Function at 0x18002de80
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x400
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1800964f0]
xor rax, rsp
mov qword [rsp + 0x3f0], rax
mov rbx, rcx
mov edx, 0x5c
call fcn.180051920
test rax, rax
je 0x18002e485
mov ecx, 0x2c
mov word [rsp + 0x80], cx
xor ecx, ecx
mov qword [rsp + 0x82], rcx
mov qword [rsp + 0x8a], rcx
mov qword [rsp + 0x92], rcx
mov qword [rsp + 0x9a], rcx
mov qword [rsp + 0xa2], rcx
mov qword [rsp + 0xaa], rcx
mov qword [rsp + 0xb2], rcx
mov dword [rsp + 0xba], ecx
mov word [rsp + 0xbe], cx
lea rsi, [rax + 1]
lea rdi, [rsp + 0x80]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
movzx eax, byte [rsi + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x18002df30
lea rdi, [rsp + 0x80]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x180080bd0]
mov word [rdi - 1], ax
mov byte [rsp + 0x1d0], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x1d1]
call fcn.180055310
lea rcx, [rsp + 0x1d0]
call fcn.1800012e0
cmp byte [rsp + 0x1d0], 0
je 0x18002e007
lea rdx, [0x18007fd38]
lea rcx, [rsp + 0x1d0]
call fcn.180050a28
mov rdi, rax
test rax, rax
je 0x18002e007
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, rax
call fcn.180051050
mov rcx, rdi
call fcn.180050f34
test eax, eax
jg 0x18002dfce
mov rcx, rdi
call fcn.1800511e8
jmp 0x18002e007
mov rcx, rdi
call fcn.180050820
mov byte [rsp + 0x20], 0
mov r9, rdi
mov edx, 1
mov r8, rdx
lea rcx, [rsp + 0x20]
call fcn.180050ccc
cmp eax, 1
je 0x18002dfff
mov rcx, rdi
call fcn.1800511e8
jmp 0x18002e007
mov rcx, rdi
call fcn.1800511e8
mov byte [rsp + 0xc0], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0xc1]
call fcn.180055310
lea rcx, [rsp + 0xc0]
call fcn.1800013e0
cmp byte [rsp + 0xc0], 0
je 0x18002e0b4
lea rdx, [0x18007fd38]
lea rcx, [rsp + 0xc0]
call fcn.180050a28
mov rdi, rax
test rax, rax
je 0x18002e0b4
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, rax
call fcn.180051050
mov rcx, rdi
call fcn.180050f34
test eax, eax
jg 0x18002e07b
mov rcx, rdi
call fcn.1800511e8
jmp 0x18002e0b4
mov rcx, rdi
call fcn.180050820
mov byte [rsp + 0x20], 0
mov r9, rdi
mov edx, 1
mov r8, rdx
lea rcx, [rsp + 0x20]
call fcn.180050ccc
cmp eax, 1
je 0x18002e0ac
mov rcx, rdi
call fcn.1800511e8
jmp 0x18002e0b4
mov rcx, rdi
call fcn.1800511e8
call fcn.1800011c0
xor edx, edx
lea rcx, [0x1800a6a20]
call fcn.180054f78
test eax, eax
jne 0x18002e23d
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x1800a4190]
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp rcx, 4
jbe 0x18002e108
lea rdx, [rsp + 0x80]
lea rcx, [0x1800a4190]
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
test rax, rax
jne 0x18002e23d
xor r8d, r8d
xor edx, edx
lea rcx, [0x1800a6a20]
call fcn.180005580
mov ebx, eax
mov dword [reloc.WS2_32.dll_accept], 0
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [rsp + 0x1d0], 0
je 0x18002e1b3
lea rdx, [0x18007fd38]
lea rcx, [rsp + 0x1d0]
call fcn.180050a28
mov rdi, rax
test rax, rax
je 0x18002e1b3
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, rax
call fcn.180051050
mov rcx, rdi
call fcn.180050f34
test eax, eax
jg 0x18002e17a
mov rcx, rdi
call fcn.1800511e8
jmp 0x18002e1b3
mov rcx, rdi
call fcn.180050820
mov byte [rsp + 0x20], 0x4d
mov r9, rdi
mov edx, 1
mov r8, rdx
lea rcx, [rsp + 0x20]
call fcn.180050ccc
cmp eax, 1
je 0x18002e1ab
mov rcx, rdi
call fcn.1800511e8
jmp 0x18002e1b3
mov rcx, rdi
call fcn.1800511e8
cmp byte [rsp + 0xc0], 0
je 0x18002e236
lea rdx, [0x18007fd38]
lea rcx, [rsp + 0xc0]
call fcn.180050a28
mov rdi, rax
test rax, rax
je 0x18002e236
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, rax
call fcn.180051050
mov rcx, rdi
call fcn.180050f34
test eax, eax
jg 0x18002e1fd
mov rcx, rdi
call fcn.1800511e8
jmp 0x18002e236
mov rcx, rdi
call fcn.180050820
mov byte [rsp + 0x20], 0x4d
mov r9, rdi
mov edx, 1
mov r8, rdx
lea rcx, [rsp + 0x20]
call fcn.180050ccc
cmp eax, 1
je 0x18002e22e
mov rcx, rdi
call fcn.1800511e8
jmp 0x18002e236
mov rcx, rdi
call fcn.1800511e8
mov eax, ebx
jmp 0x18002e485
mov byte [rsp + 0x2e0], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x2e1]
call fcn.180055310
lea rcx, [rsp + 0x2e0]
sub rcx, rbx
nop word [rax + rax]
movzx eax, byte [rbx]
mov byte [rcx + rbx], al
inc rbx
test al, al
jne 0x18002e270
mov qword [rsp + 0x78], select
mov qword [rsp + 0x70], 0
mov byte [rsp + 0x60], al
xor r8d, r8d
lea rdx, [0x18007584f]
lea rcx, [rsp + 0x58]
call fcn.1800026a0
nop
mov qword [rsp + 0x48], select
mov qword [rsp + 0x40], 0
mov byte [rsp + 0x30], 0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rsi
lea rcx, [rsp + 0x28]
call fcn.1800026a0
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x28]
call fcn.180027550
cmp eax, 1
jne 0x18002e31f
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x2e0]
nop dword [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
test al, al
jne 0x18002e310
cmp dword [0x1800a2a8c], 0
je 0x18002e346
lea rcx, [rsp + 0x2e0]
call fcn.1800042f0
lea rcx, [rsp + 0x2e0]
call fcn.1800040e0
mov ebx, eax
jmp 0x18002e355
lea rcx, [rsp + 0x2e0]
call fcn.1800040e0
mov ebx, eax
mov dword [reloc.WS2_32.dll_accept], 0
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [rsp + 0x1d0], 0
je 0x18002e3ed
lea rdx, [0x18007fd38]
lea rcx, [rsp + 0x1d0]
call fcn.180050a28
mov rdi, rax
test rax, rax
je 0x18002e3ed
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, rax
call fcn.180051050
mov rcx, rdi
call fcn.180050f34
test eax, eax
jg 0x18002e3b4
mov rcx, rdi
call fcn.1800511e8
jmp 0x18002e3ed
mov rcx, rdi
call fcn.180050820
mov byte [rsp + 0x20], 0x4d
mov r9, rdi
mov edx, 1
mov r8, rdx
lea rcx, [rsp + 0x20]
call fcn.180050ccc
cmp eax, 1
je 0x18002e3e5
mov rcx, rdi
call fcn.1800511e8
jmp 0x18002e3ed
mov rcx, rdi
call fcn.1800511e8
cmp byte [rsp + 0xc0], 0
je 0x18002e471
lea rdx, [0x18007fd38]
lea rcx, [rsp + 0xc0]
call fcn.180050a28
mov rdi, rax
test rax, rax
je 0x18002e471
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, rax
call fcn.180051050
mov rcx, rdi
call fcn.180050f34
test eax, eax
jg 0x18002e437
mov rcx, rdi
call fcn.1800511e8
jmp 0x18002e471
mov rcx, rdi
call fcn.180050820
mov byte [rsp + 0x20], 0x4d
mov r9, rdi
mov edx, 1
mov r8, rdx
lea rcx, [rsp + 0x20]
call fcn.180050ccc
cmp eax, 1
je 0x18002e468
mov rcx, rdi
call fcn.1800511e8
jmp 0x18002e471
mov rcx, rdi
call fcn.1800511e8
nop
cmp qword [rsp + 0x78], 0x10
jb 0x18002e483
mov rcx, qword [rsp + 0x60]
call fcn.180050528
mov eax, ebx
mov rcx, qword [rsp + 0x3f0]
xor rcx, rsp
call fcn.180050540
lea r11, [rsp + 0x400]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret