Function at 0x18002dd00
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov r13, rdx
mov r15, rcx
xor eax, eax
mov qword [rsp + 0x48], rax
mov ebx, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x40], 0xffffffffffffffff
xor ecx, ecx
call fcn.18007bf60
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x58]
call fcn.18007bf18
xorpd xmm2, xmm2
movsd qword [rsp + 0xc8], xmm2
test rax, rax
je 0x18002dd89
add dword [rax + 0x14], 0x76c
inc dword [rax + 0x10]
lea rdx, [rsp + 0xc8]
mov rcx, rax
call fcn.18002a590
test al, al
je 0x18002dd89
movsd xmm2, qword [rsp + 0xc8]
movsd qword [rsp + 0xc8], xmm2
lea rsi, [r15 + 0x50]
mov rcx, rsi
call fcn.18002b470
mov r12d, eax
test eax, eax
jle 0x18002de41
mov ecx, eax
and ecx, 0x80000007
jge 0x18002ddba
dec ecx
or ecx, 0xfffffff8
inc ecx
mov r14d, 8
mov edi, r14d
sub edi, ecx
cmp edi, r14d
mov eax, 0
cmove edi, eax
add r12d, edi
movsxd r15, r12d
mov rcx, r15
call fcn.180078408
mov rbx, rax
mov qword [rsp + 0x50], rax
mov rdx, rax
mov rcx, rsi
call fcn.18002b690
test edi, edi
jle 0x18002de08
movsxd r8, edi
sub r15, r8
lea rcx, [rbx + r15]
lea edx, [r14 + 0x18]
call fcn.18007e840
mov r8d, r12d
and r8d, 0xfffffff8
je 0x18002de49
mov byte [rsp + 0x28], 0
mov dword [rsp + 0x20], r14d
lea r9, [rsp + 0xc8]
mov rdx, rbx
mov rcx, rbx
call fcn.18002fe00
test al, al
jne 0x18002de49
mov rcx, rbx
call fcn.18007b7a8
xor al, al
jmp 0x18002dfbc
mov r14d, 8
jmp 0x18002de51
mov r15, qword [rsp + 0xb0]
mov ecx, 0x1e
call fcn.180078408
mov rdi, rax
mov qword [rsp + 0x48], rax
mov dword [rax], 0x23535023
mov rax, qword [rsp + 0xc8]
mov qword [rdi + 4], rax
mov word [rdi + 0xc], r14w
mov qword [rdi + 0xe], rax
mov dword [rdi + 0x16], 1
mov dword [rdi + 0x1a], r12d
cmp qword [r13 + 0x18], 8
jb 0x18002de96
mov rcx, qword [r13]
jmp 0x18002de99
mov rcx, r13
xor r14d, r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r14 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
mov qword [rsp + 0x40], rax
cmp rax, 0xffffffffffffffff
jne 0x18002deed
test rbx, rbx
je 0x18002dede
mov rcx, rbx
call fcn.18007b7a8
mov rcx, rdi
call fcn.18007b7a8
xor al, al
jmp 0x18002dfbc
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0xc0]
mov r8d, 0x1e
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18002df98
cmp dword [rsp + 0xc0], 0x1e
jne 0x18002df98
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0xc0]
mov r8d, r12d
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18002df76
cmp r12d, dword [rsp + 0xc0]
jne 0x18002df76
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call fcn.18007b7a8
test rbx, rbx
je 0x18002df67
mov rcx, rbx
call fcn.18007b7a8
nop
mov rdx, r13
mov rcx, r15
call fcn.18002d470
mov al, 1
jmp 0x18002dfbc
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call fcn.18007b7a8
test rbx, rbx
je 0x18002df94
mov rcx, rbx
call fcn.18007b7a8
xor al, al
jmp 0x18002dfbc
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call fcn.18007b7a8
test rbx, rbx
je 0x18002dfb6
mov rcx, rbx
call fcn.18007b7a8
xor al, al
jmp 0x18002dfbc
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret