Function at 0x18000e630
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r14
mov eax, 0x12b0
call fcn.180025e10
sub rsp, rax
mov rax, qword [0x180038010]
xor rax, rsp
mov qword [rsp + 0x12a0], rax
cmp dword [rcx + 8], 0xffffffff
mov r14, r8
mov ebp, edx
mov rdi, rcx
je 0x18000e66e
mov rcx, qword [rcx]
call fcn.18000dd00
mov rbx, qword [rdi]
mov dword [rdi + 8], 0xffffffff
cmp ebp, dword [rbx + 8]
jl 0x18000e687
mov eax, 0x10000
jmp 0x18000e74f
mov qword [rsp + 0x12d8], rsi
cmp ebp, dword [rbx + 0x14]
jge 0x18000e69f
mov rcx, rbx
call fcn.18000d440
mov rbx, qword [rdi]
xor esi, esi
cmp dword [rbx + 0x14], ebp
jge 0x18000e6fd
mov rax, rbx
test rbx, rbx
je 0x18000e6f5
cmp dword [rbx + 0x1c], esi
je 0x18000e6f5
mov edx, dword [rbx + 0x14]
inc edx
cmp edx, dword [rbx + 8]
je 0x18000e6f5
mov ecx, dword [rbx + 0x54]
lea r8, [rbx + 0x7c]
add ecx, dword [rbx + 0x50]
xor r9d, r9d
mov eax, dword [rbx + 0x4c]
add eax, 0x2e
mov dword [rbx + 0x14], edx
add ecx, eax
mov dword [rsp + 0x20], esi
add dword [rbx + 0x18], ecx
lea rdx, [rbx + 0x2c]
mov rcx, rbx
call fcn.18000cfc0
test eax, eax
mov ecx, esi
sete cl
mov dword [rbx + 0x1c], ecx
mov rax, qword [rdi]
mov rbx, rax
cmp dword [rax + 0x14], ebp
jl 0x18000e6a6
lea r8, [rsp + 0x60]
mov edx, ebp
mov rcx, rdi
call fcn.18000dda0
test byte [rsp + 0x26c], 0x10
movzx eax, word [r14]
je 0x18000e773
cmp ax, 0x2f
je 0x18000e73a
cmp ax, 0x5c
je 0x18000e73a
test ax, ax
je 0x18000e733
cmp word [r14 + 2], 0x3a
je 0x18000e73a
lea rsi, [rdi + 0x250]
mov rdx, r14
mov rcx, rsi
call fcn.18000e4c0
xor eax, eax
mov rsi, qword [rsp + 0x12d8]
mov rcx, qword [rsp + 0x12a0]
xor rcx, rsp
call fcn.18000ed70
mov rbx, qword [rsp + 0x12e8]
add rsp, 0x12b0
pop r14
pop rdi
pop rbp
ret
mov rbx, r14
mov rcx, r14
test ax, ax
je 0x18000e79d
nop
cmp ax, 0x2f
je 0x18000e78c
cmp ax, 0x5c
jne 0x18000e790
lea rbx, [rcx + 2]
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x18000e780
xor edx, edx
lea rcx, [rsp + 0x2a0]
mov r8d, 0x800
call fcn.1800115d0
lea rdx, [rsp + 0x2a0]
mov rcx, r14
sub rdx, r14
movzx eax, word [rcx]
mov word [rcx + rdx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x18000e7c0
cmp rbx, r14
jne 0x18000e7e2
movzx ebp, si
mov word [rsp + 0x2a0], si
jmp 0x18000e80a
mov rax, rbx
sub rax, r14
sar rax, 1
add rax, rax
cmp rax, 0x800
jae 0x18000e9b4
mov word [rsp + rax + 0x2a0], si
movzx ebp, word [rsp + 0x2a0]
xor edx, edx
lea rcx, [rsp + 0xaa0]
mov r8d, 0x800
call fcn.1800115d0
cmp bp, 0x2f
je 0x18000e869
cmp bp, 0x5c
je 0x18000e869
test bp, bp
je 0x18000e83b
cmp word [rsp + 0x2a2], 0x3a
je 0x18000e869
lea rbp, [rdi + 0x250]
mov qword [rsp + 0x20], rbx
mov r8, rbp
lea r9, [rsp + 0x2a0]
lea rdx, str._s_s_s
lea rcx, [rsp + 0xaa0]
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x18000e88c
mov r9, rbx
lea r8, [rsp + 0x2a0]
lea rdx, str._s_s
lea rcx, [rsp + 0xaa0]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rbp, rsi
lea rdx, [rsp + 0x2a0]
mov rcx, rbp
call fcn.18000e4c0
mov eax, dword [rsp + 0x26c]
lea rcx, [rsp + 0xaa0]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x18000e8e0
mov eax, 0x200
jmp 0x18000e747
mov rdx, qword [rdi + 0x240]
mov rcx, qword [rdi]
call fcn.18000d750
cmp qword [rdi + 0x248], rsi
jne 0x18000e910
mov ecx, 0x4000
call fcn.18000f79c
mov qword [rdi + 0x248], rax
nop dword [rax]
mov rdx, qword [rdi + 0x248]
lea r9, [rsp + 0x50]
mov rcx, qword [rdi]
mov r8d, 0x4000
call fcn.18000d970
mov ebx, eax
cmp eax, 0xffffff96
je 0x18000e997
test eax, eax
js 0x18000e966
jle 0x18000e95b
mov rdx, qword [rdi + 0x248]
lea r9, [rsp + 0x290]
mov r8d, eax
mov qword [rsp + 0x20], rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18000e96d
cmp byte [rsp + 0x50], sil
jne 0x18000e974
test ebx, ebx
jne 0x18000e910
mov esi, 0x5000000
jmp 0x18000e99c
mov esi, 0x400
jmp 0x18000e99c
lea r9, [rsp + 0x280]
mov rcx, rbp
lea r8, [rsp + 0x270]
lea rdx, [rsp + 0x278]
call qword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x18000e99c
mov esi, 0x1000
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi]
call fcn.18000dd00
mov eax, esi
jmp 0x18000e747
call fcn.18000f608
int3