Function at 0x18008e000
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x78]
sub rsp, 0x178
movaps xmmword [rax - 0x58], xmm6
movaps xmmword [rax - 0x68], xmm7
mov rax, qword [0x180357660]
xor rax, rsp
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0xe0]
mov r10, r9
mov r15, qword [rbp + 0xe8]
mov rsi, qword [rbp + 0x100]
mov qword [rbp - 0x10], rax
mov eax, dword [rbp + 0xf0]
mov qword [rbp + 0x28], rdx
mov rdx, rcx
mov qword [rbp - 0x78], rcx
mov rcx, qword [rbp + 0xf8]
lea ebx, [rax + 0x5f0]
mov qword [rbp - 0x80], r9
mov qword [rsp + 0x58], r8
mov qword [rbp - 0x70], rcx
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x38], rsi
mov dword [rsp + 0x60], ebx
cmp eax, ebx
jae 0x18008e176
mov r13, qword [rbp]
xor ebx, ebx
mov edi, dword [rbp - 0x30]
movss xmm7, dword [0x18034d520]
movss xmm6, dword [0x18034d540]
mov r14d, dword [rsp + 0x70]
mov r9d, dword [rsp + 0x60]
mov qword [rbp - 8], r13
mov qword [rbp - 0x40], rdi
nop word [rax + rax]
cmp eax, 0x1b3
ja 0x18008e9d2
je 0x18008e960
sub eax, 0xbf
je 0x18008e1aa
sub eax, 0x59
je 0x18008e169
sub eax, 3
je 0x18008e12a
sub eax, 0x3c
je 0x18008e251
cmp eax, 0x59
jne 0x18008eacc
test rsi, rsi
lea rax, str.Not_valid.
lea rdx, [0x180346fa8]
cmovne rax, rsi
mov rcx, rax
mov qword [rbp - 0x38], rax
mov rsi, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov qword [rbp + 0x30], rax
jmp 0x18008eab6
mov r12d, dword [rsi]
xor ecx, ecx
mov dword [rbp - 0x18], r12d
test r8, r8
jne 0x18008eaeb
mov eax, r12d
lea edx, [rcx + 0x4c]
imul eax, r12d
xor r9d, r9d
cdqe
mov qword [rbp + 8], rax
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
call fcn.18003ad60
mov r13, rax
mov qword [rbp - 8], rax
jmp 0x18008eab6
cmp qword [0x1803581f8], rbx
jne 0x18008eacc
mov rax, qword [rbp - 0x68]
mov rcx, qword [rbp + 0x48]
xor rcx, rsp
call fcn.1800bfa40
movaps xmm6, xmmword [rsp + 0x160]
movaps xmm7, xmmword [rsp + 0x150]
add rsp, 0x178
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
mov ecx, 0xfa
call fcn.1800744a0
cmp dword [rsi + 0x80], 2
mov rdi, rax
mov qword [rbp - 0x40], rax
jl 0x18008e853
cmp dword [rsi + 0x80], 4
jne 0x18008e20f
lea rax, [rbp - 0x48]
mov qword [rsp + 0x28], rbx
lea rdx, [rsi + 0x218]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor ecx, ecx
mov r8d, 0x121
call fcn.1800b95e0
mov r12d, eax
mov dword [rsp + 0x50], r12d
test eax, eax
jne 0x18008e258
lea r9, [rsp + 0x68]
mov dword [rsp + 0x68], 1
xor r8d, r8d
mov dword [rsp + 0x50], 1
mov rdx, rsi
mov dword [rsp + 0x20], 0x74
lea rcx, [rsp + 0x50]
call fcn.18008b8d0
cmp eax, 0xfffffffe
je 0x18008eb09
test eax, eax
jg 0x18008e1d5
mov dword [rbp - 0x68], eax
jmp 0x18008e176
mov r12d, dword [rsp + 0x50]
jmp 0x18008e260
mov r10, qword [rbp - 0x80]
mov rdx, qword [rbp - 0x78]
mov dword [rbp + 0xf0], 0x157
test r12d, r12d
jle 0x18008eb00
mov r13d, 0xbf
mov dword [rsp + 0x48], r13d
nop
cmp r13d, 0x16265
ja 0x18008e90f
je 0x18008e8ad
cmp r13d, 0xbf
je 0x18008e85f
cmp r13d, 0x76a1
je 0x18008e84a
cmp r13d, 0xec83
jne 0x18008e931
test r10, r10
je 0x18008e2d0
mov rcx, qword [rbp - 0x48]
mov r9, rdx
mov edx, dword [rsp + 0x74]
mov r8d, r12d
call r10
mov rax, qword [rbp + 0x108]
mov r8d, 5
movsxd rsi, dword [rsp + 0x74]
mov qword [rbp - 0x60], rsi
mov ecx, dword [rax]
mov rax, qword [rbp - 0x10]
mov dword [rsp + 0x68], ecx
cmp dword [rax], 1
jne 0x18008e417
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor edx, edx
mov qword [rsp + 0x30], rbx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call fcn.180098d40
test r12d, r12d
jle 0x18008e3f5
mov r13d, dword [rsp + 0x50]
mov r12, rbx
mov edi, dword [rsp + 0x68]
mov rax, rsi
nop word [rax + rax]
mov rsi, rbx
test rax, rax
jle 0x18008e3d5
test edi, edi
mov r15d, 0xffffff80
mov edi, 0xffffff80
cmovne r15d, ebx
nop dword [rax]
mov rax, qword [rbp - 0x48]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0x78
mov rcx, qword [rax + rsi*8]
movss xmm0, dword [rcx + r12]
lea rcx, [rbp + 0x10]
mulss xmm0, xmm7
cvtps2pd xmm0, xmm0
movsd qword [rbp + 0x10], xmm0
call fcn.180036d60
mov r14d, eax
cmp eax, 0x7f
jle 0x18008e3a8
mov r14d, 0x7f
jmp 0x18008e3af
cmp r14d, edi
cmovl r14d, edi
mov rcx, qword [rbp - 0x58]
lea eax, [r14 + r15]
inc rsi
mov dword [rsp + 0x70], r14d
mov byte [rcx], al
inc rcx
mov rax, qword [rbp - 0x60]
mov qword [rbp - 0x58], rcx
cmp rsi, rax
jl 0x18008e360
mov edi, dword [rsp + 0x68]
add r12, 4
sub r13, 1
jne 0x18008e340
mov r15, qword [rbp - 0x58]
mov r12d, dword [rsp + 0x50]
mov rdi, qword [rbp - 0x40]
mov r13d, dword [rsp + 0x48]
movzx eax, word [rsp + 0x40]
lea rcx, [rsp + 0x48]
mov edx, 1
mov word [rsp + 0x48], ax
call fcn.1800b7840
mov rsi, qword [rbp - 0x38]
jmp 0x18008e931
test ecx, ecx
mov eax, 0x8000
cmovne eax, ebx
xor r9d, r9d
mov dword [rsp + 0x68], eax
xor edx, edx
mov rax, qword [rbp - 0x70]
mov eax, dword [rax]
cmp edi, eax
jne 0x18008e632
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
test ecx, ecx
je 0x18008e53c
xor ecx, ecx
call fcn.180098d40
mov eax, dword [rsp + 0x74]
test eax, eax
jle 0x18008e3f5
mov rdx, r15
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x28], rdx
mov rcx, rbx
mov r8d, eax
mov qword [rsp + 0x78], rax
mov rdi, rsi
mov rax, qword [rbp - 0x48]
mov r15, rdx
mov rsi, qword [rcx + rax]
test r12d, r12d
jle 0x18008e514
lea r13, [rdi + rdi]
mov edi, 0xffff8000
nop
movss xmm0, dword [rsi]
lea rcx, [rbp - 0x60]
mulss xmm0, xmm6
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0x78
cvtps2pd xmm0, xmm0
movsd qword [rbp - 0x60], xmm0
call fcn.180036d60
mov r14d, eax
cmp eax, 0x7fff
jle 0x18008e4e0
mov r14d, 0x7fff
jmp 0x18008e4e7
cmp r14d, edi
cmovl r14d, edi
mov word [r15], r14w
add rsi, 4
add r15, r13
mov dword [rsp + 0x70], r14d
sub r12, 1
jne 0x18008e4a0
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x28]
mov r8, qword [rsp + 0x78]
movsxd rdi, dword [rsp + 0x74]
mov r12d, dword [rsp + 0x50]
add rdx, 2
add rcx, 8
sub r8, 1
mov qword [rbp - 0x28], rdx
mov qword [rsp + 0x78], r8
mov qword [rbp - 0x20], rcx
jne 0x18008e481
mov r15, qword [rbp - 0x58]
jmp 0x18008e3ec
xor ecx, ecx
call fcn.180098d40
mov eax, dword [rsp + 0x74]
test eax, eax
jle 0x18008e3f5
mov edi, dword [rsp + 0x68]
mov rdx, r15
mov qword [rsp + 0x78], rdx
mov rcx, rbx
mov qword [rbp - 0x20], rbx
mov r8d, eax
mov qword [rbp - 0x28], rax
nop dword [rax]
mov rax, qword [rbp - 0x48]
mov r15, rdx
mov rsi, qword [rcx + rax]
test r12d, r12d
jle 0x18008e60a
mov rax, qword [rbp - 0x60]
lea r13, [rax + rax]
nop dword [rax]
movss xmm0, dword [rsi]
lea rcx, [rsp + 0x68]
mulss xmm0, xmm6
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0x78
cvtps2pd xmm0, xmm0
movsd qword [rsp + 0x68], xmm0
call fcn.180036d60
mov r14d, eax
cmp eax, 0x7fff
jle 0x18008e5d2
mov r14d, 0x7fff
jmp 0x18008e5de
mov eax, 0xffff8000
cmp r14d, eax
cmovl r14d, eax
lea eax, [r14 + rdi]
mov dword [rsp + 0x70], r14d
mov word [r15], ax
add rsi, 4
add r15, r13
sub r12, 1
jne 0x18008e590
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rsp + 0x78]
mov r8, qword [rbp - 0x28]
mov r12d, dword [rsp + 0x50]
add rdx, 2
add rcx, 8
sub r8, 1
mov qword [rsp + 0x78], rdx
mov qword [rbp - 0x28], r8
mov qword [rbp - 0x20], rcx
jne 0x18008e570
mov r15, qword [rbp - 0x58]
jmp 0x18008e3ec
xor ecx, ecx
test eax, eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
je 0x18008e746
call fcn.180098d40
test r12d, r12d
jle 0x18008e3f5
mov edi, dword [rsp + 0x68]
mov r13, rbx
mov eax, r12d
mov qword [rsp + 0x78], rax
mov r12, rbx
test rsi, rsi
jle 0x18008e72e
nop
mov esi, 0xd6
mov eax, esi
sub eax, 0xd5
je 0x18008e6f1
cmp eax, 1
jne 0x18008e702
mov rax, qword [rbp - 0x48]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0x78
mov rcx, qword [rax + r12*8]
movss xmm0, dword [rcx + r13]
lea rcx, [rbp + 0x18]
mulss xmm0, xmm6
cvtps2pd xmm0, xmm0
movsd qword [rbp + 0x18], xmm0
call fcn.180036d60
mov r14d, eax
cmp eax, 0x7fff
jle 0x18008e6e0
mov r14d, 0x7fff
add r14d, edi
jmp 0x18008e702
mov eax, 0xffff8000
cmp r14d, eax
cmovl r14d, eax
add r14d, edi
jmp 0x18008e702
mov eax, r14d
sar eax, 8
mov byte [r15], al
mov byte [r15 + 1], r14b
add r15, 2
dec esi
cmp esi, 0xd4
ja 0x18008e685
mov rsi, qword [rbp - 0x60]
inc r12
mov qword [rbp - 0x58], r15
mov dword [rsp + 0x70], r14d
cmp r12, rsi
jl 0x18008e680
mov rax, qword [rsp + 0x78]
add r13, 4
sub rax, 1
mov qword [rsp + 0x78], rax
jne 0x18008e672
jmp 0x18008e3e7
call fcn.180098d40
test r12d, r12d
jle 0x18008e3f5
mov edi, dword [rbp - 0x50]
mov r13, rbx
mov r14d, dword [rsp + 0x68]
mov eax, r12d
mov qword [rsp + 0x78], rax
nop word [rax + rax]
mov r12, rbx
test rsi, rsi
jle 0x18008e82d
nop dword [rax]
mov esi, 0xa2
mov eax, esi
sub eax, 0xa2
je 0x18008e7b0
sub eax, 0x35
je 0x18008e7a5
cmp eax, 0x35
jne 0x18008e802
mov eax, edi
sar eax, 8
mov byte [r15], al
inc r15
jmp 0x18008e802
add edi, r14d
mov byte [r15], dil
inc r15
jmp 0x18008e802
mov rax, qword [rbp - 0x48]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0x78
mov rcx, qword [rax + r12*8]
movss xmm0, dword [rcx + r13]
lea rcx, [rbp + 0x20]
mulss xmm0, xmm6
cvtps2pd xmm0, xmm0
movsd qword [rbp + 0x20], xmm0
call fcn.180036d60
mov edi, eax
cmp eax, 0x7fff
jle 0x18008e7f8
mov edi, 0x7fff
jmp 0x18008e802
mov eax, 0xffff8000
cmp edi, eax
cmovl edi, eax
add esi, 0x35
cmp esi, 0x141
jb 0x18008e785
mov rsi, qword [rbp - 0x60]
inc r12
mov dword [rbp - 0x50], edi
mov qword [rbp - 0x58], r15
cmp r12, rsi
jl 0x18008e780
mov rax, qword [rsp + 0x78]
add r13, 4
sub rax, 1
mov qword [rsp + 0x78], rax
jne 0x18008e770
mov r14d, dword [rsp + 0x70]
jmp 0x18008e3e7
test r12d, r12d
jg 0x18008e931
mov dword [rbp - 0x68], 0xffffff7d
jmp 0x18008e176
mov r8d, 0x61
mov dword [rsp + 0x68], 0xffffffff
mov rdx, rsi
lea rcx, [rsp + 0x68]
call fcn.180024d40
mov rcx, qword [rbp - 0x10]
mov r8, qword [rsp + 0x58]
mov eax, dword [rax + 4]
mov ecx, dword [rcx]
imul ecx, eax
mov dword [rsp + 0x74], eax
mov eax, dword [r8]
cdq
idiv ecx
mov dword [rbp - 0x30], ecx
cmp r12d, eax
jle 0x18008e936
mov r12d, eax
mov dword [rsp + 0x50], eax
jmp 0x18008e936
xor r9d, r9d
mov dword [rsp + 0x68], r12d
lea rcx, [rsi + 0x218]
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x68]
lea r8d, [r9 + 0x7e]
call fcn.180047360
mov rax, qword [rsi + 0x68]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0xa4
xor ecx, ecx
call fcn.1800b92b0
mov rdx, qword [rbp + 0x28]
mov ecx, eax
mov r8, qword [rsp + 0x58]
mov eax, r12d
shl eax, cl
cdqe
add qword [rsi + 0x78], rax
test rdx, rdx
je 0x18008e936
mov eax, dword [rsi + 0x88]
mov dword [rdx], eax
jmp 0x18008e936
cmp r13d, 0x1d847
je 0x18008e927
cmp r13d, 0x24e29
je 0x18008e176
jmp 0x18008e931
mov eax, dword [rbp - 0x30]
imul eax, r12d
mov dword [rbp - 0x68], eax
mov r8, qword [rsp + 0x58]
mov r10, qword [rbp - 0x80]
add r13d, 0x75e2
mov rdx, qword [rbp - 0x78]
mov dword [rsp + 0x48], r13d
cmp r13d, 0x2c34c
jbe 0x18008e280
mov r13, qword [rbp - 8]
jmp 0x18008eac3
mov r12d, dword [rbp - 0x18]
mov rcx, r13
mov rdx, qword [rsi + 0x20]
mov eax, r12d
imul eax, r12d
movsxd r8, eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsi + 0x18]
lea rdx, [rsp + 0x48]
mov r8, qword [rsi + 0x10]
mov r9, r13
mov rcx, qword [rsi + 8]
mov dword [rsp + 0x68], eax
lea rax, [rbp + 0x38]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov rax, qword [rsi + 0x28]
mov dword [rsp + 0x28], 0xa4
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x38], 5
mov dword [rbp + 0x3c], 3
mov dword [rsp + 0x48], r12d
call fcn.18002abc0
jmp 0x18008eab6
sub eax, 0x248
je 0x18008ea5c
sub eax, 3
je 0x18008ea38
sub eax, 0x98
je 0x18008e9fd
cmp eax, 0x98
jne 0x18008eacc
mov rax, qword [rbp]
jmp 0x18008e17a
mov eax, dword [rbp - 0x18]
lea r8, [rsp + 0x68]
mov qword [rsp + 0x28], rbx
mov r9, r13
xor edx, edx
mov dword [rsp + 0x68], eax
mov ecx, 0x103
mov qword [rsp + 0x20], rbx
call fcn.18004b1d0
mov rdx, r13
mov qword [rbp], rax
mov ecx, 0x22
call fcn.1800b73a0
jmp 0x18008eab6
mov eax, dword [rbp + 0x40]
mov qword [rcx], rbx
cmp eax, 7
je 0x18008eb11
cmp eax, 6
jne 0x18008eacc
lea rax, str.Maximum_OS_version_check_fail___Version:
jmp 0x18008eb18
mov r12, qword [rbp + 0x30]
test r12, r12
je 0x18008eaa9
mov r9, r12
lea rcx, [0x180358200]
mov edx, 0x374
mov r8d, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rax, 1
je 0x18008ea93
lea rcx, str.adl:ExportAuditLogSignature
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test eax, eax
je 0x18008eab6
lea rcx, str.EnumerateWorkItemTypeUsages
jmp 0x18008eab0
lea rcx, str.Task_Failed
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
mov r10, qword [rbp - 0x80]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rbp - 0x78]
mov r9d, dword [rsp + 0x60]
mov rcx, qword [rbp - 0x70]
mov eax, dword [rbp + 0xf0]
add eax, 0x98
mov dword [rbp + 0xf0], eax
cmp eax, r9d
jb 0x18008e0c0
jmp 0x18008e176
mov r9, r8
mov edx, ILAppendID
xor r8d, r8d
call fcn.18000f200
jmp 0x18008e17a
mov dword [rbp - 0x68], r12d
jmp 0x18008e176
mov dword [rbp - 0x68], ebx
jmp 0x18008e176
lea rax, str.double2_conversion_not_implemented
mov qword [rcx], rax
mov rdx, r13
mov ecx, 0x22
call fcn.1800b73a0
mov rax, rbx
jmp 0x18008e17a