Function at 0x180002ae0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x680
mov rax, qword [0x180058a00]
xor rax, rsp
mov qword [rsp + 0x670], rax
mov rdi, rcx
mov eax, dword [0x1800599f8]
inc eax
mov dword [0x1800599f8], eax
cmp eax, 0x9c4
jl 0x180002b2f
lea rcx, str.too_many_hooks:_cant_insert
call fcn.180002830
xor al, al
jmp 0x180002dd2
test rdx, rdx
je 0x180002b52
cmp byte [rdx], 0
je 0x180002b52
add rcx, 0x1d8
mov r9d, 0x3b
mov r8, rdx
lea edx, [r9 + 1]
call sub.msvcrt.dll_strncpy_s
lea rdx, [rdi + 0x1d8]
lea rcx, str.inserting_hook:__s
call fcn.180002830
mov r9, qword [rdi]
mov rdx, qword [0x1800599f0]
lea r8, [rdx + 0x419ce0]
cmp rdx, r8
je 0x180002baf
nop dword [rax + rax]
mov rcx, qword [rdx + 0x600]
sub rcx, r9
mov rax, rcx
neg rax
cmovs rax, rcx
test rax, rax
jle 0x180002ba7
add rdx, 0x6b8
cmp rdx, r8
jne 0x180002b80
jmp 0x180002baf
mov rcx, rdx
call fcn.180004300
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
lea rcx, [rsp + 0x30]
mov rdx, rdi
mov r8d, 0x600
call sub.msvcrt.dll_memcpy
mov r8d, ebx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x650]
call fcn.18002ab50
cmp qword [rax + 0x18], 7
jbe 0x180002be9
mov rax, qword [rax]
mov r8, rax
mov edx, 0x1f4
lea rcx, [rdi + 0x214]
call sub.msvcrt.dll_wcscpy_s
mov rdx, qword [rsp + 0x668]
cmp rdx, 7
jbe 0x180002c45
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x650]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180002c40
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180002dfd
call fcn.180038704
movsxd rax, dword [0x1800599f8]
imul rbx, rax, 0x6b8
add rbx, qword [0x1800599f0]
lea rcx, [rsp + 0x30]
mov rdx, rdi
mov r8d, 0x600
call sub.msvcrt.dll_memcpy
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.180004620
test al, al
jne 0x180002d8f
lea rdx, [rdi + 0x214]
lea rcx, [rsp + 0x650]
call fcn.180002250
nop
mov r8d, 0xfde9
lea rdx, [rsp + 0x650]
lea rcx, [rsp + 0x630]
call fcn.180029fa0
nop
cmp qword [rax + 0x18], 0xf
jbe 0x180002cbd
mov rax, qword [rax]
mov rdx, rax
lea rcx, str.failed_to_insert_hook__s
call fcn.180002830
nop
mov rdx, qword [rsp + 0x648]
cmp rdx, 0xf
jbe 0x180002d10
inc rdx
mov rcx, qword [rsp + 0x630]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180002d0b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180002e03
call fcn.180038704
movdqa xmm0, xmmword [0x180047ab0]
movdqu xmmword [rsp + 0x640], xmm0
mov byte [rsp + 0x630], 0
mov rdx, qword [rsp + 0x668]
cmp rdx, 7
jbe 0x180002d71
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x650]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180002d6c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180002df7
call fcn.180038704
movsxd rax, dword [0x1800599f8]
imul rcx, rax, 0x6b8
add rcx, qword [0x1800599f0]
call fcn.180004300
xor al, al
jmp 0x180002dd2
mov dword [rsp + 0x630], 4
mov rax, qword [rdi]
mov qword [rsp + 0x638], rax
mov qword [rsp + 0x20], 0
lea r9, [0x180059a10]
mov r8d, 0x10
lea rdx, [rsp + 0x630]
mov rcx, qword [section..data]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov al, 1
mov rcx, qword [rsp + 0x670]
xor rcx, rsp
call fcn.180038bf0
lea r11, [rsp + 0x680]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.18003ca40
int3
call fcn.18003ca40
nop
call fcn.18003ca40
nop
int3