Function at 0x18005a7a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x18017b040]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor r15d, r15d
mov ebx, edx
mov rdi, rcx
movabs rsi, 0x1cfbf1a4b5f30182
movabs r14, 0xf254f3b14201e4bd
test dl, 8
je 0x18005a86d
movabs r9, 0xdc209dd42b6d87e6
lea rdx, [rbp - 0x30]
mov qword [rbp - 0x50], r9
lea rcx, [rbp - 0x30]
mov rax, qword [rbp - 0x50]
movabs r10, 0x1cfbf184e89f6de6
mov qword [rbp - 0x30], rax
mov r8d, edx
mov qword [rbp - 0x50], r10
mov rax, qword [rbp - 0x50]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x50], r14
mov rax, qword [rbp - 0x50]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x50], rsi
mov rax, qword [rbp - 0x50]
movdqa xmm0, xmmword [rbp - 0x30]
mov qword [rbp - 0x18], rax
xorps xmm0, xmmword [rbp - 0x20]
movq rax, xmm0
movdqa xmmword [rbp - 0x30], xmm0
test al, al
je 0x18005a8eb
nop dword [rax + rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r15b
jne 0x18005a860
jmp 0x18005a8eb
test bl, 4
je 0x18005a941
movabs r9, 0x817380d42f6083e6
lea rdx, [rbp - 0x30]
mov qword [rbp - 0x50], r9
lea rcx, [rbp - 0x30]
mov rax, qword [rbp - 0x50]
movabs r10, 0x1cfbd1f9d99f65a2
mov qword [rbp - 0x30], rax
mov r8d, edx
mov qword [rbp - 0x50], r10
mov rax, qword [rbp - 0x50]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x50], r14
mov rax, qword [rbp - 0x50]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x50], rsi
mov rax, qword [rbp - 0x50]
movdqa xmm0, xmmword [rbp - 0x30]
mov qword [rbp - 0x38], rax
xorps xmm0, xmmword [rbp - 0x40]
movq rax, xmm0
movdqa xmmword [rbp - 0x30], xmm0
test al, al
je 0x18005a8eb
nop dword [rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r15b
jne 0x18005a8e0
mov qword [rbp - 0x50], r9
sub r8d, edx
mov rax, qword [rbp - 0x50]
lea rdx, [rbp - 0x20]
mov qword [rbp - 0x20], rax
xor r9d, r9d
mov qword [rbp - 0x50], r10
mov rcx, rdi
mov rax, qword [rbp - 0x50]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x50], r14
mov rax, qword [rbp - 0x50]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x50], rsi
mov rax, qword [rbp - 0x50]
movdqa xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x38], rax
xorps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x20], xmm0
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test bl, 0x20
je 0x18005aa11
movabs r9, 0x863796c52d7394e6
lea rdx, [rbp - 0x30]
mov qword [rbp - 0x50], r9
lea rcx, [rbp - 0x30]
mov rax, qword [rbp - 0x50]
movabs r10, 0x1cfbf1a495ae65e7
mov qword [rbp - 0x30], rax
mov r8d, edx
mov qword [rbp - 0x50], r10
mov rax, qword [rbp - 0x50]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x50], r14
mov rax, qword [rbp - 0x50]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x50], rsi
mov rax, qword [rbp - 0x50]
movdqa xmm0, xmmword [rbp - 0x30]
mov qword [rbp - 0x38], rax
xorps xmm0, xmmword [rbp - 0x40]
movq rax, xmm0
movdqa xmmword [rbp - 0x30], xmm0
test al, al
je 0x18005a9bb
inc rcx
mov r8, rcx
cmp byte [rcx], r15b
jne 0x18005a9b0
mov qword [rbp - 0x50], r9
sub r8d, edx
mov rax, qword [rbp - 0x50]
lea rdx, [rbp - 0x20]
mov qword [rbp - 0x20], rax
xor r9d, r9d
mov qword [rbp - 0x50], r10
mov rcx, rdi
mov rax, qword [rbp - 0x50]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x50], r14
mov rax, qword [rbp - 0x50]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x50], rsi
mov rax, qword [rbp - 0x50]
movdqa xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x38], rax
xorps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x20], xmm0
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
bt ebx, 0xe
jae 0x18005aae1
movabs r9, 0xd20987d0276987e6
lea rdx, [rbp - 0x30]
mov qword [rbp - 0x50], r9
lea rcx, [rbp - 0x30]
mov rax, qword [rbp - 0x50]
mov r8d, edx
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x50], rsi
mov rax, qword [rbp - 0x50]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x50], r14
mov rax, qword [rbp - 0x50]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x50], rsi
mov rax, qword [rbp - 0x50]
movdqa xmm0, xmmword [rbp - 0x30]
mov qword [rbp - 0x38], rax
xorps xmm0, xmmword [rbp - 0x40]
movq rax, xmm0
movdqa xmmword [rbp - 0x30], xmm0
test al, al
je 0x18005aa8b
nop word [rax + rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r15b
jne 0x18005aa80
mov qword [rbp - 0x50], r9
sub r8d, edx
mov rax, qword [rbp - 0x50]
lea rdx, [rbp - 0x20]
mov qword [rbp - 0x20], rax
xor r9d, r9d
mov qword [rbp - 0x50], rsi
mov rcx, rdi
mov rax, qword [rbp - 0x50]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x50], r14
mov rax, qword [rbp - 0x50]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x50], rsi
mov rax, qword [rbp - 0x50]
movdqa xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x38], rax
xorps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x20], xmm0
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test bl, 0x10
je 0x18005abb1
movabs r9, 0xaf3a96d526688ce6
lea rdx, [rbp - 0x30]
mov qword [rbp - 0x50], r9
lea rcx, [rbp - 0x30]
mov rax, qword [rbp - 0x50]
movabs r10, 0x1cfbf1a4b5f301a2
mov qword [rbp - 0x30], rax
mov r8d, edx
mov qword [rbp - 0x50], r10
mov rax, qword [rbp - 0x50]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x50], r14
mov rax, qword [rbp - 0x50]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x50], rsi
mov rax, qword [rbp - 0x50]
movdqa xmm0, xmmword [rbp - 0x30]
mov qword [rbp - 0x38], rax
xorps xmm0, xmmword [rbp - 0x40]
movq rax, xmm0
movdqa xmmword [rbp - 0x30], xmm0
test al, al
je 0x18005ab5b
inc rcx
mov r8, rcx
cmp byte [rcx], r15b
jne 0x18005ab50
mov qword [rbp - 0x50], r9
sub r8d, edx
mov rax, qword [rbp - 0x50]
lea rdx, [rbp - 0x20]
mov qword [rbp - 0x20], rax
xor r9d, r9d
mov qword [rbp - 0x50], r10
mov rcx, rdi
mov rax, qword [rbp - 0x50]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x50], r14
mov rax, qword [rbp - 0x50]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x50], rsi
mov rax, qword [rbp - 0x50]
movdqa xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x38], rax
xorps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x20], xmm0
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test bl, 2
je 0x18005ac81
movabs r9, 0x8b389dde346480e6
lea rdx, [rbp - 0x30]
mov qword [rbp - 0x50], r9
lea rcx, [rbp - 0x30]
mov rax, qword [rbp - 0x50]
movabs r10, 0x1cfbf1a4b5f321df
mov qword [rbp - 0x30], rax
mov r8d, edx
mov qword [rbp - 0x50], r10
mov rax, qword [rbp - 0x50]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x50], r14
mov rax, qword [rbp - 0x50]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x50], rsi
mov rax, qword [rbp - 0x50]
movdqa xmm0, xmmword [rbp - 0x30]
mov qword [rbp - 0x38], rax
xorps xmm0, xmmword [rbp - 0x40]
movq rax, xmm0
movdqa xmmword [rbp - 0x30], xmm0
test al, al
je 0x18005ac2b
inc rcx
mov r8, rcx
cmp byte [rcx], r15b
jne 0x18005ac20
mov qword [rbp - 0x50], r9
sub r8d, edx
mov rax, qword [rbp - 0x50]
lea rdx, [rbp - 0x20]
mov qword [rbp - 0x20], rax
xor r9d, r9d
mov qword [rbp - 0x50], r10
mov rcx, rdi
mov rax, qword [rbp - 0x50]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x50], r14
mov rax, qword [rbp - 0x50]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x50], rsi
mov rax, qword [rbp - 0x50]
movdqa xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x38], rax
xorps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x20], xmm0
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
movabs r9, 0xf254f3b14201e4b7
lea rdx, [rbp - 0x30]
mov qword [rbp - 0x50], r9
lea rcx, [rbp - 0x30]
mov rax, qword [rbp - 0x50]
mov r8d, edx
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x50], rsi
mov rax, qword [rbp - 0x50]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x50], r14
mov rax, qword [rbp - 0x50]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x50], rsi
mov rax, qword [rbp - 0x50]
movdqa xmm0, xmmword [rbp - 0x30]
mov qword [rbp - 0x38], rax
xorps xmm0, xmmword [rbp - 0x40]
movq rax, xmm0
movdqa xmmword [rbp - 0x30], xmm0
test al, al
je 0x18005aceb
nop dword [rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r15b
jne 0x18005ace0
mov qword [rbp - 0x50], r9
sub r8d, edx
mov rax, qword [rbp - 0x50]
lea rdx, [rbp - 0x20]
mov qword [rbp - 0x20], rax
xor r9d, r9d
mov qword [rbp - 0x50], rsi
mov rcx, rdi
mov rax, qword [rbp - 0x50]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x50], r14
mov rax, qword [rbp - 0x50]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x50], rsi
mov rax, qword [rbp - 0x50]
movdqa xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x38], rax
xorps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x20], xmm0
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1800dbf00
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret