Function at 0x18002ca50
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xe8
mov rax, qword [0x180087020]
xor rax, rsp
mov qword [rbp + 0xf], rax
mov rsi, r9
mov rbx, r8
mov rdi, rdx
mov qword [rsp + 0x48], rdx
mov qword [rbp - 0x79], r9
xor r12d, r12d
mov qword [rbp - 0x11], r12
mov qword [rbp - 1], r12
mov qword [rbp + 7], 7
mov word [rbp - 0x11], r12w
mov r15, 0xffffffffffffffff
mov r8, r15
nop dword [rax + rax]
inc r8
cmp word [rcx + r8*2], r12w
jne 0x18002cab0
mov rdx, rcx
lea rcx, [rbp - 0x11]
call fcn.1800111b0
nop
lea rdx, [rbp - 0x11]
lea rcx, [rbp - 0x31]
call fcn.18002c920
nop
mov rdx, qword [rbp + 7]
cmp rdx, 8
jb 0x18002cb15
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002cb10
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002d0b6
call fcn.180035588
mov qword [rbp - 0x11], r12
mov qword [rbp - 1], r12
mov qword [rbp + 7], 7
mov word [rbp - 0x11], r12w
mov r8, r15
nop dword [rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x18002cb30
mov rdx, rbx
lea rcx, [rbp - 0x11]
call fcn.1800111b0
nop
lea rdx, [rbp - 0x11]
lea rcx, [rbp - 0x51]
call fcn.18002c920
nop
mov rdx, qword [rbp + 7]
cmp rdx, 8
jb 0x18002cb96
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002cb91
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002d0b0
call fcn.180035588
mov rdx, rsi
lea rcx, [rbp - 0x71]
call fcn.18002c920
nop
lea r8, [rbp - 0x31]
cmp qword [rbp - 0x19], 8
cmovae r8, qword [rbp - 0x31]
lea rdx, [rbp - 0x51]
cmp qword [rbp - 0x39], 8
cmovae rdx, qword [rbp - 0x51]
lea rcx, [rbp - 0x71]
cmp qword [rbp - 0x59], 8
cmovae rcx, qword [rbp - 0x71]
mov rax, r15
inc rax
cmp word [rcx + rax*2], 0
jne 0x18002cbd0
mov rcx, r15
nop dword [rax]
inc rcx
cmp word [rdx + rcx*2], 0
jne 0x18002cbe0
add rax, rcx
mov rcx, r15
lea rcx, [rcx + 1]
cmp word [r8 + rcx*2], 0
jne 0x18002cbf0
lea rbx, [rcx + 0x67]
add rbx, rax
mov eax, 2
mul rbx
cmovo rax, r15
mov rcx, rax
call fcn.1800355f8
mov r14, rax
lea r8, [rbp - 0x71]
cmp qword [rbp - 0x59], 8
cmovae r8, qword [rbp - 0x71]
lea rcx, [rbp - 0x51]
cmp qword [rbp - 0x39], 8
cmovae rcx, qword [rbp - 0x51]
lea r9, [rbp - 0x31]
cmp qword [rbp - 0x19], 8
cmovae r9, qword [rbp - 0x31]
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], rcx
lea r8, str.import_ctypes_r_nshell32__ctypes.windll.shell32_r_nshell32.ShellExecuteW_None__open____s_____s_____s__0__r_n
mov rdx, rbx
mov rcx, rax
call fcn.18002b3a0
test eax, eax
jns 0x18002cdf9
mov rcx, r14
call fcn.180035588
nop
mov rdx, qword [rbp - 0x59]
cmp rdx, 8
jb 0x18002ccb1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x71]
cmp rdx, 0x1000
mov rax, rcx
jb 0x18002ccac
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002d0b0
call fcn.180035588
mov word [rbp - 0x71], r12w
mov qword [rbp - 0x59], 7
mov qword [rbp - 0x61], r12
mov rdx, qword [rbp - 0x39]
cmp rdx, 8
jb 0x18002cd02
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x51]
cmp rdx, 0x1000
mov rax, rcx
jb 0x18002ccfd
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002d0b6
call fcn.180035588
mov word [rbp - 0x51], r12w
mov qword [rbp - 0x39], 7
mov qword [rbp - 0x41], r12
mov rdx, qword [rbp - 0x19]
cmp rdx, 8
jb 0x18002cd53
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x31]
cmp rdx, 0x1000
mov rax, rcx
jb 0x18002cd4e
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002d0bc
call fcn.180035588
mov qword [rbp - 0x21], r12
mov qword [rbp - 0x19], 7
mov word [rbp - 0x31], r12w
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x18002cda3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x18002cd9e
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18002d0a4
mov rcx, r8
call fcn.180035588
mov qword [rdi + 0x10], r12
mov qword [rdi + 0x18], 7
mov word [rdi], r12w
mov rdx, qword [rsi + 0x18]
cmp rdx, 8
jb 0x18002cdf2
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
mov rcx, qword [rsi]
jb 0x18002cded
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18002d0aa
mov rcx, r8
call fcn.180035588
xor eax, eax
jmp 0x18002d074
mov rcx, rdi
cmp qword [rdi + 0x18], 8
jb 0x18002ce06
mov rcx, qword [rdi]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18002cc68
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9d, r15d
mov r8, r14
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd r13, eax
test eax, eax
jne 0x18002ce72
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18002cc68
mov rcx, r13
call fcn.1800355f8
mov r15, rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, r14
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea r8d, [r13 - 1]
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x40]
mov rdx, r15
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
test eax, eax
jne 0x18002cedb
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call fcn.180035588
mov rcx, r15
jmp 0x18002cc6b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call fcn.180035588
mov rcx, r15
call fcn.180035588
nop
mov rdx, qword [rbp - 0x59]
cmp rdx, 8
jb 0x18002cf32
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x71]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002cf2d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002d0b0
call fcn.180035588
mov qword [rbp - 0x61], r12
mov qword [rbp - 0x59], 7
mov word [rbp - 0x71], r12w
mov rdx, qword [rbp - 0x39]
cmp rdx, 8
jb 0x18002cf83
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x51]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002cf7e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002d0b6
call fcn.180035588
mov qword [rbp - 0x41], r12
mov qword [rbp - 0x39], 7
mov word [rbp - 0x51], r12w
mov rdx, qword [rbp - 0x19]
cmp rdx, 8
jb 0x18002cfd4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x31]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002cfcf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002d0bc
call fcn.180035588
mov qword [rbp - 0x21], r12
mov qword [rbp - 0x19], 7
mov word [rbp - 0x31], r12w
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x18002d024
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x18002d01f
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18002d0a4
mov rcx, r8
call fcn.180035588
mov qword [rdi + 0x10], r12
mov qword [rdi + 0x18], 7
mov word [rdi], r12w
mov rdx, qword [rsi + 0x18]
cmp rdx, 8
jb 0x18002d06f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x18002d06a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18002d0aa
mov rcx, r8
call fcn.180035588
mov eax, 1
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], 7
mov word [rsi], r12w
mov rcx, qword [rbp + 0xf]
xor rcx, rsp
call fcn.180034f80
add rsp, 0xe8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.18003ed10
nop
call fcn.18003ed10
nop
call fcn.18003ed10
nop
call fcn.18003ed10
nop
call fcn.18003ed10
int3