Function at 0x18004c840
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xe0
mov rax, qword [0x18007cd08]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov r13, r8
mov r14d, edx
mov r15, rcx
xor edi, edi
mov qword [rbp - 0x19], rdi
mov eax, ILFindLastID
mov qword [rbp - 0x11], rax
mov byte [rbp - 0x29], dil
mov esi, edx
imul r12d, edx, 0x726
mov rbx, qword [rbp - 0x79]
cmp edx, r12d
ja 0x18004cc36
lea ecx, [rdi + 0x44]
mov edx, 0x564e
mov r9d, 0x495f
lea r10d, [rdi + 0x4e]
lea r11d, [rdi + 0x56]
mov r8d, 0x5f52
mov eax, 0x45
cmp esi, 0xb740
ja 0x18004c96b
je 0x18004c95d
cmp esi, 0x40
je 0x18004c94d
cmp esi, 0xf2
je 0x18004ca29
cmp esi, 0x2e00
je 0x18004c92c
cmp esi, 0x5bc0
je 0x18004c905
cmp esi, 0x8980
jne 0x18004ca12
mov word [rbp + 0x13], cx
jmp 0x18004ca12
mov eax, 0x49
mov word [rbp + 0xd], ax
mov dword [rbp + 0xe], 0x535f44
mov eax, 0x48
mov word [rbp + 0x11], ax
mov eax, 0x41
mov word [rbp + 0x12], ax
jmp 0x18004ca12
mov dword [rbp + 3], 0x524f5252
mov dword [rbp + 7], 0x4e495f
mov word [rbp + 0xa], r11w
mov eax, 0x4c41
mov word [rbp + 0xb], ax
jmp 0x18004ca12
mov dword [rbp - 1], 0x5f4b56
mov word [rbp + 2], ax
jmp 0x18004ca12
mov word [rbp + 0x14], ax
mov word [rbp + 0x15], r8w
jmp 0x18004ca12
cmp esi, 0xe500
je 0x18004ca0a
cmp esi, 0x112c0
je 0x18004c9c8
cmp esi, 0x14080
je 0x18004c995
cmp esi, 0x16e40
je 0x18004cc32
jmp 0x18004ca12
mov rdx, r13
mov rcx, qword [r15]
call qword [0x18007ce08]
mov rbx, rax
mov qword [rbp - 0x79], rax
mov ecx, 0x44
mov edx, 0x564e
mov r8d, 0x5f52
mov r9d, 0x495f
lea r10d, [rcx + 0xa]
lea r11d, [rcx + 0x12]
jmp 0x18004ca12
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x51], xmm0
movups xmmword [rbp - 0x41], xmm0
mov qword [rbp - 0x31], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x10c
call fcn.180058bf0
test al, al
je 0x18004cc2f
mov dword [rbp - 0x51], 0x28
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 1]
call qword [sym.imp.SHLWAPI.dll_ParseURLA]
jmp 0x18004c9a8
mov word [rbp + 0x17], dx
mov byte [rbp + 0x19], 0
imul eax, r14d, 0xb7
add esi, eax
cmp esi, r12d
ja 0x18004cc32
jmp 0x18004c8b8
xor r8d, r8d
mov rdx, r15
lea ecx, [r8 + 0x20]
call fcn.1800685a0
test al, al
jne 0x18004ca48
mov byte [rbp - 0x79], al
mov rbx, qword [rbp - 0x79]
jmp 0x18004cc32
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 0x22
xor r9d, r9d
lea r8, [rbp - 0x29]
xor edx, edx
xor ecx, ecx
call fcn.180064e10
test al, al
jne 0x18004ca7a
mov byte [rbp - 0x79], al
mov rbx, qword [rbp - 0x79]
jmp 0x18004cc32
mov esi, 0x3f
mov rbx, qword [rbp - 0x71]
mov r14, qword [rbp - 0x69]
mov r15, qword [rbp - 0x69]
nop dword [rax + rax]
cmp esi, 0x1569
ja 0x18004cbcf
je 0x18004cb91
mov eax, esi
sub eax, 0x35
je 0x18004cc06
sub eax, 0xa
je 0x18004cb4f
sub eax, 0x67
je 0x18004caeb
cmp eax, 8
jne 0x18004cbe7
xor r9d, r9d
mov r8, qword [0x18007ce00]
mov rdx, qword [0x18007ce10]
lea rcx, [rbp - 0x29]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rbx, rax
mov qword [rbp - 0x71], rax
jmp 0x18004cbe7
mov rax, qword [0x18007ce10]
mov qword [rbp - 0x61], rax
mov rax, qword [rbp - 0x19]
mov qword [rbp - 0x59], rax
mov rax, qword [rbp - 9]
mov qword [rbp - 0x69], rax
lea rax, [rbp - 0x61]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x59]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x69]
mov r8d, 0x1d
mov rdx, qword [rbp - 0x11]
mov rcx, qword [rbp - 0x29]
call fcn.1800587a0
mov r15, rax
test rax, rax
je 0x18004cbfc
mov rcx, qword [0x18007ce10]
mov qword [rbp - 0x21], rcx
mov qword [rbp - 0x29], rax
jmp 0x18004cbe7
mov qword [0x18007ce08], rdi
mov qword [0x18007ce00], rdi
mov r9d, 0x40
mov r8d, 0x1000
mov rdx, qword [rbp - 0x19]
xor ecx, ecx
call qword [0x18007ce10]
mov r14, rax
test rax, rax
jne 0x18004cbe7
mov byte [rbp - 0x71], al
mov rdi, qword [rbp - 0x71]
mov byte [rbp - 0x79], dil
mov rbx, qword [rbp - 0x79]
jmp 0x18004cc32
lea rdx, [rbp - 0x29]
cmp qword [rbp - 0x11], 0x10
cmovae rdx, qword [rbp - 0x29]
mov r8, qword [rbp - 0x19]
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rbp - 9]
add rax, r14
mov qword [0x18007ce08], rax
mov eax, dword [rbp - 5]
add rax, r14
mov qword [0x18007ce00], rax
mov byte [rbp - 0x71], 1
mov rbx, qword [rbp - 0x71]
jmp 0x18004cbe7
cmp esi, 0x2a93
je 0x18004cbf9
cmp esi, 0x386a
je 0x18004cc22
cmp esi, 0x3b22
je 0x18004cbf9
add esi, 0x152a
cmp esi, 0xa950
jbe 0x18004ca90
mov rdi, rbx
mov byte [rbp - 0x79], dil
mov rbx, qword [rbp - 0x79]
jmp 0x18004cc32
mov rcx, qword [rbp - 0x29]
movzx eax, byte [rcx]
inc qword [rbp - 0x29]
mov byte [rbp - 0x71], al
mov rdi, qword [rbp - 0x71]
mov byte [rbp - 0x79], dil
mov rbx, qword [rbp - 0x79]
jmp 0x18004cc32
mov rdi, r15
mov byte [rbp - 0x79], dil
mov rbx, qword [rbp - 0x79]
jmp 0x18004cc32
mov rbx, rdi
mov rax, qword [rbp - 0x11]
cmp rax, 0x10
jb 0x18004cc71
lea rdx, [rax + 1]
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004cc6c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18004cc6c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18006e8b0
mov rax, rbx
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.18006edc0
mov rbx, qword [rsp + 0x128]
add rsp, 0xe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret