Function at 0x1800852b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x330
lea rbp, [rsp + 0x60]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x180186e90]
mov rdx, qword [rax + rcx*8]
lea rax, [rbp + 0xc0]
movzx ecx, word [0x180188fe0]
test cx, cx
je 0x180085320
lea rdi, [0x180188fe0]
lea rsi, [rbp + 0xc0]
sub rdi, rsi
nop word [rax + rax]
mov word [rax], cx
add rax, 2
movzx ecx, word [rdi + rax]
test cx, cx
jne 0x180085310
xor edi, edi
mov word [rax], di
movzx ecx, word [rdx]
test cx, cx
je 0x180085340
sub rdx, rax
mov word [rax], cx
add rax, 2
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x180085330
mov word [rax], di
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
mov r8d, 1
lea rcx, [rbp + 0xc0]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r15, rax
mov qword [rbp + 0x70], rax
cmp rax, 0xffffffffffffffff
je 0x180085453
movabs rsi, 0xcbf29ce484222325
mov rdx, rsi
lea rcx, str.version
call fcn.18005f770
mov rdi, rax
mov rdx, rsi
lea rcx, [0x18010ae2c]
call fcn.18005f770
mov dword [rbp + 0x60], 0x3e8
lea r9, [rbp + 0x60]
mov r8, rax
mov rdx, rdi
lea rcx, [rbp + 0x20]
call fcn.180061b60
nop
lea rcx, [rbp + 0x20]
call fcn.180083ef0
lea r13, [rax + 0x10]
mov qword [rbp + 0x60], r13
mov rsi, qword [0x180186ec8]
mov rdi, qword [0x180186ec0]
cmp rdi, rsi
je 0x18008540c
nop
mov rcx, rdi
call fcn.180083ef0
add r13, 0x10
add r13, rax
add rdi, 0x28
cmp rdi, rsi
jne 0x1800853f0
mov qword [rbp + 0x60], r13
xor r9d, r9d
xor r8d, r8d
mov edx, r13d
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x1800855dd
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x1800855dd
lea rcx, [rbp + 0x20]
call fcn.18005fe30
movabs rax, 0xc88abb4ed4776e8f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
movabs rax, 0xdfb3ed70e150c2a9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
movabs rax, 0x239db31ab2c44b4c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
movabs rax, 0x73907fe8462da4bc
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
movabs rax, 0x2ba663e76319a738
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rdi, 0x99752ce222fdf1fa
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movabs rdx, 0xbcaadf2bb81e0fe9
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rcx, 0xbc9388068023e2c6
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0x42efc67ddba22523
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0x1ff919c82842cdc8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0x2ba663e741399d5d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
vmovdqu ymm0, ymmword [rbp + 0x20]
vpxor ymm1, ymm0, ymmword [rbp + 0x80]
vmovdqa ymmword [rbp + 0x80], ymm1
vmovdqa xmm2, xmmword [rbp + 0xa0]
vxorps xmm2, xmm2, xmmword [rbp + 0x40]
vmovdqa xmmword [rbp + 0xa0], xmm2
movabs rax, 0xbcaadf2bb81e0fcb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp], rcx
mov rax, qword [rbp]
xor al, al
vzeroupper
lea r11, [rsp + 0x330]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop
mov r8, r13
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbp], rax
mov rcx, qword [rbp + 0x20]
mov qword [rax], rcx
lea rbx, [rax + 8]
mov rcx, qword [rbp + 0x28]
mov qword [rbx], rcx
add rbx, 8
movabs rdx, 0x8cb0c9a388179fe5
movabs rsi, 0x26efb703382e92fd
movabs rcx, 0xa00a62a942b20165
movabs rdi, 0xbaaedcff023465cb
movabs r11, 0x889f8b4975721ba3
movabs r8, 0x2b9fff192bd4c83e
movabs r9, 0x566c1c811e86d8fd
movabs r10, 0x8012fbb270cb163d
movabs r14, 0xbf1d25349b935bb7
movabs r12, 0xcd2fd49bc6b014bd
mov rax, qword [rbp + 0x28]
cmp rax, rdx
ja 0x1800856ae
je 0x180085848
cmp rax, rsi
je 0x180085853
cmp rax, r8
je 0x180085853
cmp rax, r9
je 0x180085848
cmp rax, r10
je 0x180085848
cmp rax, r11
je 0x180085853
jmp 0x1800856e5
cmp rax, rcx
je 0x180085853
cmp rax, rdi
je 0x180085853
cmp rax, r14
je 0x180085848
cmp rax, r12
je 0x180085853
movabs rcx, 0xfb0ce58f438fe2a6
cmp rax, rcx
je 0x180085848
lea r14, [rbp + 0x40]
cmp qword [rbp + 0x38], 8
cmova r14, qword [rbp + 0x40]
mov rdi, qword [0x180186ea8]
mov rcx, qword [0x180186eb0]
cmp rdi, rcx
je 0x1800857c9
nop word [rax + rax]
cmp qword [rdi], rax
je 0x180085723
add rdi, 0x20
cmp rdi, rcx
jne 0x180085710
jmp 0x1800857c9
lea rcx, [rbp + 0x20]
call fcn.180083ef0
mov qword [rbx], rax
add rbx, 8
mov r8, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
cmp rdx, r8
je 0x180085797
mov rax, qword [rdx]
mov qword [rbx], rax
mov rax, qword [rdx + 8]
mov qword [rbx + 8], rax
add rbx, 0x10
mov rcx, qword [rdx + 0x10]
mov rsi, qword [rdx + 0x18]
add rsi, r14
mov rax, rcx
and eax, 3
mov rdi, rbx
jne 0x180085770
shr rcx, 2
rep movsd dword [rdi], dword [rsi]
jmp 0x180085780
cmp rax, 2
jne 0x18008577e
shr rcx, 1
rep movsw word [rdi], word [rsi]
jmp 0x180085780
rep movsb byte [rdi], byte [rsi]
add rbx, qword [rdx + 0x10]
add rdx, 0x20
cmp rdx, r8
jne 0x180085740
movabs rsi, 0x26efb703382e92fd
movabs r11, 0x889f8b4975721ba3
movabs r10, 0x8012fbb270cb163d
movabs r9, 0x566c1c811e86d8fd
movabs r8, 0x2b9fff192bd4c83e
movabs rdx, 0x8cb0c9a388179fe5
mov rax, qword [0x180186ec8]
mov r12, qword [0x180186ec0]
cmp r12, rax
je 0x180085a12
lea r14, [r12 + 0x20]
mov r13, rax
nop dword [rax + rax]
mov rax, qword [r12]
mov qword [rbx], rax
mov rax, qword [r14 - 0x18]
mov qword [rbx + 8], rax
add rbx, 0x10
mov rax, qword [r14 - 0x18]
cmp rax, rdx
ja 0x1800858bc
je 0x180085b41
cmp rax, rsi
je 0x180085b4c
cmp rax, r8
je 0x180085b4c
cmp rax, r9
je 0x180085b41
cmp rax, r10
je 0x180085b41
cmp rax, r11
je 0x180085b4c
jmp 0x18008591b
mov rax, qword [rbp + 0x38]
mov qword [rbx], rax
add rbx, 8
lea rsi, [rbp + 0x40]
mov rcx, qword [rbp + 0x38]
cmp rcx, 8
cmova rsi, qword [rbp + 0x40]
mov rax, rcx
and eax, 3
mov rdi, rbx
jne 0x18008589d
shr rcx, 2
rep movsd dword [rdi], dword [rsi]
add rbx, qword [rbp + 0x38]
movabs rsi, 0x26efb703382e92fd
jmp 0x1800857c9
rep movsb byte [rdi], byte [rsi]
add rbx, qword [rbp + 0x38]
movabs rsi, 0x26efb703382e92fd
jmp 0x1800857c9
cmp rax, 2
jne 0x180085888
shr rcx, 1
rep movsw word [rdi], word [rsi]
add rbx, qword [rbp + 0x38]
movabs rsi, 0x26efb703382e92fd
jmp 0x1800857c9
movabs rcx, 0xa00a62a942b20165
cmp rax, rcx
je 0x180085b4c
movabs rcx, 0xbaaedcff023465cb
cmp rax, rcx
je 0x180085b4c
movabs rcx, 0xbf1d25349b935bb7
cmp rax, rcx
je 0x180085b41
movabs rcx, 0xcd2fd49bc6b014bd
cmp rax, rcx
je 0x180085b4c
movabs rcx, 0xfb0ce58f438fe2a6
cmp rax, rcx
je 0x180085b41
cmp qword [r14 - 8], 8
mov r15, r14
jbe 0x180085928
mov r15, qword [r14]
mov rdi, qword [0x180186ea8]
mov rcx, qword [0x180186eb0]
cmp rdi, rcx
je 0x1800859c7
nop
cmp qword [rdi], rax
je 0x180085950
add rdi, 0x20
cmp rdi, rcx
jne 0x180085940
jmp 0x1800859c7
mov rcx, r12
call fcn.180083ef0
mov qword [rbx], rax
add rbx, 8
mov r8, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
cmp rdx, r8
je 0x1800859bd
nop dword [rax]
mov rax, qword [rdx]
mov qword [rbx], rax
mov rax, qword [rdx + 8]
mov qword [rbx + 8], rax
add rbx, 0x10
mov rcx, qword [rdx + 0x10]
mov rsi, qword [rdx + 0x18]
add rsi, r15
mov rax, rcx
and eax, 3
mov rdi, rbx
jne 0x1800859a0
shr rcx, 2
rep movsd dword [rdi], dword [rsi]
jmp 0x1800859b0
cmp rax, 2
jne 0x1800859ae
shr rcx, 1
rep movsw word [rdi], word [rsi]
jmp 0x1800859b0
rep movsb byte [rdi], byte [rsi]
add rbx, qword [rdx + 0x10]
add rdx, 0x20
cmp rdx, r8
jne 0x180085970
movabs rdx, 0x8cb0c9a388179fe5
add r12, 0x28
add r14, 0x28
cmp r12, r13
movabs rsi, 0x26efb703382e92fd
movabs r8, 0x2b9fff192bd4c83e
movabs r9, 0x566c1c811e86d8fd
movabs r10, 0x8012fbb270cb163d
movabs r11, 0x889f8b4975721ba3
jne 0x1800857f0
mov r13, qword [rbp + 0x60]
mov r15, qword [rbp + 0x70]
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, r13d
mov rdx, qword [rbp]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
lea rcx, [rbp + 0x20]
call fcn.18005fe30
test edi, edi
je 0x180085453
movabs rax, 0xd3c9ff4fdd686e9a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0xc8f2fa73e74a84a8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0x2783af1bfbcc4a4a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0x1ff919c82860edf2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rdx, 0xbcaadf2bb81e0fe9
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rcx, 0xbc9388068023e2c6
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0x42efc67ddba22523
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0x1ff919c82842cdc8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0xbcaadf2bb81e0fcb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp], rcx
mov rax, qword [rbp]
mov al, 1
jmp 0x1800855bc
mov rax, qword [r14 - 8]
mov qword [rbx], rax
add rbx, 8
mov rcx, qword [r14 - 8]
mov rsi, r14
cmp rcx, 8
jbe 0x180085b5c
mov rsi, qword [r14]
mov rax, rcx
and eax, 3
mov rdi, rbx
jne 0x180085b81
shr rcx, 2
rep movsd dword [rdi], dword [rsi]
add rbx, qword [r14 - 8]
jmp 0x1800859c7
rep movsb byte [rdi], byte [rsi]
add rbx, qword [r14 - 8]
jmp 0x1800859c7
cmp rax, 2
jne 0x180085b76
shr rcx, 1
rep movsw word [rdi], word [rsi]
add rbx, qword [r14 - 8]
jmp 0x1800859c7