Function at 0x6cf3c0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x378
mov rsi, qword [rsp + 0x3e0]
mov rbp, qword [rsp + 0x3e8]
mov r12, rcx
mov r13, rdx
mov rdi, r8
mov r15, r9
mov dword [rsp + 0x7c], 0
test rsi, rsi
je 0x6cf2f0
mov r8, rsi
mov rax, r9
xor ebx, ebx
shl r8, 4
add r8, r9
nop
mov edx, dword [rax]
add rax, 0x10
add rbx, rdx
cmp rax, r8
jne 0x6cf000
mov edx, 0xffffffff
mov eax, 0x2747
cmp rbx, rdx
ja 0x6cf18f
test rbp, rbp
je 0x6cf1a3
cmp dword [rbp + 0x10], 0xc
mov eax, 0x32
jne 0x6cf18f
mov edx, dword [rdi + 0x1e0]
test edx, edx
je 0x6cf2d5
lea rax, [rsp + 0xf0]
lea r8, [rsp + 0x7c]
mov rcx, rbp
mov r9, rax
mov qword [rsp + 0x50], rax
call fcn.006d6de0
test eax, eax
jne 0x6cf18f
lea rbp, [rsi + 2]
cmp rbp, 5
jbe 0x6cf260
mov edx, 0x10
mov rcx, rbp
call fcn.006ba780
mov r14, rax
test rax, rax
je 0x6cf3a7
lea rax, [rsp + 0x60]
lea rdx, [rsp + 0x80]
mov r8d, 0x10
mov qword [rsp + 0x80], 0
mov rcx, rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x88], 0
call fcn.006ba840
movdqu xmm3, xmmword [rsp + 0x60]
mov edx, dword [rsp + 0x7c]
lea rax, [rsp + 0x90]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x58]
movups xmmword [r14], xmm3
cmp edx, 1
je 0x6cf2c8
cmp edx, 2
je 0x6cf380
mov qword [rsp + 0x58], rax
mov r8d, 0x607
lea rdx, str.src_win_pipe.c
lea rcx, [0x00af3264]
call qword [sym.imp.msvcrt.dll__assert]
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
mov r8d, 0x278
mov rcx, rax
call fcn.006ba840
movdqu xmm1, xmmword [rsp + 0x60]
mov edx, 2
movups xmmword [r14 + 0x10], xmm1
test rbx, rbx
jne 0x6cf220
mov qword [rsp + 0x20], rbp
mov r9, r14
mov r8, rdi
mov rdx, r13
mov rax, qword [rsp + 0x3f0]
mov dword [rsp + 0x30], 1
mov rcx, r12
mov qword [rsp + 0x28], rax
call fcn.006ccb40
cmp r14, qword [rsp + 0x48]
je 0x6cf18f
mov rcx, r14
mov dword [rsp + 0x48], eax
call fcn.006ba750
mov eax, dword [rsp + 0x48]
add rsp, 0x378
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rbp, [rsi + 1]
cmp rbp, 5
jbe 0x6cf300
mov edx, 0x10
mov rcx, rbp
call fcn.006ba780
mov r14, rax
test rax, rax
je 0x6cf3a7
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x60]
mov r8d, 0x10
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 0
call fcn.006ba840
movdqu xmm5, xmmword [rsp + 0x60]
mov edx, 1
lea rax, [rsp + 0x90]
mov qword [rsp + 0x48], rax
movups xmmword [r14], xmm5
test rbx, rbx
je 0x6cf14d
nop
or dword [rsp + 0x80], 1
mov dword [rsp + 0x88], ebx
test rsi, rsi
je 0x6cf14d
shl rdx, 4
shl rsi, 4
xor eax, eax
add rdx, r14
movdqu xmm0, xmmword [r15 + rax]
movups xmmword [rdx + rax], xmm0
add rax, 0x10
cmp rsi, rax
jne 0x6cf245
jmp 0x6cf14d
lea rax, [rsp + 0x60]
lea rdx, [rsp + 0x80]
mov r8d, 0x10
mov qword [rsp + 0x80], 0
mov rcx, rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x88], 0
call fcn.006ba840
movdqu xmm2, xmmword [rsp + 0x60]
mov edx, dword [rsp + 0x7c]
lea rax, [rsp + 0x90]
mov qword [rsp + 0x48], rax
mov r14, rax
mov rax, qword [rsp + 0x58]
movaps xmmword [rsp + 0x90], xmm2
cmp edx, 1
jne 0x6cf0f4
or dword [rsp + 0x80], 6
jmp 0x6cf121
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
mov edx, eax
mov dword [rdi + 0x1e0], eax
jmp 0x6cf047
xor ebx, ebx
test rbp, rbp
jne 0x6cf02a
mov ebp, 1
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x60]
mov r8d, 0x10
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 0
call fcn.006ba840
movdqu xmm4, xmmword [rsp + 0x60]
movaps xmmword [rsp + 0x90], xmm4
test rbx, rbx
jne 0x6cf38d
mov qword [rsp + 0x20], rbp
mov r8, rdi
mov rdx, r13
mov rcx, r12
mov rax, qword [rsp + 0x3f0]
mov dword [rsp + 0x30], 1
lea r9, [rsp + 0x90]
mov qword [rsp + 0x28], rax
call fcn.006ccb40
jmp 0x6cf18f
or dword [rsp + 0x80], 2
jmp 0x6cf121
lea rax, [rsp + 0x90]
mov edx, 1
mov qword [rsp + 0x48], rax
mov r14, rax
jmp 0x6cf220
mov eax, 8
jmp 0x6cf18f
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rbp, qword [rsp + 0x80]
mov rax, qword [rsp + 0x88]
mov r12, qword [rsp + 0x90]
mov rdi, rdx
mov edx, dword [r8 + 0x110]
mov rsi, rcx
mov rbx, r8
test edx, edx
jne 0x6cf452
test rax, rax
je 0x6cf41f
mov qword [rsp + 0x28], r9
mov r8d, 0x62f
lea rdx, str.src_win_pipe.c
lea rcx, str.send_handle__NULL
call qword [sym.imp.msvcrt.dll__assert]
mov r9, qword [rsp + 0x28]
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
mov dword [rsp + 0x90], 0
mov qword [rsp + 0x88], r12
mov qword [rsp + 0x80], rbp
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.006ccb40
mov rdx, rdi
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp 0x6cefb0