Function at 0x6c2360
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov ebx, dword [rcx + 0x150]
mov rsi, rcx
cmp ebx, 0xffffffff
je 0x6c2560
mov rbp, qword [rcx + 0x180]
mov ecx, ebx
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x6c2660
lea rcx, [0x00de2100]
movzx edi, bl
call sub.KERNEL32.DLL_EnterCriticalSection
mov eax, edi
lea r8, [0x00b59100]
mov rdx, rax
shl rdx, 4
add rdx, r8
mov rcx, qword [rdx]
mov r9, rcx
and r9d, 0xf
test rcx, rcx
je 0x6c2640
test r9, r9
jne 0x6c2640
mov r10, qword [rdx + 8]
mov r9d, 0x10
lea rdx, [r10 + 0x28]
mov eax, 1
cmp ebx, dword [r10]
jne 0x6c2415
jmp 0x6c2515
mov ecx, dword [rdx]
lea r8, [rax + 1]
add rdx, 0x28
cmp ebx, ecx
je 0x6c2580
mov rax, r8
cmp rax, r9
jb 0x6c2400
mov rdx, qword [r10 + 0x280]
test rdx, rdx
je 0x6c2455
nop word cs:[rax + rax]
mov rcx, rdx
xor eax, eax
cmp ebx, dword [rcx]
je 0x6c2504
add eax, 1
add rcx, 0x28
cmp eax, 0x10
jne 0x6c2435
mov rdx, qword [rdx + 0x280]
test rdx, rdx
jne 0x6c2430
lea rcx, [0x00de2100]
call sub.KERNEL32.DLL_LeaveCriticalSection
cmp rbp, 0xffffffffffffffff
jne 0x6c2590
mov dword [rsp + 0x38], 0
xor r13d, r13d
xor ebx, ebx
xor edi, edi
lea r15, [rsp + 0x44]
mov r14, qword [sym.imp.KERNEL32.DLL_WriteFile]
jmp 0x6c249c
cmp dword [rsi + 0x170], ebx
jbe 0x6c2601
cmp rbp, 0xffffffffffffffff
je 0x6c24ac
mov eax, edi
add rax, rbp
mov qword [rsp + 0x60], rax
mov eax, ebx
mov r9, r15
mov rcx, r12
add ebx, 1
shl rax, 4
add rax, qword [rsi + 0x178]
mov rdx, qword [rax + 8]
mov qword [rsp + 0x20], r13
mov r8d, dword [rax]
call r14
add edi, dword [rsp + 0x44]
mov r11d, eax
mov r10d, edi
test eax, eax
jne 0x6c2490
mov edx, dword [rsp + 0x38]
test edx, edx
jne 0x6c260d
mov eax, dword [rsp + 0x38]
or eax, r10d
je 0x6c25e0
mov eax, r10d
mov qword [rsi + 0x88], rax
jmp 0x6c2548
lea rax, [rax + rax*4]
lea r10, [rdx + rax*8]
test r10, r10
je 0x6c2455
movdqu xmm0, xmmword [r10 + 8]
lea rcx, [0x00de2100]
movaps xmmword [rsp + 0x50], xmm0
movdqu xmm1, xmmword [r10 + 0x18]
movaps xmmword [rsp + 0x60], xmm1
call sub.KERNEL32.DLL_LeaveCriticalSection
lea r8, [rsp + 0x50]
mov rdx, r12
mov rcx, rsi
call fcn.006c1b40
nop
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rcx + 0x88], 0xfffffffffffff00d
mov dword [rcx + 0x14c], 6
jmp 0x6c2548
lea rax, [rax + rax*4]
lea r10, [r10 + rax*8]
jmp 0x6c250c
xor edx, edx
mov r9d, 1
lea r8, [rsp + 0x48]
mov rcx, r12
mov qword [rsp + 0x50], 0
lea r13, [rsp + 0x50]
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
call qword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
test eax, eax
setne al
movzx eax, al
mov dword [rsp + 0x38], eax
jmp 0x6c2476
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [rsi + 0x14c], eax
mov ecx, eax
call fcn.006bf1f0
cdqe
mov qword [rsi + 0x88], rax
jmp 0x6c2548
mov eax, dword [rsp + 0x38]
test eax, eax
je 0x6c24f8
mov dword [rsp + 0x3c], r10d
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x48]
mov dword [rsp + 0x38], r11d
mov rcx, r12
call qword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
mov r10d, dword [rsp + 0x3c]
mov eax, dword [rsp + 0x38]
or eax, r10d
jne 0x6c24f8
jmp 0x6c25e0
shl rax, 4
mov r10, qword [r8 + rax + 8]
test r9, r9
jne 0x6c23e6
jmp 0x6c241a
mov dword [rsi + 0x14c], 6
mov ecx, 6
call fcn.006bf1f0
cdqe
mov qword [rsi + 0x88], rax
jmp 0x6c2548