Function at 0x14002a05c
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r12d, r12d
mov r15, rdx
mov dword [rax + 8], r12d
mov rbp, rcx
mov r14d, r12d
test rcx, rcx
je 0x14002a2d7
test rdx, rdx
je 0x14002a2d7
or rdi, 0xffffffffffffffff
mov rsi, rdi
inc rsi
cmp word [rdx + rsi*2], r12w
jne 0x14002a0a1
test byte [rcx + 0x34], 1
mov ebx, 0xffffffff
je 0x14002a183
lea r13d, [rsi*4]
lea ebx, [r13 + 1]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8d, ebx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov r14, rax
test rax, rax
jne 0x14002a0fb
mov ebx, 0x8007000e
jmp 0x14002a2dc
mov qword [rsp + 0x38], r12
mov r9d, esi
mov qword [rsp + 0x30], r12
mov r8, r15
mov dword [rsp + 0x28], r13d
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
nop dword [rax + rax]
test eax, eax
jne 0x14002a170
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov edi, 0x80070000
or ecx, edi
test eax, eax
cmovle ecx, eax
test ecx, ecx
jns 0x14002a166
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, edi
test eax, eax
cmovle ebx, eax
jmp 0x14002a2ae
mov ebx, 0x80004005
jmp 0x14002a2ae
mov r15, r14
inc rdi
cmp byte [r14 + rdi], r12b
jne 0x14002a173
mov ebx, 0xffffffff
jmp 0x14002a191
mov edi, esi
add rdi, rdi
cmp rdi, rbx
ja 0x14002a2d0
mov rcx, qword [rbp + 0x20]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop dword [rax + rax]
test eax, 0xffffff7f
je 0x14002a203
cmp eax, 0x102
je 0x14002a1f9
cmp eax, ebx
je 0x14002a1bf
mov ebx, 0x80004005
jmp 0x14002a2a9
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov edi, 0x80070000
or ecx, edi
test eax, eax
cmovle ecx, eax
test ecx, ecx
jns 0x14002a1b5
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, edi
test eax, eax
cmovle ebx, eax
jmp 0x14002a2a9
mov ebx, 0x800705b4
jmp 0x14002a2a9
mov rcx, qword [rbp + 0x10]
mov r9d, 2
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
nop dword [rax + rax]
mov dword [rsp + 0x70], eax
cmp eax, ebx
jne 0x14002a236
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jne 0x14002a25d
mov rcx, qword [rbp + 0x10]
lea r9, [rsp + 0x70]
mov r8d, edi
mov qword [rsp + 0x20], r12
mov rdx, r15
mov ebx, r12d
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop dword [rax + rax]
test eax, eax
jne 0x14002a299
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov edi, 0x80070000
or ecx, edi
test eax, eax
cmovle ecx, eax
test ecx, ecx
jns 0x14002a294
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, edi
test eax, eax
cmovle ebx, eax
jmp 0x14002a299
mov ebx, 0x80004005
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
nop dword [rax + rax]
test r14, r14
je 0x14002a2dc
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
jmp 0x14002a2dc
mov ebx, 0x80070216
jmp 0x14002a2dc
mov ebx, 0x80070057
lea r11, [rsp + 0x40]
mov eax, ebx
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret