Function at 0x140006b40
Capabilities:
Delete file
Write file on windows

Disassembly:
test rdx, rdx
je 0x140006bce
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
test r8, r8
je 0x140006bbf
mov eax, dword [rdx + 8]
bt eax, 0x1c
jb 0x140006b8f
and eax, 0x7c0000
cmp eax, 0x1c0000
je 0x140006b8f
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp 0x140006bd0
xorps xmm0, xmm0
lea r8, [rdx + 0x18]
lea rdx, [rsp + 0x20]
mov r9b, 1
movups xmmword [rsp + 0x20], xmm0
call fcn.140005f40
test al, al
je 0x140006bbf
mov r9, rdi
lea r8, [rsp + 0x20]
mov rdx, rbx
mov rcx, rsi
call fcn.140006f30
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
test rdx, rdx
je 0x140006dd3
push rbx
push rdi
sub rsp, 0x48
mov rbx, r8
mov rdi, rdx
test rbx, rbx
je 0x140006dcd
cmp qword [r8 + 0x40], 0
jne 0x140006c1f
mov rax, qword [r8 + 0x28]
cmp byte [rax + 0x198], 0
je 0x140006c1f
cmp byte [r8 + 0x80], 0
jne 0x140006c17
mov eax, dword [r8 + 0x38]
dec eax
cmp eax, 1
jbe 0x140006c1f
mov rcx, rbx
call fcn.140005510
cmp qword [rbx + 0x40], 0xffffffffffffffff
je 0x140006dcd
mov ecx, dword [rdi + 0x28]
mov qword [rsp + 0x40], rsi
call fcn.140015b1c
mov rsi, rax
test rax, rax
je 0x140006dc8
mov r8d, dword [rdi + 0x28]
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x60], rbp
call fcn.140016d00
mov r8d, dword [rdi + 0x28]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
xor ebp, ebp
mov dword [rsp + 0x20], r8d
mov r9, rsi
mov dword [rsp + 0x78], ebp
mov rdx, rdi
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x34], 1
mov dword [rsp + 0x38], 4
call fcn.14000ba30
test al, al
je 0x140006dbb
mov ecx, dword [rsp + 0x78]
lea r9d, [rbp + 2]
mov dword [rsp + 0x34], ecx
xor r8d, r8d
xor edx, edx
lea eax, [rcx + 0xc]
mov rcx, qword [rbx + 0x40]
mov dword [rsp + 0x30], eax
mov eax, dword [rdi + 0x28]
mov dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rcx, qword [rbx + 0x40]
lea r9, [rsp + 0x68]
lea r8d, [rbp + 0xc]
mov dword [rsp + 0x68], ebp
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rsp + 0x68]
lea r9d, [rbp + 2]
mov rcx, qword [rbx + 0x40]
xor r8d, r8d
add dword [rbx + 0x48], eax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov r8d, dword [rsp + 0x78]
lea r9, [rsp + 0x68]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rsp + 0x68]
add dword [rbx + 0x48], eax
cmp dword [rbx + 0x48], 0x400000
jb 0x140006dbb
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rbx + 0x78], 2
mov qword [rbx + 0x40], rbp
mov dword [rbx + 0x48], ebp
mov byte [rbx + 0x80], 1
jbe 0x140006dbb
mov rdi, qword [rbx + 0x68]
mov rcx, qword [rdi + 8]
mov rax, qword [rdi]
test rcx, rcx
jne 0x140006d76
mov qword [rbx + 0x68], rax
test rax, rax
jne 0x140006d70
mov qword [rbx + 0x70], rbp
jmp 0x140006d8b
mov qword [rax + 8], rbp
jmp 0x140006d8b
test rax, rax
jne 0x140006d84
mov qword [rbx + 0x70], rcx
mov qword [rcx], rbp
jmp 0x140006d8b
mov qword [rcx], rax
mov qword [rax + 8], rcx
mov qword [rdi + 8], rbp
mov rcx, rdi
mov qword [rdi], rbp
dec dword [rbx + 0x78]
call fcn.14000c150
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, rdi
call fcn.14000bf30
mov edx, 0x120
mov rcx, rdi
call fcn.140015adc
mov rcx, rsi
call fcn.140015b24
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x40]
add rsp, 0x48
pop rdi
pop rbx
ret