Function at 0x18005ade0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov ebp, dword [rsp + 0xa0]
mov r14, rdx
mov r13, rcx
lea edi, [rbp - 0xb]
mov dword [rsp + 0x30], edi
cmp ebp, edi
jbe case.0x18005ae4e.0
mov r12, qword [rsp + 0x38]
lea r15d, [rbp - 0x60]
mov rsi, qword [rsp + 0x38]
xor ebx, ebx
lea rdx, [0x180000000]
cmp r15d, 0x2d
ja case.0x18005ae4e.10
movzx eax, byte [rdx + r15 + 0x5b0c8]
mov ecx, dword [rdx + rax*4 + 0x5b09c]
add rcx, rdx
jmp rcx
mov edi, 0x27
mov eax, edi
sub eax, 0x26
je case.0x18005ae4e.0
cmp eax, 1
jne 0x18005aeaf
mov r9d, SHTestTokenMembership
xor r8d, r8d
xor edx, edx
mov rcx, r13
call fcn.1800613e0
mov r9, r14
mov r8, r12
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rsi, rax
test rax, rax
je 0x18005aea6
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
mov qword [rsp + 0x38], rsi
test eax, eax
je 0x18005aeaf
mov qword [rsp + 0x38], 0xffffffffffffffff
dec edi
cmp edi, 0x25
ja 0x18005ae55
mov edi, dword [rsp + 0x30]
mov rsi, r13
jmp case.0x18005ae4e.10
test r13, r13
je 0x18005aeec
xor r9d, r9d
mov r8d, 0xfa
mov rdx, r13
xor ecx, ecx
call fcn.180071a70
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x98]
jmp 0x18005aeef
mov rax, rbx
test r14, r14
je 0x18005af01
cmp qword [r8], rax
jb 0x18005af01
mov r12, rbx
jmp case.0x18005ae4e.10
sub rax, qword [r8]
mov r12, qword [r9]
cmp rax, r12
cmovb r12, rax
jmp case.0x18005ae4e.10
mov rax, qword [r8]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x38], rax
mov r9, r14
lea rax, [rsp + 0xa0]
mov byte [rsp + 0xa0], 1
mov r8d, 0xc6
mov qword [rsp + 0x20], rax
mov rcx, r13
call fcn.180071540
mov rax, qword [r14]
mov qword [rsp + 0x38], rax
jmp case.0x18005ae4e.10
test r14, r14
jne case.0x18005ae4e.10
lea rax, [r14 - 1]
jmp 0x18005b082
test r14, r14
je 0x18005af7a
test byte [r14], 0x40
je 0x18005af7a
mov byte [rsp + 0x38], 1
jmp case.0x18005ae4e.10
mov byte [rsp + 0x38], bl
jmp case.0x18005ae4e.10
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
mov rdx, r14
lea ecx, [r9 + 0x15]
call fcn.180051ac0
test al, al
je 0x18005aff5
mov edi, 0xf9
mov eax, edi
sub eax, 0xf9
je 0x18005afd5
sub eax, 0x1c
je 0x18005afbc
cmp eax, 0x1c
je case.0x18005ae4e.0
jmp 0x18005afe6
mov rcx, qword [rsi]
mov r9d, 0xd0
xor r8d, r8d
xor edx, edx
call fcn.180011440
mov byte [rsp + 0x38], al
jmp 0x18005afe6
mov edx, pe_nt_image_headers64
mov rcx, r14
call fcn.180077a90
test al, al
je 0x18005b023
add edi, 0x1c
cmp edi, 0x14d
jb 0x18005afa3
mov edi, dword [rsp + 0x30]
xor edx, edx
mov ecx, 0xea
call fcn.180004f80
test al, al
je 0x18005b023
dec ebp
dec r15d
cmp ebp, edi
jbe case.0x18005ae4e.0
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x98]
jmp 0x18005ae2a
mov byte [rsp + 0x38], bl
jmp case.0x18005ae4e.0
test r14, r14
je 0x18005b065
mov qword [rsp + 0x28], rbx
mov r9d, 0x7d
xor r8d, r8d
mov qword [rsp + 0x20], r14
xor edx, edx
xor ecx, ecx
call fcn.18004ce80
test al, al
je 0x18005b05c
movzx eax, byte [r14 + 1]
lea rbx, [rax + r14]
mov rax, rbx
jmp 0x18005b082
mov eax, 4
lea rbx, [rax + r14]
mov rax, rbx
jmp 0x18005b082
xor r8d, r8d
mov rcx, r14
lea edx, [r8 + 0x21]
call fcn.1800107d0
mov byte [rsp + 0x38], al
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret