Function at 0x1000cc1fc
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov dword [r11 + 0x20], r9d
mov qword [r11 + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
and qword [r11 - 0x78], 0
and qword [r11 - 0x70], 0
and qword [rsp + 0x60], 0
and qword [r11 - 0x80], 0
lea rax, [r11 - 0x70]
mov r12, r8
mov qword [r11 - 0x68], rax
lea rax, [0x10002abb8]
mov r14, rcx
mov qword [r11 - 0x60], rax
lea rax, [rsp + 0x60]
mov rbp, rdx
mov qword [r11 - 0x58], rax
lea rax, [0x10002aba0]
lea r8, [r11 - 0x68]
mov qword [r11 - 0x50], rax
lea rax, [r11 - 0x80]
lea rcx, [r11 - 0x78]
mov qword [r11 - 0x48], rax
lea rax, [0x10002ab28]
mov edx, 3
mov qword [r11 - 0x40], rax
call fcn.1000cc0e8
xor ecx, ecx
mov ebx, eax
test eax, eax
je 0x1000cc2a4
xor r9d, r9d
mov r8d, eax
mov edx, 0x27a0197
call fcn.1000b51b8
jmp 0x1000cc477
mov esi, 0x80000
mov r9d, 4
mov r8d, 0x1000
mov rdx, rsi
mov dword [rsp + 0x40], esi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
mov qword [rsp + 0x48], rax
test rax, rax
jne 0x1000cc2eb
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x40]
call fcn.1000cbea8
mov rdi, qword [rsp + 0x48]
mov esi, dword [rsp + 0x40]
mov ebx, eax
jmp 0x1000cc2ed
xor ebx, ebx
test ebx, ebx
je 0x1000cc2fe
mov r8d, ebx
mov edx, 0x27d0197
jmp 0x1000cc457
lea r9, [rsp + 0x50]
mov r8d, esi
mov rdx, rbp
mov rcx, r14
call qword [rsp + 0x78]
mov ebx, eax
test eax, eax
je 0x1000cc320
mov edx, 0x2820197
jmp 0x1000cc454
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, r12
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x1000cc376
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
xor r9d, r9d
mov edx, 0x2910197
mov r8d, eax
mov rcx, r12
mov ebx, eax
call fcn.1000b51b8
jmp 0x1000cc435
mov rcx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x118]
mov r15d, dword [rsp + 0x110]
mov r8d, esi
lea rax, [r8 + rcx - 1]
cqo
idiv r8
mov qword [rsp + 0x48], rax
test rcx, rcx
je 0x1000cc420
xor r13d, r13d
mov rcx, qword [rsp + 0xf0]
lea r9, [rsp + 0x44]
mov r8d, esi
mov rdx, rdi
call qword [rsp + 0x60]
mov ebx, eax
test eax, eax
jne 0x1000cc4d8
mov r8d, dword [rsp + 0x44]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x58]
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1000cc4c0
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x58], eax
jne 0x1000cc4a3
mov rcx, qword [rsp + 0x50]
add r13d, r15d
xor edx, edx
sub rcx, rax
mov eax, r13d
div dword [rsp + 0x48]
mov qword [rsp + 0x50], rcx
add eax, dword [rsp + 0x108]
mov dword [r14], eax
test rcx, rcx
jne 0x1000cc3a5
mov eax, dword [rsp + 0x108]
add eax, r15d
mov dword [r14], eax
mov r14, qword [rsp + 0xf0]
cmp rbp, 0xffffffffffffffff
je 0x1000cc444
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call qword [rsp + 0x68]
test eax, eax
je 0x1000cc461
mov edx, 0x2c50197
mov r8d, eax
xor r9d, r9d
xor ecx, ecx
call fcn.1000b51b8
test rdi, rdi
je 0x1000cc477
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1000cc486
call sub.KERNEL32.dll_FreeLibrary
mov eax, ebx
mov rbx, qword [rsp + 0xf8]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ebx, 0x80070026
mov edx, 0x2ab0197
mov r8d, ebx
xor r9d, r9d
mov rcx, r12
call fcn.1000b51b8
jmp 0x1000cc42d
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov edx, 0x2a60197
mov ebx, eax
mov r8d, eax
jmp 0x1000cc4b0
xor r9d, r9d
mov r8d, eax
mov edx, 0x29f0197
xor ecx, ecx
jmp 0x1000cc4b6