Function at 0x18002b650
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x18003ca28]
xor rax, rsp
mov qword [rbp + 0x170], rax
movzx ebx, byte [rsp + 0x30]
mov rax, rdx
imul r13d, ecx, 0xee
mov r12d, ecx
mov qword [rsp + 0x48], rdx
mov esi, ecx
cmp ecx, r13d
ja 0x18002bb20
mov r15, qword [rsp + 0x48]
mov edi, 0x41
movzx r14d, byte [rsp + 0x30]
xor edx, edx
lea r8d, [rdi - 0xf]
lea r9d, [rdi + 0x2f]
lea r10d, [rdi - 0x13]
lea r11d, [rdi + 0x2b]
nop dword [rax]
cmp esi, 0x5bf9
ja 0x18002b83d
je 0x18002b824
cmp esi, 0x1f61
ja 0x18002b79b
je 0x18002b778
mov eax, esi
sub eax, 0xc5
je 0x18002b757
sub eax, 6
je 0x18002b74c
sub eax, 0x4a
je 0x18002b732
cmp eax, 0xf26
jne 0x18002bdd1
movzx eax, word [0x1800315d8]
mov word [rbp + 0x12b], ax
movzx eax, byte [0x1800315da]
mov byte [rbp + 0x12d], al
jmp 0x18002bdd1
movzx eax, word [0x1800315cc]
mov word [rbp + 0x128], ax
mov word [rbp + 0x12a], di
jmp 0x18002bdd1
inc dword [0x18003cb1c]
jmp 0x18002bdd1
cmp byte [0x18004cd31], 0
je 0x18002bdd1
call qword [0x18004cd28]
mov byte [0x18004cd31], 0
xor edx, edx
jmp 0x18002bdbf
lea rcx, [rbp + 0x128]
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x18002b782
movzx eax, word [0x1800315dc]
mov word [rcx], ax
jmp 0x18002bdd1
cmp esi, 0x2e87
je 0x18002b7db
cmp esi, 0x3dad
je 0x18002b7ce
cmp esi, 0x4cd3
jne 0x18002bdd1
mov dword [rbp + 0x158], 0x730077
mov word [rbp + 0x15c], r8w
jmp 0x18002bdd1
mov word [rbp + 0x131], r9w
jmp 0x18002bdd1
lea rcx, [rbp + 0x128]
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x18002b7e5
movzx eax, word [0x1800315d0]
lea rdx, [0x1800315d4]
mov word [rcx], ax
mov r8d, 2
movzx eax, byte [0x1800315d2]
mov byte [rcx + 2], al
lea rcx, [rbp + 0x130]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
xor edx, edx
jmp 0x18002bdbf
mov dword [rbp + 0x15e], 0x33005f
mov dword [rbp + 0x162], 0x2e0032
jmp 0x18002bdd1
cmp esi, 0xa7b7
ja 0x18002bbaa
je 0x18002b89e
cmp esi, 0x6b1f
je 0x18002b885
cmp esi, 0x896b
jne 0x18002bdd1
xor r9d, r9d
lea r8, [rbp + 0x128]
lea rdx, [rbp + 0x158]
lea ecx, [r9 + 0x4f]
call fcn.1800225b0
mov qword [rsp + 0x58], rax
xor edx, edx
jmp 0x18002bdbf
mov dword [rbp + 0x166], 0x6c0064
mov dword [rbp + 0x16a], 0x6c
jmp 0x18002bdd1
mov ecx, 0x202
lea rdx, [rsp + 0x70]
call qword [rsp + 0x58]
test eax, eax
je 0x18002b771
mov edi, 0x12a
nop dword [rax]
cmp edi, 0x5b168
ja 0x18002ba42
je 0x18002b9ec
cmp edi, 0x28862
ja 0x18002b97e
je 0x18002b95a
cmp edi, 0x12a
je 0x18002b94e
cmp edi, 0xa2f8
je 0x18002b93b
cmp edi, 0x144c6
je 0x18002b90d
xor edx, edx
cmp edi, 0x1e694
jne 0x18002b928
mov word [rbp + 0x145], 0x65
jmp 0x18002b928
mov eax, dword [0x18003152a]
mov dword [rbp + 0x140], eax
movzx eax, byte [0x18003152e]
mov byte [rbp + 0x144], al
xor edx, edx
add edi, 0xa1ce
cmp edi, 0xca418
jbe 0x18002b8c0
jmp 0x18002bdba
mov dword [rbp + 0x13c], 0x6f6c7265
mov byte [rbp + 0x140], 0
jmp 0x18002b926
mov dword [rbp + 0x138], 0x746e495f
jmp 0x18002b926
movzx eax, word [0x180031597]
mov word [rbp + 0x146], ax
movzx eax, byte [0x180031599]
mov byte [rbp + 0x148], al
mov byte [rbp + 0x149], 0
jmp 0x18002b926
cmp edi, 0x32a30
je 0x18002b9dd
cmp edi, 0x3cbfe
je 0x18002b9d1
cmp edi, 0x46dcc
je 0x18002b9ac
cmp edi, 0x50f9a
jne 0x18002b926
mov word [rbp + 0x152], 0x6c
jmp 0x18002b926
mov eax, dword [0x1800315bc]
mov dword [rbp + 0x14d], eax
movzx eax, byte [0x1800315c0]
mov byte [rbp + 0x151], al
mov byte [rbp + 0x152], 0
jmp 0x18002b926
mov byte [rbp + 0x14d], 0
jmp 0x18002b926
mov dword [rbp + 0x149], 0x746e656d
jmp 0x18002b926
mov r8d, 2
mov byte [rbp + 0x110], 0
lea rdx, [0x1800315a0]
lea rcx, [rbp + 0x110]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
lea rax, [rbp + 0x110]
dec rax
nop word [rax + rax]
cmp byte [rax + 1], 0
lea rax, [rax + 1]
jne 0x18002ba20
mov ecx, dword [str.nc.Fa]
mov dword [rax], ecx
movzx ecx, word [0x1800315a8]
mov word [rax + 4], cx
jmp 0x18002b926
cmp edi, 0x97c3c
ja 0x18002baf8
je 0x18002bac9
cmp edi, 0x65336
je 0x18002baa1
cmp edi, 0x6f504
je 0x18002ba82
xor edx, edx
cmp edi, 0x796d2
jne 0x18002b928
mov eax, 0x74
mov r14b, 1
mov word [rbp + 0x120], ax
jmp 0x18002b928
mov r8d, 2
lea rdx, [0x1800315c8]
lea rcx, [rbp + 0x110]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x18002b926
mov eax, dword [str.onCo]
mov dword [rbp + 0x117], 0x636976
mov dword [rbp + 0x11a], eax
movzx eax, byte [0x1800314fc]
mov byte [rbp + 0x11e], al
jmp 0x18002b926
xor r9d, r9d
lea rax, [rbp + 0x138]
xor edx, edx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x100
lea r8d, [r9 + 4]
lea rcx, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov r15, rax
jmp 0x18002b926
cmp edi, 0xa1e0a
je 0x18002bb95
cmp edi, 0xabfd8
je 0x18002bb5a
cmp edi, 0xb61a6
je 0x18002bb53
cmp edi, 0xc0374
jne 0x18002b926
movzx eax, bl
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.18002d670
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
xor bl, bl
jmp 0x18002b926
test r14b, r14b
je 0x18002b926
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], 0
mov r8d, 0x12
lea rdx, [rbp + 0x110]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18002b926
test r15, r15
movzx r14d, r14b
mov edx, 0
cmove r14d, edx
jmp 0x18002b928
cmp esi, 0xb6dd
je 0x18002bbe1
cmp esi, 0xc603
je 0x18002bbcb
cmp esi, 0xd529
je 0x18002bb20
jmp 0x18002bdd1
xor edx, edx
xor r8d, r8d
lea ecx, [rdx + 0x75]
call fcn.18000ce00
mov ebx, eax
xor edx, edx
jmp 0x18002bdbf
mov rdx, rax
mov ecx, 0x10
call fcn.18000fb10
xor edx, edx
test al, al
jne 0x18002bdbf
mov edi, edx
nop word [rax + rax]
cmp edi, 0xf
ja case.default.0x18002bc1d
lea r8, [0x180000000]
mov eax, edi
mov ecx, dword [r8 + rax*4 + 0x2be04]
add rcx, r8
jmp rcx
xor eax, eax
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rdx
lea r8, [rbp + 0x110]
lea rdx, str.totalFileSizeStr
mov word [rsp + 0x34], ax
lea rcx, str.BLCS_GPR_y_GPRvy
mov byte [rsp + 0x36], al
lea r9d, [rax + 1]
call qword [sym.imp.KERNEL32.dll_ReplaceFileA]
jmp 0x18002bda5
mov byte [rbp + 0x122], 0x63
jmp case.default.0x18002bc1d
movzx eax, word [0x18003163e]
mov word [rbp + 0x117], ax
movzx eax, byte [0x180031640]
mov byte [rbp + 0x119], al
jmp case.default.0x18002bc1d
mov word [rbp + 0x11b], 0x69
jmp case.default.0x18002bc1d
mov byte [rbp + 0x124], 0
mov byte [rsp + 0x30], 1
jmp case.default.0x18002bc1d
mov byte [rbp + 0x123], 0x74
jmp case.default.0x18002bc1d
mov r8d, 1
mov byte [rbp + 0x11a], 0
lea rdx, [0x180031667]
lea rcx, [rbp + 0x110]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x18002bda5
mov rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x34]
mov eax, 3
xor r8d, r8d
mov word [rsp + 0x34], ax
call qword [sym.imp.SHELL32.dll_ILAppendID]
mov qword [rsp + 0x40], rax
jmp 0x18002bda5
mov dword [rbp + 0x113], 0x664f2065
jmp case.default.0x18002bc1d
mov ecx, 0x6953
mov byte [rbp + 0x112], 0x7a
mov word [rbp + 0x110], cx
jmp case.default.0x18002bc1d
mov qword [rsp + 0x60], rdx
jmp case.default.0x18002bc1d
movzx eax, word [0x18003167e]
mov word [rbp + 0x11c], ax
movzx eax, byte [0x180031680]
mov byte [rbp + 0x11e], al
jmp case.default.0x18002bc1d
mov ecx, 8
mov qword [rsp + 0x38], rdx
mov word [rsp + 0x3a], cx
jmp case.default.0x18002bc1d
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x54]
lea rcx, [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_GetExplicitEntriesFromAclW]
movzx eax, byte [rsp + 0x30]
xor edx, edx
mov ecx, edx
cmp qword [rsp + 0x40], rcx
cmovne ecx, eax
mov byte [rsp + 0x30], cl
jmp case.default.0x18002bc1d
mov r8d, 3
mov byte [rbp + 0x11f], 0
lea rdx, [0x180031695]
lea rcx, [rbp + 0x11f]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
xor edx, edx
inc edi
lea eax, [rdi + 0xdb]
cmp eax, 0xeb
jb 0x18002bc00
mov edi, 0x41
mov r11d, 0x6c
lea r10d, [r11 - 0x3e]
lea r9d, [r11 + 4]
lea r8d, [r11 - 0x3a]
imul eax, r12d, 0xe
add esi, eax
cmp esi, r13d
ja 0x18002bb20
mov rax, qword [rsp + 0x48]
jmp 0x18002b6d0
cmp byte [rsp + 0x30], 0
je 0x18002bdfc
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_ILFree]
xor al, al
jmp 0x18002bb23