Function at 0x18001dfc0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rdi, rcx
mov rax, qword [rcx + 0x9e]
test rax, rax
je 0x18001dffb
cmp byte [rcx + 1], 0
je 0x18001dffb
mov byte [rax + 0x14], 0
mov rcx, qword [rcx + 0x9e]
call fcn.18002dbb0
xor r12d, r12d
mov qword [rdi + 0x9e], r12
cmp byte [rdi], r12b
je 0x18001e78d
cmp byte [rdi + 0x3046], r12b
je 0x18001e084
mov rbx, qword [rdi + 0x1a]
test rbx, rbx
je 0x18001e084
mov rsi, qword [0x1802632d8]
mov qword [0x1802632d8], rdi
mov dword [rdi + 0x3047], r12d
mov qword [rsp + 0x50], r12
lea rcx, [rsp + 0x50]
call fcn.18002c170
mov rbp, rax
lea rdx, [0x180176748]
mov rcx, rbx
call fcn.180018d80
mov rbx, rax
test rax, rax
je 0x18001e07d
mov r9, rax
mov r8, qword [rsp + 0x50]
lea edx, [r12 + 1]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov qword [0x1802632d8], rsi
mov edx, 6
mov rcx, rdi
call fcn.18001b760
mov esi, r12d
cmp dword [rdi + 0x1b92], r12d
jle 0x18001e0e1
mov r14, r12
mov rax, qword [rdi + 0x1b9a]
mov rbx, qword [r14 + rax]
test rbx, rbx
je 0x18001e0d3
mov rcx, rbx
call fcn.18001af30
mov rax, qword [0x1802632d8]
test rax, rax
je 0x18001e0ca
dec dword [rax + 0x399]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
inc esi
add r14, 8
cmp esi, dword [rdi + 0x1b92]
jl 0x18001e0a0
mov rcx, qword [rdi + 0x1b9a]
test rcx, rcx
je 0x18001e113
mov qword [rdi + 0x1b92], r12
mov rax, qword [0x1802632d8]
test rax, rax
je 0x18001e106
dec dword [rax + 0x399]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x1b9a], r12
mov rcx, qword [rdi + 0x1baa]
test rcx, rcx
je 0x18001e145
mov qword [rdi + 0x1ba2], r12
mov rax, qword [0x1802632d8]
test rax, rax
je 0x18001e138
dec dword [rax + 0x399]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x1baa], r12
mov rcx, qword [rdi + 0x1bba]
test rcx, rcx
je 0x18001e177
mov qword [rdi + 0x1bb2], r12
mov rax, qword [0x1802632d8]
test rax, rax
je 0x18001e16a
dec dword [rax + 0x399]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x1bba], r12
mov qword [rdi + 0x1bee], r12
mov rcx, qword [rdi + 0x1bca]
test rcx, rcx
je 0x18001e1b0
mov qword [rdi + 0x1bc2], r12
mov rax, qword [0x1802632d8]
test rax, rax
je 0x18001e1a3
dec dword [rax + 0x399]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x1bca], r12
mov rcx, qword [rdi + 0x1bda]
test rcx, rcx
je 0x18001e1e2
mov qword [rdi + 0x1bd2], r12
mov rax, qword [0x1802632d8]
test rax, rax
je 0x18001e1d5
dec dword [rax + 0x399]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x1bda], r12
mov qword [rdi + 0x1dd5], r12
mov qword [rdi + 0x1bfe], r12
mov qword [rdi + 0x1bf6], r12
mov qword [rdi + 0x1c7b], r12
mov qword [rdi + 0x1c65], r12
mov qword [rdi + 0x1c06], r12
mov rcx, qword [rdi + 0x1d49]
test rcx, rcx
je 0x18001e23e
mov qword [rdi + 0x1d41], r12
mov rax, qword [0x1802632d8]
test rax, rax
je 0x18001e231
dec dword [rax + 0x399]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x1d49], r12
mov rcx, qword [rdi + 0x1d59]
test rcx, rcx
je 0x18001e270
mov qword [rdi + 0x1d51], r12
mov rax, qword [0x1802632d8]
test rax, rax
je 0x18001e263
dec dword [rax + 0x399]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x1d59], r12
mov rcx, qword [rdi + 0x1d69]
test rcx, rcx
je 0x18001e2a2
mov qword [rdi + 0x1d61], r12
mov rax, qword [0x1802632d8]
test rax, rax
je 0x18001e295
dec dword [rax + 0x399]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x1d69], r12
mov rcx, qword [rdi + 0x1da9]
test rcx, rcx
je 0x18001e2d4
mov qword [rdi + 0x1da1], r12
mov rax, qword [0x1802632d8]
test rax, rax
je 0x18001e2c7
dec dword [rax + 0x399]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x1da9], r12
mov rcx, qword [rdi + 0x1db9]
test rcx, rcx
je 0x18001e306
mov qword [rdi + 0x1db1], r12
mov rax, qword [0x1802632d8]
test rax, rax
je 0x18001e2f9
dec dword [rax + 0x399]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x1db9], r12
mov ebp, r12d
cmp dword [rdi + 0x1dc5], r12d
jle 0x18001e3d4
mov r14, r12
nop dword [rax]
mov rax, qword [rdi + 0x1dcd]
mov rbx, qword [r14 + rax]
test rbx, rbx
je 0x18001e3c2
mov rsi, qword [rbx + 0x2c]
test rsi, rsi
je 0x18001e360
mov rcx, rsi
call fcn.1800176e0
mov rax, qword [0x1802632d8]
test rax, rax
je 0x18001e357
dec dword [rax + 0x399]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rsi, qword [rbx + 0x34]
test rsi, rsi
je 0x18001e38d
mov rcx, rsi
call fcn.1800176e0
mov rax, qword [0x1802632d8]
test rax, rax
je 0x18001e383
dec dword [rax + 0x399]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
nop
lea rcx, [rbx + 0x69]
lea r9, [0x18002cc80]
mov edx, reloc.WS2_32.dll_recv
lea r8d, [rdx - 0xe]
call fcn.1800f64a4
nop
mov rax, qword [0x1802632d8]
test rax, rax
je 0x18001e3b9
dec dword [rax + 0x399]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
inc ebp
add r14, 8
cmp ebp, dword [rdi + 0x1dc5]
jl 0x18001e320
mov rcx, qword [rdi + 0x1dcd]
test rcx, rcx
je 0x18001e406
mov qword [rdi + 0x1dc5], r12
mov rax, qword [0x1802632d8]
test rax, rax
je 0x18001e3f9
dec dword [rax + 0x399]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x1dcd], r12
lea rcx, [rdi + 0x2076]
call fcn.18002ccb0
mov rcx, qword [rdi + 0x20a6]
test rcx, rcx
je 0x18001e444
mov qword [rdi + 0x209e], r12
mov rax, qword [0x1802632d8]
test rax, rax
je 0x18001e437
dec dword [rax + 0x399]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x20a6], r12
mov rcx, qword [rdi + 0x20b6]
test rcx, rcx
je 0x18001e476
mov qword [rdi + 0x20ae], r12
mov rax, qword [0x1802632d8]
test rax, rax
je 0x18001e469
dec dword [rax + 0x399]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x20b6], r12
mov ebx, r12d
cmp dword [rdi + 0x1ffa], r12d
jle 0x18001e4c8
mov rsi, r12
nop word [rax + rax]
mov rax, qword [rdi + 0x2002]
mov rcx, qword [rsi + rax + 0x1c]
test rcx, rcx
je 0x18001e4ba
mov rax, qword [0x1802632d8]
test rax, rax
je 0x18001e4b3
dec dword [rax + 0x399]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
nop
inc ebx
add rsi, 0x24
cmp ebx, dword [rdi + 0x1ffa]
jl 0x18001e490
mov rcx, qword [rdi + 0x2002]
test rcx, rcx
je 0x18001e4fa
mov qword [rdi + 0x1ffa], r12
mov rax, qword [0x1802632d8]
test rax, rax
je 0x18001e4ed
dec dword [rax + 0x399]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x2002], r12
lea rcx, [rdi + 0x2026]
call fcn.18002ce20
mov esi, r12d
cmp dword [rdi + 0x2016], r12d
jle 0x18001e565
mov rbp, r12
nop word [rax + rax]
mov rbx, qword [rdi + 0x201e]
lea rcx, [rbx + 0x10]
add rcx, rbp
call fcn.180038d50
nop
mov rcx, qword [rbx + rbp + 0x20]
test rcx, rcx
je 0x18001e557
mov rax, qword [0x1802632d8]
test rax, rax
je 0x18001e550
dec dword [rax + 0x399]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
nop
inc esi
add rbp, 0x6c
cmp esi, dword [rdi + 0x2016]
jl 0x18001e520
mov rcx, qword [rdi + 0x201e]
test rcx, rcx
je 0x18001e597
mov qword [rdi + 0x2016], r12
mov rax, qword [0x1802632d8]
test rax, rax
je 0x18001e58a
dec dword [rax + 0x399]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x201e], r12
mov rcx, qword [rdi + 0x2066]
test rcx, rcx
je 0x18001e5c9
mov qword [rdi + 0x205e], r12
mov rax, qword [0x1802632d8]
test rax, rax
je 0x18001e5bc
dec dword [rax + 0x399]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x2066], r12
mov rcx, qword [rdi + 0x301d]
test rcx, rcx
je 0x18001e5fb
mov qword [rdi + 0x3015], r12
mov rax, qword [0x1802632d8]
test rax, rax
je 0x18001e5ee
dec dword [rax + 0x399]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x301d], r12
mov rcx, qword [rdi + 0x302d]
test rcx, rcx
je 0x18001e62d
mov qword [rdi + 0x3025], r12
mov rax, qword [0x1802632d8]
test rax, rax
je 0x18001e620
dec dword [rax + 0x399]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x302d], r12
mov rcx, qword [rdi + 0x20da]
test rcx, rcx
je 0x18001e65f
mov qword [rdi + 0x20d2], r12
mov rax, qword [0x1802632d8]
test rax, rax
je 0x18001e652
dec dword [rax + 0x399]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x20da], r12
mov rcx, qword [rdi + 0x20ea]
test rcx, rcx
je 0x18001e691
mov qword [rdi + 0x20e2], r12
mov rax, qword [0x1802632d8]
test rax, rax
je 0x18001e684
dec dword [rax + 0x399]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x20ea], r12
mov rcx, qword [rdi + 0x20fa]
test rcx, rcx
je 0x18001e6c3
mov qword [rdi + 0x20f2], r12
mov rax, qword [0x1802632d8]
test rax, rax
je 0x18001e6b6
dec dword [rax + 0x399]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x20fa], r12
mov rcx, qword [rdi + 0x3073]
test rcx, rcx
je 0x18001e6f5
mov qword [rdi + 0x306b], r12
mov rax, qword [0x1802632d8]
test rax, rax
je 0x18001e6e8
dec dword [rax + 0x399]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x3073], r12
mov rcx, qword [rdi + 0x3063]
test rcx, rcx
je 0x18001e727
mov qword [rdi + 0x305b], r12
mov rax, qword [0x1802632d8]
test rax, rax
je 0x18001e71a
dec dword [rax + 0x399]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x3063], r12
cmp qword [rdi + 0x30a4], 0
je 0x18001e758
mov rbx, qword [rdi + 0x30a4]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
cmp rbx, rax
je 0x18001e751
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov qword [rdi + 0x30a4], r12
mov rcx, qword [rdi + 0x30b4]
test rcx, rcx
je 0x18001e78a
mov qword [rdi + 0x30ac], r12
mov rax, qword [0x1802632d8]
test rax, rax
je 0x18001e77d
dec dword [rax + 0x399]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + 0x30b4], r12
mov byte [rdi], 0
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret