Function at 0x18006b760
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x180195040]
xor rax, rsp
mov qword [rbp + 0x70], rax
mov rax, qword [0x180197920]
lea r8, [0x180197838]
lea rdx, [0x18017b5c8]
mov rcx, qword [rax + 0x170]
mov rax, qword [rcx]
call qword [rax + 0x38]
xor ebx, ebx
movabs rdi, 0xd3a79a6e9465e6f2
movabs rsi, 0x51786bcf76cf5a1d
movabs r14, 0x36a2a06adea5494e
movabs r15, 0xacfeeef524b31edf
movabs r12, 0xfb5004b03c96a9d8
movabs r13, 0x91d82f23497e7061
test eax, eax
jns 0x18006b949
mov dl, 3
call fcn.18008b850
movabs rax, 0x25580faa1aa63b7b
lea rdx, [rbp + 0x20]
mov qword [rsp + 0x30], rax
lea rcx, [rbp + 0x20]
mov rax, qword [rsp + 0x30]
mov r8d, edx
mov qword [rbp + 0x20], rax
movabs rax, 0x53c6801ebbc26921
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x28], rax
movabs rax, 0xc38c88d541d077a9
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x30], rax
movabs rax, 0x933374d14be589b5
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x38], rax
movabs rax, 0x91d82f2349101900
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x40], rax
mov qword [rsp + 0x30], rdi
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x48], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x30], r12
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x78], rax
mov qword [rsp + 0x30], r13
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x70], rax
mov qword [rsp + 0x30], rdi
mov rax, qword [rsp + 0x30]
movdqa xmm2, xmmword [rbp + 0x20]
xorps xmm2, xmmword [rsp + 0x70]
movdqa xmm0, xmmword [rbp + 0x30]
movdqa xmm1, xmmword [rbp + 0x40]
xorps xmm0, xmmword [rbp - 0x80]
mov qword [rbp - 0x68], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp - 0x70]
movdqa xmmword [rbp + 0x20], xmm2
movdqa xmmword [rbp + 0x30], xmm0
movdqa xmmword [rbp + 0x40], xmm1
test al, al
je 0x18006b92a
nop dword [rax]
inc rcx
mov r8, rcx
cmp byte [rcx], bl
jne 0x18006b920
sub r8d, edx
mov qword [rsp + 0x20], rbx
lea rdx, [rbp + 0x20]
xor r9d, r9d
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_WriteFile]
int3
mov rcx, qword [0x180197838]
lea rdx, [0x180197840]
mov rax, qword [rcx]
call qword [rax + 0x140]
mov rax, qword [0x180197920]
lea rdx, [rbp - 0x30]
mov rcx, qword [rax + 0x170]
mov rax, qword [rcx]
call qword [rax + 0x60]
mov rax, qword [0x180197920]
lea r9, [rsp + 0x38]
mov qword [rsp + 0x38], rbx
lea r8, [0x18017b5d8]
xor edx, edx
mov rcx, qword [rax + 0x170]
mov rax, qword [rcx]
call qword [rax + 0x48]
test eax, eax
js 0x18006c2d2
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x18006c2d2
cmp dword [rbp - 0x20], 0x1d
lea r9, [0x180197908]
mov ecx, 0x1c
mov qword [rsp + 0x48], rbx
cmovne ecx, dword [rbp - 0x20]
lea r8, [rsp + 0x40]
mov dword [rsp + 0x40], ecx
mov rcx, qword [0x180197838]
mov dword [rsp + 0x50], ebx
mov dword [rsp + 0x44], 4
mov rax, qword [rcx]
call qword [rax + 0x48]
test eax, eax
jns 0x18006c2c7
mov dl, 2
call fcn.18008b850
movabs rax, 0x25580faa1aa63b7b
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x70], rax
movabs rax, 0x53d6c10facc66921
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x78], rax
movabs rax, 0x8c8c8b914ad66cff
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x80], rax
movabs rax, 0x8d7070d55be4c8ac
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x78], rax
movabs rax, 0xf9ac465469091508
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x70], rax
movabs rax, 0x81f8ab5fd056a2d2
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x68], rax
movabs rax, 0x40a46b8056796c77
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x60], rax
movabs rax, 0x240702b3d760aaf
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x58], rax
movabs rax, 0x8423d2a5ccfcacb1
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x50], rax
movabs rax, 0x837a1212dc4fc498
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x48], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x20], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x28], rax
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x30], rax
mov qword [rsp + 0x30], r12
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x38], rax
mov qword [rsp + 0x30], r13
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x40], rax
mov qword [rsp + 0x30], rdi
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x48], rax
movabs rax, 0xee126c912263a23
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x50], rax
movabs rax, 0x5a052474733943fc
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x58], rax
movabs rax, 0xaa0d969789aef9e5
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x60], rax
movabs rax, 0x837a1212dc4fc4b6
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
movdqa xmm2, xmmword [rsp + 0x70]
xorps xmm2, xmmword [rbp + 0x20]
movdqa xmm0, xmmword [rbp + 0x30]
xorps xmm0, xmmword [rbp - 0x80]
movdqa xmmword [rsp + 0x70], xmm2
mov qword [rbp + 0x68], rax
movdqa xmm1, xmmword [rbp - 0x70]
lea rdx, [rsp + 0x70]
xorps xmm1, xmmword [rbp + 0x40]
lea rcx, [rsp + 0x70]
movdqa xmmword [rbp - 0x70], xmm1
movq rax, xmm2
movdqa xmm1, xmmword [rbp - 0x50]
mov r8d, edx
xorps xmm1, xmmword [rbp + 0x60]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm0, xmmword [rbp - 0x60]
xorps xmm0, xmmword [rbp + 0x50]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmmword [rbp - 0x60], xmm0
test al, al
je 0x18006bc0d
inc rcx
mov r8, rcx
cmp byte [rcx], bl
jne 0x18006bc03
sub r8d, edx
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x70]
xor r9d, r9d
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dl, 1
call fcn.18008b850
movabs rax, 0x361602b604bb3f6f
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x70], rax
movabs rax, 0x57c7d209feca3d6e
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x78], rax
movabs rax, 0xc99a809056937bab
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x80], rax
movabs rax, 0x8f3563c25de289aa
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x78], rax
movabs rax, 0xf8af0f542c170641
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x70], rax
movabs rax, 0xe296de5dd0458e86
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x68], rax
movabs rax, 0x43a862964472687c
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x60], rax
movabs rax, 0xe5a6a3b3a6a0db9
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x58], rax
movabs rax, 0xee3fd3c5dcfaa1a0
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x50], rax
movabs rax, 0x837a123cf26197fb
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x48], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x20], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x28], rax
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x30], rax
mov qword [rsp + 0x30], r12
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x38], rax
mov qword [rsp + 0x30], r13
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x40], rax
mov qword [rsp + 0x30], rdi
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x48], rax
movabs rax, 0xee126c912263a23
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x50], rax
movabs rax, 0x5a052474733943fc
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x58], rax
movabs rax, 0xaa0d969789aef9e5
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x60], rax
movabs rax, 0x837a1212dc4fc4b6
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
movdqa xmm0, xmmword [rbp - 0x80]
lea rdx, [rsp + 0x70]
xorps xmm0, xmmword [rbp + 0x30]
lea rcx, [rsp + 0x70]
movdqa xmm1, xmmword [rbp - 0x70]
mov r8d, edx
xorps xmm1, xmmword [rbp + 0x40]
movdqa xmm2, xmmword [rsp + 0x70]
xorps xmm2, xmmword [rbp + 0x20]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm0, xmmword [rbp - 0x60]
xorps xmm0, xmmword [rbp + 0x50]
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmm1, xmmword [rbp - 0x50]
mov qword [rbp + 0x68], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp + 0x60]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmmword [rsp + 0x70], xmm2
test al, al
je 0x18006be3f
inc rcx
mov r8, rcx
cmp byte [rcx], bl
jne 0x18006be35
sub r8d, edx
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x70]
xor r9d, r9d
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x180197838]
lea r9, [0x180197908]
mov rdx, qword [rsp + 0x38]
lea r8, [rsp + 0x40]
mov dword [rsp + 0x44], 6
mov rax, qword [rcx]
call qword [rax + 0x48]
test eax, eax
jns 0x18006c2c7
mov dl, 2
call fcn.18008b850
movabs rax, 0x25580faa1aa63b7b
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x70], rax
movabs rax, 0x53d6c10facc66921
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x78], rax
movabs rax, 0x8c8c8b914ad66cff
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x80], rax
movabs rax, 0x8d7070d55be4c8ac
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x78], rax
movabs rax, 0xf9ac465469091508
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x70], rax
movabs rax, 0x81f8ab5fd056a2d2
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x68], rax
movabs rax, 0x40a46b8056796c77
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x60], rax
movabs rax, 0x240702b3d760aaf
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x58], rax
movabs rax, 0x8423d2a5ccfcacb1
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x50], rax
movabs rax, 0x837a1212dc4fc498
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x48], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x20], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x28], rax
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x30], rax
mov qword [rsp + 0x30], r12
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x38], rax
mov qword [rsp + 0x30], r13
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x40], rax
mov qword [rsp + 0x30], rdi
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x48], rax
movabs rax, 0xee126c912263a23
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x50], rax
movabs rax, 0x5a052474733943fc
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x58], rax
movabs rax, 0xaa0d969789aef9e5
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x60], rax
movabs rax, 0x837a1212dc4fc4b6
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
movdqa xmm2, xmmword [rsp + 0x70]
xorps xmm2, xmmword [rbp + 0x20]
movdqa xmm0, xmmword [rbp - 0x80]
xorps xmm0, xmmword [rbp + 0x30]
movdqa xmmword [rsp + 0x70], xmm2
mov qword [rbp + 0x68], rax
movdqa xmm1, xmmword [rbp - 0x70]
lea rdx, [rsp + 0x70]
xorps xmm1, xmmword [rbp + 0x40]
lea rcx, [rsp + 0x70]
movdqa xmmword [rbp - 0x70], xmm1
movq rax, xmm2
movdqa xmm1, xmmword [rbp - 0x50]
mov r8d, edx
xorps xmm1, xmmword [rbp + 0x60]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm0, xmmword [rbp - 0x60]
xorps xmm0, xmmword [rbp + 0x50]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmmword [rbp - 0x60], xmm0
test al, al
je 0x18006c09f
inc rcx
mov r8, rcx
cmp byte [rcx], bl
jne 0x18006c095
sub r8d, edx
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x70]
xor r9d, r9d
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dl, 1
call fcn.18008b850
movabs rax, 0x361602b604bb3f6f
lea rdx, [rbp - 0x40]
mov qword [rsp + 0x30], rax
lea rcx, [rbp - 0x40]
mov rax, qword [rsp + 0x30]
mov r8d, edx
mov qword [rbp - 0x40], rax
movabs rax, 0x36a2a06ade8b6760
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x38], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
movdqa xmm0, xmmword [rbp - 0x40]
mov qword [rsp + 0x68], rax
xorps xmm0, xmmword [rsp + 0x60]
movq rax, xmm0
movdqa xmmword [rbp - 0x40], xmm0
test al, al
je 0x18006c13e
inc rcx
mov r8, rcx
cmp byte [rcx], bl
jne 0x18006c134
sub r8d, edx
mov qword [rsp + 0x20], rbx
lea rdx, [rbp - 0x40]
xor r9d, r9d
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x180197838]
lea r9, [0x180197908]
mov rdx, qword [rsp + 0x38]
xor r8d, r8d
mov rax, qword [rcx]
call qword [rax + 0x48]
test eax, eax
jns 0x18006c2c7
mov dl, 3
call fcn.18008b850
movabs rax, 0x25580faa1aa63b7b
lea rcx, [rbp + 0x20]
mov qword [rsp + 0x30], rax
lea rdx, [rbp + 0x20]
mov rax, qword [rsp + 0x30]
mov r8d, ecx
mov qword [rbp + 0x20], rax
movabs rax, 0x53d6c10facc66921
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x28], rax
movabs rax, 0x8c8c8b914ad66cff
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x30], rax
movabs rax, 0x8d7070d55be4c8ac
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x38], rax
movabs rax, 0x91d82f2349091508
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x40], rax
mov qword [rsp + 0x30], rdi
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x48], rax
mov qword [rsp + 0x30], rsi
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x30], r14
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x30], r15
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x30], r12
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x78], rax
mov qword [rsp + 0x30], r13
mov rax, qword [rsp + 0x30]
mov qword [rbp - 0x70], rax
mov qword [rsp + 0x30], rdi
mov rax, qword [rsp + 0x30]
movdqa xmm2, xmmword [rbp + 0x20]
xorps xmm2, xmmword [rsp + 0x70]
movdqa xmm0, xmmword [rbp + 0x30]
movdqa xmm1, xmmword [rbp + 0x40]
xorps xmm0, xmmword [rbp - 0x80]
mov qword [rbp - 0x68], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp - 0x70]
movdqa xmmword [rbp + 0x20], xmm2
movdqa xmmword [rbp + 0x30], xmm0
movdqa xmmword [rbp + 0x40], xmm1
test al, al
je 0x18006c2aa
inc rdx
mov r8, rdx
cmp byte [rdx], bl
jne 0x18006c2a0
sub r8d, ecx
mov qword [rsp + 0x20], rbx
mov rcx, 0xffffffffffffffff
lea rdx, [rbp + 0x20]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
int3
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.1800f1520
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret