Function at 0x14006cef0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x4c], 0
mov dword [rsp + 0x34], 0
mov rax, qword [rsp + 0x60]
cmp dword [rax + 0x74], 0
je 0x14006cf76
mov rcx, qword [rsp + 0x60]
call fcn.1400645a0
test eax, eax
je 0x14006cf61
mov rax, qword [rsp + 0x60]
cmp dword [rax + 0x74], 0
je 0x14006cf5f
mov r8d, 0xffffffff
xor edx, edx
xor ecx, ecx
call fcn.140066690
cmp eax, 0xffffffff
jne 0x14006cf5d
mov eax, 0xffffffff
jmp 0x14006d2c2
jmp 0x14006cf34
jmp 0x14006cf76
call fcn.1400825b0
mov dword [rax], ntohl
mov eax, 0xffffffff
jmp 0x14006d2c2
mov rax, qword [rsp + 0x60]
cmp dword [rax + 0x78], 0
je 0x14006cff7
mov rax, qword [rsp + 0x60]
mov ecx, dword [rax + 0x78]
call fcn.14006b380
mov dword [rsp + 0x3c], eax
call fcn.1400825b0
mov ecx, dword [rsp + 0x3c]
mov dword [rax], ecx
call fcn.1400825b0
mov r8, qword [rsp + 0x60]
mov edx, dword [rax]
lea rcx, str.write___ERROR:_d_on_prior_unblocking_write__io:_p
call fcn.140002e50
mov rax, qword [rsp + 0x60]
mov dword [rax + 0x78], 0
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x90]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileType]
cmp eax, 3
jne 0x14006cfed
call fcn.1400825b0
cmp dword [rax], 0x6d
jne 0x14006cfed
call fcn.1400825b0
mov dword [rax], 0x20
mov eax, 0xffffffff
jmp 0x14006d2c2
mov rax, qword [rsp + 0x60]
cmp qword [rax + 0x60], 0
jne 0x14006d05b
mov ecx, 0x19000
call fcn.140077f84
mov rcx, qword [rsp + 0x60]
mov qword [rcx + 0x60], rax
mov rax, qword [rsp + 0x60]
cmp qword [rax + 0x60], 0
jne 0x14006d04f
call fcn.1400825b0
mov dword [rax], reloc.WS2_32.dll_inet_ntoa
call fcn.1400825b0
mov r8, qword [rsp + 0x60]
mov edx, dword [rax]
lea rcx, str.write___ERROR:_d__io:_p
call fcn.140002e50
mov eax, 0xffffffff
jmp 0x14006d2c2
mov rax, qword [rsp + 0x60]
mov dword [rax + 0x68], 0x19000
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 0x68]
cmp dword [rsp + 0x70], eax
jae 0x14006d073
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x38], eax
jmp 0x14006d07f
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 0x68]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x30], eax
movsxd rax, dword [rsp + 0x30]
mov r9, rax
mov r8, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x60]
call fcn.1400738f0
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
je 0x14006d0cc
mov edx, dword [rsp + 0x34]
lea rcx, [0x1400e5438]
call fcn.140002e50
mov eax, 0xffffffff
jmp 0x14006d2c2
mov rax, qword [rsp + 0x60]
cmp dword [rax + 0x84], 3
je 0x14006d0f1
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x90]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileType]
cmp eax, 2
jne 0x14006d12c
mov edx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
call fcn.14006e150
test eax, eax
jne 0x14006d11d
mov rax, qword [rsp + 0x60]
mov dword [rax + 0x74], 1
mov rax, qword [rsp + 0x60]
mov ecx, dword [rsp + 0x30]
mov dword [rax + 0x6c], ecx
jmp 0x14006d127
mov eax, 0xffffffff
jmp 0x14006d2c2
jmp 0x14006d1fd
mov rax, qword [rsp + 0x60]
add rax, 0x20
lea rcx, [0x14006ad60]
mov qword [rsp + 0x20], rcx
mov r9, rax
mov r8d, dword [rsp + 0x30]
mov rax, qword [rsp + 0x60]
mov rdx, qword [rax + 0x60]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x90]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFileEx]
test eax, eax
je 0x14006d182
mov rax, qword [rsp + 0x60]
mov dword [rax + 0x74], 1
mov rax, qword [rsp + 0x60]
mov ecx, dword [rsp + 0x30]
mov dword [rax + 0x6c], ecx
jmp 0x14006d1fd
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, eax
call fcn.14006b380
mov dword [rsp + 0x40], eax
call fcn.1400825b0
mov ecx, dword [rsp + 0x40]
mov dword [rax], ecx
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x90]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileType]
cmp eax, 3
jne 0x14006d1db
call fcn.1400825b0
cmp dword [rax], 0x6d
jne 0x14006d1db
mov rdx, qword [rsp + 0x60]
lea rcx, str.write___ERROR:read_end_of_the_pipe_closed__io:_p
call fcn.140002e50
call fcn.1400825b0
mov dword [rax], 0x20
call fcn.1400825b0
mov r8, qword [rsp + 0x60]
mov edx, dword [rax]
lea rcx, str.write_ERROR_from_cb_2_:_d__io:_p
call fcn.140002e50
mov eax, 0xffffffff
jmp 0x14006d2c2
mov rcx, qword [rsp + 0x60]
call fcn.1400645a0
test eax, eax
je 0x14006d253
mov rax, qword [rsp + 0x60]
cmp dword [rax + 0x74], 0
je 0x14006d253
mov r8d, 0xffffffff
xor edx, edx
xor ecx, ecx
call fcn.140066690
cmp eax, 0xffffffff
jne 0x14006d251
call fcn.1400825b0
cmp dword [rax], 4
jne 0x14006d23f
mov rax, qword [rsp + 0x60]
cmp dword [rax + 0x74], 0
je 0x14006d246
mov eax, 0xffffffff
jmp 0x14006d2c2
call fcn.1400825b0
mov dword [rax], 0
jmp 0x14006d20b
mov edx, 1
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SleepEx]
mov rax, qword [rsp + 0x60]
cmp dword [rax + 0x74], 0
jne 0x14006d2be
mov rax, qword [rsp + 0x60]
cmp dword [rax + 0x78], 0
je 0x14006d2be
mov rax, qword [rsp + 0x60]
mov ecx, dword [rax + 0x78]
call fcn.14006b380
mov dword [rsp + 0x44], eax
call fcn.1400825b0
mov ecx, dword [rsp + 0x44]
mov dword [rax], ecx
mov r8, qword [rsp + 0x60]
mov rax, qword [rsp + 0x60]
mov edx, dword [rax + 0x78]
lea rcx, str.write___ERROR_from_cb:_d__io:_p
call fcn.140002e50
mov rax, qword [rsp + 0x60]
mov dword [rax + 0x78], 0
mov eax, 0xffffffff
jmp 0x14006d2c2
mov eax, dword [rsp + 0x30]
add rsp, 0x58
ret