Function at 0x180013d60
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rax, qword [0x1800b2020]
xor rax, rsp
mov qword [rbp + 0xc0], rax
mov r12d, r8d
mov rbx, rdx
mov qword [rbp - 0x50], rdx
mov r13, rcx
xor esi, esi
mov edi, esi
mov dword [rsp + 0x30], esi
mov r15d, esi
test r8d, r8d
je 0x18001441c
lea r14, [rsi - 1]
nop word [rax + rax]
mov dword [rbp + 0x30], esi
mov eax, r12d
sub eax, r15d
mov esi, dword [r13]
cmp eax, esi
cmovbe esi, eax
call fcn.18002f970
mov rcx, qword [rax]
cmp dword [rcx], 0
je 0x180013fe2
movdqa xmm0, xmmword [0x1800a5db0]
movdqu xmmword [rbp + 0x50], xmm0
mov dword [rbp + 0x60], 0xfba0fdfb
mov word [rbp + 0x64], 0x80fd
mov byte [rbp + 0x66], 0
xor ebx, ebx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], 0xf
mov byte [rsp + 0x38], bl
lea rax, [rbp + 0x50]
mov r8, r14
inc r8
cmp byte [rax + r8], bl
jne 0x180013e21
lea rdx, [rbp + 0x50]
lea rcx, [rsp + 0x38]
call fcn.180002c00
bts edi, 0xa
lea rdx, [rsp + 0x38]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x50]
cmp r10, 0x10
cmovae rdx, r9
lea rcx, [rsp + 0x38]
cmovae rcx, r9
mov r8, qword [rsp + 0x48]
add r8, rcx
mov rcx, rbx
mov rax, r8
sub rax, rdx
cmp rdx, r8
cmova rax, rbx
test rax, rax
je 0x180013edd
cmp rax, 0x40
jb 0x180013edd
and rax, 0xffffffffffffffc0
movdqa xmm1, xmmword [0x1800a5d70]
nop dword [rax + rax]
movdqu xmm0, xmmword [rdx]
paddb xmm0, xmm1
movdqu xmmword [rdx], xmm0
movdqu xmm0, xmmword [rdx + 0x10]
paddb xmm0, xmm1
movdqu xmmword [rdx + 0x10], xmm0
movdqu xmm0, xmmword [rdx + 0x20]
paddb xmm0, xmm1
movdqu xmmword [rdx + 0x20], xmm0
movdqu xmm0, xmmword [rdx + 0x30]
paddb xmm0, xmm1
movdqu xmmword [rdx + 0x30], xmm0
add rdx, 0x40
add rcx, 0x40
cmp rcx, rax
jne 0x180013e90
mov r10, qword [rsp + 0x50]
mov r9, qword [rsp + 0x38]
cmp rdx, r8
je 0x180013ef7
add byte [rdx], 0x80
inc rdx
cmp rdx, r8
jne 0x180013ee2
mov r10, qword [rsp + 0x50]
mov r9, qword [rsp + 0x38]
bts edi, 9
or edi, 1
mov dword [rsp + 0x30], edi
lea rcx, [rsp + 0x38]
cmp r10, 0x10
cmovae rcx, r9
mov dword [rbp + 0x10], r12d
mov dword [rbp + 0x20], r15d
mov dword [rbp - 0x48], esi
movups xmm0, xmmword [rbp + 0x10]
movups xmmword [rbp + 0x80], xmm0
movups xmm1, xmmword [rbp + 0x20]
movups xmmword [rbp + 0x90], xmm1
movups xmm0, xmmword [rbp - 0x48]
movups xmmword [rbp + 0xa0], xmm0
mov qword [rbp - 0x20], 0x222
lea rax, [rbp + 0x80]
mov qword [rbp - 0x18], rax
movaps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp + 0x70], xmm0
mov qword [rbp - 0x10], rcx
mov rax, r14
nop
inc rax
cmp byte [rcx + rax], 0
jne 0x180013f60
mov qword [rbp - 8], rax
lea r8, [rbp + 0x70]
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x58]
call fcn.1800023e0
bts edi, 0xb
or edi, 2
mov dword [rsp + 0x30], edi
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 0x10
cmovae rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x78]
call fcn.18002bd50
bts edi, 0xc
or edi, 4
mov dword [rsp + 0x30], edi
lea rbx, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rbx, qword [rsp + 0x78]
call fcn.18002f970
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, str._antimalware_provider__::_bd::PipeClient::WriteBytes____
xor edx, edx
mov rcx, rax
call fcn.18002caa0
mov rbx, qword [rbp - 0x50]
test dil, 4
je 0x180014041
and edi, 0xfffffffb
mov rdx, qword [rbp - 0x70]
cmp rdx, 8
jb 0x18001402c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180014027
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180014652
call fcn.18006080c
xor eax, eax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], 7
mov word [rsp + 0x78], ax
jmp 0x180014043
xor eax, eax
test dil, 2
je 0x18001409e
and edi, 0xfffffffd
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x18001408b
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180014084
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180014658
call fcn.18006080c
xor eax, eax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], 0xf
mov byte [rsp + 0x58], 0
test dil, 1
je 0x1800140e6
and edi, 0xfffffffe
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x1800140e6
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800140df
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001465e
call fcn.18006080c
xor eax, eax
mov edx, r15d
add rdx, rbx
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x30]
mov r8d, esi
mov rcx, qword [r13 + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180014448
call fcn.18002f970
mov rcx, qword [rax]
xor esi, esi
cmp dword [rcx], esi
je 0x180014314
mov dword [rbp + 0x38], 0xf4e9f2d7
mov dword [rbp + 0x3c], 0xe1e4a0e5
mov dword [rbp + 0x40], 0xfba0e1f4
mov word [rbp + 0x44], 0x80fd
mov byte [rbp + 0x46], sil
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], 0xf
mov byte [rsp + 0x38], sil
lea rax, [rbp + 0x38]
mov r8, r14
nop word [rax + rax]
inc r8
cmp byte [rax + r8], sil
jne 0x180014160
lea rdx, [rbp + 0x38]
lea rcx, [rsp + 0x38]
call fcn.180002c00
bts edi, 0x10
lea rax, [rsp + 0x38]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x50]
cmp r10, 0x10
cmovae rax, r9
lea rdx, [rsp + 0x38]
cmovae rdx, r9
mov r8, qword [rsp + 0x48]
add r8, rdx
mov rdx, rsi
mov rcx, r8
sub rcx, rax
cmp rax, r8
cmova rcx, rsi
test rcx, rcx
je 0x18001422d
cmp rcx, 0x40
jb 0x18001422d
and rcx, 0xffffffffffffffc0
movdqa xmm2, xmmword [0x1800a5d70]
nop word [rax + rax]
movdqu xmm0, xmmword [rax]
movdqa xmm1, xmm2
paddb xmm1, xmm0
movdqu xmmword [rax], xmm1
movdqu xmm0, xmmword [rax + 0x10]
movdqa xmm1, xmm2
paddb xmm1, xmm0
movdqu xmmword [rax + 0x10], xmm1
movdqu xmm0, xmmword [rax + 0x20]
movdqa xmm1, xmm2
paddb xmm1, xmm0
movdqu xmmword [rax + 0x20], xmm1
movdqu xmm0, xmmword [rax + 0x30]
movdqa xmm1, xmm2
paddb xmm1, xmm0
movdqu xmmword [rax + 0x30], xmm1
add rax, 0x40
add rdx, 0x40
cmp rdx, rcx
jne 0x1800141d0
mov r10, qword [rsp + 0x50]
mov r9, qword [rsp + 0x38]
cmp rax, r8
je 0x180014247
add byte [rax], 0x80
inc rax
cmp rax, r8
jne 0x180014232
mov r10, qword [rsp + 0x50]
mov r9, qword [rsp + 0x38]
bts edi, 0xf
or edi, 0x40
mov dword [rsp + 0x30], edi
lea rcx, [rsp + 0x38]
cmp r10, 0x10
cmovae rcx, r9
mov eax, dword [rbp + 0x30]
mov dword [rbp - 0x30], eax
movaps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp + 0x70], xmm0
mov qword [rbp], 2
lea rax, [rbp + 0x70]
mov qword [rbp + 8], rax
movaps xmm0, xmmword [rbp]
movdqa xmmword [rbp + 0x50], xmm0
mov qword [rbp - 0x60], rcx
mov rax, r14
nop
inc rax
cmp byte [rcx + rax], 0
jne 0x180014290
mov qword [rbp - 0x58], rax
lea r8, [rbp + 0x50]
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x78]
call fcn.1800023e0
bts edi, 0x11
bts edi, 7
mov dword [rsp + 0x30], edi
lea rdx, [rsp + 0x78]
cmp qword [rbp - 0x70], 0x10
cmovae rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x58]
call fcn.18002bd50
bts edi, 0x12
bts edi, 8
mov dword [rsp + 0x30], edi
lea rbx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rbx, qword [rsp + 0x58]
call fcn.18002f970
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, str._antimalware_provider__::_bd::PipeClient::WriteBytes____
xor edx, edx
mov rcx, rax
call fcn.18002caa0
mov rbx, qword [rbp - 0x50]
bt edi, 8
jae 0x180014373
btr edi, 8
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x180014360
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001435b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180014664
call fcn.18006080c
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], si
test dil, dil
jns 0x1800143c9
btr edi, 7
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x1800143b8
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800143b3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001466a
call fcn.18006080c
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x70], 0xf
mov byte [rsp + 0x78], 0
test dil, 0x40
je 0x18001440f
and edi, 0xffffffbf
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x18001440f
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001440a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180014670
call fcn.18006080c
add r15d, dword [rbp + 0x30]
cmp r15d, r12d
jb 0x180013dc0
mov al, 1
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.1800607b0
mov rbx, qword [rsp + 0x228]
add rsp, 0x1d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.18002f970
mov rcx, qword [rax]
cmp dword [rcx], 0
je 0x180014556
lea rdx, [rsp + 0x38]
call fcn.180014690
mov rbx, rax
or edi, 8
mov dword [rsp + 0x30], edi
cmp qword [rax + 0x18], 8
jb 0x180014477
mov rbx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x50], eax
mov ecx, dword [rbp + 0x30]
mov dword [rbp - 0x30], ecx
mov dword [rbp + 0x70], r15d
mov dword [rbp - 0x48], r12d
movups xmm0, xmmword [rbp + 0x50]
movups xmmword [rbp + 0x80], xmm0
movups xmm1, xmmword [rbp - 0x30]
movups xmmword [rbp + 0x90], xmm1
movups xmm0, xmmword [rbp + 0x70]
movups xmmword [rbp + 0xa0], xmm0
movups xmm1, xmmword [rbp - 0x48]
movups xmmword [rbp + 0xb0], xmm1
mov qword [rbp - 0x60], 0x2222
lea rax, [rbp + 0x80]
mov qword [rbp - 0x58], rax
movaps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rbp + 0x50], xmm0
mov qword [rbp - 0x60], rbx
nop word [rax + rax]
inc r14
cmp word [rbx + r14*2], 0
jne 0x1800144e0
mov qword [rbp - 0x58], r14
lea r8, [rbp + 0x50]
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x78]
call fcn.180024380
bts edi, 0xd
or edi, 0x10
mov dword [rsp + 0x30], edi
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x58]
call fcn.18002e720
bts edi, 0xe
or edi, 0x20
mov dword [rsp + 0x30], edi
lea rbx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rbx, qword [rsp + 0x58]
call fcn.18002f970
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, str._antimalware_provider__::_bd::PipeClient::WriteBytes____
xor edx, edx
mov rcx, rax
call fcn.18002caa0
nop
test dil, 0x20
je 0x1800145b6
and edi, 0xffffffdf
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x1800145a1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001459c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180014676
call fcn.18006080c
xor eax, eax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], ax
test dil, 0x10
je 0x180014601
and edi, 0xffffffef
mov rdx, qword [rbp - 0x70]
cmp rdx, 8
jb 0x180014601
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800145fb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001467c
call fcn.18006080c
nop
test dil, 8
je 0x180014645
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x180014645
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180014640
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001464c
call fcn.18006080c
xor al, al
jmp 0x18001441e
call fcn.18006e72c
nop
call fcn.18006e72c
nop
call fcn.18006e72c
nop
call fcn.18006e72c
nop
call fcn.18006e72c
nop
call fcn.18006e72c
nop
call fcn.18006e72c
nop
call fcn.18006e72c
nop
call fcn.18006e72c
int3