Function at 0x14006a7e0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
movdqa xmm0, xmmword [0x140226e20]
mov rax, qword [rsp + 0xd8]
mov r12, qword [rsp + 0xd0]
mov rbx, rdx
mov rbp, rcx
mov edx, dword [rsp + 0xe8]
mov rsi, r8
mov qword [rbx + 0x78], rax
mov rax, qword [rsp + 0xe0]
mov rdi, r9
movups xmmword [rbx + 0xa0], xmm0
pxor xmm0, xmm0
mov dword [rbx + 8], 3
mov qword [rbx + 0x80], r8
mov qword [rbx + 0x70], rax
mov dword [rbx + 0x88], 0
mov dword [rbx + 0x90], 0
mov qword [rbx + 0x98], 0
movups xmmword [rbx + 0x40], xmm0
movups xmmword [rbx + 0x50], xmm0
test r12, r12
je 0x14006a940
mov r13d, dword [r9]
cmp r12, 1
jne 0x14006aae0
and edx, 1
jne 0x14006aae0
mov eax, dword [rsi + 0x58]
mov r10, qword [r9]
mov rdi, qword [r9 + 8]
mov edx, eax
not edx
and edx, 0x1100000
jne 0x14006a958
mov rcx, qword [rsi + 0x118]
lea r9, [rsp + 0x5c]
mov r8d, r13d
mov rdx, rdi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14006adc0
mov eax, dword [rsi + 0x7c]
mov qword [rbx + 0x60], 0
lea edx, [rax + 1]
mov dword [rsi + 0x7c], edx
test eax, eax
jne 0x14006a900
mov eax, dword [rsi + 0x58]
test al, 4
jne 0x14006a900
mov edx, eax
or edx, 4
mov dword [rsi + 0x58], edx
test al, 8
je 0x14006a900
mov rax, qword [rsi + 8]
add dword [rax + 8], 1
nop dword [rax]
add dword [rbp + 0x20], 1
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x38]
add dword [rsi + 0x78], 1
lea r9, [rbx + 0x40]
add dword [rsi + 0x100], 1
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
je 0x14006ae03
xor esi, esi
mov eax, esi
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor edi, edi
xor r13d, r13d
mov eax, dword [rsi + 0x58]
mov edx, eax
not edx
and edx, 0x1100000
je 0x14006a8a4
test eax, 0x1000000
je 0x14006aa00
movabs rax, 0xffffffff00000000
mov qword [rbx + 0x98], rdi
and rax, r10
mov qword [rbx + 0x68], 0
or rax, r13
mov qword [rbx + 0x90], rax
mov rax, qword [rsi + 0x208]
test rax, rax
je 0x14006ac28
mov rax, qword [rax + 0x68]
mov qword [rbx + 0x68], rax
mov rax, qword [rsi + 0x208]
mov qword [rax + 0x68], rbx
mov eax, dword [rsi + 0x100]
mov qword [rsi + 0x208], rbx
test eax, eax
je 0x14006ac38
mov qword [rbx + 0x60], r13
add qword [rsi + 0x60], r13
mov edx, dword [rsi + 0x7c]
lea ecx, [rdx + 1]
mov dword [rsi + 0x7c], ecx
test edx, edx
jne 0x14006a9e2
mov edx, dword [rsi + 0x58]
test dl, 4
je 0x14006aac0
add dword [rbp + 0x20], 1
add eax, 1
add dword [rsi + 0x78], 1
mov dword [rsi + 0x100], eax
jmp 0x14006a92a
test eax, 0x100000
jne 0x14006aa50
lea rax, [rbx + 0x40]
xor r9d, r9d
mov r8d, r13d
mov rdx, rdi
mov rcx, qword [rsi + 0x118]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14006acd0
mov qword [rbx + 0x60], 0
test byte [rsi + 0x5a], 8
jne 0x14006ad08
mov eax, dword [rsi + 0x100]
jmp 0x14006a9c9
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x58], rax
test rax, rax
je 0x14006adea
lea rax, [rbx + 0x40]
xor r9d, r9d
mov r8d, r13d
mov rdx, rdi
mov rcx, qword [rsi + 0x118]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14006ac78
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rdi
cmp eax, 0x3e5
je 0x14006ad78
call rdi
mov rcx, qword [rbx + 0x58]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14006a92c
mov ecx, edx
or ecx, 4
and edx, 8
mov dword [rsi + 0x58], ecx
je 0x14006a9e2
mov rdx, qword [rsi + 8]
add dword [rdx + 8], 1
jmp 0x14006a9e2
xor edx, edx
xor r14d, r14d
xor eax, eax
nop word [rax + rax]
shl rax, 4
mov eax, dword [rdi + rax]
add r14, rax
lea eax, [rdx + 1]
mov rdx, rax
cmp rax, r12
jb 0x14006aaf0
mov rax, r14
shr rax, 0x20
jne 0x14006acf8
lea rcx, [r14 + 0xb8]
call fcn.140082db0
mov r15, rax
test rax, rax
je 0x14006ade0
movdqu xmm1, xmmword [rbx]
lea rax, [rax + 0xb8]
xor r10d, r10d
mov r13d, 0xb8
movups xmmword [rax - 0xb8], xmm1
movdqu xmm2, xmmword [rbx + 0x10]
movups xmmword [rax - 0xa8], xmm2
movdqu xmm3, xmmword [rbx + 0x20]
movups xmmword [rax - 0x98], xmm3
movdqu xmm4, xmmword [rbx + 0x30]
movups xmmword [rax - 0x88], xmm4
movdqu xmm5, xmmword [rbx + 0x40]
movups xmmword [rax - 0x78], xmm5
movdqu xmm1, xmmword [rbx + 0x50]
movups xmmword [rax - 0x68], xmm1
movdqu xmm2, xmmword [rbx + 0x60]
movups xmmword [rax - 0x58], xmm2
movdqu xmm3, xmmword [rbx + 0x70]
movups xmmword [rax - 0x48], xmm3
movdqu xmm4, xmmword [rbx + 0x80]
movups xmmword [rax - 0x38], xmm4
movdqu xmm5, xmmword [rbx + 0x90]
movups xmmword [rax - 0x28], xmm5
movdqu xmm1, xmmword [rbx + 0xa0]
mov qword [rax - 8], rbx
xor ebx, ebx
movups xmmword [rax - 0x18], xmm1
mov dword [rax - 0x30], 1
mov qword [rsp + 0x38], rax
nop dword [rax + rax]
shl rbx, 4
lea rcx, [r15 + r13]
mov dword [rsp + 0x34], r10d
add rbx, rdi
mov rdx, qword [rbx + 8]
mov r8d, dword [rbx]
call sub.msvcrt.dll_memcpy
mov r10d, dword [rsp + 0x34]
mov eax, dword [rbx]
lea ebx, [r10 + 1]
add r13, rax
mov r10, rbx
cmp rbx, r12
jb 0x14006abc8
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x40]
mov r8d, r14d
mov rbx, r15
call fcn.140082ef0
mov r10, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov r13d, r10d
jmp 0x14006a945
mov qword [rbx + 0x68], rbx
jmp 0x14006a9ac
mov rdx, qword [rbx + 0x68]
cmp rdx, rbx
je 0x14006add0
mov rax, qword [rdx + 0x68]
mov qword [rbx + 0x68], rax
mov r8d, 0x10
lea rcx, [0x14006a740]
call qword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
test eax, eax
je 0x14006adfe
mov eax, dword [rsi + 0x100]
jmp 0x14006a9c1
mov qword [rbx + 0x60], 0
mov rcx, qword [rbx + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsi + 0x7c]
lea edx, [rax + 1]
mov dword [rsi + 0x7c], edx
test eax, eax
jne 0x14006acb8
mov eax, dword [rsi + 0x58]
test al, 4
jne 0x14006acb8
mov edx, eax
or edx, 4
mov dword [rsi + 0x58], edx
test al, 8
je 0x14006acb8
mov rax, qword [rsi + 8]
add dword [rax + 8], 1
nop word [rax + rax]
mov eax, dword [rsi + 0x100]
add dword [rbp + 0x20], 1
add dword [rsi + 0x78], 1
add eax, 1
jmp 0x14006a9ed
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rdi
cmp eax, 0x3e5
jne 0x14006ada0
mov qword [rbx + 0x60], r13
add qword [rsi + 0x60], r13
jmp 0x14006aa36
mov esi, 0x2747
jmp 0x14006a92c
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0xa0], rax
test rax, rax
je 0x14006adea
mov rdx, qword [rbx + 0x58]
lea rcx, [rbx + 0xa8]
mov dword [rsp + 0x28], 4
mov r9, rbx
mov dword [rsp + 0x20], 0xffffffff
lea r8, [0x14006a6e0]
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
test eax, eax
jne 0x14006aa40
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rbx + 0x60], r13
mov rcx, qword [rbx + 0x58]
mov edx, 0xffffffff
add qword [rsi + 0x60], r13
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14006ac80
jmp 0x14006aaab
mov rax, rdi
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14006a92c
mov qword [rsi + 0x208], 0
jmp 0x14006ac4d
mov esi, 8
jmp 0x14006a92c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x140226dcb]
mov ecx, eax
call fcn.140060630
call fcn.14006a720
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x140226db0]
mov ecx, eax
call fcn.140060630
nop
nop dword [rax + rax]