Function at 0x18002c040
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], r9
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xb0
mov rsi, qword [rbp - 0x41]
lea eax, [rcx - 0xb]
xor ebx, ebx
mov dword [rbp - 0x59], ecx
mov dword [rbp - 0x49], eax
mov r12, r8
mov r13, rdx
mov r8d, ecx
cmp ecx, eax
jbe 0x18002c533
mov rax, qword [rbp - 0x41]
mov r15, qword [rbp - 0x41]
mov r14, qword [rbp - 0x41]
mov rdi, qword [rbp - 0x41]
mov edx, dword [rbp - 0x49]
mov qword [rbp - 0x51], rax
mov eax, ecx
add eax, 0xffffff2d
lea r8, [0x180000000]
movabs r10, 0x7900610065
cmp eax, 0x2d
ja case.0x18002c0cd.222
movzx eax, byte [r8 + rax + 0x2c6ac]
mov ecx, dword [r8 + rax*4 + 0x2c67c]
add rcx, r8
jmp rcx
mov rax, qword [r12]
mov rcx, qword [rax + 0x28]
mov qword [rbp - 0x51], rcx
jmp 0x18002c0fe
mov rdx, qword [r12]
mov eax, dword [r13]
mov ecx, dword [rdx + 0x44]
shl eax, cl
or dword [rdx + 0x40], eax
mov rcx, qword [r12]
mov eax, dword [rcx + 0x38]
add dword [rcx + 0x44], eax
mov edx, dword [rbp - 0x49]
mov rcx, qword [rbp - 0x51]
mov eax, dword [rbp - 0x59]
mov r9, qword [rbp + 0x7f]
dec eax
mov dword [rbp - 0x59], eax
cmp eax, edx
ja 0x18002c09e
mov r8d, dword [rbp + 0x67]
lea r15d, [r8 + 0x30c]
cmp r8d, r15d
jae 0x18002c65d
mov rdi, qword [rbp - 0x41]
mov r14, qword [rbp - 0x41]
nop word [rax + rax]
cmp r8d, 0x14e
ja 0x18002c606
je 0x18002c5fc
mov eax, r8d
sub eax, 0xea
je 0x18002c5d6
sub eax, 0xb
je 0x18002c587
sub eax, 0xb
je 0x18002c540
sub eax, 0x38
je 0x18002c65d
cmp eax, 0xb
jne 0x18002c640
lea r8, [rbp - 1]
lea edx, [rax + 0x25]
lea ecx, [rax + 0x3f]
call fcn.180007c20
mov edx, 8
lea r8, [rbp - 0x21]
mov rdi, rax
lea ecx, [rdx + 0x42]
call fcn.180007c20
mov r14, rax
jmp 0x18002c638
lea rcx, [rbp - 1]
sub rcx, 2
nop dword [rax + rax]
cmp word [rcx + 2], bx
lea rcx, [rcx + 2]
jne 0x18002c1b0
mov eax, dword [0x1800a5bb4]
lea rdx, [rbp + 0xb]
mov dword [rcx], eax
mov r8d, 0xa
mov eax, dword [0x1800a9508]
mov dword [rbp + 1], eax
mov qword [rbp + 5], r10
lea ecx, [r8 - 7]
call fcn.18007ca80
jmp 0x18002c0f7
movsxd rax, dword [r13]
mov r15, rbx
mov rcx, qword [rbp - 0x31]
mov rsi, qword [rcx + rax*8 + 0x60]
test rsi, rsi
je 0x18002c211
mov rax, qword [r9]
nop
cmp qword [rsi + 0x10], rax
jae 0x18002c211
mov r15, rsi
mov rsi, qword [rsi]
test rsi, rsi
jne 0x18002c200
mov rcx, qword [rbp - 0x51]
mov eax, 0xe9
jmp 0x18002c101
mov r8d, 3
lea rdx, [0x1800a7178]
lea rcx, [rbp + 0xd]
call fcn.18007c17c
lea rcx, [rbp - 1]
sub rcx, 2
nop dword [rax]
cmp word [rcx + 2], bx
lea rcx, [rcx + 2]
jne 0x18002c240
mov eax, dword [0x1800a81e0]
mov dword [rcx], eax
movzx eax, word [0x1800a81e4]
mov word [rcx + 4], ax
mov dword [rbp + 0x15], 0x6c
mov dword [rbp - 0x21], 0x73
jmp 0x18002c0f7
mov word [rbp - 1], bx
jmp case.0x18002c0cd.222
mov rcx, qword [r12]
mov rax, qword [rcx + 8]
mov qword [rbp - 0x31], rax
mov rax, qword [r9]
cmp rax, 0x3b9ac9e8
jbe 0x18002c2b4
mov qword [rbp - 0x41], rcx
lea r8, [rbp - 0x39]
lea rcx, [rbp - 0x41]
mov dword [rbp - 0x39], 1
mov edx, 0xae
call fcn.180009dc0
mov r9, qword [rbp + 0x7f]
mov rax, qword [r9]
mov rcx, rax
and ecx, 7
jbe 0x18002c2c6
sub rax, rcx
add rax, 8
mov qword [r9], rax
cmp dword [r13], 1
jbe 0x18002c0f7
mov rax, qword [r12]
mov rcx, qword [rax]
mov dword [rcx + 0x28], 0xe
mov rax, qword [r12]
mov rcx, qword [rax]
mov eax, dword [r13]
mov dword [rcx + 0x2c], eax
mov rcx, qword [r12]
mov rax, qword [rcx]
call qword [rax]
jmp 0x18002c0f7
test rsi, rsi
jne case.0x18002c0cd.222
mov edx, 0xb8
nop dword [rax]
lea eax, [rdx - 0xb3]
cmp eax, 5
ja case.default.0x18002c32a
mov ecx, dword [r8 + rax*4 + 0x2c6dc]
add rcx, r8
jmp rcx
mov r14, qword [r9]
add r14, 0x18
jmp case.default.0x18002c32a
mov r8, qword [rbp - 0x31]
lea eax, [r14 + rdi]
add dword [r8 + 0x90], eax
mov qword [rsi], rbx
mov qword [rsi + 8], rbx
jmp 0x18002c456
movsxd rax, dword [r13]
test r15, r15
jne 0x18002c366
mov rcx, qword [r8 + rax*8 + 0xa2f88]
jmp 0x18002c36e
mov rcx, qword [r8 + rax*8 + 0xa2f98]
mov edi, 0x3b9aca00
sub rdi, r14
cmp rcx, rdi
cmovbe rdi, rcx
jmp case.default.0x18002c32a
mov eax, 0xe8
mov dword [rbp - 0x59], eax
jmp 0x18002c460
mov rcx, qword [r9]
add rcx, rdi
mov qword [rsi + 0x10], rcx
test r15, r15
jne 0x18002c3b0
movsxd rax, dword [r13]
mov rcx, qword [rbp - 0x31]
mov qword [rcx + rax*8 + 0x60], rsi
jmp case.default.0x18002c32a
mov qword [r15], rsi
jmp case.default.0x18002c32a
lea rax, [rdi + r14]
mov qword [rsp + 0x20], rbx
mov qword [rbp - 0x29], rax
lea rdx, [rbp - 0x29]
mov rax, qword [r12]
lea rcx, [rbp - 0x39]
xor r9d, r9d
mov qword [rbp - 0x39], rax
mov r8d, 0xd3
call fcn.1800402d0
mov rsi, rax
test rax, rax
jne 0x18002c44d
nop dword [rax + rax]
shr rdi, 1
cmp rdi, 0x32
jae 0x18002c41a
mov rax, qword [r12]
lea r8, [rbp - 0x39]
mov edx, 0xae
mov qword [rbp - 0x41], rax
lea rcx, [rbp - 0x41]
mov dword [rbp - 0x39], 2
call fcn.180009dc0
lea rax, [rdi + r14]
mov qword [rsp + 0x20], rbx
mov qword [rbp - 0x29], rax
lea rdx, [rbp - 0x29]
mov rax, qword [r12]
lea rcx, [rbp - 0x39]
xor r9d, r9d
mov qword [rbp - 0x39], rax
mov r8d, 0xd3
call fcn.1800402d0
mov rsi, rax
test rax, rax
je 0x18002c3f0
mov r9, qword [rbp + 0x7f]
mov edx, 0xb6
lea r8, [0x180000000]
mov eax, dword [rbp - 0x59]
dec edx
cmp edx, 0xb2
ja 0x18002c310
mov rcx, qword [rbp - 0x51]
mov edx, dword [rbp - 0x49]
jmp 0x18002c101
mov rdx, qword [r12]
cmp dword [rdx + 0x44], 8
jl 0x18002c0f7
nop dword [rax + rax]
movsxd rcx, dword [rdx + 0x54]
lea eax, [rcx + 1]
mov dword [rdx + 0x54], eax
mov rdx, qword [r12]
movzx eax, byte [rdx + 0x40]
mov byte [rcx + rdx + 0x59], al
mov rax, qword [r12]
cmp dword [rax + 0x54], 0xff
jl 0x18002c4cc
xor edx, edx
mov qword [rbp - 0x41], rax
lea r9, [rbp - 0x41]
xor r8d, r8d
lea ecx, [rdx + 0x3b]
call fcn.18005fd40
mov rax, qword [r12]
sar dword [rax + 0x40], 8
mov rax, qword [r12]
add dword [rax + 0x44], 0xfffffff8
mov rdx, qword [r12]
cmp dword [rdx + 0x44], 8
jge 0x18002c490
jmp 0x18002c0f7
mov eax, dword [0x1800a9508]
mov dword [rbp - 0x1f], eax
movzx eax, word [0x1800a950c]
mov word [rbp - 0x1b], ax
jmp case.0x18002c0cd.222
mov rcx, qword [r12]
mov rdx, qword [r12 + 8]
cmp rcx, rdx
je 0x18002c523
nop
movzx eax, byte [rcx + 0xc]
cmp al, byte [r13]
je 0x18002c52b
add rcx, 0x10
cmp rcx, rdx
jne 0x18002c510
mov rax, rbx
jmp 0x18002c661
mov rax, rcx
jmp 0x18002c661
mov rcx, qword [rbp - 0x41]
mov qword [rbp - 0x51], rcx
jmp 0x18002c112
mov r9, qword [rcx + 0x28]
mov edx, 1
mov rcx, qword [rcx + 0x30]
mov r8d, 0x1000
call fcn.180083240
cmp rax, 0x1000
je 0x18002c577
mov rax, qword [r12]
mov rcx, qword [rax]
mov dword [rcx + 0x28], 0x25
mov rcx, qword [r12]
mov rax, qword [rcx]
call qword [rax]
mov rcx, qword [rbp - 0x51]
mov rax, qword [rcx + 0x30]
mov qword [rcx], rax
jmp 0x18002c63c
mov r8d, 1
lea rdx, [0x1800a6bc8]
lea rcx, [rbp - 0x21]
call fcn.18007c134
mov r8d, 0xa
mov dword [rbp - 0x19], 0x61
lea rdx, [rbp - 0x15]
mov dword [rbp - 0x17], 0x79
lea ecx, [r8 - 7]
call fcn.18007ca80
movsd xmm0, qword [str.2.dll]
mov eax, dword [0x1800a9518]
movsd qword [rbp - 0x13], xmm0
mov dword [rbp - 0xb], eax
jmp 0x18002c638
mov rdx, qword [rsi + 8]
mov rcx, qword [r9]
add rcx, rdx
mov qword [rsi + 8], rcx
mov rax, qword [r9]
sub qword [rsi + 0x10], rax
lea rax, [rsi + 0x18]
mov rcx, qword [rbp - 0x51]
add rax, rdx
mov qword [rbp - 0x31], rax
jmp 0x18002c640
mov qword [rcx + 8], 0x1000
jmp 0x18002c640
mov eax, r8d
sub eax, 0x191
je 0x18002c62b
sub eax, 0xb
je 0x18002c656
sub eax, 0x43
je 0x18002c625
cmp eax, 0x4e
jne 0x18002c640
mov qword [r13], rbx
jmp 0x18002c640
mov qword [r12], rbx
jmp 0x18002c640
mov rcx, qword [r12]
call r14
mov rcx, qword [r13]
call rdi
mov rcx, qword [rbp - 0x51]
mov r8d, dword [rbp + 0x67]
add r8d, 0x4e
mov dword [rbp + 0x67], r8d
cmp r8d, r15d
jae 0x18002c65d
mov r9, qword [rbp + 0x7f]
jmp 0x18002c130
mov dword [rbp - 0x31], 1
mov rax, qword [rbp - 0x31]
mov rbx, qword [rsp + 0xf8]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret