Function at 0x18000e960
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xb0
mov rax, qword [0x180082618]
xor rax, rsp
mov qword [rbp + 0x17], rax
xor ebx, ebx
mov qword [rbp - 0x19], rdx
mov rdi, rdx
mov dword [rbp - 0x55], ebx
lea edx, [r8 + 8]
mov eax, r8d
mov dword [rbp - 0x49], eax
mov r13, rcx
mov dword [rbp - 0x51], edx
cmp r8d, edx
jae case.0x18000e9e3.224
mov r15d, dword [rbp - 0x49]
add eax, 0xffffff24
lea r10, [0x180000000]
mov r9d, 0x16
movabs r8, 0x7fffffffffffffff
cmp eax, 0x10
ja case.0x18000e9e3.225
mov ecx, dword [r10 + rax*4 + 0xf088]
add rcx, r10
jmp rcx
lea r9, [rbp - 0x41]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesEncodeIncrementalHandleCreate
mov edx, dword [rbp - 0x51]
test eax, eax
je case.0x18000e9e3.225
mov byte [rbp - 0x57], 0
jmp case.0x18000e9e3.225
mov edx, dword [r13 + 0x28]
mov rcx, qword [r13 + 0x20]
inc edx
shl rdx, 4
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov qword [rbp - 0x11], rax
mov rcx, rax
test rax, rax
je 0x18000f015
mov eax, dword [r13 + 0x28]
movups xmm0, xmmword [rdi]
mov edx, dword [rbp - 0x51]
add rax, rax
movups xmmword [rcx + rax*8], xmm0
inc dword [r13 + 0x28]
jmp case.0x18000e9e3.225
cmp qword [r13 + 0x10], 0x35
mov qword [rbp - 0x41], 0
jb case.0x18000e9e3.225
mov r12d, 0xa8
cmp r12d, 0x29d
ja 0x18000eead
je 0x18000ed3a
cmp r12d, 0xa8
je 0x18000ed31
cmp r12d, 0x14f
je 0x18000ebef
cmp r12d, 0x1f6
jne 0x18000ef94
mov rax, qword [r13 + 0x10]
mov qword [rbp + 0xf], 0xf
mov byte [rbp - 9], 0
cmp rax, 0xb
jb 0x18000f075
add rax, 0xfffffffffffffff5
mov esi, 6
cmp rax, rsi
cmovb rsi, rax
cmp qword [r13 + 0x18], 0x10
mov rax, r13
jb 0x18000ead2
mov rax, qword [r13]
lea r14, [rax + 0xb]
cmp rsi, 0xf
ja 0x18000eaf9
mov r8, rsi
mov qword [rbp + 7], rsi
mov rdx, r14
lea rcx, [rbp - 9]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + rsi - 9], 0
jmp 0x18000eb86
cmp rsi, r8
ja 0x18000f081
mov rdi, rsi
or rdi, 0xf
cmp rdi, r8
jbe 0x18000eb13
mov rdi, r8
jmp 0x18000eb1b
cmp rdi, 0x16
cmovb rdi, r9
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x18000eb54
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18000f07b
mov rcx, rax
call fcn.180036df4
test rax, rax
je 0x18000f01c
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x18000eb65
test rcx, rcx
je 0x18000eb63
call fcn.180036df4
mov rbx, rax
jmp 0x18000eb65
xor ebx, ebx
mov r8, rsi
mov qword [rbp + 7], rsi
mov rdx, r14
mov qword [rbp + 0xf], rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rsi], 0
mov qword [rbp - 9], rbx
mov ebx, dword [rbp - 0x55]
or ebx, 2
lea rdx, [rbp - 9]
lea rcx, [0x1800825a8]
mov dword [rbp - 0x55], ebx
call fcn.1800032c0
mov rdx, qword [rbp + 0xf]
cmp rdx, 0x10
jb 0x18000ebd7
mov rcx, qword [rbp - 9]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000ebd2
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000f01c
call fcn.180036e30
lea r9, [rbp - 0x39]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesEncodeIncrementalHandleCreate
mov r15d, eax
jmp 0x18000ef94
mov esi, 0xb
mov byte [rbp - 0x58], 1
cmp qword [r13 + 0x10], rsi
mov r14, r13
mov qword [rbp + 0xf], 0xf
cmovb rsi, qword [r13 + 0x10]
cmp qword [r13 + 0x18], 0x10
mov byte [rbp - 9], 0
jb 0x18000ec1b
mov r14, qword [r13]
cmp rsi, 0xf
ja 0x18000ec3e
mov r8, rsi
mov qword [rbp + 7], rsi
mov rdx, r14
lea rcx, [rbp - 9]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + rsi - 9], 0
jmp 0x18000eccb
cmp rsi, r8
ja 0x18000f081
mov rdi, rsi
or rdi, 0xf
cmp rdi, r8
jbe 0x18000ec58
mov rdi, r8
jmp 0x18000ec60
cmp rdi, 0x16
cmovb rdi, r9
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x18000ec99
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18000f07b
mov rcx, rax
call fcn.180036df4
test rax, rax
je 0x18000f01c
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x18000ecaa
test rcx, rcx
je 0x18000eca8
call fcn.180036df4
mov rbx, rax
jmp 0x18000ecaa
xor ebx, ebx
mov r8, rsi
mov qword [rbp + 7], rsi
mov rdx, r14
mov qword [rbp + 0xf], rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rsi], 0
mov qword [rbp - 9], rbx
mov ebx, dword [rbp - 0x55]
or ebx, 1
lea rdx, [rbp - 9]
lea rcx, [0x180082588]
mov dword [rbp - 0x55], ebx
call fcn.1800032c0
mov rdx, qword [rbp + 0xf]
cmp rdx, 0x10
jb 0x18000ed1c
mov rcx, qword [rbp - 9]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000ed17
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000f01c
call fcn.180036e30
mov qword [rbp - 0x39], 0
mov qword [rbp - 0x29], 0
jmp 0x18000ef94
mov byte [rbp - 0x59], 1
jmp 0x18000ef94
lea r9, [rbp - 0x29]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesEncodeIncrementalHandleCreate
mov dword [rbp - 0x45], eax
mov rax, qword [r13 + 0x10]
mov qword [rbp + 0xf], 0xf
mov byte [rbp - 9], 0
cmp rax, 0x11
jb 0x18000f075
add rax, 0xffffffffffffffef
mov esi, 0x24
cmp rax, rsi
cmovb rsi, rax
cmp qword [r13 + 0x18], 0x10
mov rax, r13
jb 0x18000ed85
mov rax, qword [r13]
lea r14, [rax + 0x11]
cmp rsi, 0xf
ja 0x18000edac
mov r8, rsi
mov qword [rbp + 7], rsi
mov rdx, r14
lea rcx, [rbp - 9]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + rsi - 9], 0
jmp 0x18000ee48
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
ja 0x18000f081
mov rdi, rsi
or rdi, 0xf
cmp rdi, rax
jbe 0x18000edd0
mov rdi, rax
jmp 0x18000eddd
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x18000ee16
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18000f07b
mov rcx, rax
call fcn.180036df4
test rax, rax
je 0x18000f01c
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x18000ee27
test rcx, rcx
je 0x18000ee25
call fcn.180036df4
mov rbx, rax
jmp 0x18000ee27
xor ebx, ebx
mov r8, rsi
mov qword [rbp + 7], rsi
mov rdx, r14
mov qword [rbp + 0xf], rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rsi], 0
mov qword [rbp - 9], rbx
mov ebx, dword [rbp - 0x55]
or ebx, 4
lea rdx, [rbp - 9]
lea rcx, [0x180082568]
mov dword [rbp - 0x55], ebx
call fcn.1800032c0
mov rdx, qword [rbp + 0xf]
cmp rdx, 0x10
jb 0x18000ee99
mov rcx, qword [rbp - 9]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000ee94
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000f01c
call fcn.180036e30
movzx eax, byte [rbp - 0x59]
xor ecx, ecx
test r15d, r15d
cmove ecx, eax
mov byte [rbp - 0x59], cl
jmp 0x18000ef94
cmp r12d, 0x344
je 0x18000eecc
cmp r12d, 0x3eb
jne 0x18000ef94
mov byte [rbp - 0x4d], 1
jmp case.0x18000e9e3.224
movzx eax, byte [rbp - 0x58]
xor ecx, ecx
cmp dword [rbp - 0x45], ecx
cmove ecx, eax
cmp byte [rbp - 0x59], 0
movzx edi, cl
mov byte [rbp - 0x58], cl
je 0x18000ef4e
mov ebx, 0x24
nop dword [rax]
cmp ebx, 0x24
je 0x18000ef35
cmp ebx, 0xc1
je 0x18000ef15
cmp ebx, 0x15e
jne 0x18000ef3d
mov rcx, qword [rbp - 0x31]
test rcx, rcx
je 0x18000ef3d
call sub.RPCRT4.dll_MesHandleFree
jmp 0x18000ef3d
lea r8, [rbp - 0x31]
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesDecodeIncrementalHandleCreate
mov rcx, qword [rbp - 0x39]
mov r15d, eax
test rcx, rcx
je 0x18000ef3d
call sub.RPCRT4.dll_MesHandleFree
jmp 0x18000ef3d
mov qword [rbp - 0x31], 0
add ebx, 0x9d
cmp ebx, 0x1fb
jb 0x18000eef0
mov ebx, dword [rbp - 0x55]
test dil, dil
je 0x18000ef94
lea r8, [rbp - 0x21]
mov qword [rbp - 0x21], 0
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesDecodeIncrementalHandleCreate
mov rcx, qword [rbp - 0x29]
mov dword [rbp - 0x45], eax
test rcx, rcx
je 0x18000ef79
call sub.RPCRT4.dll_MesHandleFree
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x18000ef90
call sub.RPCRT4.dll_MesHandleFree
nop word [rax + rax]
mov byte [rbp - 0x58], dil
add r12d, 0xa7
movabs r8, 0x7fffffffffffffff
mov r9d, 0x16
cmp r12d, 0x492
jb 0x18000ea60
mov edx, dword [rbp - 0x51]
mov rdi, qword [rbp - 0x19]
jmp case.0x18000e9e3.225
cmp byte [rbp - 0x57], 0
je 0x18000effa
mov rcx, qword [rbp - 0x41]
xor r9d, r9d
mov dword [rsp + 0x28], 0
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], 0
call sub.RPCRT4.dll_MesIncrementalHandleReset
mov rcx, qword [rbp - 0x41]
test rcx, rcx
je 0x18000eff7
call sub.RPCRT4.dll_MesHandleFree
mov edx, dword [rbp - 0x51]
mov byte [rbp - 0x4d], 0
jmp case.0x18000e9e3.225
mov byte [rbp - 0x57], 1
mov eax, dword [rbp - 0x49]
inc eax
mov dword [rbp - 0x49], eax
cmp eax, edx
jae case.0x18000e9e3.224
jmp 0x18000e9b3
mov eax, 0xfffffff4
jmp 0x18000f04e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rbp - 0x11]
mov qword [r13 + 0x20], rax
xor eax, eax
jmp 0x18000f04e
mov edx, 1
mov r9, rdi
mov r8d, edx
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rax, 1
sete byte [rbp - 0x4d]
mov eax, dword [rbp - 0x4d]
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1800375e0
mov rbx, qword [rsp + 0x100]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1800171c0
int3
call fcn.180017040
int3
call fcn.180017180
int3