Function at 0x18005ae60
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x270]
sub rsp, 0x370
mov rax, qword [0x1801a7040]
xor rax, rsp
mov qword [rbp + 0x260], rax
mov rax, qword [0x1801cee70]
mov r14, qword [rax + rcx*8]
lea rax, [rbp + 0x50]
movzx ecx, word [0x1801d0d00]
mov qword [rsp + 0x50], r14
test cx, cx
je 0x18005aed0
lea rdx, [0x1801d0d00]
lea rdi, [rbp + 0x50]
sub rdx, rdi
nop word [rax + rax]
mov word [rax], cx
add rax, 2
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x18005aec0
xor r12d, r12d
mov word [rax], r12w
movzx ecx, word [r14]
test cx, cx
je 0x18005af00
mov rdx, r14
sub rdx, rax
nop word [rax + rax]
mov word [rax], cx
add rax, 2
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x18005aef0
xor r9d, r9d
mov qword [rsp + 0x3a8], rbx
mov qword [rsp + 0x30], r12
lea rcx, [rbp + 0x50]
mov qword [rsp + 0x3b0], rsi
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
lea r8d, [r9 + 1]
mov qword [rsp + 0x3b8], r13
mov word [rax], r12w
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp - 0x60], rax
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x18005b6d8
movabs rax, 0xbb62c62c9808ea37
mov dword [rsp + 0x60], 0x3e8
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x60]
movabs rax, 0x2b9fff192bd4c83e
mov qword [rbp - 0x80], 4
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x78], r12
call fcn.180059680
lea rcx, [rsp + 0x70]
call fcn.180059740
mov rsi, qword [0x1801ceea8]
mov rdi, qword [0x1801ceea0]
lea r13, [rax + 0x10]
mov qword [rsp + 0x68], r13
cmp rdi, rsi
je 0x18005afdd
nop
mov rcx, rdi
call fcn.180059740
add r13, 0x10
add rdi, 0x20
add r13, rax
cmp rdi, rsi
jne 0x18005afc0
mov qword [rsp + 0x68], r13
xor r9d, r9d
xor r8d, r8d
mov edx, r13d
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x18005b022
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x18005b022
lea rcx, [rsp + 0x70]
call fcn.180055830
jmp 0x18005b6d8
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r13
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rsp + 0x70]
movabs rdx, 0x8cb0c9a388179fe5
mov qword [rsp + 0x40], rax
movabs rsi, 0x26efb703382e92fd
movabs r10, 0x889f8b4975721ba3
movabs r12, 0xfb0ce58f438fe2a6
mov qword [rax], rcx
lea rbx, [rax + 8]
mov rcx, qword [rsp + 0x78]
movabs rdi, 0xbf1d25349b935bb7
mov qword [rbx], rcx
movabs r8, 0x566c1c811e86d8fd
mov rax, qword [rsp + 0x78]
add rbx, 8
movabs rcx, 0xbaaedcff023465cb
movabs r9, 0x8012fbb270cb163d
movabs r11, 0xa00a62a942b20165
movabs r14, 0xcd2fd49bc6b014bd
cmp rax, rdx
ja 0x18005b100
je 0x18005b2a2
cmp rax, rsi
je 0x18005b2ad
movabs rcx, 0x2b9fff192bd4c83e
cmp rax, rcx
je 0x18005b2ad
cmp rax, r8
je 0x18005b2a2
cmp rax, r9
je 0x18005b2a2
cmp rax, r10
je 0x18005b2ad
jmp 0x18005b12d
cmp rax, r11
je 0x18005b2ad
cmp rax, rcx
je 0x18005b2ad
cmp rax, rdi
je 0x18005b2a2
cmp rax, r14
je 0x18005b2ad
cmp rax, r12
je 0x18005b2a2
cmp qword [rbp - 0x80], 8
lea r14, [rbp - 0x78]
mov rdi, qword [0x1801cee88]
mov rcx, qword [0x1801cee90]
cmova r14, qword [rbp - 0x78]
cmp rdi, rcx
je 0x18005b219
cmp qword [rdi], rax
je 0x18005b165
add rdi, 0x20
cmp rdi, rcx
jne 0x18005b152
jmp 0x18005b219
lea rcx, [rsp + 0x70]
call fcn.180059740
mov qword [rbx], rax
add rbx, 8
mov r8, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
cmp rdx, r8
je 0x18005b1e7
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rdx]
mov qword [rbx], rax
mov rax, qword [rdx + 8]
mov qword [rbx + 8], rax
add rbx, 0x10
mov rcx, qword [rdx + 0x10]
mov rdi, rbx
mov rsi, qword [rdx + 0x18]
mov rax, rcx
add rsi, r14
and eax, 3
jne 0x18005b1c0
shr rcx, 2
rep movsd dword [rdi], dword [rsi]
jmp 0x18005b1d0
cmp rax, 2
jne 0x18005b1ce
shr rcx, 1
rep movsw word [rdi], word [rsi]
jmp 0x18005b1d0
rep movsb byte [rdi], byte [rsi]
add rbx, qword [rdx + 0x10]
add rdx, 0x20
cmp rdx, r8
jne 0x18005b190
movabs rsi, 0x26efb703382e92fd
movabs r11, 0xa00a62a942b20165
movabs r10, 0x889f8b4975721ba3
movabs r9, 0x8012fbb270cb163d
movabs r8, 0x566c1c811e86d8fd
movabs rdx, 0x8cb0c9a388179fe5
mov rax, qword [0x1801ceea8]
mov r12, qword [0x1801ceea0]
cmp r12, rax
je 0x18005b463
lea r14, [r12 + 0x18]
mov r13, rax
nop dword [rax + rax]
mov rax, qword [r12]
mov qword [rbx], rax
mov rax, qword [r14 - 0x10]
mov qword [rbx + 8], rax
add rbx, 0x10
mov rax, qword [r14 - 0x10]
cmp rax, rdx
ja 0x18005b316
je 0x18005b67e
cmp rax, rsi
je 0x18005b689
movabs rcx, 0x2b9fff192bd4c83e
cmp rax, rcx
je 0x18005b689
cmp rax, r8
je 0x18005b67e
cmp rax, r9
je 0x18005b67e
cmp rax, r10
je 0x18005b689
jmp 0x18005b36b
mov rax, qword [rbp - 0x80]
mov qword [rbx], rax
add rbx, 8
mov rcx, qword [rbp - 0x80]
lea rsi, [rbp - 0x78]
cmp rcx, 8
mov rax, rcx
mov rdi, rbx
cmova rsi, qword [rbp - 0x78]
and eax, 3
jne 0x18005b2f7
shr rcx, 2
rep movsd dword [rdi], dword [rsi]
add rbx, qword [rbp - 0x80]
movabs rsi, 0x26efb703382e92fd
jmp 0x18005b219
rep movsb byte [rdi], byte [rsi]
add rbx, qword [rbp - 0x80]
movabs rsi, 0x26efb703382e92fd
jmp 0x18005b219
cmp rax, 2
jne 0x18005b2e2
shr rcx, 1
rep movsw word [rdi], word [rsi]
add rbx, qword [rbp - 0x80]
movabs rsi, 0x26efb703382e92fd
jmp 0x18005b219
cmp rax, r11
je 0x18005b689
movabs rcx, 0xbaaedcff023465cb
cmp rax, rcx
je 0x18005b689
movabs rcx, 0xbf1d25349b935bb7
cmp rax, rcx
je 0x18005b67e
movabs rcx, 0xcd2fd49bc6b014bd
cmp rax, rcx
je 0x18005b689
movabs rcx, 0xfb0ce58f438fe2a6
cmp rax, rcx
je 0x18005b67e
cmp qword [r14 - 8], 8
mov r15, r14
jbe 0x18005b378
mov r15, qword [r14]
mov rdi, qword [0x1801cee88]
mov rcx, qword [0x1801cee90]
cmp rdi, rcx
je 0x18005b417
nop
cmp qword [rdi], rax
je 0x18005b3a0
add rdi, 0x20
cmp rdi, rcx
jne 0x18005b390
jmp 0x18005b417
mov rcx, r12
call fcn.180059740
mov qword [rbx], rax
add rbx, 8
mov r8, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
cmp rdx, r8
je 0x18005b40d
nop dword [rax]
mov rax, qword [rdx]
mov qword [rbx], rax
mov rax, qword [rdx + 8]
mov qword [rbx + 8], rax
add rbx, 0x10
mov rcx, qword [rdx + 0x10]
mov rdi, rbx
mov rsi, qword [rdx + 0x18]
mov rax, rcx
add rsi, r15
and eax, 3
jne 0x18005b3f0
shr rcx, 2
rep movsd dword [rdi], dword [rsi]
jmp 0x18005b400
cmp rax, 2
jne 0x18005b3fe
shr rcx, 1
rep movsw word [rdi], word [rsi]
jmp 0x18005b400
rep movsb byte [rdi], byte [rsi]
add rbx, qword [rdx + 0x10]
add rdx, 0x20
cmp rdx, r8
jne 0x18005b3c0
movabs rdx, 0x8cb0c9a388179fe5
add r12, 0x20
add r14, 0x20
movabs rsi, 0x26efb703382e92fd
movabs r8, 0x566c1c811e86d8fd
movabs r9, 0x8012fbb270cb163d
movabs r10, 0x889f8b4975721ba3
movabs r11, 0xa00a62a942b20165
cmp r12, r13
jne 0x18005b240
mov r13, qword [rsp + 0x68]
mov r15, qword [rbp - 0x60]
mov rdx, qword [rsp + 0x40]
xor r12d, r12d
xor r9d, r9d
mov qword [rsp + 0x20], r12
mov r8d, r13d
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x40]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rcx, [rsp + 0x70]
call fcn.180055830
test edi, edi
je 0x18005b6d3
mov dl, 1
call fcn.18008d420
mov rbx, rax
lea rdx, [rbp - 0x50]
movabs rax, 0x57e5f39049161ff4
movabs rsi, 0x3886d3f42c607e87
mov qword [rsp + 0x40], rax
movabs rdi, 0x2254ea8ddf8d494c
mov rcx, qword [rsp + 0x40]
movabs rax, 0x563598f8b8e42f22
mov qword [rbp - 0x50], rcx
mov r8d, edx
mov qword [rsp + 0x40], rax
movabs rax, 0xcdd23f406fa6538
mov rcx, qword [rsp + 0x40]
mov qword [rbp - 0x48], rcx
mov qword [rsp + 0x40], rax
movabs rax, 0xcce9c8237d237b9c
mov rcx, qword [rsp + 0x40]
mov qword [rbp - 0x40], rcx
lea rcx, [rbp - 0x50]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x38], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rbp], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp + 8], rax
movabs rax, 0x69b14a9226940a51
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x10], rax
movabs rax, 0xcce9c8237d015ba6
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
movdqa xmm1, xmmword [rbp - 0x50]
xorps xmm1, xmmword [rbp]
movdqa xmm0, xmmword [rbp - 0x40]
mov qword [rbp + 0x18], rax
movq rax, xmm1
xorps xmm0, xmmword [rbp + 0x10]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmmword [rbp - 0x40], xmm0
test al, al
je 0x18005b5bb
nop dword [rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r12b
jne 0x18005b5b0
mov rcx, qword [0x1801ceca8]
sub r8d, edx
lea rdx, [rbp - 0x50]
mov qword [rsp + 0x20], r12
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rsp + 0x50]
mov rcx, rbx
call fcn.18008d590
movabs rax, 0x3886d3f42c607ea5
lea rdx, [rbp - 0x60]
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 0x60]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x58], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
movdqa xmm0, xmmword [rbp - 0x60]
mov qword [rsp + 0x58], rax
xorps xmm0, xmmword [rsp + 0x50]
movq rax, xmm0
movdqa xmmword [rbp - 0x60], xmm0
test al, al
je 0x18005b65b
nop dword [rax + rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r12b
jne 0x18005b650
mov rcx, qword [0x1801ceca8]
sub r8d, edx
lea rdx, [rbp - 0x60]
mov qword [rsp + 0x20], r12
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov al, 1
jmp 0x18005b909
mov rax, qword [r14 - 8]
mov qword [rbx], rax
add rbx, 8
mov rcx, qword [r14 - 8]
mov rsi, r14
cmp rcx, 8
jbe 0x18005b699
mov rsi, qword [r14]
mov rax, rcx
mov rdi, rbx
and eax, 3
jne 0x18005b6be
shr rcx, 2
rep movsd dword [rdi], dword [rsi]
add rbx, qword [r14 - 8]
jmp 0x18005b417
rep movsb byte [rdi], byte [rsi]
add rbx, qword [r14 - 8]
jmp 0x18005b417
cmp rax, 2
jne 0x18005b6b3
shr rcx, 1
rep movsw word [rdi], word [rsi]
add rbx, qword [r14 - 8]
jmp 0x18005b417
mov r14, qword [rsp + 0x50]
mov dl, 2
call fcn.18008d420
mov rbx, rax
lea rdx, [rbp - 0x30]
movabs rax, 0x4ca6b79140091fe1
movabs rsi, 0x3886d3f42c607e87
mov qword [rsp + 0x40], rax
movabs rdi, 0x2254ea8ddf8d494c
mov rcx, qword [rsp + 0x40]
movabs rax, 0x41748ffbbefe6923
mov qword [rbp - 0x30], rcx
mov r8d, edx
mov qword [rsp + 0x40], rax
movabs rax, 0x8c33ff54ff2643e
mov rcx, qword [rsp + 0x40]
mov qword [rbp - 0x28], rcx
mov qword [rsp + 0x40], rax
movabs rax, 0xa080ae03136e32d2
mov rcx, qword [rsp + 0x40]
mov qword [rbp - 0x20], rcx
movabs rcx, 0x5d147ab9df83fe10
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x18], rax
movabs rax, 0x72441640039848ce
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x10], rax
mov qword [rsp + 0x40], rcx
mov rax, qword [rsp + 0x40]
mov qword [rbp - 8], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x20], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x28], rax
movabs rax, 0x69b14a9226940a51
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x30], rax
movabs rax, 0xcce9c8237d015ba6
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x38], rax
movabs rax, 0x7244164021b872ab
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x40], rax
mov qword [rsp + 0x40], rcx
lea rcx, [rbp - 0x30]
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rbp - 0x30]
xorps xmm2, xmmword [rbp + 0x20]
movdqa xmm0, xmmword [rbp - 0x20]
movdqa xmm1, xmmword [rbp - 0x10]
xorps xmm0, xmmword [rbp + 0x30]
mov qword [rbp + 0x48], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp + 0x40]
movdqa xmmword [rbp - 0x30], xmm2
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmmword [rbp - 0x10], xmm1
test al, al
je 0x18005b84b
nop word [rax + rax]
inc rcx
mov r8, rcx
cmp byte [rcx], 0
jne 0x18005b840
mov rcx, qword [0x1801ceca8]
sub r8d, edx
lea rdx, [rbp - 0x30]
mov qword [rsp + 0x20], r12
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, r14
mov rcx, rbx
call fcn.18008d590
movabs rax, 0x3886d3f42c607ea5
lea rdx, [rbp - 0x70]
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 0x70]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rbp - 0x70], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x68], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
movdqa xmm0, xmmword [rbp - 0x70]
mov qword [rsp + 0x58], rax
xorps xmm0, xmmword [rsp + 0x50]
movq rax, xmm0
movdqa xmmword [rbp - 0x70], xmm0
test al, al
je 0x18005b8eb
nop dword [rax]
inc rcx
mov r8, rcx
cmp byte [rcx], 0
jne 0x18005b8e0
mov rcx, qword [0x1801ceca8]
sub r8d, edx
lea rdx, [rbp - 0x70]
mov qword [rsp + 0x20], r12
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor al, al
mov r13, qword [rsp + 0x3b8]
mov rsi, qword [rsp + 0x3b0]
mov rbx, qword [rsp + 0x3a8]
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.1800f39f0
add rsp, 0x370
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret