Function at 0x18001a8bc
Capabilities:
Get file attributes
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov eax, dword [rsp + 0x110]
lea r10d, [rdx - 0x3d3d]
mov r8d, dword [rsp + 0x100]
lea ebx, [r9 - 0x3c7d]
mov r13d, dword [rsp + 0xf0]
lea esi, [rdx + 0x199]
mov r15d, dword [rsp + 0xf8]
lea ebp, [rdx - 0x2cf]
lea edi, [rax - 0x86]
mov dword [rsp + 0xf8], r10d
mov r12, rcx
mov dword [rsp + 0x110], edi
lea ecx, [rax + 0x19b]
mov dword [rsp + 0x100], ebx
mov eax, dword [rsp + 0x108]
add r8d, 0xfffffbc5
add eax, 0xffffc2f2
mov dword [rsp + 0xd8], ecx
mov ecx, dword [rsp + 0x118]
add r13d, 0xffffc12a
add r15d, 0x290
mov dword [rsp + 0xf0], eax
add ecx, 0x16
movsxd r14, r13d
lea eax, [r8 + 0x3f]
mov dword [rsp + 0x80], r15d
mov dword [rsp + 0xe8], r8d
mov dword [rsp + 0x108], ecx
mov dword [rsp + 0x118], esi
cmp ecx, eax
je 0x18001ae22
lea eax, [r15 - 0x4b0]
cmp esi, eax
jle 0x18001ab3c
mov dword [r12 + 0x1a8], 1
lea edi, [rsi - 0x424]
mov esi, dword [rsp + 0x110]
lea r11d, [r14 + 0x3f62]
mov dword [r12 + 8], 0x11604f14
lea ebx, [rbp + 0x2a0]
mov dword [r12 + 0x28], 0x171a7660
add esi, 0x221
mov rax, qword [r12]
mov rdx, qword [r12 + 0x1c0]
mov rcx, qword [rax + 0x10]
lea eax, [r10 + 0x3ab2]
mov dword [rsp + 0x50], eax
lea r10d, [r13 + 0x3a6e]
mov dword [rsp + 0x48], r10d
xor rcx, 0x3a44
sub qword [rdx + 0x1e0], rcx
mov ecx, dword [rsp + 0xf0]
mov edx, dword [rsp + 0x118]
mov qword [rsp + 0x40], r12
add edx, 0xfffffb6e
mov dword [rsp + 0x38], r11d
lea r9d, [rcx + 0x3aed]
mov dword [rsp + 0x30], ebx
lea r8d, [rcx + 0x3b1e]
mov dword [rsp + 0x28], edi
lea ecx, [r14 + 0x3cd2]
mov dword [rsp + 0x20], esi
call fcn.18000a358
mov r9d, dword [rsp + 0xf8]
lea edi, [r13 + 0x3a95]
mov r11d, dword [rsp + 0x108]
add ebp, 0xef
mov ecx, dword [rsp + 0xd8]
add r9d, 0x3a6e
mov edx, dword [rsp + 0xf0]
lea r15d, [rax - 0xb9]
mov ebx, dword [rsp + 0xe8]
lea r8d, [rax - 0x68]
mov esi, dword [rsp + 0x80]
lea r10d, [rbp - 0x60]
mov r14d, dword [rsp + 0x100]
add r11d, 0x19b
mov dword [rsp + 0x78], r9d
add ebx, 0x1b4
mov dword [rsp + 0x70], r10d
add esi, 0xfffffddb
mov qword [rsp + 0x68], r12
add ecx, 0xffffffc4
mov dword [rsp + 0x60], r11d
add r14d, 0x3b4c
mov dword [rsp + 0x110], ebp
add edx, 0x3ed6
mov eax, dword [rsp + 0x110]
lea ebp, [r13 + 0x3ab2]
mov dword [rsp + 0x58], eax
mov r9d, ecx
mov dword [rsp + 0x50], r15d
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], r14d
mov dword [r12 + 0x118], 0xc28f5c29
call fcn.180015fac
jmp 0x18001ae22
mov eax, ebp
xor eax, 0x3cd2
cmp r13d, eax
jle 0x18001adb2
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rcx, qword [r12 + 0x1c8]
mov edx, r13d
movzx r9d, word [r12 + 0x18]
or edx, 0x3b5d
mov r8, qword [r12 + 0x10]
xor rcx, 0x3f62
add edx, dword [r12 + 0xa8]
xor r9w, r13w
movsxd rax, edi
movsxd r10, r15d
xor r10, rax
mov eax, 0x3d0e
add r8, rax
mov qword [rsp + 0x20], r10
add rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
imul eax, ebx, 0x3f62
mov r8d, r14d
or r8d, dword [rsp + 0xd8]
movsxd rcx, ebp
add r8d, 0x3b4c
xor rcx, qword [r12]
imul rcx, qword [r12 + 0x40]
movsxd rdx, eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r9d, dword [r12 + 0xa8]
movzx r8d, word [r12 + 0x88]
and r9d, 0x3ab2
mov edx, dword [r12]
movsxd rbp, dword [rsp + 0xf0]
sub edx, ebx
sub r9, qword [r12 + 0x128]
mov eax, ebp
imul eax, r13d
movsxd r10, eax
mov eax, 0x3afd
add r8w, ax
mov qword [rsp + 0x20], r10
mov eax, dword [r12 + 0x1b8]
add eax, 0x3f59
imul ecx, eax, 0x3b4c
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov r10, qword [r12 + 0x110]
mov r9d, esi
mov r8d, dword [r12 + 0x20]
mov rdi, rbp
or r8d, dword [r12 + 0xd8]
mov rdx, qword [r12 + 0xd8]
or r8d, 0x3b5d
movsxd rsi, dword [rsp + 0x108]
add rdx, rbp
and r9d, dword [rsp + 0xf8]
mov eax, esi
imul eax, dword [rsp + 0x110]
movsxd rbx, ebx
sub r10, rbx
sub r10, 0x3b1e
mov qword [rsp + 0x20], r10
movsxd rcx, eax
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rcx, qword [r12 + 0x158]
or ebp, 0x3a95
mov eax, dword [r12 + 0x128]
or rcx, rsi
or rcx, qword [r12]
or eax, r15d
or qword [r12 + 0x1e0], rcx
or rdi, rbx
sub rdi, qword [r12 + 0x30]
add qword [r12 + 0x1b8], rdi
imul ecx, eax, 0x3a6e
imul r14d, ebp
mov ebp, dword [r12 + 0x1b8]
and ecx, ebp
imul r9d, ecx, 0x3afd
mov rcx, qword [r12 + 0x88]
add rcx, 0x3d0e
add rcx, qword [r12 + 0x20]
mov qword [r12 + 0x1c8], rcx
mov ecx, dword [r12 + 0x100]
mov r8d, dword [rsp + 0xf8]
lea esi, [r15 + r14]
mov edi, dword [r12 + 0xb8]
imul ebp, dword [rsp + 0x110]
xor edi, dword [r12 + 0xb0]
mov r10d, dword [r12 + 0x140]
lea r11d, [rcx + r8]
mov eax, dword [r12 + 0x170]
sub r10d, r9d
xor r9d, dword [rsp + 0x100]
mov edx, dword [rsp + 0x108]
xor r9d, r8d
mov r8d, dword [r12 + 0x110]
add edx, r14d
or eax, dword [rsp + 0x110]
sub r8d, 0x3b5d
mov ebx, dword [rsp + 0x100]
mov dword [rsp + 0x58], edi
xor ebx, r13d
mov qword [rsp + 0x50], r12
imul esi, ecx
and ecx, dword [r12 + 0x1e0]
imul ecx, dword [rsp + 0x118]
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x40], ebp
mov dword [rsp + 0x38], r11d
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], r10d
mov dword [rsp + 0x20], eax
call fcn.180004cc0
jmp 0x18001ae22
movsxd rbx, dword [r12 + 0xb8]
movsxd rbp, r13d
mov rcx, rbp
or rcx, qword [r12 + 0xa8]
cmp rbx, rcx
jbe 0x18001ae22
movsxd rsi, dword [rsp + 0x100]
lea edi, [r8 + 0x48d]
and edi, 0x3c7d
movsxd rax, r15d
xor rsi, rax
mov rcx, qword [r12 + 0x80]
mov r8, r14
or r8, qword [r12 + 0x10]
mov r9, rdi
add rcx, qword [r12 + 0xd8]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
add ebx, 3
mov rcx, rbp
or rcx, qword [r12 + 0xa8]
movsxd rax, ebx
cmp rax, rcx
ja 0x18001ade8
lea eax, [r13 + 0x3f59]
mov rbx, qword [rsp + 0xd0]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret