Function at 0x180027440
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r12
sub rsp, 0x260
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x250], rax
xor r12d, r12d
mov rbx, rdx
mov rbp, rcx
mov esi, r12d
mov dword [rsp + 0x40], r12d
test rdx, rdx
je 0x1800277fc
lea rax, [rsp + 0x48]
test rax, rax
je 0x1800277fc
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x50]
xor edx, edx
mov r8d, 0x200
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.180002c60
test eax, eax
je 0x1800277f8
cmp dword [rsp + 0x40], 0x200
jne 0x1800277f8
mov edx, dword [rbx + 0x7f]
lea r9d, [r12 + 4]
xor ecx, ecx
mov r8d, 0x1000
mov qword [rsp + 0x290], rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea r9, [rsp + 0x30]
lea r8d, [r12 + 8]
lea rdx, [rsp + 0x48]
mov rcx, rbp
mov dword [rsp + 0x38], 0x200
mov rdi, rax
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x30], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180027572
cmp dword [rsp + 0x30], 8
jne 0x180027572
lea r9, [rsp + 0x30]
lea r8d, [r12 + 4]
lea rdx, [rsp + 0x38]
mov rcx, rbp
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180027572
cmp dword [rsp + 0x30], 4
jne 0x180027572
mov r8d, dword [rsp + 0x38]
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x50]
mov rcx, rbp
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180027572
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 0x38], eax
jne 0x180027572
lea esi, [r12 + 1]
test rdi, rdi
je 0x1800277f0
mov r8d, dword [rbx + 0x7f]
lea rax, [rsp + 0x30]
mov r9, rdi
mov edx, 0xc00
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.180002c60
test eax, eax
je 0x1800277df
mov eax, dword [rsp + 0x30]
cmp dword [rbx + 0x7f], eax
jne 0x1800277df
movabs rax, 0x4441454856495250
cmp qword [rdi], rax
jne 0x1800277df
movzx eax, byte [rdi + 0x122]
movzx ecx, byte [rdi + 0x11b]
mov byte [rdi + 0x11b], al
movzx eax, byte [rdi + 0x121]
mov byte [rdi + 0x122], cl
movzx ecx, byte [rdi + 0x11c]
mov byte [rdi + 0x11c], al
movzx eax, byte [rdi + 0x120]
mov byte [rdi + 0x121], cl
movzx ecx, byte [rdi + 0x11d]
mov byte [rdi + 0x11d], al
movzx eax, byte [rdi + 0x11f]
mov byte [rdi + 0x120], cl
movzx ecx, byte [rdi + 0x11e]
mov byte [rdi + 0x11e], al
mov byte [rdi + 0x11f], cl
movzx eax, byte [rdi + 0x12a]
movzx ecx, byte [rdi + 0x123]
mov byte [rdi + 0x123], al
movzx eax, byte [rdi + 0x129]
mov byte [rdi + 0x12a], cl
movzx ecx, byte [rdi + 0x124]
mov byte [rdi + 0x124], al
movzx eax, byte [rdi + 0x128]
mov byte [rdi + 0x129], cl
movzx ecx, byte [rdi + 0x125]
mov byte [rdi + 0x125], al
movzx eax, byte [rdi + 0x127]
mov byte [rdi + 0x128], cl
movzx ecx, byte [rdi + 0x126]
mov byte [rdi + 0x126], al
mov byte [rdi + 0x127], cl
movzx eax, byte [rdi + 0x132]
movzx ecx, byte [rdi + 0x12b]
mov byte [rdi + 0x12b], al
movzx eax, byte [rdi + 0x131]
mov byte [rdi + 0x132], cl
movzx ecx, byte [rdi + 0x12c]
mov byte [rdi + 0x12c], al
movzx eax, byte [rdi + 0x130]
mov byte [rdi + 0x131], cl
movzx ecx, byte [rdi + 0x12d]
mov byte [rdi + 0x12d], al
movzx eax, byte [rdi + 0x12f]
mov byte [rdi + 0x130], cl
movzx ecx, byte [rdi + 0x12e]
mov byte [rdi + 0x12e], al
mov byte [rdi + 0x12f], cl
movzx eax, byte [rdi + 0x13a]
movzx ecx, byte [rdi + 0x133]
mov byte [rdi + 0x133], al
movzx eax, byte [rdi + 0x139]
mov byte [rdi + 0x13a], cl
movzx ecx, byte [rdi + 0x134]
mov byte [rdi + 0x134], al
movzx eax, byte [rdi + 0x138]
mov byte [rdi + 0x139], cl
movzx ecx, byte [rdi + 0x135]
mov byte [rdi + 0x135], al
movzx eax, byte [rdi + 0x137]
mov byte [rdi + 0x138], cl
movzx ecx, byte [rdi + 0x136]
mov byte [rdi + 0x136], al
mov byte [rdi + 0x137], cl
test esi, esi
je 0x1800277dc
mov esi, dword [rbx + 0x7f]
lea r9, [rsp + 0x38]
lea rdx, [rsp + 0x48]
mov r8d, 8
mov rcx, rbp
mov qword [rsp + 0x48], 0xc00
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1800277dc
lea r9, [rsp + 0x38]
mov r8d, esi
mov rdx, rdi
mov rcx, rbp
call fcn.180026ed0
test eax, eax
je 0x1800277dc
mov r8d, dword [rbx + 0x7f]
mov rdx, rbx
mov rcx, rbp
mov r9, r8
imul r8, qword [rdi + 0x12b]
imul r9, qword [rdi + 0x133]
call fcn.180026d70
test eax, eax
je 0x1800277dc
mov esi, 1
jmp 0x1800277df
mov esi, r12d
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdi, qword [rsp + 0x290]
mov eax, esi
jmp 0x1800277fe
xor eax, eax
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.18002d590
mov rbx, qword [rsp + 0x298]
add rsp, 0x260
pop r12
pop rsi
pop rbp
ret