Function at 0x180071d80
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov rbx, qword [rsp + 0x78]
lea eax, [rdx - 0xc]
mov r13, r9
mov dword [rsp + 0x40], edx
xor r9d, r9d
mov dword [rsp + 0x44], eax
cmp edx, eax
mov edi, edx
mov rdx, qword [rsp + 0x58]
mov r11, rcx
mov rcx, qword [rsp + 0x58]
mov r10, r8
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x68], rcx
jbe 0x180072244
mov rax, qword [rsp + 0x58]
add edi, 0xffffff57
mov r14, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x58]
mov r12, qword [rsp + 0x58]
mov r15, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x44]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x70], edi
lea r8, [0x180000000]
cmp edi, 0x25
ja case.default.0x180071e38
movzx eax, byte [r8 + rdi + 0x72540]
mov ecx, dword [r8 + rax*4 + 0x72510]
add rcx, r8
jmp rcx
mov eax, dword [rsp + 0x40]
mov r8, r9
mov ecx, dword [rsp + 0x44]
mov qword [rsp + 0x48], r9
mov qword [rsp + 0x68], r9
jmp 0x180071eca
mov r8, rdx
xor ecx, ecx
mov edx, 0xa0
call fcn.1800c8420
mov ecx, 0xffffffff
mov edi, 0x9e
mov dword [rsp + 0x60], ecx
nop
mov eax, edi
sub eax, 0x9e
je 0x180071e99
sub eax, 2
je 0x180071e8a
cmp eax, 1
jne 0x180071e9f
lea r12, [rsp + 0x60]
jmp 0x180071e9f
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rsp + 0x60]
jmp 0x180071e9f
mov dword [0x180129400], ecx
dec edi
cmp edi, 0x9b
ja 0x180071e70
mov edi, dword [rsp + 0x70]
mov rdx, qword [rsp + 0x50]
mov r10, qword [rbp + 0x70]
xor r9d, r9d
mov r11, qword [rbp + 0x60]
mov eax, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x44]
mov r8, qword [rsp + 0x48]
dec eax
dec edi
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x70], edi
cmp eax, ecx
ja 0x180071e14
mov edi, dword [rbp + 0x68]
mov rcx, qword [rsp + 0x68]
lea r15d, [rdi + 0x594]
cmp edi, r15d
jae case.0x180071e38.9
mov r12, qword [rbp + 0x88]
mov rsi, qword [rbp + 0x80]
mov r14, qword [rsp + 0x58]
nop dword [rax]
cmp edi, 0x20f
ja 0x180072320
je 0x1800722e1
mov eax, edi
sub eax, 0xaa
je 0x1800722b4
sub eax, 0x18
je 0x180072287
sub eax, 0x5f
je 0x18007225f
sub eax, 0x77
je 0x180072253
cmp eax, 0x18
jne 0x1800724d5
mov r8, rdx
xor ecx, ecx
mov edx, 0xa0
call fcn.1800c8420
mov rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x48]
jmp 0x1800724d0
mov rax, qword [r10]
lea rdx, [rsp + 0x60]
mov r8, qword [r13 + 8]
mov ecx, 0xa6
mov qword [rsp + 0x60], rax
call fcn.1800e2090
mov dword [rsp + 0x78], eax
mov rbx, qword [rsp + 0x78]
jmp 0x180071ead
lea rax, [rbp - 0x60]
mov dword [rsp + 0x60], IsCharSpaceW
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x20], r9
mov r8, r13
mov r9d, 0x9c
xor ecx, ecx
call fcn.1800db6a0
xor r9d, r9d
mov dword [rsp + 0x60], 0x20
lea r8, [rsp + 0x60]
mov qword [rsp + 0x20], 0
lea rdx, [rbp - 0x60]
mov ecx, 0xe9
call fcn.1800dce30
jmp 0x180071ead
test r14, r14
jne case.0x180071e38.11
mov ecx, 0x7a
nop
mov eax, ecx
sub eax, 0x79
je case.0x180071e38.9
cmp eax, 1
jne 0x18007201c
mov rbx, 0xffffffffffffffff
mov qword [rsp + 0x78], rbx
dec ecx
cmp ecx, 0x78
ja 0x180072000
jmp case.0x180071e38.11
mov r8, rdx
xor ecx, ecx
mov edx, 0xa0
call fcn.1800c8420
jmp 0x180071ead
mov eax, dword [r14 + 8]
cmp eax, 1
jne 0x18007207c
mov eax, 0x40
nop word [rax + rax]
cmp eax, 0x40
je 0x180072062
cmp eax, 0x2a40
je case.0x180071e38.9
jmp 0x18007206e
mov rbx, 0xffffffffffffffff
mov qword [rsp + 0x78], rbx
add eax, 0x2a00
cmp eax, 0x5400
jbe 0x180072050
jmp 0x1800720e2
cmp eax, 4
jne 0x1800720e2
mov edi, 0x12d
nop word [rax + rax]
mov eax, edi
sub eax, 0x12a
je 0x18007223c
sub eax, 1
je 0x1800720cb
sub eax, 1
je 0x1800720b2
cmp eax, 1
jne 0x1800720d5
lea rsi, [r14 + 0x10]
jmp 0x1800720d5
mov r8, qword [rsi + 8]
mov rcx, r10
mov edx, dword [r11]
call qword [rsi]
mov r10, qword [rbp + 0x70]
mov r11, qword [rbp + 0x60]
mov dword [rbp - 0x70], eax
jmp 0x1800720d5
cmp dword [rbp - 0x70], 0xfffffff6
je 0x180072230
dec edi
cmp edi, 0x129
ja 0x180072090
xor r9d, r9d
mov edi, 0x1f
cmp edi, 0x1f
je 0x18007213d
cmp edi, 0xb24
je 0x180072102
cmp edi, 0x1629
je case.0x180071e38.9
jmp 0x180072159
cmp dword [rbp - 0x78], 0
jne 0x180072133
mov ecx, 0x98
nop dword [rax]
mov eax, ecx
sub eax, 0x97
je case.0x180071e38.9
cmp eax, 1
jne 0x180072129
mov rbx, 0xffffffffffffffff
dec ecx
cmp ecx, 0x96
ja 0x180072110
mov ebx, dword [rbp - 0x80]
mov qword [rsp + 0x78], rbx
jmp 0x180072159
mov r8d, dword [r11]
mov rdx, r10
mov rcx, qword [r14 + 0x10]
mov qword [rsp + 0x20], r9
lea r9, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rbp - 0x78], eax
mov r10, qword [rbp + 0x70]
add edi, 0xb05
mov r11, qword [rbp + 0x60]
mov r9d, 0
cmp edi, 0x210f
jbe 0x1800720e7
mov edi, dword [rsp + 0x70]
mov rdx, qword [rsp + 0x50]
jmp case.0x180071e38.11
mov r14, r13
jmp case.0x180071e38.11
mov ecx, 1
mov edi, 0x9e
mov dword [rsp + 0x60], ecx
nop dword [rax]
mov eax, edi
sub eax, 0x9e
je 0x1800721c9
sub eax, 2
je 0x1800721ba
cmp eax, 1
jne 0x1800721cf
lea r15, [rsp + 0x60]
jmp 0x1800721cf
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rsp + 0x60]
jmp 0x1800721cf
mov dword [0x180129400], ecx
dec edi
cmp edi, 0x9b
ja 0x1800721a0
lea r9, [rbp - 0x68]
mov qword [rbp - 0x68], 0x400
xor r8d, r8d
xor edx, edx
mov ecx, 0x8e
call fcn.1800cd140
mov edi, dword [rsp + 0x70]
mov rdx, rax
mov qword [rsp + 0x50], rax
jmp 0x180071eb2
lea r9, [rsp + 0x58]
mov qword [rsp + 0x58], 0x800
xor r8d, r8d
xor edx, edx
mov ecx, 0x8e
call fcn.1800cd140
mov rdx, rax
mov qword [rsp + 0x50], rax
jmp 0x180071eb2
mov rax, 0xffffffffffffffff
jmp 0x1800724f2
mov rax, qword [r11]
jmp 0x1800724f2
mov r8, qword [rsp + 0x58]
mov qword [rsp + 0x48], r8
jmp 0x180071ee6
mov r14, qword [r13 + 0xe8]
jmp 0x1800724d5
mov qword [rbp - 0x78], r8
mov r9d, 0xc2
mov r8, rcx
mov rdx, r13
lea rcx, [rbp - 0x78]
call fcn.180018330
mov rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x48]
jmp 0x1800724d0
lea r9, [rbp - 0x70]
mov qword [rbp - 0x70], 0x400
xor r8d, r8d
xor edx, edx
mov ecx, 0x8e
call fcn.1800cd140
mov r8, qword [rsp + 0x48]
mov rdx, rax
mov qword [rsp + 0x50], rax
jmp 0x1800724d0
cmp dword [rsi], 0
je 0x1800724d5
mov rax, qword [r13 + 0xb8]
mov r8, qword [rax + 0xc0]
mov rcx, qword [rax + 0xc8]
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x68], rcx
jmp 0x1800724d5
lea rax, [rbp - 0x60]
mov qword [rsp + 0x28], r9
mov qword [r13 + 0xe8], rax
lea rcx, [rbp + 0x68]
mov eax, dword [r12]
xor r9d, r9d
mov r8, r11
mov dword [rbp + 0x68], eax
mov edx, 0xf2
mov qword [rsp + 0x20], r13
call fcn.180053760
mov rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x48]
jmp 0x1800724d0
mov eax, edi
sub eax, 0x286
je 0x180072384
sub eax, 0x77
je 0x180072378
sub eax, 0x77
je 0x180072355
sub eax, 0x77
je 0x180072346
cmp eax, 0x77
je case.0x180071e38.9
jmp 0x1800724d5
mov dword [rsp + 0x78], r9d
mov rbx, qword [rsp + 0x78]
jmp 0x1800724d5
xor r9d, r9d
lea rdx, [rbp - 0x60]
xor r8d, r8d
mov ecx, 0xcd
call fcn.180085110
mov rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x48]
jmp 0x1800724d0
mov qword [r13 + 0xe8], r14
jmp 0x1800724d5
cmp dword [r13 + 0x9e8], 0
jbe 0x1800723a0
test r10, r10
je 0x1800724cb
mov dword [rbp + 0x68], r9d
jmp 0x1800724b0
mov edi, 0xd5
nop word [rax + rax]
mov eax, edi
sub eax, 0xd5
je 0x180072447
sub eax, 1
je 0x1800723f8
cmp eax, 1
jne 0x180072485
test r10, r10
je 0x1800723e2
mov r9, r10
lea r8d, [rax + 0x77]
lea rdx, [rbp - 0x30]
xor ecx, ecx
call fcn.1800c9c10
xor edx, edx
lea rcx, [rbp - 0x30]
mov r8d, 0xc2
call fcn.1800436b0
jmp 0x180072485
cmp dword [rsi], 0
je 0x18007241b
lea r9, [rbp - 0x30]
mov dword [rbp + 0x68], 1
mov r8, r13
lea rcx, [rbp + 0x68]
mov edx, 0x110
call fcn.180028040
jmp 0x180072430
mov r9d, 0x10f
lea rcx, [rbp - 0x30]
xor r8d, r8d
mov rdx, r13
call fcn.180088190
lea r9, [rbp - 0x60]
mov rdx, r13
lea r8, [rbp - 0x30]
mov ecx, 0xf
call fcn.1800da7d0
jmp 0x180072485
lea rax, [rbp + 0x68]
mov dword [rbp - 0x78], r9d
mov qword [rsp + 0x30], rax
lea rcx, [rbp - 0x80]
lea rax, [rbp - 0x78]
mov dword [rbp - 0x80], r9d
mov qword [rsp + 0x28], rax
mov r9d, 0xf0
xor r8d, r8d
mov qword [rsp + 0x20], r13
xor edx, edx
mov dword [rbp + 0x68], 1
call fcn.1800d6300
test eax, eax
jne 0x1800724a0
inc edi
cmp edi, 0xd8
jae 0x1800724c1
mov r10, qword [rbp + 0x70]
xor r9d, r9d
jmp 0x1800723b0
mov r10, qword [rbp + 0x70]
test r10, r10
je 0x1800724c1
mov dword [rbp + 0x68], 0
mov r8, r10
lea rcx, [rbp + 0x68]
mov edx, 0x11d
call fcn.1800d0f60
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
mov edi, 0x286
mov rcx, qword [rsp + 0x68]
mov r10, qword [rbp + 0x70]
add edi, 0x77
mov r11, qword [rbp + 0x60]
mov r9d, 0
cmp edi, r15d
jb 0x180071f10
mov rax, rbx
mov rbx, qword [rsp + 0x178]
add rsp, 0x120
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret