Function at 0x6d74c0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x378
mov rsi, qword [rsp + 0x3e0]
mov rbp, qword [rsp + 0x3e8]
mov r12, rcx
mov r13, rdx
mov rdi, r8
mov r15, r9
mov dword [rsp + 0x7c], 0
test rsi, rsi
je 0x6d73f0
mov r8, rsi
mov rax, r9
xor ebx, ebx
shl r8, 4
add r8, r9
nop
mov edx, dword [rax]
add rax, 0x10
add rbx, rdx
cmp rax, r8
jne 0x6d7100
mov edx, 0xffffffff
mov eax, 0x2747
cmp rbx, rdx
ja 0x6d728f
test rbp, rbp
je 0x6d72a3
cmp dword [rbp + 0x10], 0xc
mov eax, 0x32
jne 0x6d728f
mov edx, dword [rdi + 0x1e0]
test edx, edx
je 0x6d73d5
lea rax, [rsp + 0xf0]
lea r8, [rsp + 0x7c]
mov rcx, rbp
mov r9, rax
mov qword [rsp + 0x50], rax
call fcn.006deee0
test eax, eax
jne 0x6d728f
lea rbp, [rsi + 2]
cmp rbp, 5
jbe 0x6d7360
mov edx, 0x10
mov rcx, rbp
call fcn.006c2880
mov r14, rax
test rax, rax
je 0x6d74a7
lea rax, [rsp + 0x60]
lea rdx, [rsp + 0x80]
mov r8d, 0x10
mov qword [rsp + 0x80], 0
mov rcx, rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x88], 0
call fcn.006c2940
movdqu xmm3, xmmword [rsp + 0x60]
mov edx, dword [rsp + 0x7c]
lea rax, [rsp + 0x90]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x58]
movups xmmword [r14], xmm3
cmp edx, 1
je 0x6d73c8
cmp edx, 2
je 0x6d7480
mov qword [rsp + 0x58], rax
mov r8d, 0x607
lea rdx, str.src_win_pipe.c
lea rcx, [0x00d12384]
call qword [sym.imp.msvcrt.dll__assert]
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
mov r8d, 0x278
mov rcx, rax
call fcn.006c2940
movdqu xmm1, xmmword [rsp + 0x60]
mov edx, 2
movups xmmword [r14 + 0x10], xmm1
test rbx, rbx
jne 0x6d7320
mov qword [rsp + 0x20], rbp
mov r9, r14
mov r8, rdi
mov rdx, r13
mov rax, qword [rsp + 0x3f0]
mov dword [rsp + 0x30], 1
mov rcx, r12
mov qword [rsp + 0x28], rax
call fcn.006d4c40
cmp r14, qword [rsp + 0x48]
je 0x6d728f
mov rcx, r14
mov dword [rsp + 0x48], eax
call fcn.006c2850
mov eax, dword [rsp + 0x48]
add rsp, 0x378
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rbp, [rsi + 1]
cmp rbp, 5
jbe 0x6d7400
mov edx, 0x10
mov rcx, rbp
call fcn.006c2880
mov r14, rax
test rax, rax
je 0x6d74a7
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x60]
mov r8d, 0x10
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 0
call fcn.006c2940
movdqu xmm5, xmmword [rsp + 0x60]
mov edx, 1
lea rax, [rsp + 0x90]
mov qword [rsp + 0x48], rax
movups xmmword [r14], xmm5
test rbx, rbx
je 0x6d724d
nop
or dword [rsp + 0x80], 1
mov dword [rsp + 0x88], ebx
test rsi, rsi
je 0x6d724d
shl rdx, 4
shl rsi, 4
xor eax, eax
add rdx, r14
movdqu xmm0, xmmword [r15 + rax]
movups xmmword [rdx + rax], xmm0
add rax, 0x10
cmp rsi, rax
jne 0x6d7345
jmp 0x6d724d
lea rax, [rsp + 0x60]
lea rdx, [rsp + 0x80]
mov r8d, 0x10
mov qword [rsp + 0x80], 0
mov rcx, rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x88], 0
call fcn.006c2940
movdqu xmm2, xmmword [rsp + 0x60]
mov edx, dword [rsp + 0x7c]
lea rax, [rsp + 0x90]
mov qword [rsp + 0x48], rax
mov r14, rax
mov rax, qword [rsp + 0x58]
movaps xmmword [rsp + 0x90], xmm2
cmp edx, 1
jne 0x6d71f4
or dword [rsp + 0x80], 6
jmp 0x6d7221
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
mov edx, eax
mov dword [rdi + 0x1e0], eax
jmp 0x6d7147
xor ebx, ebx
test rbp, rbp
jne 0x6d712a
mov ebp, 1
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x60]
mov r8d, 0x10
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 0
call fcn.006c2940
movdqu xmm4, xmmword [rsp + 0x60]
movaps xmmword [rsp + 0x90], xmm4
test rbx, rbx
jne 0x6d748d
mov qword [rsp + 0x20], rbp
mov r8, rdi
mov rdx, r13
mov rcx, r12
mov rax, qword [rsp + 0x3f0]
mov dword [rsp + 0x30], 1
lea r9, [rsp + 0x90]
mov qword [rsp + 0x28], rax
call fcn.006d4c40
jmp 0x6d728f
or dword [rsp + 0x80], 2
jmp 0x6d7221
lea rax, [rsp + 0x90]
mov edx, 1
mov qword [rsp + 0x48], rax
mov r14, rax
jmp 0x6d7320
mov eax, 8
jmp 0x6d728f
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rbp, qword [rsp + 0x80]
mov rax, qword [rsp + 0x88]
mov r12, qword [rsp + 0x90]
mov rdi, rdx
mov edx, dword [r8 + 0x110]
mov rsi, rcx
mov rbx, r8
test edx, edx
jne 0x6d7552
test rax, rax
je 0x6d751f
mov qword [rsp + 0x28], r9
mov r8d, 0x62f
lea rdx, str.src_win_pipe.c
lea rcx, str.send_handle__NULL
call qword [sym.imp.msvcrt.dll__assert]
mov r9, qword [rsp + 0x28]
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
mov dword [rsp + 0x90], 0
mov qword [rsp + 0x88], r12
mov qword [rsp + 0x80], rbp
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.006d4c40
mov rdx, rdi
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp 0x6d70b0