Function at 0x18008c620
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov qword [rax - 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov r15d, r8d
mov r12, rdx
mov rdi, rcx
test rdx, rdx
je 0x18008c8c6
test r8d, r8d
je 0x18008c8c6
test rcx, rcx
je 0x18008c8c6
xor esi, esi
call fcn.180009090
mov rcx, rax
test rax, rax
je 0x18008c8ec
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x98], rax
lea rbx, [rsi - 1]
cmp rdi, 0x10000
jae 0x18008c77f
movzx ebp, di
xor edx, edx
mov ecx, ebp
call fcn.180037060
mov r14, rax
test rax, rax
je 0x18008c7a0
mov edx, ebp
shr rdx, 4
inc rdx
lea r8d, [rsi + 6]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x18008c7a0
mov r8d, ebp
mov rdx, rax
mov rcx, r14
call fcn.180009390
mov r14, rax
test rax, rax
je 0x18008c7a0
movzx ebp, word [rax]
mov rcx, qword [rsp + 0x98]
mov edx, 1
sub edx, dword [rcx - 8]
mov eax, dword [rcx - 0xc]
sub eax, ebp
movzx r9d, bp
or eax, edx
jge 0x18008c725
mov edx, ebp
lea rcx, [rsp + 0x98]
call fcn.180009160
movzx r9d, word [r14]
mov rcx, qword [rsp + 0x98]
lea r8, [r14 + 2]
movzx r9d, r9w
mov rdx, rbp
call fcn.1800db00c
test eax, eax
je 0x18008c75d
cmp eax, 0xc
je 0x18008c90d
cmp eax, 0x16
je 0x18008c902
cmp eax, 0x22
je 0x18008c902
cmp eax, 0x50
jne 0x18008c8f7
mov rax, qword [rsp + 0x98]
cmp ebp, dword [rax - 0xc]
jg 0x18008c8e1
mov dword [rax - 0x10], ebp
mov rax, qword [rsp + 0x98]
mov word [rax + rbp*2], si
jmp 0x18008c7a0
mov rax, rbx
inc rax
cmp word [rdi + rax*2], 0
jne 0x18008c782
mov r8d, eax
mov rdx, rdi
lea rcx, [rsp + 0x98]
call fcn.180009210
nop
mov r8d, 1
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x40]
call fcn.1800973c0
nop
mov rdx, qword [rsp + 0x98]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18008c7da
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [rsp + 0x40]
call fcn.180097100
test al, al
jne 0x18008c80f
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x18008c8c2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov eax, esi
jmp 0x18008c8c8
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 5]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18008c7e8
mov dword [rsp + 0x88], esi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x88]
mov r8d, r15d
mov rdx, r12
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp r15d, dword [rsp + 0x88]
je 0x18008c898
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x18008c8b9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x18008c8c8
mov esi, 1
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
sub ebx, esi
jg 0x18008c8b9
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x18008c8c8
xor eax, eax
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov ecx, 0x80070057
call fcn.180008c20
nop
mov ecx, 0x80004005
call fcn.180008c20
nop
mov ecx, 0x80004005
call fcn.180008c20
int3
mov ecx, 0x80070057
call fcn.180008c20
int3
mov ecx, 0x8007000e
call fcn.180008c20
int3