Function at 0x140002d60
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rbx, qword [rsp + 0x80]
lea r15d, [r9 - 0x29d]
mov eax, r15d
lea ebp, [rcx + 0x875]
mov r14d, ecx
lea r12d, [r8 - 0x772]
mov r13d, r9d
lea esi, [r9 - 0x46e4]
mov edx, r9d
mov edi, ecx
xor edx, 0x7996
xor eax, 0x7e66
xor r13d, 0x2b9
mov dword [rsp + 0x60], edx
xor edi, 0x1fb
xor r14d, 0x7e33
cmp edi, eax
jle 0x140002e98
mov rax, qword [section..data]
add esi, 0x3f72
cmp dword [rax + 0xd8], 0x151a8
ja 0x140002dff
mov eax, dword [rbx + 0xd0]
add eax, 0x1424fc
or dword [rbx + 0x60], eax
mov eax, dword [0x140080070]
add r14d, 0xa15
xor esi, 0x7423
xor r14d, 0xf11
dec esi
xor edi, 0x75df
sub r13d, 0xb7f
add r15d, 0x3a0
add ebp, 0x36f
cmp dword [rbx + 0x1c], eax
je 0x140002e41
or dword [rbx + 0x50], 0x1d6856
mov eax, dword [rbx + 0xb0]
xor r12d, 0x241
sub edx, 0xef
add r12d, 0xab4
sub edi, 0x1135
mov dword [rsp + 0x60], edx
cmp dword [rbx + 0x18], eax
jae 0x140002e7d
mov eax, dword [0x14008008c]
add eax, 0x190d8
or dword [rbx + 0xd4], eax
jmp 0x140002e98
mov eax, dword [rbx + 0x6c]
sub eax, dword [rbx + 0x88]
mov rcx, qword [section..data]
add eax, 0x17ae33
add dword [rcx + 0xd4], eax
lea eax, [rdx - 0x5a5]
cmp r15d, eax
jle 0x140002f16
lea eax, [r13 + 0x1048]
cmp ebp, eax
jl 0x14000309a
lea eax, [rsi - 0x709]
xor edi, 0x7c5c
xor eax, 0x7b35
xor r15d, 0xcb7
mov r8d, r13d
mov dword [rsp + 0x20], eax
mov edx, r15d
mov rcx, rbx
lea r9d, [rdi + 0x16a]
xor ebp, 0xf0b
call fcn.140001d40
mov eax, dword [0x140080060]
cmp dword [rbx + 0x78], eax
je 0x140002f0b
mov eax, dword [rbx + 0x50]
mov ecx, dword [0x1400800d8]
xor eax, 0x1d6850
imul ecx, eax
mov dword [0x1400800d8], ecx
add ebp, 0x22e
jmp 0x14000309a
movsxd rcx, r15d
or rcx, 0x3dad
call qword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
mov eax, r12d
sub eax, r13d
or eax, r15d
mov r15d, dword [rsp + 0x60]
xor dword [0x140080060], eax
mov eax, edi
imul eax, r15d
movsxd rcx, eax
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [section..data]
mov edx, r15d
mov r11d, dword [rbx + 0x90]
mov r9d, dword [rbx + 0x60]
sub edx, dword [rbx + 0x60]
mov ecx, dword [rax + 0x78]
sub ecx, r13d
mov eax, esi
xor dword [rbx + 0xc], ecx
mov ecx, dword [rbx + 0xbc]
mov r8d, dword [rbx + 0xd8]
sub r11d, ecx
sub r11d, dword [0x14008002c]
xor rcx, rax
mov rax, qword [section..data]
or r8d, 0x4141
imul r9d, esi
mov qword [rsp + 0x20], r11
mov r10d, dword [rax + 0xbc]
or rcx, r10
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r9d, dword [rbx + 0x18]
mov ecx, 0x4b56
imul r9d, dword [rbx + 0x78]
mov eax, esi
mov edx, dword [rbx + 0x94]
or eax, ebp
mov r10d, dword [0x140080050]
or eax, 0x3dad
sub r12d, eax
mov qword [rsp + 0x28], rbx
mov rax, qword [section..data]
sub edx, ecx
xor r9d, ecx
and r10d, edi
mov dword [rsp + 0x20], r10d
mov r8d, dword [rax + 0x18]
mov eax, ebp
and r8d, dword [rbx + 0x78]
xor eax, 0x38de
imul ecx, eax, 0x3bc2
call section..text
mov eax, dword [rbx + 0x88]
and eax, r13d
mov r13d, 0x3e83
xor ebp, eax
mov eax, dword [rbx + 0x78]
xor eax, r13d
imul eax, r15d
add dword [rbx + 0xec], eax
mov rax, qword [section..data]
mov ecx, dword [rax + 0xf0]
xor ecx, edi
sub ecx, dword [rax + 0x64]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r10d, dword [0x1400800cc]
sub r15d, edi
mov eax, r12d
or r15d, r14d
or r10, rax
movsxd rdx, edi
mov eax, dword [rbx + 4]
or rdx, r13
xor r10, rax
imul r9d, esi, 0x4b50
mov rax, qword [section..data]
imul r8d, dword [rax + 0xd8], 0x3e83
xor r8d, 0x467d
xor edi, dword [rbx + 0x78]
sub edi, dword [rbx + 0xd4]
mov qword [rsp + 0x28], r10
mov ecx, edi
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rbx, qword [rsp + 0x68]
lea eax, [rbp + 0x4c6]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret