Function at 0x1800600c0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1f0]
sub rsp, 0x2f0
mov rax, qword [0x180195040]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
mov rax, qword [0x180196050]
mov r14, qword [rax + rcx*8]
lea rax, [rbp - 0x30]
movzx ecx, word [0x180197570]
mov qword [rsp + 0x58], r14
test cx, cx
je 0x180060130
lea rdx, [0x180197570]
lea rdi, [rbp - 0x30]
sub rdx, rdi
nop word [rax + rax]
mov word [rax], cx
add rax, 2
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x180060120
xor r15d, r15d
mov word [rax], r15w
movzx ecx, word [r14]
test cx, cx
je 0x180060160
mov rdx, r14
sub rdx, rax
nop word [rax + rax]
mov word [rax], cx
add rax, 2
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x180060150
mov qword [rsp + 0x328], rbx
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov qword [rsp + 0x330], rsi
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov r8d, 1
mov qword [rsp + 0x338], r13
mov dword [rsp + 0x20], 2
mov word [rax], r15w
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x60], rax
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x180060914
movabs rax, 0xbb62c62c9808ea37
mov dword [rsp + 0x48], 0x3e8
movabs rbx, 0x2b9fff192bd4c83e
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x78], rbx
lea rcx, [rsp + 0x70]
mov qword [rbp - 0x80], 4
mov qword [rbp - 0x78], r15
call fcn.18005eb50
lea rcx, [rsp + 0x70]
call fcn.18005ec20
mov rsi, qword [0x180196088]
mov rdi, qword [0x180196080]
lea r13, [rax + 0x10]
mov qword [rsp + 0x50], r13
cmp rdi, rsi
je 0x18006023f
mov rcx, rdi
call fcn.18005ec20
add r13, 0x10
add rdi, 0x20
add r13, rax
cmp rdi, rsi
jne 0x180060222
mov qword [rsp + 0x50], r13
xor r9d, r9d
xor r8d, r8d
mov edx, r13d
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x180060284
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x180060284
lea rcx, [rsp + 0x70]
call fcn.180057410
jmp 0x180060914
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r13
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rsp + 0x70]
movabs rdx, 0x26efb703382e92fd
mov r15, rax
mov qword [rsp + 0x40], rax
add rax, r13
lea r14, [r15 + 8]
mov qword [rbp - 0x60], rax
movabs rdi, 0x566c1c811e86d8fd
movabs rsi, 0x8012fbb270cb163d
movabs r8, 0x889f8b4975721ba3
mov qword [r15], rcx
movabs r9, 0xa00a62a942b20165
mov rcx, qword [rsp + 0x78]
movabs r10, 0xbaaedcff023465cb
mov qword [r14], rcx
movabs r11, 0xbf1d25349b935bb7
mov rax, qword [rsp + 0x78]
add r14, 8
movabs rcx, 0x8cb0c9a388179fe5
cmp rax, rcx
ja 0x18006034e
je 0x18006043f
cmp rax, rdx
je 0x18006044a
cmp rax, rbx
je 0x18006044a
cmp rax, rdi
je 0x18006043f
cmp rax, rsi
je 0x18006043f
cmp rax, r8
je 0x18006044a
jmp 0x18006038f
cmp rax, r9
je 0x18006044a
cmp rax, r10
je 0x18006044a
cmp rax, r11
je 0x18006043f
movabs rcx, 0xcd2fd49bc6b014bd
cmp rax, rcx
je 0x18006044a
movabs rcx, 0xfb0ce58f438fe2a6
cmp rax, rcx
je 0x18006043f
lea rcx, [rsp + 0x70]
call fcn.180061d90
mov rcx, qword [0x180196070]
mov rbx, rax
mov rdi, qword [0x180196068]
cmp rdi, rcx
je 0x1800603c2
mov rdx, qword [rsp + 0x78]
cmp qword [rdi], rdx
je 0x1800603c8
add rdi, 0x20
cmp rdi, rcx
jne 0x1800603b4
int3
lea rcx, [rsp + 0x70]
call fcn.18005ec20
mov qword [r14], rax
add r14, 8
mov r8, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
cmp rdx, r8
je 0x18006048b
nop word [rax + rax]
mov rax, qword [rdx]
mov qword [r14], rax
mov rax, qword [rdx + 8]
mov qword [r14 + 8], rax
add r14, 0x10
mov rcx, qword [rdx + 0x10]
mov rdi, r14
mov rsi, qword [rdx + 0x18]
mov rax, rcx
add rsi, rbx
and eax, 3
jne 0x180060420
shr rcx, 2
rep movsd dword [rdi], dword [rsi]
jmp 0x180060430
cmp rax, 2
jne 0x18006042e
shr rcx, 1
rep movsw word [rdi], word [rsi]
jmp 0x180060430
rep movsb byte [rdi], byte [rsi]
add r14, qword [rdx + 0x10]
add rdx, 0x20
cmp rdx, r8
jne 0x1800603f0
jmp 0x18006048b
mov rax, qword [rbp - 0x80]
mov qword [r14], rax
add r14, 8
mov rbx, qword [rbp - 0x80]
lea rcx, [rsp + 0x70]
call fcn.180061d90
mov rcx, rbx
mov rdi, r14
mov rsi, rax
and ecx, 3
jne 0x180060471
shr rbx, 2
mov rcx, rbx
rep movsd dword [rdi], dword [rsi]
jmp 0x180060487
cmp rcx, 2
jne 0x180060482
shr rbx, 1
mov rcx, rbx
rep movsw word [rdi], word [rsi]
jmp 0x180060487
mov rcx, rbx
rep movsb byte [rdi], byte [rsi]
add r14, qword [rbp - 0x80]
lea rcx, [rsp + 0x70]
call fcn.18005ec20
mov rcx, r14
add rax, 0x10
sub rcx, r15
cmp rcx, rax
je 0x1800604a5
int3
mov rsi, qword [0x180196088]
mov r15, qword [0x180196080]
mov qword [rsp + 0x48], rsi
cmp r15, rsi
je 0x1800606f0
mov r13, qword [rbp - 0x60]
cmp r14, r13
jbe 0x1800604cb
int3
mov rax, qword [r15]
lea rbx, [r14 + 8]
mov qword [r14], rax
movabs rcx, 0x8cb0c9a388179fe5
mov rax, qword [r15 + 8]
mov qword [rbx], rax
add rbx, 8
mov rax, qword [r15 + 8]
cmp rax, rcx
ja 0x18006055a
je 0x18006066f
movabs rcx, 0x26efb703382e92fd
cmp rax, rcx
je 0x18006067a
movabs rcx, 0x2b9fff192bd4c83e
cmp rax, rcx
je 0x18006067a
movabs rcx, 0x566c1c811e86d8fd
cmp rax, rcx
je 0x18006066f
movabs rcx, 0x8012fbb270cb163d
cmp rax, rcx
je 0x18006066f
movabs rcx, 0x889f8b4975721ba3
cmp rax, rcx
je 0x18006067a
jmp 0x1800605b9
movabs rcx, 0xa00a62a942b20165
cmp rax, rcx
je 0x18006067a
movabs rcx, 0xbaaedcff023465cb
cmp rax, rcx
je 0x18006067a
movabs rcx, 0xbf1d25349b935bb7
cmp rax, rcx
je 0x18006066f
movabs rcx, 0xcd2fd49bc6b014bd
cmp rax, rcx
je 0x18006067a
movabs rcx, 0xfb0ce58f438fe2a6
cmp rax, rcx
je 0x18006066f
mov rcx, r15
call fcn.180061d90
mov rcx, qword [0x180196070]
mov r12, rax
mov rdi, qword [0x180196068]
cmp rdi, rcx
je 0x1800605ee
mov rdx, qword [r15 + 8]
nop dword [rax + rax]
cmp qword [rdi], rdx
je 0x1800605f4
add rdi, 0x20
cmp rdi, rcx
jne 0x1800605e0
int3
mov rcx, r15
call fcn.18005ec20
mov qword [rbx], rax
add rbx, 8
mov r8, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
cmp rdx, r8
je 0x1800606be
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [rdx]
mov qword [rbx], rax
mov rax, qword [rdx + 8]
mov qword [rbx + 8], rax
add rbx, 0x10
mov rcx, qword [rdx + 0x10]
mov rdi, rbx
mov rsi, qword [rdx + 0x18]
mov rax, rcx
add rsi, r12
and eax, 3
jne 0x180060650
shr rcx, 2
rep movsd dword [rdi], dword [rsi]
jmp 0x180060660
cmp rax, 2
jne 0x18006065e
shr rcx, 1
rep movsw word [rdi], word [rsi]
jmp 0x180060660
rep movsb byte [rdi], byte [rsi]
add rbx, qword [rdx + 0x10]
add rdx, 0x20
cmp rdx, r8
jne 0x180060620
jmp 0x1800606b9
mov rax, qword [r15 + 0x10]
mov qword [rbx], rax
add rbx, 8
mov r12, qword [r15 + 0x10]
mov rcx, r15
call fcn.180061d90
mov rcx, r12
mov rdi, rbx
mov rsi, rax
and ecx, 3
jne 0x18006069f
shr r12, 2
mov rcx, r12
rep movsd dword [rdi], dword [rsi]
jmp 0x1800606b5
cmp rcx, 2
jne 0x1800606b0
shr r12, 1
mov rcx, r12
rep movsw word [rdi], word [rsi]
jmp 0x1800606b5
mov rcx, r12
rep movsb byte [rdi], byte [rsi]
add rbx, qword [r15 + 0x10]
mov rsi, qword [rsp + 0x48]
mov rcx, r15
call fcn.18005ec20
mov rcx, rbx
add rax, 0x10
sub rcx, r14
cmp rcx, rax
je 0x1800606d6
int3
add r15, 0x20
mov r14, rbx
cmp r15, rsi
jne 0x1800604c5
mov r13, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x40]
xor r15d, r15d
xor r9d, r9d
mov qword [rsp + 0x20], r15
mov r8d, r13d
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r12
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x40]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rcx, [rsp + 0x70]
call fcn.180057410
test edi, edi
je 0x18006090f
mov dl, 1
call fcn.18008b850
mov rbx, rax
lea rdx, [rsp + 0x70]
movabs rax, 0x52f66dc46643369c
movabs rsi, 0x3d954da0033557ef
mov qword [rsp + 0x40], rax
movabs rdi, 0xc35fa6211be4c2ac
mov rcx, qword [rsp + 0x40]
movabs rax, 0xb73ed4547c8da4c2
mov qword [rsp + 0x70], rcx
mov r8d, edx
mov qword [rsp + 0x40], rax
movabs rax, 0xd4a0c890840b1158
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x40], rax
movabs rax, 0xd7e14f6740e83b6c
mov rcx, qword [rsp + 0x40]
mov qword [rbp - 0x80], rcx
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x78], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x58], rax
movabs rax, 0xb1cca1f6a4657e31
movdqa xmm1, xmmword [rbp - 0x60]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x50], rax
movabs rax, 0xd7e14f6740ca1b56
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
xorps xmm1, xmmword [rsp + 0x70]
movdqa xmm0, xmmword [rbp - 0x80]
mov qword [rbp - 0x48], rax
movq rax, xmm1
xorps xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmmword [rsp + 0x70], xmm1
test al, al
je 0x18006084b
nop
inc rcx
mov r8, rcx
cmp byte [rcx], r15b
jne 0x180060840
sub r8d, edx
mov qword [rsp + 0x20], r15
lea rdx, [rsp + 0x70]
xor r9d, r9d
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.18008b9c0
movabs rax, 0x3d954da0033557cd
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x60]
mov rax, qword [rsp + 0x40]
mov r8d, ecx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
movdqa xmm0, xmmword [rsp + 0x60]
mov qword [rbp - 0x58], rax
xorps xmm0, xmmword [rbp - 0x60]
movq rax, xmm0
movdqa xmmword [rsp + 0x60], xmm0
test al, al
je 0x1800608eb
nop
inc rdx
mov r8, rdx
cmp byte [rdx], r15b
jne 0x1800608e0
sub r8d, ecx
mov qword [rsp + 0x20], r15
mov rcx, 0xffffffffffffffff
lea rdx, [rsp + 0x60]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov al, 1
jmp 0x180060b4a
mov r14, qword [rsp + 0x58]
mov dl, 2
call fcn.18008b850
mov rbx, rax
lea rdx, [rsp + 0x70]
movabs rax, 0x49b529c56f5c3689
movabs rsi, 0x3d954da0033557ef
mov qword [rsp + 0x40], rax
movabs rdi, 0xc35fa6211be4c2ac
mov rcx, qword [rsp + 0x40]
movabs rax, 0xa07fc3577a97e2c3
mov qword [rsp + 0x70], rcx
mov r8d, edx
mov qword [rsp + 0x40], rax
movabs rax, 0xd0bed491cd03105e
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x40], rax
movabs rax, 0xbb8829472ea57222
mov rcx, qword [rsp + 0x40]
mov qword [rbp - 0x80], rcx
movabs rcx, 0xd412b275cc13a930
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x78], rax
movabs rax, 0xcad5cfe40e323c66
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x70], rax
mov qword [rsp + 0x40], rcx
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x68], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x58], rax
movabs rax, 0xb1cca1f6a4657e31
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x50], rax
movabs rax, 0xd7e14f6740ca1b56
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x48], rax
movabs rax, 0xcad5cfe42c120603
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x40], rax
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x70]
mov rax, qword [rsp + 0x40]
movdqa xmm2, xmmword [rsp + 0x70]
xorps xmm2, xmmword [rbp - 0x60]
movdqa xmm0, xmmword [rbp - 0x80]
movdqa xmm1, xmmword [rbp - 0x70]
xorps xmm0, xmmword [rbp - 0x50]
mov qword [rbp - 0x38], rax
movq rax, xmm2
xorps xmm1, xmmword [rbp - 0x40]
movdqa xmmword [rsp + 0x70], xmm2
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmmword [rbp - 0x70], xmm1
test al, al
je 0x180060a8b
nop dword [rax + rax]
inc rcx
mov r8, rcx
cmp byte [rcx], 0
jne 0x180060a80
sub r8d, edx
mov qword [rsp + 0x20], r15
lea rdx, [rsp + 0x70]
xor r9d, r9d
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, r14
mov rcx, rbx
call fcn.18008b9c0
movabs rax, 0x3d954da0033557cd
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x60]
mov rax, qword [rsp + 0x40]
mov r8d, edx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
movdqa xmm0, xmmword [rsp + 0x60]
mov qword [rbp - 0x58], rax
xorps xmm0, xmmword [rbp - 0x60]
movq rax, xmm0
movdqa xmmword [rsp + 0x60], xmm0
test al, al
je 0x180060b2b
nop dword [rax]
inc rcx
mov r8, rcx
cmp byte [rcx], 0
jne 0x180060b20
sub r8d, edx
mov qword [rsp + 0x20], r15
lea rdx, [rsp + 0x60]
xor r9d, r9d
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor al, al
mov r13, qword [rsp + 0x338]
mov rsi, qword [rsp + 0x330]
mov rbx, qword [rsp + 0x328]
mov rcx, qword [rbp + 0x1e0]
xor rcx, rsp
call fcn.1800f1520
add rsp, 0x2f0
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret