Function at 0x180018ab0
Capabilities:
Write file on windows

Disassembly:
test rcx, rcx
je 0x180018d49
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe0
mov qword [r11 - 0x78], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
mov rax, qword [0x180272190]
xor rax, rsp
mov qword [rsp + 0xd8], rax
mov r12, rdx
mov r13, rcx
cmp byte [0x18028029b], 0
je 0x180018d1d
mov rax, qword [0x180280300]
mov qword [rsp + 0x78], rax
mov qword [r11 - 0x88], rax
xor bl, bl
mov edx, 0xffffffff
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
movzx r15d, bl
mov ecx, 1
test eax, eax
cmove r15d, ecx
mov byte [rsp + 0x88], r15b
lea rsi, vtable.WKString.0
mov qword [rsp + 0x50], rsi
mov byte [rsp + 0x58], bl
xor eax, eax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
movzx ecx, word [rsp + 0xd6]
movzx edx, word [rsp + 0xd4]
movzx r10d, word [rsp + 0xd2]
movzx r11d, word [rsp + 0xd0]
movzx ebx, word [rsp + 0xce]
movzx r9d, word [rsp + 0xca]
movzx r8d, word [rsp + 0xc8]
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x30], r10d
mov dword [rsp + 0x28], r11d
mov dword [rsp + 0x20], ebx
lea rdx, str._04d__02d__02d__02d:_02d:_02d._03d___d__:
lea rcx, [rsp + 0x50]
call sym.WebKeyAPICPPDLLx64.dll_public:_class_WKString____ptr64___cdecl_WKString::Format_char_const____ptr64____ptr64
mov r14, qword [rsp + 0x60]
test r14, r14
je 0x180018c54
lea rdx, [0x1801cb84c]
mov rcx, r14
call fcn.180154574
test rax, rax
je 0x180018c54
sub eax, r14d
cmp eax, 0xffffffff
je 0x180018c54
movsxd r8, eax
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x50]
call sym.WebKeyAPICPPDLLx64.dll_public:_class_WKString___cdecl_WKString::Left_unsigned_long_long_unsigned___int64_____ptr64
nop
lea rdi, [0x1801ca568]
cmp qword [rax + 0x20], 0
mov rdx, rdi
je 0x180018c28
mov rdx, qword [rax + 0x10]
lea rcx, [rsp + 0x50]
call sym.WebKeyAPICPPDLLx64.dll_protected:_void___cdecl_WKString::Set_char_const____ptr64____ptr64
nop
mov qword [rsp + 0xa0], rsi
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x180018c4d
call fcn.1801525f4
mov r14, qword [rsp + 0x60]
jmp 0x180018c5b
lea rdi, [0x1801ca568]
cmp qword [rsp + 0x70], 0
cmovne rdi, r14
mov rbx, 0xffffffffffffffff
mov rsi, rbx
nop
inc rsi
cmp byte [rdi + rsi], 0
jne 0x180018c70
mov r8d, esi
mov r9, qword [r13]
mov edx, 1
mov rcx, rdi
call fcn.18016a114
cmp rax, rsi
jne 0x180018d4a
inc rbx
cmp byte [r12 + rbx], 0
jne 0x180018c96
mov r8d, ebx
mov r9, qword [r13]
mov edx, 1
mov rcx, r12
call fcn.18016a114
cmp rax, rbx
jne 0x180018d59
mov r9, qword [r13]
mov edx, 1
mov r8d, edx
lea rcx, [0x1801cb84c]
call fcn.18016a114
cmp rax, 1
jne 0x180018d67
mov rcx, qword [r13]
call fcn.18016b990
nop
test r14, r14
je 0x180018cf7
mov rcx, r14
call fcn.1801525f4
nop
mov rcx, qword [rsp + 0x78]
jmp 0x180018d0f
test r15b, r15b
je 0x180018d1d
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rsp + 0xd8]
xor rcx, rsp
call fcn.1801525d0
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.18016ad64
nop
xor edx, edx
mov ecx, dword [rax]
call fcn.1800cb250
call fcn.18016ad64
xor edx, edx
mov ecx, dword [rax]
call fcn.1800cb250
call fcn.18016ad64
xor edx, edx
mov ecx, dword [rax]
call fcn.1800cb250
int3