Function at 0x1800935e0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
sub rsp, 0x1d8
mov r8d, dword [rsp + 0x200]
mov qword [rax - 8], rbx
mov qword [rax - 0x18], rsi
mov qword [rax - 0x20], rdi
mov rdi, qword [rsp + 0x208]
mov ebx, r9d
mov qword [rax - 0x38], r14
mov esi, edx
mov r14, rcx
lea rdx, [rax - 0x158]
mov r9, rdi
mov ecx, ebx
mov qword [rax - 0x40], r15
call fcn.180093030
test rax, rax
mov r15, rax
jne 0x180093638
mov ax, 0x1f
jmp 0x1800939e9
lea rcx, [rsp + 0x48]
mov r8, rdi
mov edx, ebx
mov qword [rsp + 0x1c8], rbp
call fcn.18008e280
lea rbp, [0x180117740]
xor edi, edi
mov rax, rbp
mov edx, edi
nop
inc rax
inc edx
cmp byte [rax], dil
jne 0x180093660
mov ecx, edi
cmp byte [rsp + 0x48], cl
je 0x18009368a
lea rax, [rsp + 0x48]
nop
nop
nop
inc rax
inc ecx
cmp byte [rax], dil
jne 0x180093680
lea eax, [rdx + 1]
movsxd r8, ecx
test eax, eax
lea rcx, [rsp + r8 + 0x48]
je 0x1800936b2
mov rdx, rcx
sub rdx, r8
lea r8, [rsp + 0x48]
sub rdx, r8
mov r8d, eax
add rdx, rbp
call fcn.180005f30
lea ecx, [rsi*4 + 3]
mov eax, 0xaaaaaaab
mov qword [rsp + 0x1a8], r13
mul ecx
mov ebx, edx
xor ecx, ecx
shr ebx, 1
add ebx, 0xa
movsxd rdx, ebx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
test rax, rax
mov r13, rax
jne 0x1800936eb
mov ax, reloc.WSOCK32.dll_ioctlsocket
jmp 0x1800939d9
mov eax, ebx
xor ecx, ecx
mov qword [rsp + 0x1b0], r12
shr eax, 6
lea eax, [rbx + rax*2 + 0xa]
movsxd rdx, eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
test rax, rax
mov r12, rax
jne 0x180093721
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ax, reloc.WSOCK32.dll_ioctlsocket
jmp 0x1800939d1
lea rdx, [rsp + 0x44]
mov r9d, esi
mov r8, r14
mov rcx, r13
call fcn.18008a5a0
test ax, ax
je 0x18009374b
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ax, 0xcf
jmp 0x1800939d1
cmp dword [rsp + 0x44], edi
mov r10d, edi
mov ebx, edi
jbe 0x1800937b9
mov r9, r12
mov r11, r13
nop
movzx eax, byte [r11]
mov byte [r9], al
mov eax, r10d
and eax, 0x3f
cmp al, 0x3f
jne 0x1800937a7
mov eax, ebx
mov r8, rbp
mov edx, 2
sub r8, rax
lea rcx, [rax + r12 + 1]
sub r8, r12
nop
nop
nop
movzx eax, byte [r8 + rcx - 1]
inc rcx
dec edx
mov byte [rcx - 1], al
jne 0x180093790
add ebx, 2
add r9, 2
inc r10d
inc r11
inc ebx
inc r9
cmp r10d, dword [rsp + 0x44]
jb 0x180093760
test r10b, 0x3f
je 0x1800937f2
mov eax, ebx
mov r8, rbp
mov edx, 2
sub r8, rax
lea rcx, [rax + r12]
sub r8, r12
nop
nop
nop
nop
movzx eax, byte [r8 + rcx]
inc rcx
dec edx
mov byte [rcx - 1], al
jne 0x1800937e0
add ebx, 2
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov edx, 0x40000000
lea r8d, [r9 + 2]
mov rcx, r15
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov rsi, rax
jne 0x180093840
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ax, 0x1f
jmp 0x1800939d1
lea r9, [rsp + 0x40]
lea rdx, str.Begin_HL_RUS_License_______________________
mov r8d, 0x2b
mov rcx, rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18009386b
cmp dword [rsp + 0x40], 0x2b
je 0x18009388f
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ax, 0x21
jmp 0x1800939d1
lea r9, [rsp + 0x40]
mov r8d, 2
mov rdx, rbp
mov rcx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18009386b
cmp dword [rsp + 0x40], 2
jne 0x18009386b
cmp byte [rsp + 0x48], dil
mov r8d, edi
je 0x1800938d0
lea rax, [rsp + 0x48]
inc rax
inc r8d
cmp byte [rax], dil
jne 0x1800938c5
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x48]
mov rcx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [rsp + 0x40]
test eax, eax
mov ecx, edi
cmove edx, edi
cmp byte [rsp + 0x48], cl
je 0x18009390a
lea rax, [rsp + 0x48]
nop
inc rax
inc ecx
cmp byte [rax], dil
jne 0x180093900
cmp edx, ecx
jne 0x18009386b
lea r9, [rsp + 0x40]
mov r8d, ebx
mov rdx, r12
mov rcx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [rsp + 0x40]
test eax, eax
cmove ecx, edi
cmp ecx, ebx
jne 0x18009386b
lea r9, [rsp + 0x40]
lea rdx, str.End_HL_RUS_License_________________________
mov r8d, 0x2b
mov rcx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18009386b
cmp dword [rsp + 0x40], 0x2b
jne 0x18009386b
mov r8d, edi
mov rax, rbp
inc rax
inc r8d
cmp byte [rax], dil
jne 0x180093975
lea r9, [rsp + 0x40]
mov rdx, rbp
mov rcx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [rsp + 0x40]
test eax, eax
cmove ecx, edi
nop
inc rbp
inc edi
cmp byte [rbp], 0
jne 0x1800939a0
cmp ecx, edi
jne 0x18009386b
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ax, ax
mov r12, qword [rsp + 0x1b0]
mov r13, qword [rsp + 0x1a8]
mov rbp, qword [rsp + 0x1c8]
mov r15, qword [rsp + 0x198]
mov r14, qword [rsp + 0x1a0]
mov rdi, qword [rsp + 0x1b8]
mov rsi, qword [rsp + 0x1c0]
mov rbx, qword [rsp + 0x1d0]
add rsp, 0x1d8
ret