mov qword [rsp + 0x20], r15
lea r9, [rbp]
mov r8d, dword [rsi - 8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rcx, [rbp + 0x30]
call fcn.18001e364
mov r15, qword [rbp + 0x38]
mov r14, qword [rbp + 0x30]
jmp 0x180063d6f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsi - 0xc]
lea rsi, [0x18015f758]
cmp rcx, rsi
mov rbx, qword [rbp + 0x18]
mov rdi, qword [rbp + 8]
mov r13, qword [rbp + 0x88]
je 0x180063f59
mov eax, r12d
lock xadd dword [rcx], eax
add eax, r12d
test eax, eax
jg 0x180063f51
call fcn.1800d1434
mov rdi, qword [rbp + 8]
mov rbx, qword [rbp + 0x18]
jmp 0x180063f59
mov rdi, qword [rbp + 8]
mov rbx, qword [rbp + 0x18]
lea rcx, [rbx - 0xc]
cmp rcx, rsi
je 0x180063f7f
mov eax, r12d
lock xadd dword [rcx], eax
add eax, r12d
test eax, eax
jg 0x180063f7b
call fcn.1800d1434
mov rdi, qword [rbp + 8]
jmp 0x180063f7f
mov rdi, qword [rbp + 8]
lea rcx, [rdi - 0xc]
cmp rcx, rsi
je 0x180063f9c
mov eax, r12d
lock xadd dword [rcx], eax
add eax, r12d
test eax, eax
jg 0x180063f9c
call fcn.1800d1434
nop
mov rcx, qword [r13]
add rcx, 0xfffffffffffffff4
cmp rcx, rsi
je 0x180063fc4
mov eax, r12d
lock xadd dword [rcx], eax
add eax, r12d
test eax, eax
jg 0x180063fc4
mov rcx, qword [r13]
sub rcx, 0xc
call fcn.1800d1434
mov rcx, qword [rbp + 0x48]
xor rcx, rbp
call fcn.1800d12b0
mov rbx, qword [rbp + 0x80]
mov rsi, qword [rbp + 0x90]
mov rdi, qword [rbp + 0x98]
lea rsp, [rbp + 0x50]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret