Function at 0x18004edd0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov rax, qword [0x180070338]
xor rax, rsp
mov qword [rbp + 0x60], rax
mov rax, qword [rbp + 0xd0]
mov r15, r8
mov qword [rbp + 0x48], rax
mov rbx, rcx
imul eax, r9d, 0x1c8
mov qword [rbp + 0x28], r8
mov r8, rdx
mov qword [rbp + 0x10], rdx
mov edx, r9d
mov dword [rbp - 0x68], r9d
mov qword [rbp + 0x18], rcx
mov dword [rsp + 0x78], edx
mov dword [rbp - 0x28], eax
cmp r9d, eax
ja 0x18004f107
mov rdi, qword [rbp + 0x18]
movzx r14d, word [rsp + 0x58]
movzx r12d, word [rsp + 0x58]
movzx r13d, word [rsp + 0x58]
movzx esi, word [rsp + 0x58]
mov r11d, 0x4000
mov r10d, 0xfffe
mov ecx, 0x3c
cmp edx, 0x1ff2
ja 0x18004f42c
je 0x18004f107
mov eax, edx
sub eax, 0x84
je 0x18004f313
sub eax, 9
je 0x18004f4ce
sub eax, 0x5a
je 0x18004eeb7
cmp eax, 6
jne 0x18004f5d8
mov rax, qword [0x180074e00]
mov byte [rsp + 0x51], 0xff
mov qword [rbp + 0x40], rax
lea rcx, [rax + 9]
mov qword [rbp + 8], rcx
jmp 0x18004f5d8
cmp qword [0x180070478], 0
je 0x18004f5d8
mov eax, 0x8f
mov dword [rbp - 0x50], eax
nop dword [rax]
sub eax, 0x8f
je 0x18004f290
sub eax, 0x46
je 0x18004f132
sub eax, 0x46
je 0x18004f0ba
sub eax, 0x46
je 0x18004f0a4
cmp eax, 0x46
jne 0x18004f2e6
cmp edi, dword [rbp - 0x58]
jae 0x18004f068
nop dword [rax + rax]
mov r15d, 0x34
nop word [rax + rax]
mov eax, r15d
sub eax, 0x34
je 0x18004f02b
sub eax, 0x39
je 0x18004f012
sub eax, 0x39
je 0x18004f005
sub eax, 0x39
je 0x18004eff7
cmp eax, 0x39
jne 0x18004f049
movzx eax, byte [rdi]
inc rdi
or r12w, ax
cmp r13w, 3
je 0x18004f5f8
movzx eax, r13w
lea r9, [rbp - 0x80]
xor edx, edx
mov byte [rsp + 0x60], 7
lea r8, [rsp + 0x60]
movzx ecx, word [rbp + rax*2 + 0x58]
add cx, r12w
mov word [rbp - 0x80], cx
lea ecx, [rdx + 0x5b]
call fcn.1800437a0
nop
mov ebx, 0xb8
cmp ebx, 0xb8
je 0x18004efc3
cmp ebx, 0x5d70
jne 0x18004efd5
xor edx, edx
mov word [rbp - 0x78], si
lea r9, [rbp - 0x78]
mov byte [rsp + 0x68], 6
lea r8, [rsp + 0x68]
lea ecx, [rdx + 0x5b]
call fcn.1800437a0
jmp 0x18004efd5
movzx esi, byte [rdi]
movzx eax, byte [rdi + 1]
shl si, 8
or si, ax
add rdi, 2
add ebx, 0x5cb8
cmp ebx, 0xb970
jbe 0x18004ef95
mov r10d, 0xfffe
add r14w, r10w
jne 0x18004ef90
mov r11d, 0x4000
jmp 0x18004f049
movzx r12d, byte [rdi]
inc rdi
shl r12w, 8
jmp 0x18004f049
movzx eax, byte [rdi]
and ax, r10w
or r14w, ax
jmp 0x18004f046
cmp r13w, 4
jae 0x18004f628
movzx r14d, byte [rdi]
inc rdi
shl r14w, 8
jmp 0x18004f049
movzx r13d, byte [rdi]
mov dword [rbp + 0x50], 0x8000
mov eax, dword [rbp + 0x50]
mov dword [rbp + 0x58], eax
mov word [rbp + 0x54], r11w
mov word [rbp + 0x5c], r11w
inc rdi
add r15d, 0x39
cmp r15d, 0x151
jb 0x18004ef20
cmp edi, dword [rbp - 0x58]
jb 0x18004ef10
mov ecx, 0x3c
mov eax, ecx
nop word [rax + rax]
cmp eax, 0x3c
je 0x18004f08d
cmp eax, 0x100
je 0x18004f2e6
cmp eax, 0x29f4
je 0x18004f2e6
jmp 0x18004f093
xor edx, edx
mov qword [rbp - 0x18], rdx
add eax, 0x29b8
cmp eax, 0x7d28
jbe 0x18004f070
jmp 0x18004f2e6
lea rdx, str.DPNERR_NOTREGISTERED
mov ecx, 1
call fcn.180058590
jmp 0x18004f2e1
mov eax, dword [rbp - 0x54]
add eax, edi
cmp byte [rdi], 0x50
mov dword [rbp - 0x58], eax
jne 0x18004f0e0
cmp byte [rdi + 1], 0x26
lea rax, [rdi + 2]
jne 0x18004f0e0
cmp byte [rax], 0x48
lea rdi, [rax + 1]
je 0x18004f2e6
nop
cmp ecx, 0x100
je 0x18004f0fe
cmp ecx, 0x29f4
je 0x18004f0fe
add ecx, 0x29b8
cmp ecx, 0x7d28
jbe 0x18004f0e0
mov eax, 0xffff
mov word [rbp - 0x60], ax
mov rax, qword [rbp - 0x60]
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.180058e50
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x170
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ebx, 0xdb
nop word [rax + rax]
mov eax, ebx
sub eax, 0xd7
je 0x18004f24c
sub eax, 1
je 0x18004f197
sub eax, 3
je 0x18004f270
cmp eax, 4
jne 0x18004f251
mov ecx, 0x3c
nop dword [rax]
cmp ecx, 0x100
je 0x18004f0fe
cmp ecx, 0x29f4
je 0x18004f0fe
add ecx, 0x29b8
cmp ecx, 0x7d28
jbe 0x18004f170
jmp 0x18004f0fe
mov r15, qword [rbp - 0x18]
cmp r15b, 0x1e
jne 0x18004f1c9
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, dword [SHChangeNotifyDeregister]
mov edx, 1
mov r9, rax
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x18004f251
cmp r15b, 0x1f
jne 0x18004f1d6
mov ecx, 2
jmp 0x18004f1a6
cmp r15b, 0xd
je 0x18004f206
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, dword [SHChangeNotifyDeregister]
mov edx, 1
mov r9, rax
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov ecx, 1
jmp 0x18004f22e
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, dword [SHChangeNotifyDeregister]
mov edx, 1
mov r9, rax
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov edx, 1
lea rcx, [rsp + 0x50]
mov r8d, edx
mov r9, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x18004f251
mov byte [rsp + 0x50], 0xa
inc ebx
cmp ebx, 0xdf
jb 0x18004f140
mov eax, dword [rbp + 0x20]
mov dword [rbp - 0x54], eax
cmp eax, 3
jb 0x18004f164
jmp 0x18004f2e1
mov r15, qword [rbp - 0x18]
test r15, r15
je 0x18004f164
cmp dword [r15], 1
jne 0x18004f164
mov eax, dword [r15 + 0x14]
mov dword [rbp + 0x20], eax
jmp 0x18004f262
mov rcx, qword [0x180070468]
lea rax, [rbp - 0x18]
mov r8d, r8d
lea rdx, [rbp - 0x20]
mov r9d, 0x126
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x20], 1
call fcn.18002f7a0
test eax, eax
jne 0x18004f0fe
lea rdx, str.48UJfU5aSROhPUOTLwotNA
lea ecx, [rax + 1]
call fcn.180058590
xor edx, edx
lea r8, [rbp - 0x18]
lea ecx, [rdx + 0x42]
call fcn.1800532d0
mov rdi, rax
mov ecx, 0x3c
mov eax, dword [rbp - 0x50]
mov r10d, 0xfffe
mov r8, qword [rbp + 0x10]
add eax, 0x46
mov dword [rbp - 0x50], eax
mov r11d, 0x4000
cmp eax, 0x1ed
jb 0x18004eed0
mov r15, qword [rbp + 0x28]
jmp 0x18004f5d0
cmp r8, 0x40083000
je 0x18004f393
cmp r8, 0x400c5000
je 0x18004f393
xor edx, edx
mov ecx, 0x64
mov dword [rbp + 0x30], edx
nop
mov eax, ecx
sub eax, 0x5d
je 0x18004f393
sub eax, 9
je 0x18004f660
sub eax, 5
je 0x18004f38d
sub eax, 7
je 0x18004f375
cmp eax, 1
jne 0x18004f384
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x18004f393
mov rax, qword [rbp + 0x30]
nop dword [rax]
cmp qword [rcx + 0x10], rax
jae 0x18004f393
mov rcx, qword [rcx + 0x18]
mov qword [rbp - 8], rcx
test rcx, rcx
jne 0x18004f360
jmp 0x18004f393
mov rax, qword [0x1800643ee]
mov rdx, qword [rax + 0x18]
mov qword [rbp - 8], rdx
inc ecx
cmp ecx, 0x6b
jb 0x18004f330
jmp 0x18004f393
mov eax, dword [0x180074acc]
mov eax, dword [rbx]
test eax, eax
je 0x18004f407
cmp eax, 1
je 0x18004f40c
xor eax, eax
mov ecx, 0x64
mov dword [rbp + 0x38], eax
mov eax, ecx
sub eax, 0x5d
je 0x18004f407
sub eax, 9
je 0x18004f662
sub eax, 5
je 0x18004f401
sub eax, 7
je 0x18004f3e9
cmp eax, 1
jne 0x18004f3f8
mov rcx, qword [rbp]
test rcx, rcx
je 0x18004f407
mov rax, qword [rbp + 0x38]
cmp qword [rcx + 0x10], rax
jae 0x18004f407
mov rcx, qword [rcx + 0x18]
mov qword [rbp], rcx
test rcx, rcx
jne 0x18004f3d4
jmp 0x18004f407
mov rax, qword [0x1800643ee]
mov rdx, qword [rax + 0x18]
mov qword [rbp], rdx
inc ecx
cmp ecx, 0x6b
jb 0x18004f3a8
jmp 0x18004f407
mov eax, dword [0x180074acc]
cmp dword [rbx], 1
jne 0x18004f41c
mov eax, dword [r8 + 4]
or eax, 1
mov dword [r8 + 4], eax
jmp 0x18004f5d4
mov eax, dword [r8 + 4]
and eax, 0xe
mov dword [r8 + 4], eax
jmp 0x18004f5d4
cmp edx, 0x3456
je 0x18004f0fe
cmp edx, 0x35b2
je 0x18004f4d9
cmp edx, 0x6a77
jne 0x18004f5d8
mov ebx, 0x62
mov eax, ebx
sub eax, 0x60
je 0x18004f107
sub eax, 1
je 0x18004f491
cmp eax, 1
jne 0x18004f4bf
mov r9, qword [rbp + 0x40]
lea r8, [rbp - 0x70]
mov eax, 0x2002
mov byte [rsp + 0x70], reloc.SHELL32.dll_ILFindLastID
lea rdx, [rsp + 0x70]
mov word [rbp - 0x70], ax
mov ecx, 0x7d
call fcn.18002e300
jmp 0x18004f4bf
mov eax, 0x2002
lea r9, [rsp + 0x51]
mov word [rsp + 0x58], ax
lea rdx, [rsp + 0x58]
xor eax, eax
xor ecx, ecx
mov qword [rsp + 0x20], rax
lea r8d, [rax + 0x5d]
call fcn.180022f70
movsx eax, byte [rsp + 0x51]
mov dword [rbp - 0x60], eax
dec ebx
cmp ebx, 0x5f
ja 0x18004f455
mov edx, dword [rsp + 0x78]
mov r9d, dword [rbp - 0x68]
xor eax, eax
mov qword [rbp - 0x60], rax
jmp 0x18004f5d8
mov eax, dword [r8]
xor r9d, r9d
mov rdx, qword [rbp + 8]
xor r8d, r8d
mov dword [rbp - 0x48], eax
xor ecx, ecx
xor eax, eax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x48]
mov dword [rsp + 0x28], 0xfc
mov qword [rsp + 0x20], rax
call fcn.180018150
mov ecx, dword [rbx]
xor r9d, r9d
xor ebx, ebx
mov dword [rbp - 0x40], ecx
mov qword [rsp + 0x48], rbx
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x40], rbx
xor r8d, r8d
mov qword [rsp + 0x38], rbx
mov rdx, rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0xfc
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call fcn.180018150
mov rcx, qword [rbp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x48], rbx
xor r8d, r8d
mov qword [rsp + 0x40], rbx
mov rdx, rax
mov qword [rsp + 0x38], rbx
mov ecx, dword [rcx]
mov dword [rbp - 0x38], ecx
lea rcx, [rbp - 0x38]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0xfc
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call fcn.180018150
mov ecx, dword [r15]
xor r9d, r9d
mov qword [rsp + 0x48], rbx
xor r8d, r8d
mov qword [rsp + 0x40], rbx
mov rdx, rax
mov dword [rbp - 0x30], ecx
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0xfc
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call fcn.180018150
mov qword [rbp + 8], rax
mov r9d, dword [rbp - 0x68]
mov edx, dword [rsp + 0x78]
imul eax, r9d, 0x39
add edx, eax
mov dword [rsp + 0x78], edx
cmp edx, dword [rbp - 0x28]
ja 0x18004f107
mov r8, qword [rbp + 0x10]
mov rbx, qword [rbp + 0x18]
jmp 0x18004ee53
mov ecx, 0x3c
nop dword [rax]
cmp ecx, 0x100
je 0x18004f61e
cmp ecx, 0x29f4
je 0x18004f61e
add ecx, 0x29b8
cmp ecx, 0x7d28
jbe 0x18004f600
mov word [rbp - 0x60], r12w
jmp 0x18004f107
mov ecx, 0x3c
nop dword [rax]
cmp ecx, 0x100
je 0x18004f0fe
cmp ecx, 0x29f4
je 0x18004f0fe
add ecx, 0x29b8
cmp ecx, 0x7d28
jbe 0x18004f630
jmp 0x18004f0fe
jmp 0x18004f660
jmp 0x18004f662