Function at 0x180001b40
Capabilities:
Delete file
Get file size
Move file
Print debug messages
Read file on windows
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x980
mov rax, qword [0x1800a2de8]
xor rax, rsp
mov qword [rsp + 0x970], rax
mov qword [rsp + 0xa0], rsp
mov qword [rsp + 0xd8], r9
mov esi, r8d
mov dword [rsp + 0xd0], r8d
mov dword [rsp + 0xc0], edx
mov rdi, rcx
mov rbx, qword [rsp + 0x9e0]
mov qword [rsp + 0xb0], rbx
xor r14d, r14d
mov word [rsp + 0x350], r14w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x352]
call fcn.180056c20
mov word [rsp + 0x560], r14w
xor edx, edx
mov r8d, 0x40e
lea rcx, [rsp + 0x562]
call fcn.180056c20
mov byte [rsp + 0x240], r14b
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x241]
call fcn.180056c20
mov byte [rsp + 0x130], r14b
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x131]
call fcn.180056c20
mov qword [rsp + 0xa8], r14
mov word [rsp + 0xf8], r14w
xor eax, eax
mov qword [rsp + 0xfa], rax
mov dword [rsp + 0x102], eax
mov word [rsp + 0x106], ax
mov dword [rsp + 0x90], r14d
or r12, 0xffffffffffffffff
mov qword [rsp + 0xb8], r12
mov dword [rsp + 0x94], r14d
lea r15d, [r14 + 0x32]
mov dword [rsp + 0x108], r14d
mov qword [rsp + 0x10c], rax
mov qword [rsp + 0x114], rax
mov qword [rsp + 0x11c], rax
mov qword [rsp + 0x124], rax
mov qword [rsp + 0xc8], r14
mov dword [rsp + 0x98], 0x140003
mov r13d, dword [rsp + 0x9e8]
test r13d, r13d
je 0x18000246c
call fcn.1800018e0
cmp eax, 1
je 0x180001cbf
cmp esi, 1
jle 0x180001cbf
xor eax, eax
jmp 0x18000246c
lea rcx, [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
cmp word [0x1800a6d20], 0
je 0x180001e31
lea r9, str.mbae_default.log
lea r8, [0x1800a6d20]
lea rdx, str._s_s
lea rcx, [rsp + 0x350]
call fcn.180003d50
lea r8, [rsp + 0x108]
xor edx, edx
lea rcx, [rsp + 0x350]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x180001e31
mov ecx, dword [rsp + 0x124]
shl rcx, 0x20
mov eax, dword [rsp + 0x128]
add rcx, rax
cmp rcx, 0x1900000
jbe 0x180001d45
call fcn.180003210
jmp 0x180001e2a
cmp byte [0x1800a4ab0], 1
jne 0x180001e2a
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 1
mov r8d, edx
lea rcx, [rsp + 0x350]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0xb8], rax
cmp rax, 0xffffffffffffffff
je 0x180001e22
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x94]
mov r8d, 4
lea rdx, [rsp + 0x98]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0xb8], r12
cmp dword [rsp + 0x98], 0x140003
je 0x180001e22
lea r8, [rsp + 0x350]
lea rdx, str._s.old
lea rcx, [rsp + 0x560]
call fcn.180003d80
lea rcx, [rsp + 0x560]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rsp + 0x560]
lea rcx, [rsp + 0x350]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov dword [rsp + 0x98], 0x140003
mov rbx, qword [rsp + 0xb0]
mov byte [0x1800a4ab0], 0
mov r8d, 0x104
lea rdx, [rsp + 0x130]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x180001e64
lea r8, str.NoProc
mov edx, 0x104
lea rcx, [rsp + 0x130]
call fcn.18005425c
mov edx, 0x5c
lea rcx, [rsp + 0x130]
call fcn.180054988
test rax, rax
je 0x180001eab
lea r8, [rax + 1]
mov edx, 0x104
lea rcx, [rsp + 0x130]
call fcn.18005425c
mov edx, 0x2e
lea rcx, [rsp + 0x130]
call fcn.180053b8c
test rax, rax
je 0x180001eab
mov byte [rax], 0
test rdi, rdi
je 0x180001efe
cmp byte [rdi], 0
je 0x180001efe
mov edx, 0x5c
mov rcx, rdi
call fcn.180054988
mov edx, 0x104
lea rcx, [rsp + 0x240]
test rax, rax
je 0x180001ef9
lea r8, [rax + 1]
call fcn.18005425c
mov edx, 0x2e
lea rcx, [rsp + 0x240]
call fcn.180053b8c
test rax, rax
je 0x180001f17
mov byte [rax], 0
jmp 0x180001f17
mov r8, rdi
jmp 0x180001f12
lea r8, str.NoMod
mov edx, 0x104
lea rcx, [rsp + 0x240]
call fcn.18005425c
mov rax, r12
nop word [rax + rax]
inc rax
cmp byte [rbx + rax], 0
jne 0x180001f20
add rax, 0x514
mov dword [rsp + 0x90], eax
add eax, 0xa
movsxd rcx, eax
call fcn.180053ad4
mov r14, rax
mov qword [rsp + 0xa8], rax
test rax, rax
jne 0x180001f9b
mov r8d, r13d
lea rdx, [rsp + 0x350]
lea rcx, str.Memory_allocation_error_in_log_file:__s____d_n
call fcn.1800541b0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [rsp + 0xe0], r13d
lea rdx, [0x180001f8f]
mov rcx, qword [rsp + 0xa0]
call fcn.180057580
nop
nop
nop
mov eax, dword [rsp + 0x9e8]
jmp 0x18000246c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
movzx r8d, word [rsp + 0x104]
movzx r9d, word [rsp + 0x102]
movzx r10d, word [rsp + 0x100]
movzx r11d, word [rsp + 0xfe]
movzx edi, word [rsp + 0xfa]
movzx esi, word [rsp + 0xf8]
mov ecx, dword [rsp + 0x90]
dec ecx
movsxd rdx, ecx
mov dword [rsp + 0x88], ebx
mov dword [rsp + 0x80], eax
mov dword [rsp + 0x78], r13d
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0xd0]
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x58], r8d
mov dword [rsp + 0x50], r9d
mov dword [rsp + 0x48], r10d
mov dword [rsp + 0x40], r11d
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], esi
mov eax, dword [rsp + 0xc0]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x240]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x130]
lea r8, str._s__s__d_____04d__02d__02d____02d:_02d:_02d____X____s:__s____t_d____u____u_r_n
mov rcx, r14
call fcn.180053a70
cmp word [rsp + 0x350], 0
jne 0x1800020ab
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [rsp + 0xf4], r13d
lea rdx, [0x18000209f]
mov rcx, qword [rsp + 0xa0]
call fcn.180057580
nop
nop
nop
mov eax, dword [rsp + 0x9e8]
jmp 0x18000246c
xor esi, esi
nop dword [rax]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
lea edx, [r9 + 4]
lea r8d, [r9 + 1]
lea rcx, [rsp + 0x350]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0xb8], rax
cmp rax, 0xffffffffffffffff
jne 0x180002107
lea rcx, str.Retry_log_file_open_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp rbx, 0xffffffffffffffff
jne 0x1800021c3
mov ecx, r15d
dec r15d
mov dword [rsp + 0xe8], r15d
test ecx, ecx
jne 0x1800020b0
cmp rbx, rbx
jne 0x1800021c3
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rdx, r14
lea rcx, [0x1800888bc]
call fcn.1800541b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rsp + 0x90]
dec ecx
movsxd rdx, ecx
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x350]
lea r8, [0x1800888c0]
lea rcx, [rsp + 0x560]
call fcn.180053a4c
lea rcx, [rsp + 0x560]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rdx, [rsp + 0x560]
lea rcx, [0x18008890c]
call fcn.180053f50
mov dword [rsp + 0xf0], r13d
lea rdx, [0x1800021b7]
mov rcx, qword [rsp + 0xa0]
call fcn.180057580
nop
nop
nop
mov eax, dword [rsp + 0x9e8]
jmp 0x18000246c
lea rdx, [rsp + 0xc8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x180002280
cmp qword [rsp + 0xc8], rsi
jne 0x180002280
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x94]
mov r8d, 4
lea rdx, [rsp + 0x98]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18000221c
cmp dword [rsp + 0x94], 4
je 0x180002280
mov eax, dword [rsp + 0x90]
dec eax
movsxd rdx, eax
lea r8, str.Error_writting_the_log_file_header_n
mov rcx, r14
call fcn.180053a70
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rdx, r14
lea rcx, [0x18008893c]
call fcn.1800541b0
mov dword [rsp + 0xe4], r13d
lea rdx, [0x18000226e]
mov rcx, qword [rsp + 0xa0]
call fcn.180057580
nop
nop
nop
mov eax, dword [rsp + 0x9e8]
jmp 0x18000246c
inc r12
cmp byte [r14 + r12], sil
jne 0x180002280
mov dword [rsp + 0x90], r12d
mov rcx, r14
call fcn.180002b70
movsxd rdi, eax
mov r8d, dword [rsp + 0x90]
mov eax, r8d
cdq
and edx, 7
add eax, edx
sar eax, 3
cmp edi, eax
jge 0x180002315
lea ecx, [r8 - 1]
movsxd rdx, ecx
mov dword [rsp + 0x20], r8d
mov r9d, edi
lea r8, str.Error_MbaeEncryptBuffer:__d____d_n
mov rcx, r14
call fcn.180053a70
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rdx, r14
lea rcx, [0x18008893c]
call fcn.1800541b0
mov dword [rsp + 0xec], r13d
lea rdx, [0x180002309]
mov rcx, qword [rsp + 0xa0]
call fcn.180057580
nop
nop
nop
mov eax, dword [rsp + 0x9e8]
jmp 0x18000246c
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x94]
mov r8d, 4
lea rdx, [rsp + 0x90]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1800023f1
cmp dword [rsp + 0x94], 4
jne 0x1800023f1
lea r8d, [rdi*8]
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x94]
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180002387
mov rcx, rdi
shl rcx, 3
mov eax, dword [rsp + 0x94]
cmp rax, rcx
je 0x1800023d3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
mov dword [rsp + 0x20], edi
lea r8, [rsp + 0x350]
lea rdx, str.Error_writting_the_log_file:__s____d____d_n
lea rcx, [rsp + 0x560]
call fcn.180003d80
lea rcx, [rsp + 0x560]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rdx, [rsp + 0x560]
lea rcx, [0x18008890c]
call fcn.180053f50
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call fcn.180053a94
mov qword [rsp + 0xa8], rsi
mov eax, r13d
jmp 0x18000246c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
mov dword [rsp + 0x20], edi
lea r8, [rsp + 0x350]
lea rdx, str.Error_writting_the_log_file:__s____d____d_n
lea rcx, [rsp + 0x560]
call fcn.180003d80
lea rcx, [rsp + 0x560]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rdx, [rsp + 0x560]
lea rcx, [0x18008890c]
call fcn.180053f50
mov dword [rsp + 0xd4], r13d
lea rdx, [0x18000245b]
mov rcx, qword [rsp + 0xa0]
call fcn.180057580
nop
nop
nop
mov eax, dword [rsp + 0x9e8]
jmp 0x18000246c
mov rcx, qword [rsp + 0x970]
xor rcx, rsp
call fcn.180052be0
add rsp, 0x980
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret