Function at 0x18012d460
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rcx, qword [rsp + 0xb0]
lea rax, [0x180062a10]
mov qword [rcx], rax
mov dword [rsp + 0x98], 0
mov dword [rsp + 0x90], 0
mov dword [rsp + 0x94], 0
lea r8, [0x18005f6c8]
lea rdx, [0x180062bd8]
mov ecx, 1
call fcn.1801276b0
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x240]
cmp eax, 1
jne 0x18012d70f
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0xb0]
mov rcx, qword [rcx + 0x258]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x98], eax
cmp dword [rsp + 0x98], 0xffffffff
jne 0x18012d552
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x90], eax
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], 0
mov r9, qword [rsp + 0xb0]
mov r9, qword [r9 + 0x258]
lea r8, [0x180062b80]
lea rdx, [0x180062bd8]
xor ecx, ecx
call fcn.1801276b0
jmp 0x18012d70f
cmp dword [rsp + 0x98], 0
je 0x18012d5c3
mov dword [rsp + 0x90], 0x19
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], 0
mov r9, qword [rsp + 0xb0]
mov r9, qword [r9 + 0x258]
lea r8, [0x180062b00]
lea rdx, [0x180062bd8]
xor ecx, ecx
call fcn.1801276b0
jmp 0x18012d70f
mov rax, qword [rsp + 0xb0]
mov edx, dword [rax + 0x250]
lea rcx, [rsp + 0x60]
call fcn.180127840
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x94]
mov r8d, 0x2c
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0xb0]
mov rcx, qword [rcx + 0x258]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x18012d67c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x90], eax
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x38], eax
lea rax, [rsp + 0x94]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0x2c
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xb0]
mov r9, qword [r9 + 0x258]
lea r8, [0x180062aa0]
lea rdx, [0x180062bd8]
xor ecx, ecx
call fcn.1801276b0
jmp 0x18012d70f
mov eax, dword [rsp + 0x94]
cmp rax, 0x2c
je 0x18012d704
mov dword [rsp + 0x90], 0x3e4
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x40], 0x2c
mov eax, dword [rsp + 0x94]
mov dword [rsp + 0x38], eax
lea rax, [rsp + 0x94]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0x2c
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xb0]
mov r9, qword [r9 + 0x258]
lea r8, [0x180062a20]
lea rdx, [0x180062bd8]
xor ecx, ecx
call fcn.1801276b0
jmp 0x18012d70f
mov dword [rsp + 0x90], 0
mov rcx, qword [rsp + 0xb0]
call fcn.18012d780
mov rax, qword [rsp + 0xb0]
cmp qword [rax + 0x260], 0
je 0x18012d743
mov rcx, qword [rsp + 0xb0]
mov rcx, qword [rcx + 0x260]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0xb0]
add rcx, 8
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea r8, [0x18005f618]
lea rdx, [0x180062bd8]
mov ecx, 1
call fcn.1801276b0
add rsp, 0xa8
ret