Function at 0x140002430
Capabilities:
Get common file path
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rbp
push r12
push r13
sub rsp, 0x2a8
mov rax, qword [0x140044020]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor r12d, r12d
lea r13, [r12 - 1]
cmp byte [rbp + 0xb0], r12b
jne 0x1400024e0
mov dword [rsp + 0x40], 0x18
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x48], r12
cmp byte [rbp + 0xb1], r12b
jne 0x14000266d
mov rcx, qword [rbp + 0x98]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], r12
xor r8d, r8d
mov dword [rsp + 0x28], 0xa0000000
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rbp + 0xb8], rax
cmp rax, r13
je 0x140002674
mov byte [rbp + 0xb0], 1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [rsp + 0x58], r12d
cmp qword [rbp + 0xb8], r13
je 0x14000284b
mov rbx, qword [rsp + 0x2d8]
test rbx, rbx
je 0x14000282e
mov qword [rsp + 0x2a0], rsi
mov qword [rsp + 0x298], rdi
mov qword [rsp + 0x290], r14
mov qword [rsp + 0x288], r15
lea r15, [rsp + 0x2e0]
call fcn.140001250
mov qword [rsp + 0x28], r15
mov r9, rbx
xor r8d, r8d
mov qword [rsp + 0x20], r12
xor edx, edx
mov rdi, rax
mov rcx, qword [rax]
or rcx, 1
call fcn.140017a5c
mov esi, eax
mov eax, 0xffffffff
test esi, esi
cmovs esi, eax
mov eax, 2
lea edx, [rsi + 1]
mul rdx
mov rbx, rax
cmovo rbx, r13
mov rcx, rbx
call fcn.14000ccb0
mov r8, rbx
xor edx, edx
mov rcx, rax
mov r14, rax
call fcn.14000eec0
mov word [r14], r12w
mov r8, r13
mov r9, qword [rsp + 0x2d8]
mov rdx, r14
mov rcx, qword [rdi]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r12
call fcn.140017a5c
lea rcx, [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r9, qword [rbp + 0x80]
test r9, r9
je 0x1400027cc
lea r8, str._hs:_ls
mov qword [rsp + 0x20], r14
xor edx, edx
xor ecx, ecx
call fcn.140001ee0
mov esi, eax
mov eax, 2
lea edx, [rsi + 1]
mul rdx
mov rbx, rax
cmovo rbx, r13
mov rcx, rbx
call fcn.14000ccb0
mov r8, rbx
xor edx, edx
mov rcx, rax
mov rdi, rax
call fcn.14000eec0
mov word [rdi], r12w
lea r8, str._hs:_ls
mov r9, qword [rbp + 0x80]
mov edx, esi
mov rcx, rdi
mov qword [rsp + 0x20], r14
call fcn.140001ee0
mov rcx, qword [rbp + 0xb8]
lea r8d, [rsi + rsi]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x20], r12
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rbp + 0xb8]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov edx, 2
mov rcx, rdi
call fcn.14000c780
jmp 0x1400027f7
mov qword [rbp + 0xb8], r13
mov ecx, 0x208
call fcn.14000ccb0
xor edx, edx
mov r8d, 0x208
mov rcx, rax
mov rbx, rax
call fcn.14000eec0
mov r8, qword [rbp + 0x90]
test r8, r8
je 0x1400026c0
mov ecx, dword [rbp + 0xb4]
lea rdx, [0x14003c370]
mov r9, qword [rbp + 0x88]
mov dword [rsp + 0x20], ecx
mov rcx, rbx
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x1400026ff
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x208
call fcn.14000eec0
lea rdx, [rsp + 0x60]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov rcx, rbx
test eax, eax
je 0x1400027bb
lea r8, [rsp + 0x60]
lea rdx, [0x14003c3a0]
call qword [sym.imp.USER32.dll_wsprintfW]
mov edx, 4
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
lea r9, [rsp + 0x40]
mov rcx, rbx
mov dword [rsp + 0x20], 3
lea r8d, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp + 0xb8], rax
cmp rax, r13
jne 0x1400027a2
mov qword [rsp + 0x30], r12
lea r9, [rsp + 0x40]
mov dword [rsp + 0x28], 0x80
mov edx, 0x40000000
mov r8d, 3
mov dword [rsp + 0x20], 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp + 0xb8], rax
cmp rax, r13
jne 0x140002785
mov edx, 2
mov rcx, rbx
call fcn.14000c780
xor eax, eax
jmp 0x14000284f
mov rdx, rbx
mov dword [rsp + 0x38], r12d
call fcn.140002090
mov rdx, rbx
mov dword [rsp + 0x38], 3
call fcn.140002090
mov edx, 2
mov byte [rbp + 0xb1], 1
mov rcx, rbx
call fcn.14000c780
jmp 0x1400024e0
mov edx, 2
call fcn.14000c780
xor eax, eax
jmp 0x14000284f
mov rcx, qword [rbp + 0xb8]
lea r8d, [rsi + rsi]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x20], r12
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rbp + 0xb8]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov edx, 2
mov rcx, r14
call fcn.14000c780
lea rcx, [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r15, qword [rsp + 0x288]
mov r14, qword [rsp + 0x290]
mov rdi, qword [rsp + 0x298]
mov rsi, qword [rsp + 0x2a0]
cmp byte [rbp + 0xb1], r12b
je 0x14000284b
mov rcx, qword [rbp + 0xb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0xb8], r13
mov eax, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14000c760
add rsp, 0x2a8
pop r13
pop r12
pop rbp
pop rbx
ret