Function at 0x6ca460
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov ebx, dword [rcx + 0x150]
mov rsi, rcx
cmp ebx, 0xffffffff
je 0x6ca660
mov rbp, qword [rcx + 0x180]
mov ecx, ebx
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x6ca760
lea rcx, [0x010a6200]
movzx edi, bl
call sub.KERNEL32.DLL_EnterCriticalSection
mov eax, edi
lea r8, [0x00e1d200]
mov rdx, rax
shl rdx, 4
add rdx, r8
mov rcx, qword [rdx]
mov r9, rcx
and r9d, 0xf
test rcx, rcx
je 0x6ca740
test r9, r9
jne 0x6ca740
mov r10, qword [rdx + 8]
mov r9d, 0x10
lea rdx, [r10 + 0x28]
mov eax, 1
cmp ebx, dword [r10]
jne 0x6ca515
jmp 0x6ca615
mov ecx, dword [rdx]
lea r8, [rax + 1]
add rdx, 0x28
cmp ebx, ecx
je 0x6ca680
mov rax, r8
cmp rax, r9
jb 0x6ca500
mov rdx, qword [r10 + 0x280]
test rdx, rdx
je 0x6ca555
nop word cs:[rax + rax]
mov rcx, rdx
xor eax, eax
cmp ebx, dword [rcx]
je 0x6ca604
add eax, 1
add rcx, 0x28
cmp eax, 0x10
jne 0x6ca535
mov rdx, qword [rdx + 0x280]
test rdx, rdx
jne 0x6ca530
lea rcx, [0x010a6200]
call sub.KERNEL32.DLL_LeaveCriticalSection
cmp rbp, 0xffffffffffffffff
jne 0x6ca690
mov dword [rsp + 0x38], 0
xor r13d, r13d
xor ebx, ebx
xor edi, edi
lea r15, [rsp + 0x44]
mov r14, qword [sym.imp.KERNEL32.DLL_WriteFile]
jmp 0x6ca59c
cmp dword [rsi + 0x170], ebx
jbe 0x6ca701
cmp rbp, 0xffffffffffffffff
je 0x6ca5ac
mov eax, edi
add rax, rbp
mov qword [rsp + 0x60], rax
mov eax, ebx
mov r9, r15
mov rcx, r12
add ebx, 1
shl rax, 4
add rax, qword [rsi + 0x178]
mov rdx, qword [rax + 8]
mov qword [rsp + 0x20], r13
mov r8d, dword [rax]
call r14
add edi, dword [rsp + 0x44]
mov r11d, eax
mov r10d, edi
test eax, eax
jne 0x6ca590
mov edx, dword [rsp + 0x38]
test edx, edx
jne 0x6ca70d
mov eax, dword [rsp + 0x38]
or eax, r10d
je 0x6ca6e0
mov eax, r10d
mov qword [rsi + 0x88], rax
jmp 0x6ca648
lea rax, [rax + rax*4]
lea r10, [rdx + rax*8]
test r10, r10
je 0x6ca555
movdqu xmm0, xmmword [r10 + 8]
lea rcx, [0x010a6200]
movaps xmmword [rsp + 0x50], xmm0
movdqu xmm1, xmmword [r10 + 0x18]
movaps xmmword [rsp + 0x60], xmm1
call sub.KERNEL32.DLL_LeaveCriticalSection
lea r8, [rsp + 0x50]
mov rdx, r12
mov rcx, rsi
call fcn.006c9c40
nop
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rcx + 0x88], 0xfffffffffffff00d
mov dword [rcx + 0x14c], 6
jmp 0x6ca648
lea rax, [rax + rax*4]
lea r10, [r10 + rax*8]
jmp 0x6ca60c
xor edx, edx
mov r9d, 1
lea r8, [rsp + 0x48]
mov rcx, r12
mov qword [rsp + 0x50], 0
lea r13, [rsp + 0x50]
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
call qword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
test eax, eax
setne al
movzx eax, al
mov dword [rsp + 0x38], eax
jmp 0x6ca576
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [rsi + 0x14c], eax
mov ecx, eax
call fcn.006c72f0
cdqe
mov qword [rsi + 0x88], rax
jmp 0x6ca648
mov eax, dword [rsp + 0x38]
test eax, eax
je 0x6ca5f8
mov dword [rsp + 0x3c], r10d
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x48]
mov dword [rsp + 0x38], r11d
mov rcx, r12
call qword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
mov r10d, dword [rsp + 0x3c]
mov eax, dword [rsp + 0x38]
or eax, r10d
jne 0x6ca5f8
jmp 0x6ca6e0
shl rax, 4
mov r10, qword [r8 + rax + 8]
test r9, r9
jne 0x6ca4e6
jmp 0x6ca51a
mov dword [rsi + 0x14c], 6
mov ecx, 6
call fcn.006c72f0
cdqe
mov qword [rsi + 0x88], rax
jmp 0x6ca648