Function at 0x1000066ac
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0xf0
mov rax, qword [0x100009110]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov rbx, rcx
mov rcx, qword [0x100012438]
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, dword [0x10001242c]
lea r15, [0x100009db0]
movdqu xmm0, xmmword [rbx]
xor r13d, r13d
mov ebp, 1
mov r8d, edi
cmp eax, r13d
mov eax, 0x51eb851f
cmovne ebp, r13d
mul edi
shr edx, 5
imul edx, edx, 0x64
sub r8d, edx
mov ecx, r8d
imul rcx, rcx, 0x34
lea r12, [rcx + r15 + 0x19c]
movdqu xmmword [r12], xmm0
mov eax, dword [rbx + 0x68]
mov dword [rcx + r15 + 0x1ac], eax
mov eax, dword [rbx + 0x6c]
mov dword [rcx + r15 + 0x1b0], eax
mov eax, dword [rbx + 0x60]
mov dword [rcx + r15 + 0x1b4], eax
mov eax, dword [rbx + 0x70]
mov dword [rcx + r15 + 0x1b8], eax
mov eax, dword [rbx + 0x74]
mov dword [rcx + r15 + 0x1bc], eax
mov eax, dword [rbx + 0x78]
mov dword [rcx + r15 + 0x1c0], eax
mov eax, dword [rbx + 0x7c]
mov dword [rcx + r15 + 0x1c4], eax
mov eax, dword [rbx + 0x80]
mov dword [rcx + r15 + 0x1c8], eax
mov eax, dword [rbx + 0x84]
mov dword [rcx + r15 + 0x1cc], eax
cmp edi, 0x64
jae 0x1000067b2
lea eax, [rdi + 1]
mov dword [0x100009db8], eax
mov dword [r15 + r8*4 + 0xc], r8d
jmp 0x1000067dc
lea rdi, [0x100009dbc]
lea rsi, [0x100009dc0]
mov ecx, 0x63
rep movsd dword [rdi], dword [rsi]
mov dword [0x100009db8], 0x64
mov dword [0x100009f48], r8d
lea edi, [r8 + 0x64]
inc edi
mov dword [0x10001242c], edi
cmp ebp, 1
jne 0x100006828
mov rcx, qword [0x100012430]
lea edx, [rbp + 1]
mov esi, 0x15ec
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
cmp rax, r13
je 0x100006828
mov r8, rsi
mov rdx, r15
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp dword [0x1000124f8], 1
lea rsi, [0x100009740]
mov r15d, 0x80
jne 0x10000694d
mov edi, dword [rbx + 0x58]
mov rcx, rsi
call fcn.100002988
cmp eax, r13d
jne 0x1000068ad
mov rcx, rsi
call fcn.100002910
cmp eax, r13d
je 0x10000693e
mov rcx, qword [0x100009748]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x10000693e
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.100003714
mov rcx, qword [0x100009748]
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x60]
mov r8d, r15d
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x100009748]
mov r9d, 2
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x10000693e
lea rcx, [rsp + 0x60]
mov r8, r15
xor edx, edx
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x68]
lea rdx, [rbx + 0x10]
mov r8d, 0x47
mov dword [rsp + 0x60], 2
call sub.msvcrt.dll_memcpy
mov dword [rsp + 0xaf], edi
mov al, r13b
mov byte [rsp + 0x64], r13b
lea rcx, [rsp + 0x60]
mov rdx, r15
add al, byte [rcx]
inc rcx
sub rdx, 1
jne 0x10000690c
mov rcx, qword [0x100009748]
not al
lea r9, [rsp + 0x30]
inc al
lea rdx, [rsp + 0x60]
mov r8d, r15d
mov byte [rsp + 0x64], al
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
call fcn.100002a3c
mov dword [0x1000124f8], r13d
mov rcx, rsi
call fcn.100002988
cmp eax, r13d
jne 0x1000069b5
mov rcx, rsi
call fcn.100002910
cmp eax, r13d
je 0x100006a3e
mov rcx, qword [0x100009748]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x100006a3e
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.100003714
mov rcx, qword [0x100009748]
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x60]
mov r8d, r15d
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x100009748]
mov r9d, 2
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x100006a3e
lea rcx, [rsp + 0x60]
mov r8, r15
xor edx, edx
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x68]
mov rdx, r12
mov r8d, 0x34
mov dword [rsp + 0x60], 3
call sub.msvcrt.dll_memcpy
mov dl, r13b
mov byte [rsp + 0x64], r13b
lea rax, [rsp + 0x60]
mov rcx, r15
add dl, byte [rax]
inc rax
sub rcx, 1
jne 0x100006a0c
mov rcx, qword [0x100009748]
not dl
lea r9, [rsp + 0x30]
inc dl
mov r8d, r15d
mov qword [rsp + 0x20], r13
mov byte [rsp + 0x64], dl
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
call fcn.100002a3c
cmp dword [0x100009758], r13d
je 0x100006a8d
mov rcx, qword [0x100009760]
lea r8, [rsp + 0x38]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
cmp eax, r13d
je 0x100006a8d
mov ecx, dword [rsp + 0x54]
mov eax, dword [rsp + 0x58]
shl rcx, 0x20
add rcx, rax
cmp rcx, 0xc35000
jl 0x100006a8d
mov rcx, qword [0x100012468]
call qword [sym.imp.KERNEL32.dll_SetEvent]
cmp ebp, 1
jne 0x100006a9f
mov rcx, qword [0x100012438]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.1000077a0
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret