Function at 0x18002bec0
Capabilities:
Delete file
Move file
Print debug messages
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x4d0
mov rax, qword [0x1800a2de8]
xor rax, rsp
mov qword [rsp + 0x4c0], rax
mov qword [rsp + 0x50], rsp
mov rsi, r9
mov r14, rdx
mov dword [rsp + 0x48], r8d
mov rax, qword [0x1800a6d10]
mov ebx, 0x32
mov qword [rsp + 0x58], 0xffffffffffffffff
xor r15d, r15d
mov dword [rsp + 0x44], r15d
test rax, rax
je 0x18002c407
cmp dword [rax], 0x1234abcd
jne 0x18002c407
lea r9, str.mbae_protector.xpe
lea r8, [0x1800a6d20]
lea rdx, str._s_s
lea rcx, [rsp + 0xa0]
call fcn.180003d50
lea r8, [rsp + 0x78]
xor edx, edx
lea rcx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x18002bfc0
mov ecx, dword [rsp + 0x94]
shl rcx, 0x20
mov eax, dword [rsp + 0x98]
add rcx, rax
cmp rcx, 0x800000
jbe 0x18002bfc0
lea r8, [rsp + 0xa0]
lea rdx, str._s.bak
lea rcx, [rsp + 0x2b0]
call fcn.180003d50
lea rcx, [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
nop dword [rax]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
lea edx, [r9 + 4]
lea r8d, [r9 + 1]
lea rcx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
mov qword [rsp + 0x58], rax
cmp rax, 0xffffffffffffffff
jne 0x18002c014
lea rcx, str.Retry_XPE_file_open_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
dec ebx
mov dword [rsp + 0x70], ebx
cmp rdi, 0xffffffffffffffff
jne 0x18002c100
test ebx, ebx
jg 0x18002bfc0
cmp rdi, rdi
jne 0x18002c100
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea edi, [rax + 0x1e]
mov dword [rsp + 0x40], edi
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [rax + 0x1e]
mov ecx, 0x1000a
call fcn.180053ad4
mov rbx, rax
test rax, rax
jne 0x18002c074
lea rcx, str.Memory_allocation_error_in_log_file_n
call fcn.180053f50
lea rcx, str.Memory_allocation_error_in_log_file_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x18002c0df
lea r8, [0x180088a64]
mov edx, 0xffff
mov rcx, rax
call fcn.180053a70
test eax, eax
jle 0x18002c0bc
mov byte [rbx + 0xffff], 0
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbx
lea r9, str.SaveIPCMessage
mov edx, 0x61a
mov r8d, 1
lea rcx, str...ServerIpcNA.cpp
call fcn.180001b40
jmp 0x18002c0d7
mov edx, esi
lea rcx, str.Error__d_in_swprintf_s_n
call fcn.180053f50
lea rcx, str.Error_in_swprintf_s_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, rbx
call fcn.180053a94
mov dword [rsp + 0x64], edi
lea rdx, [0x18002c0f7]
mov rcx, qword [rsp + 0x50]
call fcn.180057580
nop
nop
nop
mov eax, dword [rsp + 0x40]
jmp 0x18002c571
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x44]
mov r8d, 8
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18002c338
cmp dword [rsp + 0x44], 8
jne 0x18002c338
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x44]
mov r8d, 4
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18002c269
cmp dword [rsp + 0x44], 4
jne 0x18002c269
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x48]
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18002c19a
mov eax, dword [rsp + 0x48]
cmp dword [rsp + 0x44], eax
jne 0x18002c19a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor eax, eax
jmp 0x18002c571
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea edi, [rax + 0x1e]
mov dword [rsp + 0x40], edi
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [rax + 0x1e]
mov ecx, 0x1000a
call fcn.180053ad4
mov rbx, rax
test rax, rax
jne 0x18002c1dd
lea rcx, str.Memory_allocation_error_in_log_file_n
call fcn.180053f50
lea rcx, str.Memory_allocation_error_in_log_file_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x18002c248
lea r8, [0x180088a64]
mov edx, 0xffff
mov rcx, rax
call fcn.180053a70
test eax, eax
jle 0x18002c225
mov byte [rbx + 0xffff], 0
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbx
lea r9, str.SaveIPCMessage
mov edx, 0x629
mov r8d, 1
lea rcx, str...ServerIpcNA.cpp
call fcn.180001b40
jmp 0x18002c240
mov edx, esi
lea rcx, str.Error__d_in_swprintf_s_n
call fcn.180053f50
lea rcx, str.Error_in_swprintf_s_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, rbx
call fcn.180053a94
mov dword [rsp + 0x68], edi
lea rdx, [0x18002c260]
mov rcx, qword [rsp + 0x50]
call fcn.180057580
nop
nop
nop
mov eax, dword [rsp + 0x40]
jmp 0x18002c571
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea edi, [rax + 0x1e]
mov dword [rsp + 0x40], edi
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [rax + 0x1e]
mov ecx, 0x1000a
call fcn.180053ad4
mov rbx, rax
test rax, rax
jne 0x18002c2ac
lea rcx, str.Memory_allocation_error_in_log_file_n
call fcn.180053f50
lea rcx, str.Memory_allocation_error_in_log_file_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x18002c317
lea r8, [0x180088a64]
mov edx, 0xffff
mov rcx, rax
call fcn.180053a70
test eax, eax
jle 0x18002c2f4
mov byte [rbx + 0xffff], 0
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbx
lea r9, str.SaveIPCMessage
mov edx, 0x624
mov r8d, 1
lea rcx, str...ServerIpcNA.cpp
call fcn.180001b40
jmp 0x18002c30f
mov edx, esi
lea rcx, str.Error__d_in_swprintf_s_n
call fcn.180053f50
lea rcx, str.Error_in_swprintf_s_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, rbx
call fcn.180053a94
mov dword [rsp + 0x60], edi
lea rdx, [0x18002c32f]
mov rcx, qword [rsp + 0x50]
call fcn.180057580
nop
nop
nop
mov eax, dword [rsp + 0x40]
jmp 0x18002c571
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea edi, [rax + 0x1e]
mov dword [rsp + 0x40], edi
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [rax + 0x1e]
mov ecx, 0x1000a
call fcn.180053ad4
mov rbx, rax
test rax, rax
jne 0x18002c37b
lea rcx, str.Memory_allocation_error_in_log_file_n
call fcn.180053f50
lea rcx, str.Memory_allocation_error_in_log_file_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x18002c3e6
lea r8, [0x180088a64]
mov edx, 0xffff
mov rcx, rax
call fcn.180053a70
test eax, eax
jle 0x18002c3c3
mov byte [rbx + 0xffff], 0
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbx
lea r9, str.SaveIPCMessage
mov edx, 0x61f
mov r8d, 1
lea rcx, str...ServerIpcNA.cpp
call fcn.180001b40
jmp 0x18002c3de
mov edx, esi
lea rcx, str.Error__d_in_swprintf_s_n
call fcn.180053f50
lea rcx, str.Error_in_swprintf_s_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, rbx
call fcn.180053a94
mov dword [rsp + 0x6c], edi
lea rdx, [0x18002c3fe]
mov rcx, qword [rsp + 0x50]
call fcn.180057580
nop
nop
nop
mov eax, dword [rsp + 0x40]
jmp 0x18002c571
mov ecx, 0x1000a
call fcn.180053ad4
mov rbx, rax
test rax, rax
jne 0x18002c434
lea rcx, str.Memory_allocation_error_in_log_file_n
call fcn.180053f50
lea rcx, str.Memory_allocation_error_in_log_file_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x18002c4a6
lea r8, [0x180088a64]
mov edx, 0xffff
mov rcx, rax
call fcn.180053a70
test eax, eax
jle 0x18002c480
mov byte [rbx + 0xffff], 0
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], rbx
lea r9, str.SaveIPCMessage
mov edx, 0x5fa
mov r8d, 1
lea rcx, str...ServerIpcNA.cpp
call fcn.180001b40
jmp 0x18002c49e
mov edx, 8
lea rcx, str.Error__d_in_swprintf_s_n
call fcn.180053f50
lea rcx, str.Error_in_swprintf_s_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, rbx
call fcn.180053a94
mov dword [rsp + 0x74], 8
lea rdx, [0x18002c4c2]
mov rcx, qword [rsp + 0x50]
call fcn.180057580
nop
nop
nop
mov eax, 8
jmp 0x18002c571
mov rcx, qword [rsp + 0x4c0]
xor rcx, rsp
call fcn.180052be0
add rsp, 0x4d0
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret