Function at 0x180051f18
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x3b0
mov rax, qword [0x1800ba600]
xor rax, rsp
mov qword [rsp + 0x3a0], rax
cmp dword [rsp + 0x3f0], 3
mov esi, r9d
mov rbp, r8
mov ebx, edx
mov rdi, rcx
je 0x180052255
cmp dword [rsp + 0x3f0], 2
je 0x180051f76
cmp dword [rsp + 0x3f0], 1
je 0x180051f76
mov eax, 0x10000
jmp 0x1800522fa
cmp dword [rcx + 8], 0xffffffff
je 0x180051f84
mov rcx, qword [rcx]
call fcn.18004fb94
mov rcx, qword [rdi]
or dword [rdi + 8], 0xffffffff
cmp ebx, dword [rcx + 8]
jge 0x180051f6c
cmp ebx, dword [rcx + 0x14]
jge 0x180051f9a
call fcn.18004f8e8
mov rax, qword [rdi]
cmp dword [rax + 0x14], ebx
jge 0x180051fb3
mov rcx, qword [rdi]
call fcn.18004f944
mov r11, qword [rdi]
cmp dword [r11 + 0x14], ebx
jl 0x180051fa2
lea r8, [rsp + 0x50]
mov edx, ebx
mov rcx, rdi
call fcn.180051788
mov r11d, dword [rsp + 0x158]
shr r11d, 4
test r11b, 1
je 0x180052014
cmp dword [rsp + 0x3f0], 1
je 0x1800522db
cmp byte [rbp], 0x2f
je 0x180052005
cmp byte [rbp], 0x5c
je 0x180052005
xor esi, esi
cmp byte [rbp], sil
je 0x180051ffc
cmp byte [rbp + 1], 0x3a
je 0x180052005
lea rcx, [rdi + 0x150]
jmp 0x180052007
xor ecx, ecx
mov rdx, rbp
call fcn.180051d24
jmp 0x1800522db
xor esi, esi
cmp dword [rsp + 0x3f0], 1
mov byte [rsp + 0x290], sil
je 0x18005216b
mov al, byte [rbp]
mov r9, rbp
mov rcx, rbp
jmp 0x180052048
cmp al, 0x2f
je 0x18005203f
cmp al, 0x5c
jne 0x180052043
lea r9, [rcx + 1]
inc rcx
mov al, byte [rcx]
cmp al, sil
jne 0x180052037
lea rdx, [rsp + 0x180]
mov r10d, 0x104
mov r8, rbp
sub r8, rdx
mov rcx, r10
lea rax, [rsp + 0x180]
cmp rcx, rsi
je 0x18005208a
mov dl, byte [r8 + rax]
cmp dl, sil
je 0x180052085
mov byte [rax], dl
inc rax
sub rcx, 1
jne 0x18005206c
cmp rcx, rsi
jne 0x18005208d
dec rax
mov byte [rax], sil
cmp r9, rbp
jne 0x18005209f
mov byte [rsp + 0x180], sil
jmp 0x1800520cb
mov rax, r9
sub rax, rbp
mov byte [rsp + rax + 0x180], sil
mov al, byte [rsp + 0x180]
cmp al, 0x2f
je 0x180052104
cmp al, 0x5c
je 0x180052104
cmp al, sil
je 0x1800520cb
cmp byte [rsp + 0x181], 0x3a
je 0x180052104
mov qword [rsp + 0x28], r9
lea rax, [rsp + 0x180]
lea r8, str._s_s_s
lea r9, [rdi + 0x150]
lea rcx, [rsp + 0x290]
mov rdx, r10
mov qword [rsp + 0x20], rax
call fcn.18000d8e4
lea rcx, [rdi + 0x150]
jmp 0x18005212a
mov qword [rsp + 0x20], r9
lea r8, str._s_s
lea rcx, [rsp + 0x290]
lea r9, [rsp + 0x180]
mov rdx, r10
call fcn.18000d8e4
xor ecx, ecx
lea rdx, [rsp + 0x180]
call fcn.180051d24
mov eax, dword [rsp + 0x158]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x290]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbp, rax
cmp rbp, 0xffffffffffffffff
jne 0x18005217b
mov eax, 0x200
jmp 0x1800522fa
mov rdx, qword [rdi + 0x140]
mov rcx, qword [rdi]
call fcn.1800510e0
cmp qword [rdi + 0x148], rsi
jne 0x1800521a4
mov ecx, 0x4000
call fcn.180064d40
mov qword [rdi + 0x148], rax
mov ebx, esi
mov rdx, qword [rdi + 0x148]
mov rcx, qword [rdi]
lea r9, [rsp + 0x40]
mov r8d, 0x4000
call fcn.1800512d8
mov r12d, eax
cmp eax, 0xffffff96
je 0x180052209
cmp eax, esi
jl 0x1800521fb
jle 0x1800521ef
mov rdx, qword [rdi + 0x148]
lea r9, [rsp + 0x44]
mov r8d, eax
mov rcx, rbp
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, esi
je 0x180052202
cmp byte [rsp + 0x40], sil
jne 0x18005220e
cmp r12d, esi
jne 0x1800521a6
mov ebx, 0x5000000
jmp 0x18005220e
mov ebx, 0x400
jmp 0x18005220e
mov ebx, 0x1000
mov rcx, qword [rdi]
call fcn.18004fb94
cmp ebx, esi
jne 0x18005223b
lea r9, [rsp + 0x16c]
lea r8, [rsp + 0x15c]
lea rdx, [rsp + 0x164]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetFileTime]
cmp dword [rsp + 0x3f0], 1
je 0x18005224e
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x1800522fa
cmp edx, dword [rcx + 8]
je 0x1800522ad
cmp dword [rcx + 8], 0xffffffff
je 0x180052268
mov rcx, qword [rcx]
call fcn.18004fb94
mov rcx, qword [rdi]
or dword [rdi + 8], 0xffffffff
cmp ebx, dword [rcx + 8]
jge 0x180051f6c
cmp ebx, dword [rcx + 0x14]
jge 0x180052282
call fcn.18004f8e8
mov rax, qword [rdi]
cmp dword [rax + 0x14], ebx
jge 0x18005229b
mov rcx, qword [rdi]
call fcn.18004f944
mov r11, qword [rdi]
cmp dword [r11 + 0x14], ebx
jl 0x18005228a
mov rdx, qword [rdi + 0x140]
mov rcx, qword [rdi]
call fcn.1800510e0
mov dword [rdi + 8], ebx
mov rcx, qword [rdi]
lea r9, [rsp + 0x40]
mov r8d, esi
mov rdx, rbp
call fcn.1800512d8
xor esi, esi
cmp eax, esi
mov ebp, eax
jg 0x1800522d4
mov rcx, qword [rdi]
call fcn.18004fb94
or dword [rdi + 8], 0xffffffff
cmp byte [rsp + 0x40], sil
je 0x1800522df
xor eax, eax
jmp 0x1800522fa
cmp ebp, esi
jle 0x1800522ea
mov eax, 0x600
jmp 0x1800522fa
mov eax, 0x5000000
mov ebx, 0x1000
cmp ebp, 0xffffff96
cmove eax, ebx
mov rcx, qword [rsp + 0x3a0]
xor rcx, rsp
call fcn.180064d20
lea r11, [rsp + 0x3b0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret