Function at 0x18000c670
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x180089b10]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov ebp, r9d
mov dword [rsp + 0x38], r9d
mov rbx, r8
mov qword [rsp + 0x40], rbx
mov r10, rdx
mov qword [rsp + 0x30], rdx
mov r12, rcx
xor r8d, r8d
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], ILFindLastID
mov byte [rsp + 0x50], r8b
mov edi, r8d
lea edx, [r9 + 9]
mov dword [rsp + 0x20], edx
cmp r9d, edx
jae 0x18000c97c
lea r14d, [r9 - 0xbb]
mov dword [rsp + 0x28], r14d
lea r9, [0x180000000]
mov esi, dword [rsp + 0x28]
mov r15, qword [rsp + 0x40]
mov r13, qword [rsp + 0x40]
nop dword [rax]
cmp r14d, 0x14
ja case.0x18000c715.4
mov ecx, dword [r9 + r14*4 + 0xc9ec]
add rcx, r9
jmp rcx
mov qword [rsp + 0x48], r10
jmp case.0x18000c715.4
mov rbx, r10
cmp qword [r10 + 0x18], 0x10
jb 0x18000c730
mov rbx, qword [r10]
nop
mov rcx, r10
cmp qword [r10 + 0x18], 0x10
jb 0x18000c73d
mov rcx, qword [r10]
add rcx, qword [r10 + 0x10]
cmp rbx, rcx
je 0x18000c94b
mov ebp, 0xd0
nop
cmp ebp, 0xd0
je 0x18000c7a1
cmp ebp, 0x6800
je 0x18000c78f
cmp ebp, 0xcf30
je 0x18000c78a
cmp ebp, 0x13660
jne 0x18000c7e9
lea rax, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae rax, qword [rsp + 0x50]
movzx eax, byte [rax + r13]
mov byte [rbx], al
jmp 0x18000c7e9
inc rdi
jmp 0x18000c7e9
movzx edx, byte [rdi]
mov rcx, r15
call qword [r12]
mov r13, rax
xor r8d, r8d
jmp 0x18000c7e9
lea r14, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae r14, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
test r8, r8
je 0x18000c7d4
movsx edx, byte [rbx]
mov rcx, r14
call sub.VCRUNTIME140.dll_memchr
mov r15, rax
test rax, rax
je 0x18000c7d4
sub r15, r14
jmp 0x18000c7db
mov r15, 0xffffffffffffffff
cmp r15, 0xffffffffffffffff
mov r8d, 0
cmove r15, r8
add ebp, 0x6730
cmp ebp, 0x19cc0
jbe 0x18000c750
inc rbx
mov r10, qword [rsp + 0x30]
jmp 0x18000c730
mov r8, qword [r12]
lea rdx, str.__crtMessageBoxW
mov rcx, r10
call fcn.18006f4c0
mov r10, qword [rsp + 0x30]
xor r8d, r8d
jmp 0x18000c959
mov r9, r10
mov edx, 1
lea r8d, [rdx + 2]
lea rcx, [0x18007c8ac]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r10, qword [rsp + 0x30]
xor r8d, r8d
jmp 0x18000c959
mov rax, qword [r12]
mov qword [rsp + 0x28], rax
mov r9d, 0xb3
lea r8, [rsp + 0x28]
mov rdx, rbx
mov rcx, r10
call fcn.18004fe90
mov r10, qword [rsp + 0x30]
xor r8d, r8d
jmp 0x18000c959
xor r9d, r9d
xor r8d, r8d
mov edx, 0x11b
lea rcx, [rsp + 0x50]
call fcn.1800075c0
mov rdi, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x18000c89c
mov rdi, qword [rbx]
mov r10, qword [rsp + 0x30]
xor r8d, r8d
jmp 0x18000c959
cmp qword [rbx], 0
jbe 0x18000c910
mov r10, qword [rsp + 0x48]
mov eax, 0x116
nop dword [rax]
cmp eax, 0x116
je 0x18000c8d0
cmp eax, 0xacaa
jne 0x18000c8f3
jmp 0x18000c8d9
movzx ecx, byte [r8 + r10]
xor dword [r12], ecx
mov edx, dword [r12]
mov ecx, edx
and ecx, 0xf
shr edx, 4
mov ecx, dword [r9 + rcx*4 + 0x74e50]
xor ecx, edx
mov dword [r12], ecx
add eax, 0xab94
cmp eax, 0x15728
jbe 0x18000c8c0
inc r8
cmp r8, qword [rbx]
jb 0x18000c8b4
mov r10, qword [rsp + 0x30]
mov edx, dword [rsp + 0x20]
mov esi, dword [r12]
not esi
xor r8d, r8d
jmp case.0x18000c715.4
cmp qword [rbx], 0
jne 0x18000c945
mov eax, 0xdc
cmp eax, 0xdc
je 0x18000c936
cmp eax, 0x837c
je case.0x18000c715.3
jmp 0x18000c939
mov esi, r8d
add eax, 0x82a0
cmp eax, 0x10540
jbe 0x18000c926
not dword [r12]
jmp case.0x18000c715.4
mov rbx, qword [rsp + 0x40]
mov ebp, dword [rsp + 0x38]
mov r14d, dword [rsp + 0x28]
mov edx, dword [rsp + 0x20]
lea r9, [0x180000000]
inc ebp
mov dword [rsp + 0x38], ebp
inc r14d
mov dword [rsp + 0x28], r14d
cmp ebp, edx
jb 0x18000c700
jmp case.0x18000c715.3
mov esi, dword [rsp + 0x28]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x18000c9c0
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c9bb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000c9bb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18006f72c
mov eax, esi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.18006fee0
mov rbx, qword [rsp + 0xd8]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret