Function at 0x10006b644
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
or qword [rax + 0x18], 0xffffffffffffffff
xor ebx, ebx
mov r15, rdx
and dword [rax + 8], ebx
and dword [rax + 0x10], ebx
mov r14, rcx
lea edx, [rbx + 0x5e]
lea r8, [0x100029340]
lea rcx, [rax - 0x48]
mov esi, 0x100000
call sub.vdsutil.dll_public:_void___cdecl_CVdsCallTracer::constructor_unsigned_long_int__char_const____ptr64____ptr64
mov rcx, qword [r14 + 0xd0]
lea r8, [rsp + 0xa0]
mov edx, 0xc0000000
call sub.vdsutil.dll_unsigned_long_int___cdecl_OpenDevice_unsigned_short_int____ptr64__unsigned_long_int__void____ptr64____ptr64_
mov edi, eax
test eax, eax
je 0x10006b6c6
lea r8, [0x100029368]
lea ecx, [rbx + 0x5e]
mov r9d, eax
xor edx, edx
call sub.vdsutil.dll_void___cdecl_VdsTraceEx_unsigned_long_int__unsigned_long_int__char____ptr64_
movzx esi, di
or esi, 0x80070000
jmp 0x10006b8bd
mov r13d, 0x80070000
cmp esi, 0x200
jb 0x10006b711
call qword [sym.imp.API_MS_Win_Core_Heap_L1_1_0.dll_GetProcessHeap]
mov r8d, esi
mov edx, 8
mov rcx, rax
call sub.vdsutil.dll_void____ptr64___cdecl_VdsHeapAlloc_void____ptr64__unsigned_long_int__unsigned_long_long_unsigned___int64__
mov rdi, rax
test rbx, rbx
je 0x10006b705
call qword [sym.imp.API_MS_Win_Core_Heap_L1_1_0.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.vdsutil.dll_int___cdecl_VdsHeapFree_void____ptr64__unsigned_long_int__void____ptr64_
mov rbx, rdi
test rdi, rdi
jne 0x10006b734
shr esi, 1
jmp 0x10006b6c6
test rbx, rbx
jne 0x10006b734
mov esi, 0x8007000e
lea r8, [0x100029390]
lea ecx, [rbx + 0x5e]
mov r9d, esi
xor edx, edx
call sub.vdsutil.dll_void___cdecl_VdsTraceEx_unsigned_long_int__unsigned_long_int__char____ptr64_
jmp 0x10006b85c
xor edx, edx
mov eax, 0x100000
xor edi, edi
div esi
mov r12d, eax
mov ebp, eax
mov eax, 1
test r12d, r12d
je 0x10006b7df
test eax, eax
je 0x10006b7a7
mov rcx, qword [rsp + 0xa0]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x90]
mov r8d, esi
mov rdx, rbx
call qword [sym.imp.API_MS_Win_Core_File_L1_1_0.dll_WriteFile]
test eax, eax
je 0x10006b79d
mov eax, dword [rsp + 0x90]
mov rcx, qword [rsp + 0xa0]
xor r9d, r9d
add rdi, rax
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.API_MS_Win_Core_File_L1_1_0.dll_SetFilePointerEx]
add r12d, 0xffffffff
jne 0x10006b752
test eax, eax
jne 0x10006b7df
call qword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
lea ecx, [rbp - 1]
xor edx, edx
cmp r12d, ecx
lea ecx, [rdx + 0x5e]
mov edi, eax
mov r9d, eax
lea r8, [0x1000293b0]
je 0x10006b7cd
lea r8, [0x1000293d8]
call sub.vdsutil.dll_void___cdecl_VdsTraceEx_unsigned_long_int__unsigned_long_int__char____ptr64_
movzx esi, di
or esi, r13d
test edi, edi
cmovle esi, edi
jmp 0x10006b85c
mov rdx, qword [r14 + 0x98]
mov rcx, qword [rsp + 0xa0]
xor r9d, r9d
sub rdx, 0x100000
xor r8d, r8d
call qword [sym.imp.API_MS_Win_Core_File_L1_1_0.dll_SetFilePointerEx]
test eax, eax
je 0x10006b839
mov eax, 1
test ebp, ebp
je 0x10006b85a
test eax, eax
je 0x10006b839
mov rcx, qword [rsp + 0xa0]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x90]
mov r8d, esi
mov rdx, rbx
call qword [sym.imp.API_MS_Win_Core_File_L1_1_0.dll_WriteFile]
add ebp, 0xffffffff
jne 0x10006b80e
cmp eax, 1
je 0x10006b85a
call qword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
xor edx, edx
lea r8, [0x100029400]
mov edi, eax
mov r9d, eax
lea ecx, [rdx + 0x5e]
jmp 0x10006b7cd
xor esi, esi
and qword [rsp + 0x38], 0
mov rcx, qword [rsp + 0xa0]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x30], rax
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x70140
call qword [sym.imp.API_MS_Win_Core_IO_L1_1_0.dll_DeviceIoControl]
test eax, eax
jne 0x10006b8c2
call qword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
xor edx, edx
lea r8, [0x100029430]
lea ecx, [rdx + 0x5e]
mov r9d, eax
mov edi, eax
call sub.vdsutil.dll_void___cdecl_VdsTraceEx_unsigned_long_int__unsigned_long_int__char____ptr64_
test esi, esi
jne 0x10006b8c2
movzx esi, di
or esi, r13d
test edi, edi
cmovle esi, edi
mov rcx, qword [r15 + 8]
xor r8d, r8d
test esi, esi
lea eax, [r8 + 0x64]
mov edx, esi
cmovns r8d, eax
call sub.vdsutil.dll_public:_void___cdecl_CVdsAsyncObjectBase::SetCompletionStatus_long_int__unsigned_long_int____ptr64
mov rcx, qword [r15 + 8]
call sub.vdsutil.dll_public:_void___cdecl_CVdsAsyncObjectBase::Signal_void____ptr64
mov rcx, qword [r15 + 8]
mov rax, qword [rcx]
call qword [rax + 0x10]
lea rcx, [rsp + 0x40]
call sub.vdsutil.dll_public:_void___cdecl_CVdsCallTracer::destructor_void____ptr64
test rbx, rbx
je 0x10006b90f
call qword [sym.imp.API_MS_Win_Core_Heap_L1_1_0.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.vdsutil.dll_int___cdecl_VdsHeapFree_void____ptr64__unsigned_long_int__void____ptr64_
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x10006b928
cmp rcx, 0xffffffffffffffff
je 0x10006b928
call qword [sym.imp.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle]
xor eax, eax
mov rbx, qword [rsp + 0xa8]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret