Function at 0x180002640
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rsi
push rdi
push r14
mov eax, 0x60
call fcn.180025560
sub rsp, rax
mov rdi, rcx
lea rcx, [0x180034c00]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rsi, qword [0x180034c30]
xor r14d, r14d
test rsi, rsi
je 0x1800027bf
mov rdx, qword [rsi]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], r14b
jne 0x180002684
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x88]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp qword [rsi + 8], 0xffffffffffffffff
je 0x180002793
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x88]
mov r8d, 1
lea rdx, [0x180027b38]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r8, qword [rsi + 8]
mov rdx, r8
shr rdx, 0x10
mov rcx, r8
shr rcx, 0x20
mov rax, r8
shr rax, 0x30
mov word [rsp + 0x90], ax
mov word [rsp + 0x92], cx
mov word [rsp + 0x94], dx
mov word [rsp + 0x96], r8w
mov ebx, r14d
mov dword [rsp + 0x30], ebx
cmp ebx, 4
jge 0x180002793
movsxd rax, ebx
movzx ecx, word [rsp + rax*2 + 0x90]
mov r8d, 0xa
lea rdx, [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ltoa]
lea rax, [rsp + 0x38]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], r14b
jne 0x180002740
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x88]
lea rdx, [rsp + 0x38]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp ebx, 3
je 0x18000278c
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x88]
mov r8d, 1
lea rdx, [0x180027b3c]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
inc ebx
jmp 0x18000270e
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x88]
mov r8d, 1
lea rdx, [0x180027b40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rsi, qword [rsi + 0x10]
jmp 0x180002671
jmp 0x1800027c1
lea rcx, [0x180034c00]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop r14
pop rdi
pop rsi
ret

Function at 0x180003190
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
mov eax, 0x840
call fcn.180025560
sub rsp, rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x18000320a
lea rbx, [rsp + 0x858]
call fcn.180003180
mov r9, qword [rsp + 0x850]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x28], rbx
mov r8d, 0x800
mov qword [rsp + 0x20], 0
mov rcx, qword [rax]
or rcx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vsprintf]
lea rcx, [rsp + 0x30]
mov byte [rsp + 0x82f], 0
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__dup]
mov ecx, eax
lea rdx, str.a_._
call qword [sym.imp.api_ms_win_crt_math_l1_1_0.dll__fdopen]
mov rbx, rax
test rax, rax
je 0x18000326e
mov qword [rsp + 0x838], rdi
lea rdi, [rsp + 0x858]
call fcn.180003180
mov r8, qword [rsp + 0x850]
xor r9d, r9d
mov rdx, rbx
mov qword [rsp + 0x20], rdi
mov rcx, qword [rax]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vfprintf]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rdi, qword [rsp + 0x838]
add rsp, 0x840
pop rbx
ret