Function at 0x18005b590
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push r15
lea rbp, [rsp - 0x1a8]
sub rsp, 0x2a8
mov rax, qword [0x18015f040]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov rax, qword [0x18015f488]
mov rdx, qword [rax + rcx*8]
lea rax, [rbp - 0x80]
movzx ecx, word [0x18015fb90]
test cx, cx
je 0x18005b5f0
lea rdi, [0x18015fb90]
lea rsi, [rbp - 0x80]
sub rdi, rsi
nop
mov word [rax], cx
add rax, 2
movzx ecx, word [rdi + rax]
test cx, cx
jne 0x18005b5e0
xor edi, edi
mov word [rax], di
movzx ecx, word [rdx]
test cx, cx
je 0x18005b610
sub rdx, rax
mov word [rax], cx
add rax, 2
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x18005b600
mov qword [rsp + 0x30], rdi
lea rcx, [rbp - 0x80]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov qword [rsp + 0x2e0], r13
mov edx, 0x40000000
mov r8d, 1
mov dword [rsp + 0x20], 2
mov qword [rsp + 0x2a0], r14
mov word [rax], di
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x58], rax
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x18005b735
movabs rax, 0xbb62c62c9808ea37
mov dword [rsp + 0x48], 0x3e8
movabs r14, 0x2b9fff192bd4c83e
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x68], r14
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x70], 4
mov qword [rsp + 0x78], rdi
call fcn.18005a3f0
lea rcx, [rsp + 0x60]
call fcn.18005a4b0
mov rsi, qword [0x18015f4c0]
mov rdi, qword [0x18015f4b8]
lea r13, [rax + 0x10]
mov qword [rsp + 0x48], r13
cmp rdi, rsi
je 0x18005b6ed
nop dword [rax + rax]
mov rcx, rdi
call fcn.18005a4b0
add r13, 0x10
add rdi, 0x20
add r13, rax
cmp rdi, rsi
jne 0x18005b6d0
mov qword [rsp + 0x48], r13
xor r9d, r9d
xor r8d, r8d
mov edx, r13d
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x18005b87b
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x18005b87b
lea rcx, [rsp + 0x60]
call fcn.180051290
movabs rax, 0x71649d8c56e205db
movabs rcx, 0x9fe74ab83cc32036
mov qword [rsp + 0x40], rax
movabs rdi, 0x533253dc5763c53a
mov rax, qword [rsp + 0x40]
movabs rdx, 0x544f9e93a8b64bd
movabs rax, 0xfcc72fce5db00059
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
movabs rax, 0x836e95b82b10f1f8
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
movabs rax, 0x4fb67fc66961296c
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
movabs rax, 0xe6f325d644b32c4
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rdx
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rcx
mov rax, qword [rsp + 0x40]
movabs rax, 0xe21ce0df42769f97
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
movabs rax, 0x23df19e6070e4018
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
movabs rax, 0xe6f325d466b08a1
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
movabs rax, 0x544f9e93a8b649f
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rcx
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rdx
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rcx
mov rax, qword [rsp + 0x40]
xor al, al
mov r14, qword [rsp + 0x2a0]
mov r13, qword [rsp + 0x2e0]
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.1800e1360
add rsp, 0x2a8
pop r15
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 0x2d0], rbx
mov qword [rsp + 0x2d8], r12
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r13
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rsp + 0x60]
movabs rdx, 0x8cb0c9a388179fe5
mov qword [rsp + 0x40], rax
movabs rsi, 0x26efb703382e92fd
movabs rdi, 0xbf1d25349b935bb7
movabs r10, 0x889f8b4975721ba3
mov qword [rax], rcx
lea rbx, [rax + 8]
mov rcx, qword [rsp + 0x68]
movabs r8, 0x566c1c811e86d8fd
mov qword [rbx], rcx
movabs r9, 0x8012fbb270cb163d
mov rax, qword [rsp + 0x68]
add rbx, 8
movabs rcx, 0xbaaedcff023465cb
movabs r11, 0xa00a62a942b20165
movabs r12, 0xcd2fd49bc6b014bd
cmp rax, rdx
ja 0x18005b955
je 0x18005bb02
cmp rax, rsi
je 0x18005bb0e
cmp rax, r14
je 0x18005bb0e
cmp rax, r8
je 0x18005bb02
cmp rax, r9
je 0x18005bb02
cmp rax, r10
je 0x18005bb0e
jmp 0x18005b98c
cmp rax, r11
je 0x18005bb0e
cmp rax, rcx
je 0x18005bb0e
cmp rax, rdi
je 0x18005bb02
cmp rax, r12
je 0x18005bb0e
movabs rcx, 0xfb0ce58f438fe2a6
cmp rax, rcx
je 0x18005bb02
cmp qword [rsp + 0x70], 8
lea r14, [rsp + 0x78]
mov rdi, qword [0x18015f4a0]
mov rcx, qword [0x18015f4a8]
cmova r14, qword [rsp + 0x78]
cmp rdi, rcx
je 0x18005ba79
cmp qword [rdi], rax
je 0x18005b9c7
add rdi, 0x20
cmp rdi, rcx
jne 0x18005b9b4
jmp 0x18005ba79
lea rcx, [rsp + 0x60]
call fcn.18005a4b0
mov qword [rbx], rax
add rbx, 8
mov r8, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
cmp rdx, r8
je 0x18005ba47
nop word [rax + rax]
mov rax, qword [rdx]
mov qword [rbx], rax
mov rax, qword [rdx + 8]
mov qword [rbx + 8], rax
add rbx, 0x10
mov rcx, qword [rdx + 0x10]
mov rdi, rbx
mov rsi, qword [rdx + 0x18]
mov rax, rcx
add rsi, r14
and eax, 3
jne 0x18005ba20
shr rcx, 2
rep movsd dword [rdi], dword [rsi]
jmp 0x18005ba30
cmp rax, 2
jne 0x18005ba2e
shr rcx, 1
rep movsw word [rdi], word [rsi]
jmp 0x18005ba30
rep movsb byte [rdi], byte [rsi]
add rbx, qword [rdx + 0x10]
add rdx, 0x20
cmp rdx, r8
jne 0x18005b9f0
movabs rsi, 0x26efb703382e92fd
movabs r11, 0xa00a62a942b20165
movabs r10, 0x889f8b4975721ba3
movabs r9, 0x8012fbb270cb163d
movabs r8, 0x566c1c811e86d8fd
movabs rdx, 0x8cb0c9a388179fe5
mov rax, qword [0x18015f4c0]
mov r12, qword [0x18015f4b8]
cmp r12, rax
je 0x18005bcc6
lea r14, [r12 + 0x18]
mov r13, rax
nop dword [rax + rax]
mov rax, qword [r12]
mov qword [rbx], rax
mov rax, qword [r14 - 0x10]
mov qword [rbx + 8], rax
add rbx, 0x10
mov rax, qword [r14 - 0x10]
cmp rax, rdx
ja 0x18005bb7d
je 0x18005bdff
cmp rax, rsi
je 0x18005be0a
movabs rcx, 0x2b9fff192bd4c83e
cmp rax, rcx
je 0x18005be0a
cmp rax, r8
je 0x18005bdff
cmp rax, r9
je 0x18005bdff
cmp rax, r10
je 0x18005be0a
jmp 0x18005bbd2
mov rax, qword [rsp + 0x70]
mov qword [rbx], rax
add rbx, 8
mov rcx, qword [rsp + 0x70]
lea rsi, [rsp + 0x78]
cmp rcx, 8
mov rax, rcx
mov rdi, rbx
cmova rsi, qword [rsp + 0x78]
and eax, 3
jne 0x18005bb5d
shr rcx, 2
rep movsd dword [rdi], dword [rsi]
add rbx, qword [rsp + 0x70]
movabs rsi, 0x26efb703382e92fd
jmp 0x18005ba79
rep movsb byte [rdi], byte [rsi]
add rbx, qword [rsp + 0x70]
movabs rsi, 0x26efb703382e92fd
jmp 0x18005ba79
cmp rax, 2
jne 0x18005bb47
shr rcx, 1
rep movsw word [rdi], word [rsi]
add rbx, qword [rsp + 0x70]
movabs rsi, 0x26efb703382e92fd
jmp 0x18005ba79
cmp rax, r11
je 0x18005be0a
movabs rcx, 0xbaaedcff023465cb
cmp rax, rcx
je 0x18005be0a
movabs rcx, 0xbf1d25349b935bb7
cmp rax, rcx
je 0x18005bdff
movabs rcx, 0xcd2fd49bc6b014bd
cmp rax, rcx
je 0x18005be0a
movabs rcx, 0xfb0ce58f438fe2a6
cmp rax, rcx
je 0x18005bdff
cmp qword [r14 - 8], 8
mov r15, r14
jbe 0x18005bbdf
mov r15, qword [r14]
mov rdi, qword [0x18015f4a0]
mov rcx, qword [0x18015f4a8]
cmp rdi, rcx
je 0x18005bc79
cmp qword [rdi], rax
je 0x18005bc06
add rdi, 0x20
cmp rdi, rcx
jne 0x18005bbf6
jmp 0x18005bc79
mov rcx, r12
call fcn.18005a4b0
mov qword [rbx], rax
add rbx, 8
mov r8, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
cmp rdx, r8
je 0x18005bc6f
mov rax, qword [rdx]
mov qword [rbx], rax
mov rax, qword [rdx + 8]
mov qword [rbx + 8], rax
add rbx, 0x10
mov rcx, qword [rdx + 0x10]
mov rdi, rbx
mov rsi, qword [rdx + 0x18]
mov rax, rcx
add rsi, r15
and eax, 3
jne 0x18005bc52
shr rcx, 2
rep movsd dword [rdi], dword [rsi]
jmp 0x18005bc62
cmp rax, 2
jne 0x18005bc60
shr rcx, 1
rep movsw word [rdi], word [rsi]
jmp 0x18005bc62
rep movsb byte [rdi], byte [rsi]
add rbx, qword [rdx + 0x10]
add rdx, 0x20
cmp rdx, r8
jne 0x18005bc22
movabs rdx, 0x8cb0c9a388179fe5
add r12, 0x20
add r14, 0x20
movabs rsi, 0x26efb703382e92fd
movabs r8, 0x566c1c811e86d8fd
movabs r9, 0x8012fbb270cb163d
movabs r10, 0x889f8b4975721ba3
movabs r11, 0xa00a62a942b20165
cmp r12, r13
jne 0x18005baa0
mov r13, qword [rsp + 0x48]
mov r15, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x40]
xor r9d, r9d
mov r8d, r13d
mov qword [rsp + 0x20], 0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x40]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rcx, [rsp + 0x60]
call fcn.180051290
mov r12, qword [rsp + 0x2d8]
mov rbx, qword [rsp + 0x2d0]
test edi, edi
je 0x18005b735
movabs rcx, 0x9fe74ab83cc32036
movabs rax, 0x6a27d98d5ffd05ce
mov qword [rsp + 0x40], rax
movabs rdx, 0x544f9e93a8b64bd
mov rax, qword [rsp + 0x40]
movabs rax, 0xeb8638cd5baa4658
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
movabs rax, 0x877089b96218f0fe
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
movabs rax, 0x23df19e6072c6022
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rdx
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rcx
mov rax, qword [rsp + 0x40]
movabs rax, 0xe21ce0df42769f97
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
movabs rax, 0x23df19e6070e4018
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
movabs rax, 0x544f9e93a8b649f
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rcx
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rdx
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rcx
mov rax, qword [rsp + 0x40]
mov al, 1
jmp 0x18005b84f
mov rax, qword [r14 - 8]
mov qword [rbx], rax
add rbx, 8
mov rcx, qword [r14 - 8]
mov rsi, r14
cmp rcx, 8
jbe 0x18005be1a
mov rsi, qword [r14]
mov rax, rcx
mov rdi, rbx
and eax, 3
jne 0x18005be3f
shr rcx, 2
rep movsd dword [rdi], dword [rsi]
add rbx, qword [r14 - 8]
jmp 0x18005bc79
rep movsb byte [rdi], byte [rsi]
add rbx, qword [r14 - 8]
jmp 0x18005bc79
cmp rax, 2
jne 0x18005be34
shr rcx, 1
rep movsw word [rdi], word [rsi]
add rbx, qword [r14 - 8]
jmp 0x18005bc79