Function at 0x18002c170
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
imul eax, r9d, 0x3e8
mov rdi, r8
mov r14, rcx
mov ebp, r9d
mov dword [rsp + 0x30], eax
cmp r9d, eax
ja 0x18002c426
mov r15, qword [rsp + 0x58]
xor ebx, ebx
movzx r12d, word [rsp + 0xb8]
mov r13d, dword [rsp + 0xb8]
nop dword [rax + rax]
cmp ebp, 0x648
ja 0x18002c29b
je 0x18002c280
mov eax, ebp
sub eax, 8
je 0x18002c25e
sub eax, 0xaa
je 0x18002c24c
sub eax, 0x1e
je 0x18002c3c2
sub eax, 0x17
je 0x18002c219
cmp eax, 0x241
jne 0x18002c3ac
mov eax, r13d
add rax, rdx
mov qword [rsp + 0x40], rax
jmp 0x18002c3ac
mov eax, dword [rdx]
xor r9d, r9d
not eax
mov qword [rsp + 0x28], rbx
xor edx, edx
mov dword [rsp + 0x48], eax
lea rax, [rsp + 0x48]
mov r8, r14
mov qword [rsp + 0x20], rax
lea ecx, [rdx + 0x41]
call fcn.180030560
mov ecx, dword [rdi]
or ecx, eax
mov dword [r14], ecx
jmp 0x18002c3a4
cmp dword [rdx], ebx
jne 0x18002c3db
mov qword [rsp + 0x38], r14
jmp 0x18002c3ac
xor eax, eax
lea r15, [r14 + 0x258]
mov qword [r15], rax
mov r13d, dword [r14 + 0x38]
test r13d, r13d
jne 0x18002c3ac
mov dword [rsp + 0x38], ebx
jmp 0x18002c426
movzx r12d, word [r14 + 0x18c]
test r12w, r12w
je 0x18002c3f7
inc r12w
jmp 0x18002c3ac
cmp ebp, 0x968
je 0x18002c2d1
cmp ebp, 0xc88
je 0x18002c2c8
cmp ebp, 0xfa8
je 0x18002c426
cmp ebp, 0x463a
je 0x18002c426
jmp 0x18002c3ac
mov dword [rsp + 0x38], ebx
jmp 0x18002c3ac
movzx esi, r12w
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x58]
mov qword [rsp + 0x58], rsi
mov edx, 0x75
mov qword [rsp + 0x50], 4
mov rcx, r14
call fcn.18002e740
mov qword [r15], rax
test rax, rax
je 0x18002c41e
mov r8, qword [rdi]
movzx ecx, r12w
cmp word [r14 + 0xf2], bx
je 0x18002c354
lea edx, [rcx*4]
add edx, r13d
cmp r8, rdx
jb 0x18002c401
mov rdi, rbx
test rsi, rsi
je 0x18002c39c
xor edx, edx
lea r8, [rsp + 0x40]
xor r9d, r9d
lea ecx, [rdx + 0x44]
call fcn.180027b80
mov rcx, qword [r15]
mov dword [rcx + rdi*4], eax
inc rdi
cmp rdi, rsi
jb 0x18002c332
jmp 0x18002c39c
lea edx, [rcx*2]
add edx, r13d
cmp r8, rdx
jb 0x18002c401
mov rdi, rbx
test rsi, rsi
je 0x18002c39c
nop
mov r9d, 0x2e
mov qword [rsp + 0x20], rbx
lea r8, [rsp + 0x40]
xor edx, edx
xor ecx, ecx
call fcn.18002b910
movzx ecx, ax
mov rax, qword [r15]
add ecx, ecx
mov dword [rax + rdi*4], ecx
inc rdi
cmp rdi, rsi
jb 0x18002c370
mov rdi, qword [rsp + 0xb0]
mov rdx, qword [rsp + 0xa8]
imul eax, dword [rsp + 0xb8], 0x64
add ebp, eax
cmp ebp, dword [rsp + 0x30]
jbe 0x18002c1d0
jmp 0x18002c426
mov r9, qword [rsp + 0xc0]
mov rcx, r14
mov r8, qword [rdi]
mov rdx, qword [rdx]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x18002c42b
xor r9d, r9d
mov qword [rsp + 0x20], rbx
mov r8, r14
xor edx, edx
mov ecx, 0x98
call fcn.18002c450
mov rax, rbx
jmp 0x18002c42b
mov dword [rsp + 0x38], 0x70003
jmp 0x18002c426
mov r9, r14
xor r8d, r8d
mov rdx, rax
mov ecx, SHTestTokenMembership
call fcn.180040cc0
mov dword [rsp + 0x38], 0x70004
jmp 0x18002c426
mov dword [rsp + 0x38], 0x70001
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret