Function at 0x180093224
Capabilities:
Create thread
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov qword [rbp - 0x39], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov rbx, rdx
mov rdi, rcx
lea rdx, [0x1802c7412]
lea rcx, [0x1802c7424]
call fcn.18008fbf4
mov dword [0x1802a6c5c], 0xa1
xor r15d, r15d
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, [0x180093214]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rax, [rbp - 0x11]
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov rdx, rbx
lea rcx, [rbp - 0x11]
call fcn.18005fac0
lea rdx, [rbp - 0x11]
lea rcx, [rbp - 0x31]
call fcn.180090a7c
nop
cmp qword [rbp - 0x21], r15
jne 0x18009338b
mov r14d, 0x1000
mov rdx, qword [rbp - 0x19]
cmp rdx, 0x10
jb 0x1800932fe
inc rdx
mov rcx, qword [rbp - 0x31]
mov rax, rcx
cmp rdx, r14
jb 0x1800932f9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800936ab
call fcn.18009e42c
mov qword [rbp - 0x21], r15
mov esi, reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x19], rsi
mov byte [rbp - 0x31], r15b
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x180093345
mov rcx, qword [rdi]
inc rdx
cmp rdx, r14
jb 0x180093340
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800936b1
mov rcx, r8
call fcn.18009e42c
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], rsi
mov byte [rdi], r15b
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x18009366f
inc rdx
mov rcx, qword [rbx]
cmp rdx, r14
jb 0x18009366a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180093699
jmp 0x180093667
mov qword [rbp + 0x1f], r15
mov qword [rbp + 0x27], r15
lea rdx, [rbp - 0x31]
lea rcx, [rbp + 0xf]
call fcn.18005fac0
lea rcx, [rbp + 0xf]
call fcn.180091eec
test al, al
jne 0x18009347b
mov r14d, 0x1000
mov rdx, qword [rbp - 0x19]
cmp rdx, 0x10
jb 0x1800933ee
inc rdx
mov rcx, qword [rbp - 0x31]
mov rax, rcx
cmp rdx, r14
jb 0x1800933e9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800936b7
call fcn.18009e42c
mov qword [rbp - 0x21], r15
mov esi, reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x19], rsi
mov byte [rbp - 0x31], r15b
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x180093435
mov rcx, qword [rdi]
inc rdx
cmp rdx, r14
jb 0x180093430
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800936bd
mov rcx, r8
call fcn.18009e42c
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], rsi
mov byte [rdi], r15b
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x18009366f
inc rdx
mov rcx, qword [rbx]
cmp rdx, r14
jb 0x18009366a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18009369f
jmp 0x180093667
mov rcx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x180093488
mov rcx, qword [rdi]
mov qword [rsp + 0x30], r15
mov eax, 2
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
xor r9d, r9d
mov edx, 0x1f01ff
lea r8d, [rax - 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1800935b2
mov dword [rbp + 0x6f], r15d
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x6f]
mov r8d, 0x19ec0
lea rdx, [0x1802a6ce0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov r14d, 0x1000
mov rdx, qword [rbp - 0x19]
cmp rdx, 0x10
jb 0x180093523
inc rdx
mov rcx, qword [rbp - 0x31]
mov rax, rcx
cmp rdx, r14
jb 0x18009351e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800936c3
call fcn.18009e42c
mov qword [rbp - 0x21], r15
mov esi, reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x19], rsi
mov byte [rbp - 0x31], r15b
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x18009356a
mov rcx, qword [rdi]
inc rdx
cmp rdx, r14
jb 0x180093565
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800936c9
mov rcx, r8
call fcn.18009e42c
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], rsi
mov byte [rdi], r15b
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1800935ab
inc rdx
mov rcx, qword [rbx]
cmp rdx, r14
jb 0x1800935a6
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800936cf
mov rcx, r8
call fcn.18009e42c
mov al, 1
jmp 0x180093671
mov r14d, 0x1000
mov rdx, qword [rbp - 0x19]
cmp rdx, 0x10
jb 0x1800935ef
inc rdx
mov rcx, qword [rbp - 0x31]
mov rax, rcx
cmp rdx, r14
jb 0x1800935ea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800936d5
call fcn.18009e42c
mov qword [rbp - 0x21], r15
mov esi, reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x19], rsi
mov byte [rbp - 0x31], r15b
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x180093632
mov rcx, qword [rdi]
inc rdx
cmp rdx, r14
jb 0x18009362d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180093693
mov rcx, r8
call fcn.18009e42c
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], rsi
mov byte [rdi], r15b
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x18009366f
inc rdx
mov rcx, qword [rbx]
cmp rdx, r14
jb 0x18009366a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800936a5
mov rcx, r8
call fcn.18009e42c
xor al, al
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], rsi
mov byte [rbx], r15b
mov rbx, qword [rsp + 0xf8]
add rsp, 0xb0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.1801c897c
nop
call fcn.1801c897c
int3
call fcn.1801c897c
int3
call fcn.1801c897c
nop
call fcn.1801c897c
nop
call fcn.1801c897c
nop
call fcn.1801c897c
nop
call fcn.1801c897c
nop
call fcn.1801c897c
nop
call fcn.1801c897c
nop
call fcn.1801c897c
nop
call fcn.1801c897c
int3