Function at 0x140006bc0
Capabilities:
Delete file
Write file on windows

Disassembly:
test rdx, rdx
je 0x140006c4e
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
test r8, r8
je 0x140006c3f
mov eax, dword [rdx + 8]
bt eax, 0x1c
jb 0x140006c0f
and eax, 0x7c0000
cmp eax, 0x1c0000
je 0x140006c0f
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp 0x140006c50
xorps xmm0, xmm0
lea r8, [rdx + 0x18]
lea rdx, [rsp + 0x20]
mov r9b, 1
movups xmmword [rsp + 0x20], xmm0
call fcn.140005f80
test al, al
je 0x140006c3f
mov r9, rdi
lea r8, [rsp + 0x20]
mov rdx, rbx
mov rcx, rsi
call fcn.140006fc0
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
test rdx, rdx
je 0x140006e53
push rbx
push rdi
sub rsp, 0x48
mov rbx, r8
mov rdi, rdx
test rbx, rbx
je 0x140006e4d
cmp qword [r8 + 0x40], 0
jne 0x140006c9f
mov rax, qword [r8 + 0x28]
cmp byte [rax + 0x198], 0
je 0x140006c9f
cmp byte [r8 + 0x80], 0
jne 0x140006c97
mov eax, dword [r8 + 0x38]
dec eax
cmp eax, 1
jbe 0x140006c9f
mov rcx, rbx
call fcn.140005540
cmp qword [rbx + 0x40], 0xffffffffffffffff
je 0x140006e4d
mov ecx, dword [rdi + 0x28]
mov qword [rsp + 0x40], rsi
call fcn.140015bbc
mov rsi, rax
test rax, rax
je 0x140006e48
mov r8d, dword [rdi + 0x28]
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x60], rbp
call fcn.140016dc0
mov r8d, dword [rdi + 0x28]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
xor ebp, ebp
mov dword [rsp + 0x20], r8d
mov r9, rsi
mov dword [rsp + 0x78], ebp
mov rdx, rdi
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x34], 1
mov dword [rsp + 0x38], 4
call fcn.14000bad0
test al, al
je 0x140006e3b
mov ecx, dword [rsp + 0x78]
lea r9d, [rbp + 2]
mov dword [rsp + 0x34], ecx
xor r8d, r8d
xor edx, edx
lea eax, [rcx + 0xc]
mov rcx, qword [rbx + 0x40]
mov dword [rsp + 0x30], eax
mov eax, dword [rdi + 0x28]
mov dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rcx, qword [rbx + 0x40]
lea r9, [rsp + 0x68]
lea r8d, [rbp + 0xc]
mov dword [rsp + 0x68], ebp
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rsp + 0x68]
lea r9d, [rbp + 2]
mov rcx, qword [rbx + 0x40]
xor r8d, r8d
add dword [rbx + 0x48], eax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov r8d, dword [rsp + 0x78]
lea r9, [rsp + 0x68]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rsp + 0x68]
add dword [rbx + 0x48], eax
cmp dword [rbx + 0x48], 0x400000
jb 0x140006e3b
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rbx + 0x78], 2
mov qword [rbx + 0x40], rbp
mov dword [rbx + 0x48], ebp
mov byte [rbx + 0x80], 1
jbe 0x140006e3b
mov rdi, qword [rbx + 0x68]
mov rcx, qword [rdi + 8]
mov rax, qword [rdi]
test rcx, rcx
jne 0x140006df6
mov qword [rbx + 0x68], rax
test rax, rax
jne 0x140006df0
mov qword [rbx + 0x70], rbp
jmp 0x140006e0b
mov qword [rax + 8], rbp
jmp 0x140006e0b
test rax, rax
jne 0x140006e04
mov qword [rbx + 0x70], rcx
mov qword [rcx], rbp
jmp 0x140006e0b
mov qword [rcx], rax
mov qword [rax + 8], rcx
mov qword [rdi + 8], rbp
mov rcx, rdi
mov qword [rdi], rbp
dec dword [rbx + 0x78]
call fcn.14000c1f0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, rdi
call fcn.14000bfd0
mov edx, 0x120
mov rcx, rdi
call fcn.140015b7c
mov rcx, rsi
call fcn.140015bc4
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x40]
add rsp, 0x48
pop rdi
pop rbx
ret