Function at 0x18005ffe0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x1800ab9c8]
xor rax, rsp
mov qword [rsp + 0x80], rax
lea esi, [rcx + 8]
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x58], esi
mov rbp, r9
mov rdi, r8
mov r15, rdx
mov ebx, ecx
cmp ecx, esi
jae case.0x180060075.3
mov rdx, qword [rsp + 0x50]
lea r13d, [rcx - 0x4c]
mov r14, qword [rsp + 0x50]
lea r8, [0x180000000]
movzx r12d, word [rsp + 0x30]
lea r9, str.PKWND
mov qword [rsp + 0x48], rdx
lea r10, [0x18009e524]
mov qword [rsp + 0x50], r14
mov r11d, 1
cmp r13d, 0x10
ja case.0x180060075.4
mov ecx, dword [r8 + r13*4 + 0x6046c]
add rcx, r8
jmp rcx
cmp qword [r15], 0
mov r12d, r11d
je 0x180060462
jmp case.0x180060075.4
xor eax, eax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x12e
mov rcx, r15
call fcn.18003d590
lea r8, [0x180000000]
lea r9, str.PKWND
lea r10, [0x18009e524]
jmp 0x180060427
cmp rdx, 1
je case.0x180060075.4
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov byte [rsp + 0x30], 0
movzx eax, word [rsp + 0x30]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.180089600
mov rbx, qword [rsp + 0xd0]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rdx, [0x18009e518]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov qword [rsp + 0x50], rax
mov r14, rax
test rax, rax
je 0x1800600d0
mov r9, rax
mov edx, 0x1093
mov r8d, 1
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rdx, rax
mov qword [rsp + 0x48], rax
lea r8, [0x180000000]
lea r9, str.PKWND
lea r10, [0x18009e524]
jmp 0x18006042c
mov rcx, qword [r15]
mov edx, 0x2f
call sub.VCRUNTIME140.dll_strchr
mov r14, rax
test rax, rax
je 0x180060452
mov rcx, qword [r15]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rcx + rax], 0
jne 0x180060180
cmp rax, 8
jb 0x180060462
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x1800601a0
cmp rax, 0xb
ja 0x180060462
lea rsi, [r14 + 1]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rsi + rax], 0
jne 0x1800601c0
mov r8d, ILFindLastID
mov dword [rsp + 0x38], eax
mov rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.180064a80
test eax, eax
je 0x180060462
mov rdx, qword [r15]
lea rcx, [rsp + 0x38]
mov eax, r14d
mov r8d, ILFindLastID
sub eax, dword [r15]
mov dword [rsp + 0x38], eax
call fcn.180064a80
test eax, eax
je 0x180060462
mov rax, r14
sub rax, qword [r15]
sub rax, 5
cmp rax, 1
ja 0x180060462
mov ebx, 7
nop word [rax + rax]
lea r8, [0x180000000]
cmp ebx, 7
ja case.default.0x18006024d
mov eax, ebx
mov ecx, dword [r8 + rax*4 + 0x604b0]
add rcx, r8
jmp rcx
test r12w, r12w
je case.default.0x18006024d
inc dword [rdi]
jmp case.default.0x18006024d
lea rcx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
lea rcx, [rsp + 0x60]
cmp eax, 0x63
jle 0x1800602c5
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov ecx, eax
mov eax, 0x51eb851f
imul ecx
lea rcx, [rsp + 0x60]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [rbp + 0x21c], edx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov ecx, eax
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x64
sub ecx, eax
mov dword [rbp + 0x220], ecx
add dword [rdi], 2
jmp 0x180060367
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov dword [rbp + 0x220], eax
mov ecx, eax
add dword [rdi], 2
jmp 0x180060367
xor eax, eax
mov dword [rsp + 0x60], eax
jmp case.default.0x18006024d
lea rdx, [rsp + 0x60]
mov rax, rsi
sub rdx, rsi
movzx ecx, byte [rax]
mov byte [rdx + rax], cl
lea rax, [rax + 1]
test cl, cl
jne 0x1800602f1
jmp case.default.0x18006024d
mov rdx, qword [r15]
lea rcx, [rsp + 0x60]
xor eax, eax
mov r8, r14
sub r8, rdx
mov dword [rsp + 0x60], eax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
lea rcx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov dword [rbp + 0x214], eax
jmp 0x180060367
lea rcx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov dword [rbp + 0x218], eax
xor eax, eax
mov dword [rsp + 0x60], eax
mov byte [rsp + 0x64], al
jmp 0x180060367
mov rdx, qword [r15]
lea rcx, [rsp + 0x60]
mov r8, r14
sub r8, rdx
add rdx, 3
sub r8, 3
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
lea r8, [0x180000000]
dec ebx
lea eax, [rbx + 0xb]
cmp eax, 0xa
ja 0x180060230
mov ebx, dword [rsp + 0x40]
lea r9, str.PKWND
mov esi, dword [rsp + 0x58]
lea r10, [0x18009e524]
mov r14, qword [rsp + 0x50]
jmp 0x180060427
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov byte [rsp + 0x30], 1
jmp 0x1800600a3
mov rdx, qword [r15]
cmp byte [rdx], 0x50
jne 0x1800603c3
cmp byte [rdx + 1], 0x4b
jne 0x1800603c3
cmp byte [rdx + 2], 0
je 0x1800603ea
xor r11d, r11d
mov ecx, r11d
nop dword [rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r9 + rcx - 1]
jne 0x180060462
cmp rcx, 6
jne 0x1800603d0
jmp 0x1800603ed
xor r11d, r11d
mov rdx, qword [r15 + 8]
add r15, 8
test rdx, rdx
je 0x180060462
mov rcx, r11
nop dword [rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r10 + rcx - 1]
jne 0x18006041e
cmp rcx, 4
jne 0x180060400
mov rdx, qword [r15 + 8]
add r15, 8
jmp 0x180060422
movzx r12d, r11w
test rdx, rdx
je 0x180060462
mov rdx, qword [rsp + 0x48]
mov r11d, 1
inc ebx
inc r13d
mov dword [rsp + 0x40], ebx
cmp ebx, esi
jb 0x180060060
jmp case.0x180060075.3
mov eax, 1
jmp 0x1800600da
mov ecx, dword [rdi]
inc ecx
mov dword [rdi], ecx
test r12w, r12w
je 0x180060462
inc ecx
mov dword [rdi], ecx
xor eax, eax
jmp 0x1800600da