Function at 0x14002b3e0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x148
mov rax, rdx
mov r10, rdx
mov qword [rsp + 0x140], r10
mov qword [rsp + 0x138], r9
mov qword [rsp + 0x130], r8
mov qword [rsp + 0x128], rcx
mov byte [rsp + 0x127], 0
mov rcx, rdx
lea r8, [0x1401193e0]
mov qword [rsp + 0x98], rdx
mov rdx, r8
mov qword [rsp + 0x90], rax
call fcn.140006090
mov qword [rsp + 0x118], 0
mov dword [rsp + 0x10c], 0
mov dword [rsp + 0x104], 0
mov rcx, qword [rsp + 0x130]
mov qword [rsp + 0x88], rax
call fcn.140016d40
test al, 1
jne 0x14002b47b
jmp 0x14002b493
mov byte [rsp + 0x127], 1
mov dword [rsp + 0x100], 1
jmp 0x14002b75e
mov rcx, qword [rsp + 0x130]
call fcn.1400073b0
xor edx, edx
xor r8d, r8d
mov ecx, r8d
mov r8d, 0xfde9
mov qword [rsp + 0x80], rcx
mov ecx, r8d
mov r8, rax
mov r9d, 0xffffffff
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [rsp + 0x10c], eax
cmp dword [rsp + 0x10c], 0
jne 0x14002b4f3
jmp 0x14002b72b
mov eax, dword [rsp + 0x10c]
add eax, 1
movsxd rcx, eax
shl rcx, 1
mov dword [rsp + 0x108], ecx
mov eax, dword [rsp + 0x108]
mov edx, eax
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x118], rax
cmp rax, 0
jne 0x14002b536
jmp 0x14002b72b
xor edx, edx
mov rax, qword [rsp + 0x118]
mov ecx, dword [rsp + 0x108]
mov r8d, ecx
mov rcx, rax
call fcn.1400a9170
mov edx, dword [rsp + 0x10c]
mov rax, qword [rsp + 0x118]
mov rcx, qword [rsp + 0x130]
mov dword [rsp + 0x7c], edx
mov qword [rsp + 0x70], rax
call fcn.1400073b0
xor edx, edx
mov ecx, 0xfde9
mov r8, rax
mov r9d, 0xffffffff
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r10d, dword [rsp + 0x7c]
mov dword [rsp + 0x28], r10d
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor r8d, r8d
xor ecx, ecx
mov r9d, ecx
mov rcx, qword [rsp + 0x118]
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x6c], eax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x110], rax
mov rax, 0xffffffffffffffff
cmp qword [rsp + 0x110], rax
jne 0x14002b63c
lea rcx, [rsp + 0xe0]
lea rdx, [0x14011de4b]
mov r8d, 0x48
call fcn.14002f4b0
mov rcx, qword [rsp + 0x98]
lea rdx, [rsp + 0xe0]
call fcn.140023780
lea rcx, [rsp + 0xe0]
mov qword [rsp + 0x60], rax
call fcn.140001770
jmp 0x14002b72b
mov rcx, qword [rsp + 0x138]
call fcn.1400017a0
mov rcx, qword [rsp + 0x138]
mov dword [rsp + 0x5c], eax
call fcn.1400073b0
xor edx, edx
mov ecx, edx
mov r8, qword [rsp + 0x110]
mov qword [rsp + 0x50], rcx
mov rcx, r8
mov rdx, rax
mov r8d, dword [rsp + 0x5c]
lea r9, [rsp + 0x104]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 0
jne 0x14002b6dc
lea rcx, [rsp + 0xc0]
lea rdx, [0x14011de94]
mov r8d, 0x50
call fcn.14002f4b0
mov rcx, qword [rsp + 0x98]
lea rdx, [rsp + 0xc0]
call fcn.140023780
lea rcx, [rsp + 0xc0]
mov qword [rsp + 0x48], rax
call fcn.140001770
jmp 0x14002b71d
lea rcx, [rsp + 0xa0]
lea rdx, [0x14011dee5]
mov r8d, 0x43
call fcn.14002f4b0
mov rcx, qword [rsp + 0x98]
lea rdx, [rsp + 0xa0]
call fcn.140023780
lea rcx, [rsp + 0xa0]
mov qword [rsp + 0x40], rax
call fcn.140001770
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x118], 0
je 0x14002b74b
mov rax, qword [rsp + 0x118]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov byte [rsp + 0x127], 1
mov dword [rsp + 0x100], 1
test byte [rsp + 0x127], 1
jne 0x14002b779
mov rcx, qword [rsp + 0x98]
call fcn.140001770
mov rax, qword [rsp + 0x90]
add rsp, 0x148
ret