Function at 0x1800ef7f0
Capabilities:
Check if file exists
Get file attributes
Get file size
Set file attributes
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x270
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edi, edi
mov dword [rsp + 0x44], edx
mov esi, edi
mov qword [rsp + 0x48], rcx
mov r14, rcx
mov r15d, 0x100000
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov eax, 0x80
cmp ebx, 0xffffffff
cmove ebx, eax
test bl, 1
je 0x1800ef855
mov edx, ebx
mov rcx, r14
and edx, 0xfffffffe
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea esi, [rdi + 1]
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov qword [rsp + reloc.SHELL32.dll_IsUserAnAdmin], rbp
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0x20000000
mov rcx, r14
mov qword [rsp + 0x2b0], r12
lea r8d, [r9 + 3]
mov dword [rsp + 0x20], 3
call sym.SafeBase64.dll_LngCreateFile
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x1800ef8d6
lea rdx, [rsp + 0x58]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1800ef8cd
mov rax, qword [rsp + 0x58]
cmp rax, r15
jge 0x1800ef8ba
lea r15d, [rax + 0x400]
mov ecx, r15d
mov r12d, r15d
call fcn.180115540
mov rbp, rax
test rax, rax
jne 0x1800ef8ec
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x1800ef8e5
mov edx, ebx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
jmp 0x1800efa34
mov dword [rsp + 0x40], edi
cmp dword [rsp + 0x44], edi
jbe 0x1800efa16
nop word [rax + rax]
mov rbx, qword [rsp + 0x58]
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
xor ecx, ecx
call fcn.18011ab34
mov rcx, rax
call fcn.18011aa84
mov esi, edi
lea r14, [rsp + 0x60]
nop dword [rax]
call fcn.18011aa58
imul ecx, eax, 0xff
mov eax, 0x20005
mul ecx
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 0xe
mov byte [r14], cl
test cl, cl
jne 0x1800ef958
lea eax, [rsi + 1]
mov byte [r14], al
inc esi
inc r14
cmp esi, 0x200
jb 0x1800ef930
mov edx, r15d
mov rcx, rbp
call sym.SafeBase64.dll_Ordinal_27
mov r14d, dword [rsp + 0x40]
mov esi, r14d
and esi, 1
cmp rbx, r12
jle 0x1800ef9bb
mov r9d, 0x100
mov dword [rsp + 0x20], esi
lea r8, [rsp + 0x60]
mov edx, r15d
mov rcx, rbp
call sym.SafeBase64.dll_Ordinal_23
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], rdi
mov r8d, r15d
mov rdx, rbp
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
sub rbx, r12
cmp rbx, r12
jg 0x1800ef980
test rbx, rbx
jle 0x1800ef9fe
add ebx, 0x200
mov dword [rsp + 0x20], esi
and ebx, 0xfffffe00
lea r8, [rsp + 0x60]
mov edx, ebx
mov r9d, 0x100
mov rcx, rbp
call sym.SafeBase64.dll_Ordinal_23
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], rdi
mov r8d, ebx
mov rdx, rbp
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
inc r14d
mov dword [rsp + 0x40], r14d
cmp r14d, dword [rsp + 0x44]
jb 0x1800ef900
mov r14, qword [rsp + 0x48]
mov rcx, rbp
call fcn.180115548
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call sym.SafeBase64.dll_LngDeleteFile
mov eax, 1
mov r12, qword [rsp + 0x2b0]
mov rbp, qword [rsp + reloc.SHELL32.dll_IsUserAnAdmin]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.18010faf0
mov rbx, qword [rsp + 0x2b8]
add rsp, 0x270
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret