Function at 0x18006b000
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xf8
mov rax, qword [0x1800a74e0]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov r13d, dword [rsp + 0x160]
mov r11, r8
mov qword [rsp + 0x40], r9
mov r10, rdx
mov qword [rsp + 0x48], r8
mov rbx, rcx
mov qword [rsp + 0x38], rdx
lea edi, [r13 + 0x344]
mov qword [rsp + 0x50], rcx
mov dword [rsp + 0x30], edi
cmp r13d, edi
jae 0x18006b16d
mov r14, qword [rsp + 0x58]
lea rdx, [0x180000000]
mov esi, dword [rsp + 0x34]
mov rdi, qword [rsp + 0x78]
mov r12d, dword [rsp + 0x34]
mov r15d, dword [rsp + 0x34]
mov ebp, dword [rsp + 0x34]
mov eax, dword [rsp + 0x30]
cmp r13d, 0xfb
ja 0x18006b0cc
je 0x18006b0b5
cmp r13d, 0xb4
jne 0x18006b160
xor edx, edx
lea ecx, [rdx + 0x5f]
call fcn.180048560
mov r14, rax
mov qword [rsp + 0x58], rax
jmp 0x18006b146
xor r15d, r15d
xor r12d, r12d
xor ebp, ebp
cmp dword [r10 + 8], 1
cmova r15d, dword [r10 + 8]
jmp case.0x18006b0f0.265
lea eax, [r13 - 0x100]
cmp eax, 0xe4
ja case.0x18006b0f0.265
movzx eax, byte [rdx + rax + 0x6b434]
mov ecx, dword [rdx + rax*4 + 0x6b40c]
add rcx, rdx
jmp rcx
xor esi, esi
jmp case.0x18006b0f0.265
mov eax, dword [r9]
mov dword [rsp + 0xc0], eax
mov rax, qword [r9]
shr rax, 0x20
mov dword [rsp + 0xc4], eax
mov qword [rsp + 0xc8], 0
jmp case.0x18006b0f0.265
xor ebx, ebx
nop
mov r8d, ebx
lea rdx, [0x18009732c]
lea rcx, [rsp + 0xd0]
call fcn.180085ad0
inc ebx
cmp ebx, 0x2710
jl 0x18006b120
mov rbx, qword [rsp + 0x50]
mov r10, qword [rsp + 0x38]
mov r9, qword [rsp + 0x40]
mov r11, qword [rsp + 0x48]
lea rdx, [0x180000000]
mov eax, dword [rsp + 0x30]
add r13d, 0x4c
cmp r13d, eax
jb 0x18006b086
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.1800864a0
add rsp, 0xf8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov r8d, dword [rbx]
lea rax, [rsp + 0xb0]
mov rcx, qword [r10]
lea r9, [rsp + 0x34]
mov rdx, r11
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18006b3fb
mov eax, dword [rbx]
cmp dword [rsp + 0x34], eax
jne 0x18006b3fb
jmp 0x18006b146
lea r8, [rsp + 0x80]
mov rdx, r14
mov ecx, 0x10d
call fcn.180049ff0
mov edx, 0xbc
lea rcx, [rsp + 0x80]
call fcn.18004b5d0
test eax, eax
je 0x18006b146
nop
mov ebx, 0x58
mov eax, ebx
sub eax, 0x58
je 0x18006b25d
sub eax, 0x4b
je 0x18006b21e
cmp eax, 0x4b
jne 0x18006b29b
inc esi
jmp 0x18006b29b
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov ecx, eax
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x64
cmp ecx, eax
jne 0x18006b29b
lea r9, [rsp + 0x60]
mov qword [rsp + 0x60], rdi
xor r8d, r8d
mov rdx, r14
mov ecx, 0xa0
call fcn.18001bef0
jmp 0x18006b29b
mov dword [rsp + 0x28], SHSetInstanceExplorer
lea r9, [rsp + 0x80]
xor r8d, r8d
mov qword [rsp + 0x20], 0
xor edx, edx
lea rcx, [rsp + 0xa0]
call fcn.18006f600
movaps xmm0, xmmword [rsp + 0xa0]
movdqa xmmword [rsp + 0x70], xmm0
mov rdi, qword [rsp + 0x78]
add ebx, 0x4b
cmp ebx, 0x139
jb 0x18006b205
mov edx, 0xbc
lea rcx, [rsp + 0x80]
call fcn.18004b5d0
test eax, eax
jne 0x18006b200
jmp 0x18006b141
cmp r12d, r15d
je 0x18006b31b
mov rdi, qword [rsp + 0x38]
mov r14, qword [rsp + 0x40]
nop dword [rax + rax]
mov rdx, qword [rdi]
lea ebp, [r15 + r12]
mov rcx, qword [r14]
shr ebp, 1
mov rdx, qword [rdx + rbp*8]
call qword [rdi + 0x18]
test eax, eax
jns 0x18006b2fc
mov r15d, ebp
jmp 0x18006b302
jle 0x18006b307
lea r12d, [rbp + 1]
cmp r12d, r15d
jne 0x18006b2e0
mov rdi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x58]
mov r10, qword [rsp + 0x38]
mov r9, qword [rsp + 0x40]
cmp dword [r10 + 8], 0
mov r13d, 0x147
jbe 0x18006b343
mov rdx, qword [r10]
mov rcx, qword [r9]
mov eax, ebp
mov rdx, qword [rdx + rax*8]
call qword [r10 + 0x18]
mov r10, qword [rsp + 0x38]
test eax, eax
jle 0x18006b343
inc ebp
mov eax, dword [r10 + 8]
inc eax
cmp eax, dword [r10 + 0xc]
jbe 0x18006b14b
mov ebx, dword [r10 + 0xc]
mov rcx, qword [r10]
add ebx, ebx
mov edx, ebx
shl rdx, 3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
test rax, rax
je 0x18006b3ec
mov r10, qword [rsp + 0x38]
mov dword [r10 + 0xc], ebx
mov rbx, qword [rsp + 0x50]
mov qword [r10], rax
jmp 0x18006b14b
xor r9d, r9d
mov qword [rsp + 0x20], 0
xor edx, edx
mov rcx, r14
lea r8d, [r9 + 0x52]
call fcn.18004dc60
jmp 0x18006b146
mov r9, qword [r10]
mov r8d, dword [r10 + 8]
mov eax, ebp
sub r8d, ebp
shl r8, 3
lea rbx, [rax*8]
lea eax, [rbp + 1]
lea rcx, [r9 + rax*8]
lea rdx, [rbx + r9]
call sub.VCRUNTIME140.dll_memmove
mov r10, qword [rsp + 0x38]
mov r9, qword [rsp + 0x40]
mov rcx, qword [r10]
mov rax, qword [r9]
mov qword [rbx + rcx], rax
inc dword [r10 + 8]
mov rbx, qword [rsp + 0x50]
jmp 0x18006b150
jmp 0x18006b171
mov eax, 1
jmp 0x18006b171
mov edx, dword [rbx]
lea rcx, str.VmodlVimFaultNotSupportedHostInHACluster
call fcn.180047050
int3