Function at 0x18004fe90
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov r12, qword [rbp - 0x30]
lea eax, [r9 - 0xe]
mov rsi, qword [rbp - 0x30]
mov r13, rdx
mov rdx, qword [rbp - 0x30]
mov edi, r9d
mov qword [rbp - 0x38], rdx
mov r14, rcx
mov dword [rbp - 0x40], r9d
mov dword [rbp - 0x3c], eax
cmp r9d, eax
jbe 0x180050139
movzx r15d, byte [rbp + 0x58]
lea ebx, [r9 - 0x9c]
mov rdi, qword [rbp - 0x20]
lea r9, [0x180000000]
mov eax, dword [rbp - 0x40]
mov r10d, 0x64
mov ecx, dword [rbp - 0x3c]
mov dword [rbp - 0x28], ebx
mov qword [rbp - 0x18], rsi
nop dword [rax + rax]
cmp ebx, 0x17
ja case.default.0x18004ff24
mov ecx, dword [r9 + rbx*4 + 0x50288]
add rcx, r9
jmp rcx
mov rdi, qword [r8]
mov qword [rbp - 0x20], rdi
test r13, r13
jne case.0x18004ff24.2
mov ebx, 0x46
nop dword [rax + rax]
mov eax, ebx
sub eax, 0x46
je 0x18004ff52
cmp eax, 1
je 0x18005026e
jmp 0x18004ff6b
mov edx, 1
lea rcx, str.NULL
mov r9, r14
lea r8d, [rdx + 3]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
inc ebx
cmp ebx, 0x48
jb 0x18004ff40
mov ebx, dword [rbp - 0x28]
mov rdx, qword [rbp - 0x38]
mov r8, qword [rbp + 0x50]
lea r9, [0x180000000]
mov r10d, 0x64
jmp case.0x18004ff24.2
mov r8, rsi
mov rdx, r12
mov ecx, 0xfa
call fcn.180014f20
mov r9, r12
mov qword [rbp - 0x28], 1
lea r8, [rbp - 0x28]
mov edx, ILFree
mov rcx, rsi
call fcn.18005d450
jmp 0x18004ff75
mov qword [rbp - 0x38], rdx
mov r8, r12
lea rdx, [rbp - 0x38]
mov ecx, 0xee
call fcn.180065540
mov r8, r12
lea rcx, [rbp - 0x10]
mov edx, 0x117
call fcn.18003c700
mov rdx, rax
mov qword [rbp - 0x38], rax
jmp 0x18004ff79
mov rax, qword [rbp - 0x20]
cmp rax, 0x64
cmova rax, r10
xor esi, esi
mov qword [rbp - 0x20], rax
test rax, rax
je 0x180050117
nop word [rax + rax]
mov edi, SHSetFolderPathW
mov eax, edi
sub eax, 0xe3
je 0x18005002a
cmp eax, 1
jne 0x180050059
movzx r15d, byte [rsi + r13]
jmp 0x180050059
movzx ebx, r15b
mov ecx, ebx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isprint]
test eax, eax
je 0x180050047
mov rdx, r14
mov ecx, ebx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
jmp 0x180050059
mov r8d, ebx
lea rdx, str.x_02X
mov rcx, r14
call fcn.18006f4c0
dec edi
cmp edi, 0xe2
ja 0x180050015
inc rsi
cmp rsi, qword [rbp - 0x20]
jb 0x180050010
mov rsi, qword [rbp - 0x18]
mov rdi, qword [rbp - 0x20]
jmp 0x18004ff72
cmp rdi, qword [r8]
je case.0x18004ff24.2
mov rdx, r14
lea rcx, [0x18007b94c]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputs]
jmp 0x18004ff75
mov r8d, 0x59
mov dword [rbp - 0x28], 0
mov rdx, r12
lea rcx, [rbp - 0x28]
call fcn.18001bdd0
mov r9, r12
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x28]
mov qword [rbp - 0x28], 1
mov edx, ILFree
mov rcx, rax
mov rsi, rax
call fcn.18005d450
jmp 0x18004ff75
mov rcx, qword [0x1800929f0]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r12, rax
jmp 0x18004ff75
mov r9d, PathMakeUniqueName
mov qword [rbp - 0x30], 3
mov r8, r12
mov dword [rbp - 0x28], 2
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.18005c170
jmp 0x18004ff75
mov rsi, qword [rbp - 0x18]
mov rdi, rax
mov ecx, dword [rbp - 0x3c]
mov eax, dword [rbp - 0x40]
dec eax
dec ebx
mov dword [rbp - 0x40], eax
mov dword [rbp - 0x28], ebx
cmp eax, ecx
ja 0x18004ff10
mov edi, dword [rbp + 0x58]
lea ebx, [rdi + 0x310]
cmp edi, ebx
jae 0x18005026e
nop word [rax + rax]
cmp edi, 0x1f5
ja 0x1800501e7
je 0x180050230
mov eax, edi
sub eax, 0xa5
je 0x1800501c9
sub eax, 0x38
je 0x180050193
sub eax, 0x38
je 0x1800501b4
sub eax, 0x38
je 0x180050193
cmp eax, 0x38
jne 0x180050263
mov r8, rsi
mov rdx, r12
mov ecx, 0xfa
call fcn.180014f20
mov r9, r12
mov qword [rbp - 0x30], 1
lea r8, [rbp - 0x30]
mov edx, ILFree
mov rcx, rsi
call fcn.18005d450
jmp 0x18005025f
mov r8, rsi
mov rdx, r12
mov ecx, 0xfa
call fcn.180014f20
jmp 0x18005025f
mov r9, r12
mov qword [rbp - 0x30], 2
lea r8, [rbp - 0x30]
mov edx, ILFree
mov rcx, rsi
call fcn.18005d450
jmp 0x18005025f
mov eax, edi
sub eax, 0x265
je 0x18005024a
sub eax, 0x38
je 0x180050230
sub eax, 0x70
je 0x18005024a
sub eax, 0x38
je 0x18005020f
cmp eax, 0x38
jne 0x180050263
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x18005025f
xor r9d, r9d
mov qword [rsp + 0x28], r12
mov rdx, rsi
mov qword [rsp + 0x20], 0
xor ecx, ecx
lea r8d, [r9 + 0xa]
call fcn.18005f440
jmp 0x18005025f
mov r8, r12
lea rcx, [rbp - 0x10]
mov edx, 0x117
call fcn.18003c700
mov rdx, rax
mov qword [rbp - 0x38], rax
jmp 0x180050263
mov qword [rbp - 0x30], rdx
mov r8, r12
lea rdx, [rbp - 0x30]
mov ecx, 0xee
call fcn.180065540
mov rdx, qword [rbp - 0x38]
add edi, 0x38
cmp edi, ebx
jb 0x180050150
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret