Function at 0x18002f4d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf]
sub rsp, 0x90
mov r13d, dword [rbp + 0x7f]
mov rax, r9
mov r11d, dword [rbp + 0x7f]
mov r10, rdx
mov r9d, dword [rbp + 0x7f]
mov rdi, rcx
mov r14d, r13d
mov dword [rbp - 0x3d], r11d
lea r15d, [r13 - 0xf]
mov dword [rbp - 0x41], r9d
cmp r13d, r15d
jbe 0x18002f8ea
mov rdx, qword [rbp - 0x39]
lea esi, [r13 - 0x75]
mov r13, qword [rbp - 0x39]
lea rcx, [0x180000000]
mov r12, qword [rbp - 0x39]
mov ebx, dword [rbp + 0x7f]
mov eax, dword [rbp + 0x7f]
mov qword [rbp - 0x39], rdx
mov dword [rbp - 0x31], ebx
mov dword [rbp - 0x21], eax
nop
cmp esi, 0x4d
ja case.default.0x18002f572
movzx eax, byte [rcx + rsi + 0x2fc40]
mov ecx, dword [rcx + rax*4 + 0x2fc00]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
lea rdx, [0x1800e7050]
mov rcx, rdi
call fcn.1800b3014
mov r13, rax
test rax, rax
je 0x18002f8d8
mov r8, qword [rbp + 0x5f]
mov r9d, dword [rbp - 0x41]
mov rdx, qword [rbp - 0x39]
mov r10, qword [rbp + 0x57]
mov r11d, dword [rbp - 0x3d]
jmp case.0x18002f572.15
mov rax, qword [rbp + 0x67]
mov eax, dword [rax]
mov dword [rdx + 0x14], eax
mov rax, qword [rbp + 0x6f]
mov dword [rdx + 0xc], 3
mov eax, dword [rax]
mov dword [rdx + 0x10], eax
jmp case.0x18002f572.15
lea rax, [0x180107660]
mov edx, 8
mov ecx, dword [rdi]
cmp dword [rax], ecx
jne 0x18002f5e4
dec byte [0x1801074f7]
mov dword [rax], 0xffffffff
add rax, 0x18
sub rdx, 1
jne 0x18002f5d2
mov rdx, qword [rbp - 0x39]
jmp case.0x18002f572.15
mov byte [rdi + 0x53], 0
jmp case.0x18002f572.15
inc dword [rdi]
lea rcx, [rdi + 8]
mov rdx, r10
call fcn.180004e90
mov rdx, qword [rbp + 0x57]
lea rcx, [rdi + 0x28]
add rdx, 0x20
call fcn.180004e90
mov rdx, qword [rbp + 0x57]
lea rcx, [rdi + 0x48]
add rdx, 0x40
call fcn.180004e90
mov rcx, qword [rbp + 0x57]
mov rax, qword [rcx + 0x60]
mov qword [rdi + 0x68], rax
mov rax, qword [rcx + 0x68]
mov qword [rdi + 0x70], rax
mov rcx, qword [rdi + 0x78]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov r8, qword [rbp + 0x5f]
mov r9d, dword [rbp - 0x41]
mov rdx, qword [rbp - 0x39]
mov r10, qword [rbp + 0x57]
mov r11d, dword [rbp - 0x3d]
mov ebx, dword [rbp - 0x31]
jmp case.0x18002f572.15
mov rax, qword [r10]
xor r9d, r9d
mov qword [rdx + 0x40], rax
mov r8, rdx
xor ecx, ecx
lea edx, [r9 + 0x59]
call fcn.180086d50
mov r8, qword [rbp + 0x5f]
mov r9d, dword [rbp - 0x41]
mov rdx, qword [rbp - 0x39]
mov r10, qword [rbp + 0x57]
mov r11d, dword [rbp - 0x3d]
jmp case.0x18002f572.15
movsxd rax, dword [rdi]
imul rdx, rax, 0x278
lea rax, [0x180107730]
add rdx, rax
lea rax, [0x1800e62a0]
mov qword [rbp - 0x39], rdx
mov qword [rdx], rax
jmp case.0x18002f572.15
movzx ebx, byte [rdi]
and ebx, 7
mov dword [rbp - 0x31], ebx
jmp case.0x18002f572.15
mov rax, qword [rbp + 0x6f]
lea r9, [rbp - 0x29]
lea rdx, [rbp - 9]
lea rcx, [rbp - 1]
mov eax, dword [rax]
mov dword [rbp - 1], eax
mov rax, qword [rbp + 0x67]
mov eax, dword [rax]
mov dword [rbp - 0x11], eax
mov eax, dword [r10]
mov dword [rbp - 9], eax
mov eax, dword [r8]
mov r8d, 0x31
mov dword [rbp - 0x19], eax
mov rax, qword [rbp + 0x77]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x19]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x11]
mov qword [rsp + 0x20], rax
call fcn.180095e10
mov r12, rax
test rax, rax
je 0x18002f8e0
mov r8, qword [rbp + 0x5f]
mov r9d, dword [rbp - 0x41]
mov rdx, qword [rbp - 0x39]
mov r10, qword [rbp + 0x57]
mov r11d, dword [rbp - 0x3d]
jmp case.0x18002f572.15
lea rax, [r10 + 0x40]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor edx, edx
xor eax, eax
xor ecx, ecx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r8d, [rax + 0x71]
call fcn.1800180e0
test al, al
je 0x18002f77b
mov rcx, qword [rdi + 0x88]
call qword [rdi + 0x80]
mov rcx, qword [rdi + 0x78]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r8, qword [rbp + 0x5f]
mov r9d, dword [rbp - 0x41]
mov rdx, qword [rbp - 0x39]
mov r10, qword [rbp + 0x57]
mov r11d, dword [rbp - 0x3d]
jmp case.0x18002f572.15
mov byte [rdx + 0x25c], 0
mov word [rdx + 0x258], 1
jmp case.0x18002f572.15
movsxd r8, dword [rbp - 0x29]
mov r9, r13
mov edx, 1
mov rcx, r12
call fcn.1800b396c
mov rcx, r13
call fcn.1800b30fc
mov rcx, r12
call fcn.1800b16dc
mov r8, qword [rbp + 0x5f]
mov r9d, dword [rbp - 0x41]
mov rdx, qword [rbp - 0x39]
mov r10, qword [rbp + 0x57]
mov r11d, dword [rbp - 0x3d]
jmp case.0x18002f572.15
xor eax, eax
mov dword [rdx + 0x262], eax
jmp case.0x18002f572.15
lea rcx, [rdi + 0x56]
xor edx, edx
mov r8d, 0xc0
call fcn.1800ae1d0
mov r8, qword [rbp + 0x5f]
mov r9d, dword [rbp - 0x41]
mov rdx, qword [rbp - 0x39]
mov r10, qword [rbp + 0x57]
mov r11d, dword [rbp - 0x3d]
jmp case.0x18002f572.15
movzx eax, byte [rdi + 2]
lea r9d, [rbx + rbx*4]
movzx r11d, byte [rdi + 1]
and eax, 7
and r11d, 7
mov dword [rbp - 0x21], eax
movzx eax, byte [rdi + 3]
sar r9d, 4
add r9d, eax
mov dword [rbp - 0x3d], r11d
mov dword [rbp - 0x41], r9d
lea rcx, [0x180000000]
dec r14d
dec esi
cmp r14d, r15d
ja 0x18002f550
mov r13d, dword [rbp + 0x7f]
mov edx, dword [rbp - 0x21]
mov r8d, dword [rbp - 0x31]
mov rax, qword [rbp + 0x67]
mov r15, qword [rbp - 0x39]
mov ebx, r13d
imul r12d, r13d, 0xb6d
cmp r13d, r12d
ja 0x18002fbdf
mov r14d, dword [rbp + 0x7f]
mov ecx, 0xff
mov esi, dword [rbp + 0x7f]
cmp ebx, 0x15512
ja 0x18002fa37
je 0x18002fa19
cmp ebx, 0x7214
ja 0x18002f920
je 0x18002f911
mov eax, ebx
sub eax, 0x77
je 0x18002fbd8
sub eax, 0x1e
je 0x18002f8fd
cmp eax, 0x1e
jne 0x18002fbb6
movzx eax, byte [rdi]
mov byte [r15 + 0x266], al
jmp 0x18002fbb6
mov rcx, r12
call fcn.1800b16dc
xor eax, eax
mov dword [rbp - 0x39], eax
jmp 0x18002fbdf
mov r8d, dword [rbp + 0x7f]
mov edx, dword [rbp + 0x7f]
mov dword [rbp - 0x31], r8d
mov dword [rbp - 0x21], edx
jmp 0x18002f871
movzx eax, byte [rdi + 4]
lea r14d, [r11 + r11*4]
sar r14d, 4
add r14d, eax
jmp 0x18002fbb6
movzx eax, byte [rdi + 5]
lea esi, [rdx + rdx*4]
sar esi, 4
jmp 0x18002fbb4
cmp ebx, 0x890c
je 0x18002f9c0
cmp ebx, 0xe393
je 0x18002f9ae
cmp ebx, 0x11165
jne 0x18002fbb6
mov eax, dword [rax]
lea rdx, [rbp + 0x7f]
mov r8, qword [r15 + 0x150]
lea rcx, [rbp - 0x29]
mov dword [rbp - 0x29], eax
mov r9d, 0xc8
movzx eax, byte [rdi]
mov byte [rbp + 0x7f], al
call fcn.180080520
mov rcx, qword [rbp + 0x6f]
xor r9d, r9d
mov rdx, qword [r15 + 0x48]
mov eax, dword [rcx]
lea r8d, [r9 + 0x3a]
mov dword [rbp - 0x29], eax
lea rcx, [rbp - 0x29]
movzx eax, byte [rdi]
mov byte [rbp + 0x7f], al
xor eax, eax
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x20], rax
call fcn.18008e020
mov r9d, dword [rbp - 0x41]
mov ecx, 0xff
mov r11d, dword [rbp - 0x3d]
mov qword [rbp - 0x39], r15
jmp 0x18002fbb6
cmp r9d, ecx
movzx eax, r9b
cmovg eax, ecx
mov byte [rdi + 3], al
jmp 0x18002fbb6
mov rcx, qword [r15 + 0x150]
mov r9d, 0xef
xor r8d, r8d
xor edx, edx
call fcn.180018790
mov r9, qword [r15 + 0x48]
xor eax, eax
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [rax + 0x5a]
call fcn.1800135f0
lea r9, [rbp + 0x7f]
mov byte [rbp + 0x7f], 1
mov r8d, 0xf2
mov rdx, r15
xor ecx, ecx
call fcn.180094c70
mov r9d, dword [rbp - 0x41]
mov ecx, 0xff
mov r11d, dword [rbp - 0x3d]
jmp 0x18002fbb6
cmp r14d, ecx
movzx eax, r14b
cmovg eax, ecx
cmp esi, ecx
mov byte [rdi + 4], al
movzx eax, sil
cmovg eax, ecx
mov byte [rdi + 5], al
jmp 0x18002fbb6
cmp ebx, 0x2a98f
ja 0x18002fb09
je 0x18002faea
cmp ebx, 0x199be
je 0x18002fbdf
cmp ebx, 0x1c691
je 0x18002fab3
cmp ebx, 0x23810
jne 0x18002fbb6
mov eax, dword [r10]
mov r8d, 0xff
lea ecx, [rax + rax*2]
lea eax, [rdx + rdx*2]
movsxd rcx, ecx
sar eax, 4
movzx edx, r14b
movzx esi, byte [rcx + rdi - 1]
add esi, eax
movzx eax, r9b
cmp r9d, r8d
cmovg eax, r8d
cmp r14d, r8d
mov byte [rcx + rdi - 3], al
mov ecx, r8d
mov eax, dword [r10]
cmovg edx, r8d
lea eax, [rax + rax*2]
cdqe
mov byte [rax + rdi - 2], dl
jmp 0x18002fbb6
mov eax, dword [r10]
lea ecx, [rax + rax*2]
movsxd rcx, ecx
lea eax, [r8 + r8*2]
sar eax, 4
movzx r9d, byte [rcx + rdi - 3]
movzx r14d, byte [rcx + rdi - 2]
add r9d, eax
lea eax, [r11 + r11*2]
mov dword [rbp - 0x41], r9d
sar eax, 4
mov ecx, 0xff
add r14d, eax
jmp 0x18002fbb6
mov eax, dword [r10]
cmp esi, ecx
movzx edx, sil
cmovg edx, ecx
mov ecx, 0xff
lea eax, [rax + rax*2]
cdqe
mov byte [rax + rdi - 1], dl
jmp 0x18002fbb6
cmp ebx, 0x31b0e
je 0x18002fb78
cmp ebx, 0x38c8d
je 0x18002fb41
cmp ebx, 0x3fe0c
jne 0x18002fbb6
mov eax, dword [r10]
cmp esi, ecx
movzx edx, sil
cmovg edx, ecx
mov ecx, 0xff
lea eax, [rax + rax*2]
cdqe
mov byte [rax + rdi + 2], dl
jmp 0x18002fbb6
mov eax, dword [r10]
cmp r9d, ecx
mov r8d, 0xff
movzx edx, r9b
cmovg edx, ecx
cmp r14d, r8d
mov ecx, r8d
lea eax, [rax + rax*2]
cdqe
mov byte [rax + rdi], dl
mov eax, dword [r10]
movzx edx, r14b
cmovg edx, r8d
lea eax, [rax + rax*2]
cdqe
mov byte [rax + rdi + 1], dl
jmp 0x18002fbb6
mov eax, dword [r10]
lea r9d, [r8 + r8*4]
sar r9d, 4
lea ecx, [rax + rax*2]
movsxd rcx, ecx
movzx eax, byte [rcx + rdi]
movzx r14d, byte [rcx + rdi + 1]
add r9d, eax
movzx esi, byte [rcx + rdi + 2]
lea eax, [r11 + r11*4]
sar eax, 4
mov ecx, 0xff
add r14d, eax
mov dword [rbp - 0x41], r9d
lea eax, [rdx + rdx*4]
sar eax, 4
add esi, eax
imul eax, r13d, 0xc3
add ebx, eax
cmp ebx, r12d
ja 0x18002fbdf
mov r10, qword [rbp + 0x57]
mov edx, dword [rbp - 0x21]
mov r8d, dword [rbp - 0x31]
mov rax, qword [rbp + 0x67]
jmp 0x18002f894
mov dword [rbp - 0x39], 1
mov rax, qword [rbp - 0x39]
mov rbx, qword [rsp + 0xd0]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret