Function at 0x18002d6c0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xb0
mov rax, qword [0x180087020]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov rbx, r8
mov rsi, rdx
xor r15d, r15d
mov qword [rbp - 0x41], r15
mov qword [rbp - 0x31], r15
mov qword [rbp - 0x29], 7
mov word [rbp - 0x41], r15w
mov r12, 0xffffffffffffffff
mov r8, r12
nop dword [rax]
inc r8
cmp word [rcx + r8*2], r15w
jne 0x18002d710
mov rdx, rcx
lea rcx, [rbp - 0x41]
call fcn.1800111b0
nop
lea rdx, [rbp - 0x41]
lea rcx, [rbp - 1]
call fcn.18002c920
nop
mov rdx, qword [rbp - 0x29]
cmp rdx, 8
jb 0x18002d775
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002d770
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002da44
call fcn.180035588
mov qword [rbp - 0x41], r15
mov qword [rbp - 0x31], r15
mov qword [rbp - 0x29], 7
mov word [rbp - 0x41], r15w
mov r8, r12
nop dword [rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x18002d790
mov rdx, rbx
lea rcx, [rbp - 0x41]
call fcn.1800111b0
nop
lea rdx, [rbp - 0x41]
lea rcx, [rbp - 0x21]
call fcn.18002c920
nop
mov rdx, qword [rbp - 0x29]
cmp rdx, 8
jb 0x18002d7f6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002d7f1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002da3e
call fcn.180035588
lea rdx, [rbp - 1]
cmp qword [rbp + 0x17], 8
cmovae rdx, qword [rbp - 1]
lea rax, [rbp - 0x21]
cmp qword [rbp - 9], 8
cmovae rax, qword [rbp - 0x21]
mov rcx, r12
inc rcx
cmp word [rax + rcx*2], 0
jne 0x18002d815
mov rax, r12
lea rax, [rax + 1]
cmp word [rdx + rax*2], 0
jne 0x18002d822
lea rbx, [rax + 0x194]
add rbx, rcx
mov eax, 2
mul rbx
cmovo rax, r12
mov rcx, rax
call fcn.1800355f8
mov rdi, rax
lea rax, [rbp - 0x21]
cmp qword [rbp - 9], 8
cmovae rax, qword [rbp - 0x21]
lea r9, [rbp - 1]
cmp qword [rbp + 0x17], 8
cmovae r9, qword [rbp - 1]
mov qword [rsp + 0x20], rax
lea r8, str._html__r_n_head__r_n_____meta_http_equiv_Content_Type__content_text_html__charsetutf_8_____r_n_____title___title__r_n__head__r_n_body_onload_win_run_____r_n_script_type_text_javascript___r_n____function_win_run____r_n________var_cmd__new_ActiveXObject__WScript.Shell____r_n________var_strCommandLine__cmd.exe__c_copy__b__y___s____s___r_n________cmd.run_strCommandLine_0_false___r_n_____r_n__script__r_n__body__r_n__html__r_n
mov rdx, rbx
mov rcx, rdi
call fcn.18002b3a0
test eax, eax
js 0x18002d963
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18002d963
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
mov r9d, r12d
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd r14, eax
test eax, eax
jne 0x18002d903
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call fcn.180035588
mov ebx, r15d
jmp 0x18002d98b
mov rcx, r14
call fcn.1800355f8
mov rsi, rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
mov r9d, r12d
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea r8d, [r14 - 1]
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x49]
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
test eax, eax
jne 0x18002d970
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call fcn.180035588
mov rdi, rsi
mov rcx, rdi
call fcn.180035588
mov ebx, r15d
jmp 0x18002d98b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call fcn.180035588
mov rcx, rsi
call fcn.180035588
mov ebx, 1
mov rdx, qword [rbp - 9]
cmp rdx, 8
jb 0x18002d9cb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002d9c6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002da44
call fcn.180035588
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], 7
mov word [rbp - 0x21], r15w
mov rdx, qword [rbp + 0x17]
cmp rdx, 8
jb 0x18002da18
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002da13
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002da38
call fcn.180035588
mov eax, ebx
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.180034f80
add rsp, 0xb0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.18003ed10
nop
call fcn.18003ed10
nop
call fcn.18003ed10
int3