Function at 0x180062420
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x250
mov rbx, qword [rsp + 0x298]
lea eax, [r8 + 9]
mov dword [rsp + 0x2a0], eax
mov r14, r9
mov ebp, r8d
mov rdi, rcx
cmp r8d, eax
jae case.0x1800624ac.253
mov r12, qword [rsp + 0x298]
mov r13, qword [rsp + 0x298]
movzx r15d, byte [rsp + 0x2a0]
xor edx, edx
lea eax, [rbp - 0xfc]
lea r9, [0x180000000]
movabs r8, 0xfffffffeffffffff
cmp eax, 0x14
ja case.0x1800624ac.254
mov ecx, dword [r9 + rax*4 + 0x627fc]
add rcx, r9
jmp rcx
mov rax, qword [r14]
mov qword [rsp + 0x298], rax
jmp case.0x1800624ac.254
xor r9d, r9d
mov dword [rsp + 0x20], 0x127
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.18003b660
test al, al
jne case.0x1800624ac.254
mov edx, 0xbf
mov rcx, rdi
call fcn.180028de0
mov rax, rbx
mov rbx, qword [rsp + 0x290]
add rsp, 0x250
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rax, qword [rdi]
mov rsi, qword [rsp + 0x298]
mov edx, dword [rax + 0x88]
mov r10, qword [rsi + 0x30]
test edx, edx
je 0x180062556
mov r14, qword [rsp + 0x40]
nop word [rax + rax]
movsx rax, byte [r12]
lea r10, [r10 + 1]
inc r12
movzx ecx, byte [rax + r14]
mov byte [r10 - 1], cl
add edx, 0xffffffff
jne 0x180062530
mov r14, qword [rsp + 0x2a8]
mov r10, qword [rsi + 0x30]
mov r9, qword [rsi + 0x18]
mov edx, 1
mov r8, qword [rsi + 0x40]
mov rcx, r10
call fcn.18007be3c
jmp case.0x1800624ac.254
cmp byte [rdi + 0x1b9], 0
je 0x180062609
mov esi, 0x11e
mov eax, esi
sub eax, 0x11b
je 0x1800627e3
sub eax, 1
je 0x1800625e5
sub eax, 1
je 0x1800625a4
cmp eax, 1
jne 0x1800625fb
movzx r15d, al
jmp 0x1800625fb
mov edx, 0xbf
mov rcx, rdi
call fcn.180028de0
xor edx, edx
lea rcx, [rsp + 0x90]
mov r8d, 0x1c0
call fcn.1800746e0
lea rcx, [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_OpenTraceW]
xor edx, edx
movabs r8, 0xfffffffeffffffff
mov r13, rax
jmp 0x1800625fb
lea rax, [r13 + 1]
movzx r15d, r15b
test r8, rax
mov byte [rdi + 0x1b9], 0
cmove r15d, edx
dec esi
cmp esi, 0x11a
ja 0x180062582
movzx eax, byte [rdi + 0x1ba]
test al, al
je case.0x1800624ac.254
mov esi, 0xfd
nop dword [rax]
cmp esi, 0xfd
je 0x180062665
cmp esi, 0x5ee
je 0x180062657
cmp esi, 0xadf
jne 0x18006268b
mov r8, qword [rsp + 0x50]
lea r9, [rsp + 0x48]
lea rdx, [rsp + 0x58]
mov ecx, 1
call qword [sym.imp.ADVAPI32.dll_SetEntriesInAclA]
jmp case.0x1800624ac.253
mov byte [rdi + 0x1ba], 0
mov qword [rsp + 0x50], rdx
jmp 0x18006268b
mov edx, 0x9f
mov rcx, rdi
call fcn.180038880
xorps xmm0, xmm0
xor edx, edx
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x48], rdx
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x78], xmm0
add esi, 0x4f1
cmp esi, 0xed3
jbe 0x180062620
jmp case.0x1800624ac.254
xor r8d, r8d
xor ecx, ecx
lea edx, [r8 + 0x4e]
call fcn.180040080
cmp rax, 2
je 0x1800624dd
xor eax, eax
mov r9, rdi
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov dword [rsp + 0x28], 0x113
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.18003d3f0
test al, al
je 0x1800626ef
mov edx, 0xbf
mov rcx, rdi
call fcn.180028de0
jmp case.0x1800624ac.254
xor r8d, r8d
mov rdx, rdi
mov ecx, 0xea
call fcn.180011370
jmp case.0x1800624ac.254
mov rax, qword [rsp + 0x298]
mov rax, qword [rax + 0x20]
mov r12, qword [rax]
jmp case.0x1800624ac.254
mov ebx, 0xdf
mov eax, ebx
sub eax, 0xdd
je 0x1800627a4
sub eax, 1
je 0x180062778
cmp eax, 1
jne 0x1800627aa
movsx ecx, byte [rdi]
cmp ecx, 0x80
jae 0x180062760
movsx ecx, cl
call fcn.180076d9c
test eax, eax
je 0x180062760
movsxd rax, dword [r14]
add rdi, rax
movsx ecx, byte [rdi]
cmp ecx, 0x80
jb 0x180062743
cmp byte [rdi], 0x2f
jne 0x18006276e
movsxd rax, dword [r14]
cmp byte [rax + rdi], 0x2a
je 0x1800627aa
mov ebp, 0xfc
mov rbx, rdi
jmp case.0x1800624ac.254
movsxd rdx, dword [r14]
lea rax, [rdi + rdx*2]
nop
movzx ecx, byte [rax]
cmp cl, 0x2a
jne 0x180062797
cmp byte [rdx + rax], 0x2f
lea rdi, [rdx + rax]
je 0x1800627aa
add rax, rdx
jmp 0x180062780
test cl, cl
je 0x1800624ed
add rax, rdx
jmp 0x180062780
movsxd rax, dword [r14]
add rdi, rax
dec ebx
cmp ebx, 0xdc
ja 0x180062725
jmp case.0x1800624ac.252
mov rax, qword [rdi]
mov rcx, qword [rax + 0xa0]
mov rax, qword [rcx]
mov qword [rsp + 0x40], rax
inc ebp
cmp ebp, dword [rsp + 0x2a0]
jae case.0x1800624ac.253
jmp 0x18006247f
test r15b, r15b
je case.0x1800624ac.253
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_CloseTrace]
jmp case.0x1800624ac.253