Function at 0x180028f50
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x118
mov dword [rsp + 0x5c], 7
mov dword [rsp + 0x64], 0xb
mov eax, dword [rsp + 0x64]
test eax, eax
jle 0x180028fc5
mov eax, dword [rsp + 0x64]
cmp eax, 1
jle 0x180028fa1
mov eax, dword [rsp + 0x5c]
and eax, 0x66b
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x64]
sub eax, 2
mov dword [rsp + 0x64], eax
jmp 0x180028f76
mov eax, dword [rsp + 0x5c]
cmp eax, 0x80d
jle 0x180028fb9
mov eax, dword [rsp + 0x5c]
and eax, 0x86
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x64]
dec eax
mov dword [rsp + 0x64], eax
jmp 0x180028f76
mov dword [rsp + 0x58], 1
mov dword [rsp + 0x54], 0x15
cmp dword [rsp + 0x54], 0
jle 0x18002901d
mov eax, dword [rsp + 0x54]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x180029009
mov dword [rsp + 0x58], 4
mov eax, dword [rsp + 0x54]
sub eax, 2
mov dword [rsp + 0x54], eax
jmp 0x180028fd5
mov dword [rsp + 0x58], 0
mov eax, dword [rsp + 0x54]
dec eax
mov dword [rsp + 0x54], eax
jmp 0x180028fd5
mov dword [rsp + 0x50], 4
mov dword [rsp + 0x60], 0x11
cmp dword [rsp + 0x60], 0
jle 0x180029075
mov eax, dword [rsp + 0x60]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x180029060
mov dword [rsp + 0x50], 4
mov eax, dword [rsp + 0x60]
dec eax
mov dword [rsp + 0x60], eax
jmp 0x18002902d
mov dword [rsp + 0x50], 4
mov eax, dword [rsp + 0x60]
sub eax, 2
mov dword [rsp + 0x60], eax
jmp 0x18002902d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 4
mov rcx, qword [rsp + 0x120]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0xffffffffffffffff
jne 0x1800293ae
mov dword [rsp + 0x78], 2
mov dword [rsp + 0x7c], 0xa
mov eax, dword [rsp + 0x7c]
test eax, eax
jle 0x18002911a
mov eax, dword [rsp + 0x7c]
cmp eax, 1
jle 0x1800290f6
mov eax, dword [rsp + 0x78]
and eax, 0x2106
mov dword [rsp + 0x78], eax
mov eax, dword [rsp + 0x7c]
sub eax, 2
mov dword [rsp + 0x7c], eax
jmp 0x1800290cb
mov eax, dword [rsp + 0x78]
cmp eax, 0x80c
jle 0x18002910e
mov eax, dword [rsp + 0x78]
and eax, 0x85
mov dword [rsp + 0x78], eax
mov eax, dword [rsp + 0x7c]
dec eax
mov dword [rsp + 0x7c], eax
jmp 0x1800290cb
mov dword [rsp + 0x8c], 3
mov dword [rsp + 0x9c], 0x12
cmp dword [rsp + 0x9c], 0
jle 0x180029191
mov eax, dword [rsp + 0x9c]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x180029173
mov dword [rsp + 0x8c], 4
mov eax, dword [rsp + 0x9c]
sub eax, 2
mov dword [rsp + 0x9c], eax
jmp 0x180029130
mov dword [rsp + 0x8c], 0
mov eax, dword [rsp + 0x9c]
sub eax, 2
mov dword [rsp + 0x9c], eax
jmp 0x180029130
mov dword [rsp + 0x94], 7
mov dword [rsp + 0x68], 0x11
cmp dword [rsp + 0x68], 0
jle 0x1800291f2
mov eax, dword [rsp + 0x68]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x1800291da
mov dword [rsp + 0x94], 0
mov eax, dword [rsp + 0x68]
dec eax
mov dword [rsp + 0x68], eax
jmp 0x1800291a4
mov dword [rsp + 0x94], 4
mov eax, dword [rsp + 0x68]
sub eax, 2
mov dword [rsp + 0x68], eax
jmp 0x1800291a4
mov dword [rsp + 0x84], 0
mov dword [rsp + 0x74], 0xd
cmp dword [rsp + 0x74], 0
jle 0x180029253
mov eax, dword [rsp + 0x74]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x18002923b
mov dword [rsp + 0x84], 4
mov eax, dword [rsp + 0x74]
dec eax
mov dword [rsp + 0x74], eax
jmp 0x180029205
mov dword [rsp + 0x84], 0
mov eax, dword [rsp + 0x74]
sub eax, 2
mov dword [rsp + 0x74], eax
jmp 0x180029205
mov dword [rsp + 0x70], 5
mov dword [rsp + 0x88], 4
mov eax, dword [rsp + 0x88]
test eax, eax
jle 0x1800292c5
mov eax, dword [rsp + 0x88]
cmp eax, 1
jle 0x18002929d
mov eax, dword [rsp + 0x70]
and eax, 0x1952
mov dword [rsp + 0x70], eax
mov eax, dword [rsp + 0x88]
sub eax, 2
mov dword [rsp + 0x88], eax
jmp 0x180029266
mov eax, dword [rsp + 0x70]
cmp eax, 0x806
jle 0x1800292b3
mov eax, dword [rsp + 0x70]
and eax, 0x7f
mov dword [rsp + 0x70], eax
mov eax, dword [rsp + 0x88]
dec eax
mov dword [rsp + 0x88], eax
jmp 0x180029266
mov dword [rsp + 0x6c], 8
mov dword [rsp + 0x80], 0x12
cmp dword [rsp + 0x80], 0
jle 0x180029332
mov eax, dword [rsp + 0x80]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x180029317
mov dword [rsp + 0x6c], 4
mov eax, dword [rsp + 0x80]
dec eax
mov dword [rsp + 0x80], eax
jmp 0x1800292d8
mov dword [rsp + 0x6c], 0
mov eax, dword [rsp + 0x80]
sub eax, 2
mov dword [rsp + 0x80], eax
jmp 0x1800292d8
mov dword [rsp + 0x98], 7
mov dword [rsp + 0x90], 0x11
cmp dword [rsp + 0x90], 0
jle 0x1800293a7
mov eax, dword [rsp + 0x90]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x18002938a
mov dword [rsp + 0x98], 0
mov eax, dword [rsp + 0x90]
dec eax
mov dword [rsp + 0x90], eax
jmp 0x180029348
mov dword [rsp + 0x98], 0
mov eax, dword [rsp + 0x90]
dec eax
mov dword [rsp + 0x90], eax
jmp 0x180029348
xor eax, eax
jmp 0x180029b26
mov dword [rsp + 0xa8], 5
mov dword [rsp + 0xcc], 5
mov eax, dword [rsp + 0xcc]
test eax, eax
jle 0x180029434
mov eax, dword [rsp + 0xcc]
cmp eax, 1
jle 0x180029401
mov eax, dword [rsp + 0xa8]
and eax, 0x9c1
mov dword [rsp + 0xa8], eax
mov eax, dword [rsp + 0xcc]
sub eax, 2
mov dword [rsp + 0xcc], eax
jmp 0x1800293c4
mov eax, dword [rsp + 0xa8]
cmp eax, 0x807
jle 0x180029422
mov eax, dword [rsp + 0xa8]
and eax, 0x80
mov dword [rsp + 0xa8], eax
mov eax, dword [rsp + 0xcc]
dec eax
mov dword [rsp + 0xcc], eax
jmp 0x1800293c4
mov dword [rsp + 0xb4], 2
mov dword [rsp + 0xc4], 0x10
cmp dword [rsp + 0xc4], 0
jle 0x1800294aa
mov eax, dword [rsp + 0xc4]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x18002948c
mov dword [rsp + 0xb4], 4
mov eax, dword [rsp + 0xc4]
dec eax
mov dword [rsp + 0xc4], eax
jmp 0x18002944a
mov dword [rsp + 0xb4], 4
mov eax, dword [rsp + 0xc4]
sub eax, 2
mov dword [rsp + 0xc4], eax
jmp 0x18002944a
mov dword [rsp + 0xb0], 7
mov dword [rsp + 0xc0], 0xb
mov eax, dword [rsp + 0xc0]
test eax, eax
jle 0x180029530
mov eax, dword [rsp + 0xc0]
cmp eax, 1
jle 0x1800294fd
mov eax, dword [rsp + 0xb0]
and eax, 0x66b
mov dword [rsp + 0xb0], eax
mov eax, dword [rsp + 0xc0]
sub eax, 2
mov dword [rsp + 0xc0], eax
jmp 0x1800294c0
mov eax, dword [rsp + 0xb0]
cmp eax, 0x80d
jle 0x18002951e
mov eax, dword [rsp + 0xb0]
and eax, 0x86
mov dword [rsp + 0xb0], eax
mov eax, dword [rsp + 0xc0]
dec eax
mov dword [rsp + 0xc0], eax
jmp 0x1800294c0
mov dword [rsp + 0xbc], 5
mov dword [rsp + 0xac], 5
mov eax, dword [rsp + 0xac]
test eax, eax
jle 0x1800295b6
mov eax, dword [rsp + 0xac]
cmp eax, 1
jle 0x180029583
mov eax, dword [rsp + 0xbc]
and eax, 0x152b
mov dword [rsp + 0xbc], eax
mov eax, dword [rsp + 0xac]
sub eax, 2
mov dword [rsp + 0xac], eax
jmp 0x180029546
mov eax, dword [rsp + 0xbc]
cmp eax, 0x807
jle 0x1800295a4
mov eax, dword [rsp + 0xbc]
and eax, 0x80
mov dword [rsp + 0xbc], eax
mov eax, dword [rsp + 0xac]
dec eax
mov dword [rsp + 0xac], eax
jmp 0x180029546
mov dword [rsp + 0xb8], 8
mov dword [rsp + 0xc8], 0xc
cmp dword [rsp + 0xc8], 0
jle 0x18002962c
mov eax, dword [rsp + 0xc8]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x18002960e
mov dword [rsp + 0xb8], 4
mov eax, dword [rsp + 0xc8]
dec eax
mov dword [rsp + 0xc8], eax
jmp 0x1800295cc
mov dword [rsp + 0xb8], 0
mov eax, dword [rsp + 0xc8]
sub eax, 2
mov dword [rsp + 0xc8], eax
jmp 0x1800295cc
mov dword [rsp + 0xa0], 3
mov dword [rsp + 0xa4], 0xa
mov eax, dword [rsp + 0xa4]
test eax, eax
jle 0x1800296b2
mov eax, dword [rsp + 0xa4]
cmp eax, 1
jle 0x18002967f
mov eax, dword [rsp + 0xa0]
and eax, 0x107d
mov dword [rsp + 0xa0], eax
mov eax, dword [rsp + 0xa4]
sub eax, 2
mov dword [rsp + 0xa4], eax
jmp 0x180029642
mov eax, dword [rsp + 0xa0]
cmp eax, 0x80c
jle 0x1800296a0
mov eax, dword [rsp + 0xa0]
and eax, 0x85
mov dword [rsp + 0xa0], eax
mov eax, dword [rsp + 0xa4]
dec eax
mov dword [rsp + 0xa4], eax
jmp 0x180029642
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x130]
xor r8d, r8d
mov edx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0xe4], 0
mov dword [rsp + 0xe8], 0x14
cmp dword [rsp + 0xe8], 0
jle 0x180029763
mov eax, dword [rsp + 0xe8]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x180029746
mov dword [rsp + 0xe4], 4
mov eax, dword [rsp + 0xe8]
dec eax
mov dword [rsp + 0xe8], eax
jmp 0x180029704
mov dword [rsp + 0xe4], 0
mov eax, dword [rsp + 0xe8]
dec eax
mov dword [rsp + 0xe8], eax
jmp 0x180029704
mov dword [rsp + 0xd4], 3
mov dword [rsp + 0xd8], 0xa
mov eax, dword [rsp + 0xd8]
test eax, eax
jle 0x1800297e9
mov eax, dword [rsp + 0xd8]
cmp eax, 1
jle 0x1800297b6
mov eax, dword [rsp + 0xd4]
and eax, 0x107d
mov dword [rsp + 0xd4], eax
mov eax, dword [rsp + 0xd8]
sub eax, 2
mov dword [rsp + 0xd8], eax
jmp 0x180029779
mov eax, dword [rsp + 0xd4]
cmp eax, 0x80c
jle 0x1800297d7
mov eax, dword [rsp + 0xd4]
and eax, 0x85
mov dword [rsp + 0xd4], eax
mov eax, dword [rsp + 0xd8]
dec eax
mov dword [rsp + 0xd8], eax
jmp 0x180029779
mov dword [rsp + 0xec], 1
mov dword [rsp + 0xe0], 0x10
cmp dword [rsp + 0xe0], 0
jle 0x18002985f
mov eax, dword [rsp + 0xe0]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x180029841
mov dword [rsp + 0xec], 4
mov eax, dword [rsp + 0xe0]
dec eax
mov dword [rsp + 0xe0], eax
jmp 0x1800297ff
mov dword [rsp + 0xec], 0
mov eax, dword [rsp + 0xe0]
sub eax, 2
mov dword [rsp + 0xe0], eax
jmp 0x1800297ff
mov dword [rsp + 0xdc], 7
mov dword [rsp + 0xd0], 0x10
cmp dword [rsp + 0xd0], 0
jle 0x1800298d5
mov eax, dword [rsp + 0xd0]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x1800298b8
mov dword [rsp + 0xdc], 0
mov eax, dword [rsp + 0xd0]
sub eax, 2
mov dword [rsp + 0xd0], eax
jmp 0x180029875
mov dword [rsp + 0xdc], 0
mov eax, dword [rsp + 0xd0]
dec eax
mov dword [rsp + 0xd0], eax
jmp 0x180029875
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x4c]
mov r8d, dword [rsp + 0x130]
mov rdx, qword [rsp + 0x128]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x130]
xor r8d, r8d
mov edx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0xf0], 3
mov dword [rsp + 0xf8], 0xa
mov eax, dword [rsp + 0xf8]
test eax, eax
jle 0x1800299b1
mov eax, dword [rsp + 0xf8]
cmp eax, 1
jle 0x18002997e
mov eax, dword [rsp + 0xf0]
and eax, 0x107d
mov dword [rsp + 0xf0], eax
mov eax, dword [rsp + 0xf8]
sub eax, 2
mov dword [rsp + 0xf8], eax
jmp 0x180029941
mov eax, dword [rsp + 0xf0]
cmp eax, 0x80c
jle 0x18002999f
mov eax, dword [rsp + 0xf0]
and eax, 0x85
mov dword [rsp + 0xf0], eax
mov eax, dword [rsp + 0xf8]
dec eax
mov dword [rsp + 0xf8], eax
jmp 0x180029941
mov dword [rsp + 0xf4], 8
mov dword [rsp + 0x100], 0x12
cmp dword [rsp + 0x100], 0
jle 0x180029a27
mov eax, dword [rsp + 0x100]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x180029a09
mov dword [rsp + 0xf4], 4
mov eax, dword [rsp + 0x100]
dec eax
mov dword [rsp + 0x100], eax
jmp 0x1800299c7
mov dword [rsp + 0xf4], 0
mov eax, dword [rsp + 0x100]
sub eax, 2
mov dword [rsp + 0x100], eax
jmp 0x1800299c7
mov dword [rsp + 0x10c], 0
mov dword [rsp + 0x108], 0xe
cmp dword [rsp + 0x108], 0
jle 0x180029a9d
mov eax, dword [rsp + 0x108]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x180029a80
mov dword [rsp + 0x10c], 4
mov eax, dword [rsp + 0x108]
sub eax, 2
mov dword [rsp + 0x108], eax
jmp 0x180029a3d
mov dword [rsp + 0x10c], 4
mov eax, dword [rsp + 0x108]
dec eax
mov dword [rsp + 0x108], eax
jmp 0x180029a3d
mov dword [rsp + 0xfc], 4
mov dword [rsp + 0x104], 3
mov eax, dword [rsp + 0x104]
test eax, eax
jle 0x180029b21
mov eax, dword [rsp + 0x104]
cmp eax, 1
jle 0x180029af0
mov eax, dword [rsp + 0xfc]
and eax, 0x1891
mov dword [rsp + 0xfc], eax
mov eax, dword [rsp + 0x104]
sub eax, 2
mov dword [rsp + 0x104], eax
jmp 0x180029ab3
mov eax, dword [rsp + 0xfc]
cmp eax, 0x805
jle 0x180029b0f
mov eax, dword [rsp + 0xfc]
and eax, 0x7e
mov dword [rsp + 0xfc], eax
mov eax, dword [rsp + 0x104]
dec eax
mov dword [rsp + 0x104], eax
jmp 0x180029ab3
mov eax, 1
add rsp, 0x118
ret