Function at 0x100002cd4
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov esi, edx
mov r13b, cl
mov edi, 0x80
or rbp, 0xffffffffffffffff
xor r14d, r14d
lea r15, [0x100007448]
mov r12d, 0x1000
mov r8d, edi
mov eax, 2
mul r8
cmovo rax, rbp
mov rcx, rax
call fcn.100003824
mov rbx, rax
mov qword [rsp + 0x48], rax
cmp rax, r14
je 0x100002d8c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov r9d, edi
mov r8, rbx
mov edx, esi
call qword [sym.imp.USER32.dll_LoadStringW]
cmp eax, r14d
je 0x100002d7a
inc eax
cmp eax, edi
jb 0x100002d94
mov rcx, rbx
call sub.msvcrt.dll_free
mov rbx, r15
mov qword [rsp + 0x48], rbx
add edi, edi
cmp edi, r12d
jb 0x100002d19
jmp 0x100002d94
mov rcx, rbx
call sub.msvcrt.dll_free
mov rbx, r15
mov qword [rsp + 0x48], rbx
jmp 0x100002d94
mov rbx, r15
mov qword [rsp + 0x48], rbx
mov rcx, r12
call fcn.100003824
mov rdi, rax
cmp rax, r14
jne 0x100002db8
cmp rbx, r15
je 0x100002db1
mov rcx, rbx
call sub.msvcrt.dll_free
xor eax, eax
jmp 0x100002f7a
lea r9, [rsp + 0xc0]
mov r8, rbx
mov esi, 0x7ff
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.msvcrt.dll__vsnwprintf]
cmp eax, r14d
jl 0x100002def
cdqe
cmp rax, rsi
ja 0x100002def
cmp rax, rsi
jne 0x100002df7
mov word [rdi + 0xffe], r14w
jmp 0x100002df7
mov word [rdi + 0xffe], r14w
call qword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
mov r12d, eax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
mov r9d, ebp
mov r8, rdi
xor edx, edx
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rsi, eax
mov rcx, rsi
call fcn.100003824
mov rbp, rax
cmp rax, r14
jne 0x100002e8b
cmp esi, 0xffffffff
jne 0x100002e6e
lea rax, [0x100006180]
mov rcx, qword [0x100006180]
cmp rcx, rax
je 0x100002e6e
test byte [rcx + 0x1c], 8
je 0x100002e6e
cmp byte [rcx + 0x19], r14b
jne 0x100002e6e
lea edx, [rsi + 0xb]
lea r8, [0x1000013a8]
mov rcx, qword [rcx + 0x10]
call fcn.100002c1c
mov rcx, rdi
call sub.msvcrt.dll_free
nop
cmp rbx, r15
je 0x100002e84
mov rcx, rbx
call sub.msvcrt.dll_free
xor eax, eax
jmp 0x100002f7a
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
or r9d, 0xffffffff
mov r8, rdi
xor edx, edx
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r8d, [rsi - 1]
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x40]
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp r13b, r14b
je 0x100002f23
call sub.wbemcomn.dll_class_CMemoryLog____ptr64___cdecl_GetMemLogObject_void_
mov rcx, rax
or edx, 0xffffffff
call sub.wbemcomn.dll_public:_void___cdecl_CMemoryLog::Write_long_int____ptr64
lea rax, [0x100006180]
mov rcx, qword [0x100006180]
cmp rcx, rax
je 0x100002f5a
test byte [rcx + 0x1c], 1
je 0x100002f5a
cmp byte [rcx + 0x19], 2
jb 0x100002f5a
mov edx, 0xb
mov r9, rdi
lea r8, [0x1000013a8]
mov rcx, qword [rcx + 0x10]
call fcn.100002c4c
jmp 0x100002f5a
lea rax, [0x100006180]
mov rcx, qword [0x100006180]
cmp rcx, rax
je 0x100002f5a
test byte [rcx + 0x1c], 1
je 0x100002f5a
cmp byte [rcx + 0x19], 5
jb 0x100002f5a
mov edx, 0xc
mov r9, rdi
lea r8, [0x1000013a8]
mov rcx, qword [rcx + 0x10]
call fcn.100002c4c
mov rcx, rdi
call sub.msvcrt.dll_free
mov rcx, rbp
call sub.msvcrt.dll_free
nop
cmp rbx, r15
je 0x100002f78
mov rcx, rbx
call sub.msvcrt.dll_free
mov eax, esi
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret