Function at 0x180061790
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x200]
sub rsp, 0x300
mov rax, qword [0x1800a3d18]
xor rax, rsp
mov qword [rbp + 0x1f0], rax
imul esi, r8d, 0x406
mov r15, rcx
mov rcx, qword [rbp + 0x260]
xor ebx, ebx
mov qword [rsp + 0x68], r9
mov r12d, r8d
mov dword [rbp - 0x78], r8d
mov r10, rdx
mov qword [rsp + 0x58], rdx
mov edi, r8d
mov qword [rsp + 0x60], rcx
cmp r8d, esi
ja 0x180061977
imul r14d, r12d, 0x67
nop word [rax + rax]
cmp edi, 0x2e04
ja 0x1800618eb
je 0x1800618d2
mov eax, edi
sub eax, 0x26
je 0x1800618a1
sub eax, 0x92
je 0x180061895
sub eax, 0x15
je 0x18006187c
sub eax, 0xea3
je 0x18006185a
cmp eax, 0xf4a
jne 0x18006196c
lea rcx, [r15 + 0x58]
mov qword [rsp + 0x20], rbx
mov r9d, 0x101
lea r8, [rbp - 0x58]
xor edx, edx
call fcn.18008d340
jmp 0x18006195d
mov eax, dword [r9]
lea rdx, [rsp + 0x30]
mov r9, r15
mov dword [rsp + 0x30], eax
mov r8d, 0x1a
mov rcx, r10
call fcn.180067330
jmp 0x18006195d
mov eax, dword [0x18009603a]
mov dword [rbp - 0x48], eax
movzx eax, word [0x18009603e]
mov word [rbp - 0x44], ax
jmp 0x18006196c
mov dword [rbp - 0x30], 0x77
jmp 0x18006196c
mov rax, qword [r9]
lea r8, [rsp + 0x30]
mov qword [rbp - 0x70], rax
lea r9, [rbp - 0x70]
mov eax, dword [rcx]
mov edx, 0xa2
mov dword [rsp + 0x30], eax
mov rcx, r15
lea rax, [rbp - 0x58]
mov qword [rsp + 0x20], rax
call fcn.180005320
jmp 0x18006195d
cmp dword [rcx], 8
jne 0x18006196c
or dword [r15 + 0xc0], 0x400
jmp 0x18006196c
cmp edi, 0x4ac0
je 0x18006193b
cmp edi, 0x5348
je 0x18006191e
cmp edi, 0xa5c3
je 0x180061918
cmp edi, 0xf83e
jne 0x18006196c
mov dword [rbp - 0x3e], 0x2e0032
mov word [rbp - 0x3a], bx
jmp 0x18006196c
mov word [rbp - 0x3e], bx
jmp 0x18006196c
mov r8d, 2
mov word [rbp - 0x42], bx
lea rdx, [0x180095f3e]
lea rcx, [rbp - 0x42]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
jmp 0x18006195d
movups xmm0, xmmword [str.s2_32.d]
mov r8d, 2
lea rdx, [0x180095fe0]
lea rcx, [rbp - 0x30]
movups xmmword [rbp - 0x2e], xmm0
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov r10, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
mov r9, qword [rsp + 0x68]
add edi, r14d
cmp edi, esi
jbe 0x180061800
imul eax, r12d, 0x289
mov edi, r12d
mov qword [rsp + 0x350], r13
mov dword [rsp + 0x30], r12d
mov dword [rbp - 0x70], eax
cmp r12d, eax
ja 0x180061ce5
mov r13, qword [rsp + 0x70]
mov edx, 1
mov r12, qword [rsp + 0x70]
lea r8d, [rdx + 0x6b]
nop dword [rax]
cmp edi, 0x5f4b
ja 0x180061b23
je 0x180061af0
mov eax, edi
sub eax, 0xb8
je 0x180061ac2
sub eax, 0x15
je 0x180061ab2
sub eax, 0x2a53
je 0x180061a12
sub eax, 0x4ec
je 0x180061a06
cmp eax, 0x257c
jne 0x180061cba
mov rcx, qword [r12 + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 1
jmp 0x180061cb4
mov dword [rbp - 0x36], 0x6c
jmp 0x180061cba
mov r14d, ebx
nop word [rax + rax]
mov rax, qword [r12]
lea r8, [rbp - 0x68]
mov dword [rsp + 0x48], edx
lea rcx, [rsp + 0x48]
mov edx, 0x12
mov qword [rbp - 0x68], rax
call fcn.18008d060
test eax, eax
je 0x180061cab
mov rcx, qword [r12]
lea rdx, [rbp - 0x10]
xor r9d, r9d
mov r8d, 0x200
call qword [rbp - 0x60]
mov esi, eax
mov edx, 1
test eax, eax
jle 0x180061cb0
mov edi, ebx
nop dword [rax]
cmp edi, esi
jge 0x180061a20
mov rcx, qword [r12 + 8]
lea rdx, [rbp - 0x10]
mov r8d, esi
movsxd rax, edi
sub r8d, edi
mov qword [rsp + 0x20], rbx
add rdx, rax
lea r9, [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
mov edx, 1
cmove r14d, edx
add edi, dword [rsp + 0x78]
test r14d, r14d
je 0x180061a70
jmp 0x180061cb0
mov dword [rbp - 0x3a], 0x6c0064
mov word [rbp - 0x36], bx
jmp 0x180061cba
mov r9d, 0x10
lea rax, [rbp - 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0xd]
call fcn.180010940
mov qword [rbp - 0x60], rax
mov edx, 1
mov r12, r15
jmp 0x180061cb4
mov r9d, 9
lea rax, [rbp - 0x48]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x14]
call fcn.180010940
mov r13, rax
mov edx, 1
mov rax, qword [r15 + 0x60]
mov qword [rsp + 0x70], rax
jmp 0x180061cb4
cmp edi, 0x7ff0
je 0x180061c95
cmp edi, 0x8e8a
je 0x180061c82
cmp edi, 0xaa58
je 0x180061ce0
cmp edi, 0xbdc9
je 0x180061c5b
cmp edi, 0xed08
jne 0x180061cba
mov r14, rbx
cmp qword [r10], rbx
jbe 0x180061c20
mov rsi, rcx
nop
mov edi, 0x82
cmp edi, 0x82
je 0x180061bbb
cmp edi, 0x924
jne 0x180061bf5
mov rcx, qword [rsi]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rcx + rax], bl
jne 0x180061b90
mov r9, r15
mov dword [rbp - 0x80], eax
mov r8d, 0x1a
lea rdx, [rbp - 0x80]
call fcn.180067330
lea rcx, [rsi + 8]
mov dword [rsp + 0x48], 1
jmp 0x180061be2
mov rax, qword [rsi]
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rax + rcx], bl
jne 0x180061bc5
call r13
mov word [rsp + 0x50], ax
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x48], 2
mov r9, r15
lea rdx, [rsp + 0x48]
mov r8d, 0x1a
call fcn.180067330
add edi, 0x8a2
cmp edi, 0x1144
jbe 0x180061b75
mov r10, qword [rsp + 0x58]
inc r14
add rsi, 0x10
cmp r14, qword [r10]
jb 0x180061b70
mov edi, dword [rsp + 0x30]
mov rax, qword [r15 + 0x60]
lea r9, [rsp + 0x38]
sub rax, qword [rsp + 0x70]
lea r8, [rbp - 0x68]
lea rdx, [rsp + 0x40]
mov qword [rbp - 0x68], rax
mov ecx, 0x28
mov byte [rsp + 0x38], 2
mov byte [rsp + 0x40], 8
mov qword [rsp + 0x20], r15
call fcn.18000b000
mov edx, 1
jmp 0x180061cb4
mov r9, r15
mov dword [rsp + 0x48], 2
mov r8d, 0x1a
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x54]
call fcn.180067330
mov edx, 1
jmp 0x180061cb4
movzx ecx, word [r9]
call r13
mov word [rsp + 0x54], ax
mov edx, 1
jmp 0x180061cb4
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__endthread]
mov edx, 1
jmp 0x180061cb4
mov edx, 1
mov edi, dword [rsp + 0x30]
mov r8d, 0x6c
imul eax, dword [rbp - 0x78], 0x3b
add edi, eax
mov dword [rsp + 0x30], edi
cmp edi, dword [rbp - 0x70]
ja 0x180061ce5
mov r10, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
mov r9, qword [rsp + 0x68]
jmp 0x1800619b0
mov rax, rbx
jmp 0x180061cea
mov rax, qword [rsp + 0x70]
mov r13, qword [rsp + 0x350]
mov rcx, qword [rbp + 0x1f0]
xor rcx, rsp
call fcn.18008f350
add rsp, 0x300
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret