Function at 0x14006fdb0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
push rbp
sub rsp, 0x48
mov r15, rcx
mov rdi, r8
mov rbx, rdx
xor r12d, r12d
test r15, r15
je 0x1400702d6
movzx r14d, byte [r15 + 0x24c]
xor eax, eax
and r14d, 0x80
movzx r13d, byte [r15 + 0x24d]
mov rsi, qword [r15 + 0x218]
and r13d, 1
mov rbp, qword [r15 + 0x178]
shr r14d, 7
mov qword [r15 + 0x150], rax
mov qword [r15 + 0x190], rax
test rdi, rdi
jne 0x14006fed5
mov eax, 1
test r15, r15
je 0x1400701ad
test byte [r15 + 0x249], 4
jne 0x14006fe4f
mov qword [r15 + 0x130], 0
add rsp, 0x48
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov rdx, qword [r15 + 0x68]
mov rcx, rbp
mov rbx, qword [r15 + 0x78]
lea r9, [rsp + 0x38]
sub rbx, rdx
mov r8d, ebx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, 0xffffffff
test eax, eax
mov rbp, qword [r15 + 0x68]
mov rcx, qword [r15 + 0x1a0]
cmove eax, edx
xor edi, edi
mov rsi, qword [r15 + 0x148]
add rcx, rbp
add rbx, rsi
mov qword [r15 + 0x78], rdi
mov qword [r15 + 0x80], rcx
and byte [r15 + 0x249], 0xfb
mov qword [r15 + 0x70], rbp
mov qword [r15 + 0x148], rbx
mov qword [r15 + 0x140], rbx
mov qword [r15 + 0x130], rdi
add rsp, 0x48
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
test r15, r15
je 0x14006ff52
mov r10, qword [r15 + 0x78]
test r10, r10
je 0x14006ff52
cmp rbx, r10
je 0x14006ff52
mov rdx, qword [r15 + 0x68]
sub r10, rdx
je 0x14006ff52
mov rcx, rbp
mov qword [rsp + 0x20], 0
mov r8d, r10d
mov qword [rsp + 0x30], r10
lea r9, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r10, qword [rsp + 0x30]
test eax, eax
jne 0x14006ff3a
mov qword [r15 + 0x130], 0
mov eax, 0xffffffff
add rsp, 0x48
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov rax, qword [r15 + 0x148]
add r10, rax
mov qword [r15 + 0x148], r10
mov qword [r15 + 0x140], r10
cmp dword [0x1400fc280], 0
je 0x140070000
test rsi, rsi
jne 0x14006ff6b
mov eax, 0xffffffff
jmp 0x14006ffdb
test r14d, r14d
je 0x14006ff7a
cmp rsi, 0xfffffffffffffffa
je 0x1400701be
cmp rsi, 2
je 0x14006ff86
cmp rsi, 1
jne 0x14006ff9d
mov r12d, 1
call fcn.1400a7760
movsxd rax, eax
cmp dword [0x1400fc280], 0
je 0x14006ffbd
test r14d, r14d
je 0x14006ffb8
test r13d, r13d
je 0x14006ffb8
mov ecx, eax
mov qword [rsp + 0x30], rax
call fcn.1400a7740
mov rax, qword [rsp + 0x30]
test r12d, r12d
je 0x140070000
mov r8d, eax
mov rcx, rbx
mov edx, edi
xor r9d, r9d
call fcn.1400a7740
movsxd rax, eax
mov edx, 0xffffffff
cmp rax, rdi
cmovne eax, edx
test r15, r15
je 0x1400701ad
mov qword [r15 + 0x130], 0
add rsp, 0x48
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov eax, 1
test r15, r15
je 0x140070079
test byte [r15 + 0x24d], 0x40
jne 0x14007001a
mov r10, qword [r15 + 0x78]
jmp 0x14007005e
test byte [r15 + 0x24b], 1
je 0x14007002a
mov r10, qword [r15 + 0x78]
jmp 0x14007005e
mov r8, qword [r15 + 0x68]
cmp rbx, r8
mov r10, qword [r15 + 0x78]
je 0x14007003c
cmp rbx, r10
jne 0x14007006d
mov r11, qword [r15 + 0x1a0]
mov rcx, qword [r15 + 0x70]
mov rdx, qword [r15 + 0x188]
add r8, rdx
lea r9, [rcx + r11*2]
cmp r8, r9
ja 0x140070185
cmp rbx, r10
jne 0x14007006d
add rdi, r10
mov rbx, qword [r15 + 0x68]
sub rdi, rbx
mov rax, qword [r15 + 0x210]
test rax, rax
jne 0x14007007e
mov eax, 0x20000
cmp rdi, rax
jbe 0x1400700ef
mov rax, rdi
test r15, r15
je 0x140070097
mov r14, qword [r15 + 0x210]
test r14, r14
jne 0x14007009d
mov r14d, 0x20000
mov qword [rsp + 0x30], rsi
mov r13, rbx
mov r12d, edi
mov rsi, rbx
mov rbx, rax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp rbp, rax
je 0x140070214
mov rcx, rbp
mov rdx, r13
mov r8d, r14d
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
je 0x1400701cc
mov rsi, qword [rsp + 0x30]
jmp 0x140070120
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp rbp, rax
je 0x140070280
mov rcx, rbp
mov rdx, rbx
mov r8d, edi
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140070133
cmp rsi, 1
je 0x14007026a
mov eax, 0xffffffff
test r15, r15
je 0x1400701ad
mov rdx, qword [r15 + 0x68]
xor ecx, ecx
add rdx, qword [r15 + 0x1a0]
add rdi, qword [r15 + 0x148]
and byte [r15 + 0x249], 0xfb
mov qword [r15 + 0x78], rcx
mov qword [r15 + 0x80], rdx
mov qword [r15 + 0x148], rdi
mov qword [r15 + 0x140], rdi
mov qword [r15 + 0x130], rcx
add rsp, 0x48
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
add rbx, rdi
mov qword [r15 + 0x78], rbx
or byte [r15 + 0x249], 4
add qword [r15 + 0x80], r11
add qword [r15 + 0x140], rdi
mov qword [r15 + 0x130], 0
add rsp, 0x48
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov r12d, 1
mov rax, rbp
jmp 0x14006ffa2
mov edx, dword [rsp + 0x38]
add r13, rdx
sub rbx, rdx
test r15, r15
je 0x1400701e7
mov rcx, qword [r15 + 0x210]
test rcx, rcx
jne 0x1400701ec
mov ecx, 0x20000
cmp rbx, rcx
ja 0x1400701fe
mov r14, rbx
test rbx, rbx
jne 0x140070207
jmp 0x140070133
test rbx, rbx
je 0x140070133
test edx, edx
ja 0x1400700ae
jmp 0x140070133
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
jne 0x1400700c2
mov ecx, 1
mov rdx, r13
mov r8d, r14d
call fcn.140039b1c
mov edx, eax
cmp edx, 0xffffffff
je 0x140070248
mov dword [rsp + 0x38], edx
mov eax, 1
jmp 0x1400701d0
mov rcx, rbp
mov rdx, rsi
mov r8d, r12d
lea r9, [rsp + 0x38]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x1400700df
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 6
jne 0x14007012e
xor eax, eax
jmp 0x140070133
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
jne 0x140070103
mov r12d, edi
mov ecx, 1
mov rdx, rbx
mov r8d, r12d
call fcn.140039b1c
cmp eax, 0xffffffff
je 0x1400702b4
mov eax, 1
jmp 0x140070133
mov rcx, rbp
mov rdx, rbx
mov r8d, r12d
lea r9, [rsp + 0x38]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x140070120
cmp dword [0x1400fc280], 0
jne 0x140070301
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbp, rax
mov r14d, dword [0x1400fc280]
mov r13d, r14d
mov esi, 1
jmp 0x14006fe12
call fcn.1400a7760
movsxd rbp, eax
jmp 0x1400702ed