Function at 0x18006b6c0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1f0]
sub rsp, 0x2f0
mov rax, qword [0x180141040]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
mov rax, qword [0x180141488]
mov r14, qword [rax + rcx*8]
lea rax, [rbp - 0x30]
movzx ecx, word [0x180141b70]
mov qword [rsp + 0x50], r14
test cx, cx
je 0x18006b730
lea rdx, [0x180141b70]
lea rdi, [rbp - 0x30]
sub rdx, rdi
nop word [rax + rax]
mov word [rax], cx
add rax, 2
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x18006b720
xor r12d, r12d
mov word [rax], r12w
movzx ecx, word [r14]
test cx, cx
je 0x18006b760
mov rdx, r14
sub rdx, rax
nop word [rax + rax]
mov word [rax], cx
add rax, 2
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x18006b750
mov qword [rsp + 0x328], rbx
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x30], r12
xor r9d, r9d
mov qword [rsp + 0x330], rsi
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov r8d, 1
mov qword [rsp + 0x338], r13
mov dword [rsp + 0x20], 2
mov word [rax], r12w
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp - 0x70], rax
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x18006bf48
movabs rax, 0xbb62c62c9808ea37
mov dword [rsp + 0x48], 0x3e8
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x48]
movabs rax, 0x2b9fff192bd4c83e
mov qword [rsp + 0x70], 4
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x78], r12
call fcn.18006a100
lea rcx, [rsp + 0x60]
call fcn.18006a1c0
mov rsi, qword [0x1801414c0]
mov rdi, qword [0x1801414b8]
lea r13, [rax + 0x10]
mov qword [rsp + 0x48], r13
cmp rdi, rsi
je 0x18006b840
mov rcx, rdi
call fcn.18006a1c0
add r13, 0x10
add rdi, 0x20
add r13, rax
cmp rdi, rsi
jne 0x18006b823
mov qword [rsp + 0x48], r13
xor r9d, r9d
xor r8d, r8d
mov edx, r13d
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x18006b885
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x18006b885
lea rcx, [rsp + 0x60]
call fcn.180050710
jmp 0x18006bf48
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r13
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rsp + 0x60]
movabs rdx, 0x8cb0c9a388179fe5
mov qword [rsp + 0x40], rax
movabs rsi, 0x26efb703382e92fd
movabs r10, 0x889f8b4975721ba3
movabs r12, 0xfb0ce58f438fe2a6
mov qword [rax], rcx
lea rbx, [rax + 8]
mov rcx, qword [rsp + 0x68]
movabs rdi, 0xbf1d25349b935bb7
mov qword [rbx], rcx
movabs r8, 0x566c1c811e86d8fd
mov rax, qword [rsp + 0x68]
add rbx, 8
movabs rcx, 0xbaaedcff023465cb
movabs r9, 0x8012fbb270cb163d
movabs r11, 0xa00a62a942b20165
movabs r14, 0xcd2fd49bc6b014bd
cmp rax, rdx
ja 0x18006b963
je 0x18006bb02
cmp rax, rsi
je 0x18006bb0e
movabs rcx, 0x2b9fff192bd4c83e
cmp rax, rcx
je 0x18006bb0e
cmp rax, r8
je 0x18006bb02
cmp rax, r9
je 0x18006bb02
cmp rax, r10
je 0x18006bb0e
jmp 0x18006b990
cmp rax, r11
je 0x18006bb0e
cmp rax, rcx
je 0x18006bb0e
cmp rax, rdi
je 0x18006bb02
cmp rax, r14
je 0x18006bb0e
cmp rax, r12
je 0x18006bb02
cmp qword [rsp + 0x70], 8
lea r14, [rsp + 0x78]
mov rdi, qword [0x1801414a0]
mov rcx, qword [0x1801414a8]
cmova r14, qword [rsp + 0x78]
cmp rdi, rcx
je 0x18006ba79
cmp qword [rdi], rax
je 0x18006b9cb
add rdi, 0x20
cmp rdi, rcx
jne 0x18006b9b8
jmp 0x18006ba79
lea rcx, [rsp + 0x60]
call fcn.18006a1c0
mov qword [rbx], rax
add rbx, 8
mov r8, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
cmp rdx, r8
je 0x18006ba47
nop dword [rax]
mov rax, qword [rdx]
mov qword [rbx], rax
mov rax, qword [rdx + 8]
mov qword [rbx + 8], rax
add rbx, 0x10
mov rcx, qword [rdx + 0x10]
mov rdi, rbx
mov rsi, qword [rdx + 0x18]
mov rax, rcx
add rsi, r14
and eax, 3
jne 0x18006ba20
shr rcx, 2
rep movsd dword [rdi], dword [rsi]
jmp 0x18006ba30
cmp rax, 2
jne 0x18006ba2e
shr rcx, 1
rep movsw word [rdi], word [rsi]
jmp 0x18006ba30
rep movsb byte [rdi], byte [rsi]
add rbx, qword [rdx + 0x10]
add rdx, 0x20
cmp rdx, r8
jne 0x18006b9f0
movabs rsi, 0x26efb703382e92fd
movabs r11, 0xa00a62a942b20165
movabs r10, 0x889f8b4975721ba3
movabs r9, 0x8012fbb270cb163d
movabs r8, 0x566c1c811e86d8fd
movabs rdx, 0x8cb0c9a388179fe5
mov rax, qword [0x1801414c0]
mov r12, qword [0x1801414b8]
cmp r12, rax
je 0x18006bcc5
lea r14, [r12 + 0x18]
mov r13, rax
nop dword [rax + rax]
mov rax, qword [r12]
mov qword [rbx], rax
mov rax, qword [r14 - 0x10]
mov qword [rbx + 8], rax
add rbx, 0x10
mov rax, qword [r14 - 0x10]
cmp rax, rdx
ja 0x18006bb7d
je 0x18006beee
cmp rax, rsi
je 0x18006bef9
movabs rcx, 0x2b9fff192bd4c83e
cmp rax, rcx
je 0x18006bef9
cmp rax, r8
je 0x18006beee
cmp rax, r9
je 0x18006beee
cmp rax, r10
je 0x18006bef9
jmp 0x18006bbd2
mov rax, qword [rsp + 0x70]
mov qword [rbx], rax
add rbx, 8
mov rcx, qword [rsp + 0x70]
lea rsi, [rsp + 0x78]
cmp rcx, 8
mov rax, rcx
mov rdi, rbx
cmova rsi, qword [rsp + 0x78]
and eax, 3
jne 0x18006bb5d
shr rcx, 2
rep movsd dword [rdi], dword [rsi]
add rbx, qword [rsp + 0x70]
movabs rsi, 0x26efb703382e92fd
jmp 0x18006ba79
rep movsb byte [rdi], byte [rsi]
add rbx, qword [rsp + 0x70]
movabs rsi, 0x26efb703382e92fd
jmp 0x18006ba79
cmp rax, 2
jne 0x18006bb47
shr rcx, 1
rep movsw word [rdi], word [rsi]
add rbx, qword [rsp + 0x70]
movabs rsi, 0x26efb703382e92fd
jmp 0x18006ba79
cmp rax, r11
je 0x18006bef9
movabs rcx, 0xbaaedcff023465cb
cmp rax, rcx
je 0x18006bef9
movabs rcx, 0xbf1d25349b935bb7
cmp rax, rcx
je 0x18006beee
movabs rcx, 0xcd2fd49bc6b014bd
cmp rax, rcx
je 0x18006bef9
movabs rcx, 0xfb0ce58f438fe2a6
cmp rax, rcx
je 0x18006beee
cmp qword [r14 - 8], 8
mov r15, r14
jbe 0x18006bbdf
mov r15, qword [r14]
mov rdi, qword [0x1801414a0]
mov rcx, qword [0x1801414a8]
cmp rdi, rcx
je 0x18006bc79
cmp qword [rdi], rax
je 0x18006bc06
add rdi, 0x20
cmp rdi, rcx
jne 0x18006bbf6
jmp 0x18006bc79
mov rcx, r12
call fcn.18006a1c0
mov qword [rbx], rax
add rbx, 8
mov r8, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
cmp rdx, r8
je 0x18006bc6f
mov rax, qword [rdx]
mov qword [rbx], rax
mov rax, qword [rdx + 8]
mov qword [rbx + 8], rax
add rbx, 0x10
mov rcx, qword [rdx + 0x10]
mov rdi, rbx
mov rsi, qword [rdx + 0x18]
mov rax, rcx
add rsi, r15
and eax, 3
jne 0x18006bc52
shr rcx, 2
rep movsd dword [rdi], dword [rsi]
jmp 0x18006bc62
cmp rax, 2
jne 0x18006bc60
shr rcx, 1
rep movsw word [rdi], word [rsi]
jmp 0x18006bc62
rep movsb byte [rdi], byte [rsi]
add rbx, qword [rdx + 0x10]
add rdx, 0x20
cmp rdx, r8
jne 0x18006bc22
movabs rdx, 0x8cb0c9a388179fe5
add r12, 0x20
add r14, 0x20
movabs rsi, 0x26efb703382e92fd
movabs r8, 0x566c1c811e86d8fd
movabs r9, 0x8012fbb270cb163d
movabs r10, 0x889f8b4975721ba3
movabs r11, 0xa00a62a942b20165
cmp r12, r13
jne 0x18006baa0
mov r13, qword [rsp + 0x48]
mov r15, qword [rbp - 0x70]
mov rdx, qword [rsp + 0x40]
xor r12d, r12d
xor r9d, r9d
mov qword [rsp + 0x20], r12
mov r8d, r13d
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x40]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rcx, [rsp + 0x60]
call fcn.180050710
test edi, edi
je 0x18006bf43
mov dl, 1
call fcn.180072d40
mov rbx, rax
lea rdx, [rsp + 0x60]
movabs rax, 0xf577986216d63130
movabs rsi, 0x9a14b80673a05043
mov qword [rsp + 0x40], rax
movabs rdi, 0xa6f65830f4bb6f0
mov rcx, qword [rsp + 0x40]
movabs rax, 0x7e0e17f66822d09e
mov qword [rsp + 0x60], rcx
mov r8d, edx
mov qword [rsp + 0x40], rax
movabs rax, 0xa1126bb2f84627f4
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x40], rax
movabs rax, 0x73efd1b180affe88
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x70], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x58], rax
movabs rax, 0xc47e02d4d828489d
vmovdqu xmm0, xmmword [rbp - 0x60]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x50], rax
movabs rax, 0x73efd1b1808ddeb2
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
vpxor xmm2, xmm0, xmmword [rsp + 0x60]
vmovdqu xmm0, xmmword [rsp + 0x70]
mov qword [rbp - 0x48], rax
vpxor xmm1, xmm0, xmmword [rbp - 0x50]
vmovq rax, xmm2
vmovdqu xmmword [rsp + 0x70], xmm1
vmovdqu xmmword [rsp + 0x60], xmm2
test al, al
je 0x18006be2b
nop word [rax + rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r12b
jne 0x18006be20
mov rcx, qword [0x180141318]
sub r8d, edx
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x20], r12
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rsp + 0x50]
mov rcx, rbx
call fcn.180072eb0
movabs rax, 0x9a14b80673a05061
lea rdx, [rbp - 0x70]
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 0x70]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rbp - 0x70], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x68], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
vmovdqu xmm0, xmmword [rbp - 0x70]
mov qword [rbp - 0x58], rax
vpxor xmm1, xmm0, xmmword [rbp - 0x60]
vmovq rax, xmm1
vmovdqu xmmword [rbp - 0x70], xmm1
test al, al
je 0x18006becb
nop word [rax + rax]
inc rcx
mov r8, rcx
cmp byte [rcx], r12b
jne 0x18006bec0
mov rcx, qword [0x180141318]
sub r8d, edx
lea rdx, [rbp - 0x70]
mov qword [rsp + 0x20], r12
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov al, 1
jmp 0x18006c179
mov rax, qword [r14 - 8]
mov qword [rbx], rax
add rbx, 8
mov rcx, qword [r14 - 8]
mov rsi, r14
cmp rcx, 8
jbe 0x18006bf09
mov rsi, qword [r14]
mov rax, rcx
mov rdi, rbx
and eax, 3
jne 0x18006bf2e
shr rcx, 2
rep movsd dword [rdi], dword [rsi]
add rbx, qword [r14 - 8]
jmp 0x18006bc79
rep movsb byte [rdi], byte [rsi]
add rbx, qword [r14 - 8]
jmp 0x18006bc79
cmp rax, 2
jne 0x18006bf23
shr rcx, 1
rep movsw word [rdi], word [rsi]
add rbx, qword [r14 - 8]
jmp 0x18006bc79
mov r14, qword [rsp + 0x50]
mov dl, 2
call fcn.180072d40
mov rbx, rax
lea rdx, [rsp + 0x60]
movabs rax, 0xee34dc631fc93125
movabs rsi, 0x9a14b80673a05043
mov qword [rsp + 0x40], rax
movabs rdi, 0xa6f65830f4bb6f0
mov rcx, qword [rsp + 0x40]
movabs rax, 0x694f00f56e38969f
mov qword [rsp + 0x60], rcx
mov r8d, edx
mov qword [rsp + 0x40], rax
movabs rax, 0xa50c77b3b14e26f2
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x40], rax
movabs rax, 0x1f86b791eee2b7c6
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x70], rcx
movabs rcx, 0xf8f833c76a6d64d4
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x78], rax
movabs rax, 0x43a66e7ad123bfb2
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x40], rcx
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x78], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x58], rax
movabs rax, 0xc47e02d4d828489d
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x50], rax
movabs rax, 0x73efd1b1808ddeb2
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x48], rax
movabs rax, 0x43a66e7af30385d7
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x40], rax
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x60]
mov rax, qword [rsp + 0x40]
vmovdqu xmm0, xmmword [rsp + 0x60]
vpxor xmm3, xmm0, xmmword [rbp - 0x60]
vmovdqu xmm0, xmmword [rsp + 0x70]
vmovdqu xmm2, xmmword [rbp - 0x80]
vpxor xmm1, xmm0, xmmword [rbp - 0x50]
mov qword [rbp - 0x38], rax
vpxor xmm0, xmm2, xmmword [rbp - 0x40]
vmovq rax, xmm3
vmovdqu xmmword [rbp - 0x80], xmm0
vmovdqu xmmword [rsp + 0x60], xmm3
vmovdqu xmmword [rsp + 0x70], xmm1
test al, al
je 0x18006c0be
inc rcx
mov r8, rcx
cmp byte [rcx], 0
jne 0x18006c0b3
mov rcx, qword [0x180141318]
sub r8d, edx
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x20], r12
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, r14
mov rcx, rbx
call fcn.180072eb0
movabs rax, 0x9a14b80673a05061
lea rdx, [rbp - 0x70]
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 0x70]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rbp - 0x70], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x68], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
vmovdqu xmm0, xmmword [rbp - 0x70]
mov qword [rbp - 0x58], rax
vpxor xmm1, xmm0, xmmword [rbp - 0x60]
vmovq rax, xmm1
vmovdqu xmmword [rbp - 0x70], xmm1
test al, al
je 0x18006c15b
nop dword [rax + rax]
inc rcx
mov r8, rcx
cmp byte [rcx], 0
jne 0x18006c150
mov rcx, qword [0x180141318]
sub r8d, edx
lea rdx, [rbp - 0x70]
mov qword [rsp + 0x20], r12
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor al, al
mov r13, qword [rsp + 0x338]
mov rsi, qword [rsp + 0x330]
mov rbx, qword [rsp + 0x328]
mov rcx, qword [rbp + 0x1e0]
xor rcx, rsp
call fcn.1800d7380
add rsp, 0x2f0
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret