Function at 0x6d750
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x3c0
mov rax, qword [0x00090008]
xor rax, rsp
mov qword [rsp + 0x3b0], rax
cmp dword [rcx + 8], 0xffffffff
mov rsi, r8
mov ebp, edx
mov rdi, rcx
je 0x6d783
mov rcx, qword [rcx]
call fcn.0006cd60
mov rcx, qword [rdi]
mov dword [rdi + 8], 0xffffffff
cmp ebp, dword [rcx + 8]
jl 0x6d79c
mov eax, 0x10000
jmp 0x6d86b
mov qword [rsp + 0x3f8], r14
cmp ebp, dword [rcx + 0x14]
jge 0x6d7ae
call fcn.0006c550
mov rax, qword [rdi]
xor r14d, r14d
mov qword [rsp + 0x3e8], rbx
cmp dword [rax + 0x14], ebp
jge 0x6d818
mov rbx, qword [rdi]
test rbx, rbx
je 0x6d810
cmp dword [rbx + 0x1c], r14d
je 0x6d810
mov edx, dword [rbx + 0x14]
inc edx
cmp edx, dword [rbx + 8]
je 0x6d810
mov ecx, dword [rbx + 0x54]
lea r8, [rbx + 0x7c]
add ecx, dword [rbx + 0x50]
xor r9d, r9d
mov eax, dword [rbx + 0x4c]
add eax, 0x2e
mov dword [rbx + 0x14], edx
add ecx, eax
mov dword [rsp + 0x20], r14d
add dword [rbx + 0x18], ecx
lea rdx, [rbx + 0x2c]
mov rcx, rbx
call fcn.0006c2d0
mov ecx, r14d
test eax, eax
sete cl
mov dword [rbx + 0x1c], ecx
mov rax, qword [rdi]
cmp dword [rax + 0x14], ebp
jl 0x6d7c1
lea r8, [rsp + 0x60]
mov edx, ebp
mov rcx, rdi
call fcn.0006cf90
test byte [rsp + 0x168], 0x10
movzx eax, byte [rsi]
je 0x6d886
cmp al, 0x2f
je 0x6d84f
cmp al, 0x5c
je 0x6d84f
test al, al
je 0x6d846
cmp byte [rsi + 1], 0x3a
je 0x6d84f
lea rcx, [rdi + 0x150]
jmp 0x6d851
xor ecx, ecx
mov rdx, rsi
call fcn.0006d5f0
xor eax, eax
mov rbx, qword [rsp + 0x3e8]
mov r14, qword [rsp + 0x3f8]
mov rcx, qword [rsp + 0x3b0]
xor rcx, rsp
call fcn.0006e940
add rsp, 0x3c0
pop rdi
pop rsi
pop rbp
ret
mov r9, rsi
mov rcx, rsi
test al, al
je 0x6d8a7
cmp al, 0x2f
je 0x6d898
cmp al, 0x5c
jne 0x6d89c
lea r9, [rcx + 1]
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x6d890
lea rdx, [rsp + 0x190]
mov rcx, rsi
sub rdx, rsi
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x6d8c0
cmp r9, rsi
jne 0x6d8dd
mov byte [rsp + 0x190], r14b
jmp 0x6d915
mov rax, r9
sub rax, rsi
cmp rax, 0x104
jae 0x6da85
mov byte [rsp + rax + 0x190], r14b
movzx eax, byte [rsp + 0x190]
cmp al, 0x2f
je 0x6d947
cmp al, 0x5c
je 0x6d947
test al, al
je 0x6d915
cmp byte [rsp + 0x191], 0x3a
je 0x6d947
mov qword [rsp + 0x20], r9
lea r8, [rdi + 0x150]
lea r9, [rsp + 0x190]
lea rdx, str._s_s_s
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rdi + 0x150]
jmp 0x6d966
lea r8, [rsp + 0x190]
lea rdx, str._s_s
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.USER32.dll_wsprintfA]
xor ecx, ecx
lea rdx, [rsp + 0x190]
call fcn.0006d5f0
mov eax, dword [rsp + 0x168]
lea rcx, [rsp + 0x2a0]
mov qword [rsp + 0x30], r14
xor r9d, r9d
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x6d9b7
mov eax, 0x200
jmp 0x6d85b
mov rdx, qword [rdi + 0x140]
mov rcx, qword [rdi]
call fcn.0006c7f0
cmp qword [rdi + 0x148], r14
jne 0x6d9e0
mov ecx, 0x4000
call fcn.0006e9a8
mov qword [rdi + 0x148], rax
mov rdx, qword [rdi + 0x148]
lea r9, [rsp + 0x50]
mov rcx, qword [rdi]
mov r8d, 0x4000
call fcn.0006ca10
mov ebx, eax
cmp eax, 0xffffff96
je 0x6da66
test eax, eax
js 0x6da33
jle 0x6da28
mov rdx, qword [rdi + 0x148]
lea r9, [rsp + 0x54]
mov r8d, eax
mov qword [rsp + 0x20], r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x6da3b
cmp byte [rsp + 0x50], r14b
jne 0x6da43
test ebx, ebx
jne 0x6d9e0
mov r14d, 0x5000000
jmp 0x6da6c
mov r14d, 0x400
jmp 0x6da6c
lea r9, [rsp + 0x17c]
mov rcx, rsi
lea r8, [rsp + 0x16c]
lea rdx, [rsp + 0x174]
call qword [sym.imp.KERNEL32.dll_SetFileTime]
jmp 0x6da6c
mov r14d, 0x1000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi]
call fcn.0006cd60
mov eax, r14d
jmp 0x6d85b
call fcn.0006ed94
int3