Function at 0x180006840
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x180045068]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rdx
mov rbx, rcx
mov qword [rbp - 0x40], rdx
mov ecx, 0xd8
call fcn.1800108dc
mov qword [rbp - 0x38], rax
xor r15d, r15d
test rax, rax
je 0x1800068b1
lea r9, [rbx + 0x310]
lea r8, [rbx + 0x250]
lea rdx, [rbx + 0x270]
movzx ecx, byte [rbx + 0x2b1]
mov byte [rsp + 0x20], cl
mov rcx, rax
call fcn.18000ad40
mov rdi, rax
jmp 0x1800068b4
mov rdi, r15
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x20], r15
mov ecx, 0xf
mov qword [rbp - 0x18], rcx
mov byte [rbp - 0x30], 0
mov rax, qword [rsi + 8]
sub rax, qword [rsi]
sar rax, 5
cmp rax, 3
je 0x180006971
test rdi, rdi
je 0x1800068fc
mov rcx, rdi
call fcn.18000aea0
mov edx, 0xd8
mov rcx, rdi
call fcn.180010918
mov rcx, qword [rbp - 0x18]
cmp rcx, 0x10
jb 0x180006934
lea rdx, [rcx + 1]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000692f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006b41
call fcn.180010918
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], 0
mov rcx, rsi
call fcn.180009290
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1800110b0
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
add rbx, 0x350
mov qword [rbp - 0x38], rbx
mov rcx, rbx
call fcn.18000f20c
test eax, eax
jne 0x180006b39
mov rdx, qword [rsi]
add rdx, 0x20
lea r8, [rbp - 0x30]
mov rcx, rdi
call fcn.18000be50
test al, al
jne 0x1800069dd
test rdi, rdi
je 0x1800069be
mov rcx, rdi
call fcn.18000aea0
mov edx, 0xd8
mov rcx, rdi
call fcn.180010918
nop
mov rcx, rbx
call fcn.18000f214
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x180006934
inc rdx
jmp 0x180006906
mov rcx, qword [rsi]
add rcx, 0x40
mov dword [rbp - 0x40], r15d
cmp qword [rcx + 0x18], 0x10
jb 0x1800069f2
mov rcx, qword [rcx]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x180006a52
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x40]
mov r8d, dword [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r14
test eax, eax
jne 0x180006ab9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rdi, rdi
je 0x180006a6d
mov rcx, rdi
call fcn.18000aea0
mov edx, 0xd8
mov rcx, rdi
call fcn.180010918
nop
mov rcx, rbx
call fcn.18000f214
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x180006934
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000692f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006b41
jmp 0x18000692f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rdi, rdi
je 0x180006ada
mov rcx, rdi
call fcn.18000aea0
mov edx, 0xd8
mov rcx, rdi
call fcn.180010918
nop
mov rcx, rbx
call fcn.18000f214
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x180006b1a
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006b15
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006b41
call fcn.180010918
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], 0
mov rcx, rsi
call fcn.180009290
mov al, 1
jmp 0x18000694e
mov ecx, eax
call fcn.18000f4e0
nop
call fcn.180016e8c
int3