Function at 0x180026f70
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push r13
sub rsp, 0x288
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor esi, esi
mov rbp, rdx
mov r13, rcx
mov ebx, esi
mov dword [rsp + 0x48], esi
test rdx, rdx
je 0x18002741e
lea rax, [rsp + 0x40]
test rax, rax
je 0x18002741e
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x60]
xor edx, edx
mov r8d, 0x200
mov rcx, rbp
mov qword [rsp + 0x20], rax
call fcn.180002c60
test eax, eax
je 0x18002741a
cmp dword [rsp + 0x48], 0x200
jne 0x18002741a
lea r9, [rsp + 0x38]
lea r8d, [rsi + 8]
lea rdx, [rsp + 0x50]
mov rcx, r13
mov qword [rsp + 0x2c0], rdi
mov dword [rsp + 0x30], 0x200
mov qword [rsp + 0x50], rsi
mov dword [rsp + 0x38], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18002707e
cmp dword [rsp + 0x38], 8
jne 0x18002707e
lea r9, [rsp + 0x38]
lea r8d, [rsi + 4]
lea rdx, [rsp + 0x30]
mov rcx, r13
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18002707e
cmp dword [rsp + 0x38], 4
jne 0x18002707e
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x38]
lea rdx, [rsp + 0x60]
mov rcx, r13
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18002707e
mov eax, dword [rsp + 0x38]
cmp dword [rsp + 0x30], eax
jne 0x18002707e
lea ebx, [rsi + 1]
mov edx, dword [rbp + 0x7f]
xor ecx, ecx
mov r8d, 0x1000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x180027412
mov dword [rsp + 0x38], esi
mov ecx, dword [rbp + 0x7f]
lea rax, [rsp + 0x38]
mov rdx, rcx
mov r8d, ecx
mov r9, rdi
mov rcx, rbp
mov qword [rsp + 0x20], rax
call fcn.180002c60
test eax, eax
je 0x180027401
mov ecx, dword [rbp + 0x7f]
cmp ecx, dword [rsp + 0x38]
jne 0x180027401
movabs rax, 0x5452415020494645
cmp qword [rdi], rax
jne 0x180027401
cmp qword [rdi + 0x18], 1
jne 0x180027401
mov rax, qword [rdi + 0x20]
xor edx, edx
mov qword [rsp + 0x278], r14
mov qword [rsp + 0x40], rax
mov eax, dword [rdi + 0x50]
mov qword [rsp + 0x270], r15
imul eax, dword [rdi + 0x54]
dec eax
div ecx
lea r14d, [rax + 1]
imul r14d, ecx
test ebx, ebx
je 0x180027171
mov ebx, ecx
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x50]
mov r8d, 8
mov rcx, r13
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180027171
lea r9, [rsp + 0x30]
mov r8d, ebx
mov rdx, rdi
mov rcx, r13
call fcn.180026ed0
test eax, eax
je 0x180027171
mov ebx, 1
jmp 0x180027173
mov ebx, esi
xor ecx, ecx
mov edx, r14d
mov r8d, 0x1000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
test rax, rax
je 0x1800273f1
mov qword [rsp + 0x280], r12
mov r12d, dword [rbp + 0x7f]
lea rax, [rsp + 0x38]
mov r9, r15
mov r8d, r14d
mov rcx, rbp
imul r12, qword [rdi + 0x48]
mov rdx, r12
mov qword [rsp + 0x20], rax
call fcn.180002c60
test eax, eax
je 0x1800273d8
cmp r14d, dword [rsp + 0x38]
jne 0x1800273d8
mov rsi, r15
test ebx, ebx
je 0x18002722b
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x50]
mov r8d, 8
mov rcx, r13
mov qword [rsp + 0x50], r12
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18002722b
lea r9, [rsp + 0x30]
mov r8d, r14d
mov rdx, r15
mov rcx, r13
call fcn.180026ed0
test eax, eax
je 0x18002722b
mov ebx, 1
jmp 0x18002722d
xor ebx, ebx
mov r9d, dword [rdi + 0x50]
xor r8d, r8d
test r9d, r9d
je 0x1800272a4
lea r10, [0x18004a520]
mov rdx, qword [rsi]
cmp rdx, qword [r10]
jne 0x180027256
mov rdx, qword [rsi + 8]
cmp rdx, qword [r10 + 8]
jne 0x180027256
xor eax, eax
jmp 0x18002725b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x18002726f
mov eax, dword [rdi + 0x54]
inc r8d
add rsi, rax
cmp r8d, r9d
jb 0x180027240
jmp 0x1800272a4
test ebx, ebx
je 0x1800272a2
mov r8, qword [rsi + 0x20]
mov eax, dword [rbp + 0x7f]
mov r9, qword [rsi + 0x28]
sub r9, r8
mov rdx, rbp
mov rcx, r13
inc r9
imul r8, rax
imul r9, rax
call fcn.180026d70
test eax, eax
je 0x1800272a2
mov ebx, 1
jmp 0x1800272a4
xor ebx, ebx
mov eax, dword [rbp + 0x7f]
mov r12, qword [rsp + 0x40]
lea rcx, [rsp + 0x38]
mov rsi, rax
mov qword [rsp + 0x20], rcx
mov r9, rdi
mov r8d, eax
mov rcx, rbp
imul rsi, r12
mov rdx, rsi
call fcn.180002c60
test eax, eax
je 0x1800273d8
mov eax, dword [rsp + 0x38]
cmp dword [rbp + 0x7f], eax
jne 0x1800273d8
movabs rax, 0x5452415020494645
cmp qword [rdi], rax
jne 0x1800273d8
cmp qword [rdi + 0x18], r12
jne 0x1800273d8
test ebx, ebx
je 0x180027353
mov ebx, dword [rbp + 0x7f]
xor r12d, r12d
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x40]
lea r8d, [r12 + 8]
mov rcx, r13
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x30], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180027356
lea r9, [rsp + 0x30]
mov r8d, ebx
mov rdx, rdi
mov rcx, r13
call fcn.180026ed0
test eax, eax
je 0x180027356
lea ebx, [r12 + 1]
jmp 0x180027359
xor r12d, r12d
mov ebx, r12d
mov esi, dword [rbp + 0x7f]
lea rax, [rsp + 0x38]
mov r9, r15
mov r8d, r14d
mov rcx, rbp
mov qword [rsp + 0x20], rax
imul rsi, qword [rdi + 0x48]
mov rdx, rsi
call fcn.180002c60
test eax, eax
je 0x1800273d8
cmp r14d, dword [rsp + 0x38]
jne 0x1800273d8
test ebx, ebx
je 0x1800273d5
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r8d, 8
mov rcx, r13
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x30], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1800273d5
lea r9, [rsp + 0x30]
mov r8d, r14d
mov rdx, r15
mov rcx, r13
call fcn.180026ed0
test eax, eax
je 0x1800273d5
mov ebx, 1
jmp 0x1800273d8
mov ebx, r12d
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov r12, qword [rsp + 0x280]
mov r14, qword [rsp + 0x278]
mov r15, qword [rsp + 0x270]
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdi, qword [rsp + 0x2c0]
mov eax, ebx
jmp 0x180027420
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.18002d590
add rsp, 0x288
pop r13
pop rsi
pop rbp
pop rbx
ret