Function at 0x6a3040
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov ebx, dword [rcx + 0x150]
mov rsi, rcx
cmp ebx, 0xffffffff
je 0x6a3240
mov rbp, qword [rcx + 0x180]
mov ecx, ebx
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x6a3340
lea rcx, [0x00c2c540]
movzx edi, bl
call sub.KERNEL32.dll_EnterCriticalSection
mov eax, edi
lea r8, [0x009a3540]
mov rdx, rax
shl rdx, 4
add rdx, r8
mov rcx, qword [rdx]
mov r9, rcx
and r9d, 0xf
test rcx, rcx
je 0x6a3320
test r9, r9
jne 0x6a3320
mov r10, qword [rdx + 8]
mov r9d, 0x10
lea rdx, [r10 + 0x28]
mov eax, 1
cmp ebx, dword [r10]
jne 0x6a30f5
jmp 0x6a31f5
mov ecx, dword [rdx]
lea r8, [rax + 1]
add rdx, 0x28
cmp ebx, ecx
je 0x6a3260
mov rax, r8
cmp rax, r9
jb 0x6a30e0
mov rdx, qword [r10 + 0x280]
test rdx, rdx
je 0x6a3135
nop word cs:[rax + rax]
mov rcx, rdx
xor eax, eax
cmp ebx, dword [rcx]
je 0x6a31e4
add eax, 1
add rcx, 0x28
cmp eax, 0x10
jne 0x6a3115
mov rdx, qword [rdx + 0x280]
test rdx, rdx
jne 0x6a3110
lea rcx, [0x00c2c540]
call sub.KERNEL32.dll_LeaveCriticalSection
cmp rbp, 0xffffffffffffffff
jne 0x6a3270
mov dword [rsp + 0x38], 0
xor r13d, r13d
xor ebx, ebx
xor edi, edi
lea r15, [rsp + 0x44]
mov r14, qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x6a317c
cmp dword [rsi + 0x170], ebx
jbe 0x6a32e1
cmp rbp, 0xffffffffffffffff
je 0x6a318c
mov eax, edi
add rax, rbp
mov qword [rsp + 0x60], rax
mov eax, ebx
mov r9, r15
mov rcx, r12
add ebx, 1
shl rax, 4
add rax, qword [rsi + 0x178]
mov rdx, qword [rax + 8]
mov qword [rsp + 0x20], r13
mov r8d, dword [rax]
call r14
add edi, dword [rsp + 0x44]
mov r11d, eax
mov r10d, edi
test eax, eax
jne 0x6a3170
mov edx, dword [rsp + 0x38]
test edx, edx
jne 0x6a32ed
mov eax, dword [rsp + 0x38]
or eax, r10d
je 0x6a32c0
mov eax, r10d
mov qword [rsi + 0x88], rax
jmp 0x6a3228
lea rax, [rax + rax*4]
lea r10, [rdx + rax*8]
test r10, r10
je 0x6a3135
movdqu xmm0, xmmword [r10 + 8]
lea rcx, [0x00c2c540]
movaps xmmword [rsp + 0x50], xmm0
movdqu xmm1, xmmword [r10 + 0x18]
movaps xmmword [rsp + 0x60], xmm1
call sub.KERNEL32.dll_LeaveCriticalSection
lea r8, [rsp + 0x50]
mov rdx, r12
mov rcx, rsi
call fcn.006a2820
nop
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rcx + 0x88], 0xfffffffffffff00d
mov dword [rcx + 0x14c], 6
jmp 0x6a3228
lea rax, [rax + rax*4]
lea r10, [r10 + rax*8]
jmp 0x6a31ec
xor edx, edx
mov r9d, 1
lea r8, [rsp + 0x48]
mov rcx, r12
mov qword [rsp + 0x50], 0
lea r13, [rsp + 0x50]
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
setne al
movzx eax, al
mov dword [rsp + 0x38], eax
jmp 0x6a3156
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi + 0x14c], eax
mov ecx, eax
call fcn.0069fed0
cdqe
mov qword [rsi + 0x88], rax
jmp 0x6a3228
mov eax, dword [rsp + 0x38]
test eax, eax
je 0x6a31d8
mov dword [rsp + 0x3c], r10d
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x48]
mov dword [rsp + 0x38], r11d
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov r10d, dword [rsp + 0x3c]
mov eax, dword [rsp + 0x38]
or eax, r10d
jne 0x6a31d8
jmp 0x6a32c0
shl rax, 4
mov r10, qword [r8 + rax + 8]
test r9, r9
jne 0x6a30c6
jmp 0x6a30fa
mov dword [rsi + 0x14c], 6
mov ecx, 6
call fcn.0069fed0
cdqe
mov qword [rsi + 0x88], rax
jmp 0x6a3228