Function at 0x140048bb3
Capabilities:
Write file on windows

Disassembly:
push rax
pushf
mov eax, 0x18699a85
pushf
not eax
add eax, 0x89879eef
xor eax, 0xb1fa80f8
rol eax, 0xd9
popf
pushf
not eax
add eax, 0xeae6b927
xor eax, 0xbc815e00
rol eax, 0xf7
popf
pushf
not eax
add eax, 0x9365ec4f
xor eax, 0xc3fc998a
rol eax, 0xe3
popf
pushf
not eax
add eax, 0xc2f02130
xor eax, 0x88151945
rol eax, 0xd1
popf
cmp eax, 4
jne 0x140048c16
popf
pop rax
jmp 0x140048ec9
cmp eax, 0
jne 0x140048c25
popf
pop rax
jmp 0x140048cbb
cmp eax, 3
jne 0x140048c34
popf
pop rax
jmp 0x140048e30
cmp eax, 1
jne 0x140048c43
popf
pop rax
jmp 0x140048def
cmp eax, 0xa
jne 0x140048c52
popf
pop rax
jmp 0x140049214
cmp eax, 7
jne 0x140048c61
popf
pop rax
jmp 0x1400490dc
cmp eax, 6
jne 0x140048c70
popf
pop rax
jmp 0x14004900f
cmp eax, 0xb
jne 0x140048c7f
popf
pop rax
jmp 0x14004924f
cmp eax, 9
jne 0x140048c8e
popf
pop rax
jmp 0x1400491de
cmp eax, 8
jne 0x140048c9d
popf
pop rax
jmp 0x140049173
cmp eax, 5
jne 0x140048cac
popf
pop rax
jmp 0x140048f5c
cmp eax, 2
jne 0x140048cbb
popf
pop rax
jmp 0x140048e27
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
mov eax, 0x3cc27df6
pushf
not eax
add eax, 0x955d0822
xor eax, 0xd12fb969
rol eax, 0x62
popf
pushf
not eax
add eax, 0xe5746fc7
xor eax, 0xbe3d22bc
rol eax, 0x15
popf
call fcn.1400666b9
sub rsp, rax
mov rax, qword [0x14001b008]
xor rax, rsp
mov qword [rsp + 0x1440], rax
movsxd r10, edx
mov rdi, rcx
mov rax, r10
mov ebp, r9d
sar rax, 6
lea rcx, [0x19a276d66]
pushf
sub rcx, 0x5a25a786
popf
and r10d, 0x3f
push r8
not r8
sub rbp, r8
pop r8
sub rbp, 1
mov rsi, r8
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
mov r14, qword [rax + rdx*8 + 0x28]
xor eax, eax
mov qword [rdi], rax
mov dword [rdi + 8], eax
cmp r8, rbp
jae 0x140048d96
push rax
pushf
mov eax, 0x5380be82
pushf
not eax
add eax, 0x836b73b3
xor eax, 0xdc5fbc6b
rol eax, 0x91
popf
pushf
not eax
add eax, 0xc5e349bf
xor eax, 0xb32b6244
rol eax, 0x7c
popf
jmp 0x140048c07
push rax
pushf
mov eax, 0x4793d4d4
pushf
not eax
add eax, 0x8d840c27
xor eax, 0xa453d76f
rol eax, 0xa3
popf
pushf
not eax
add eax, 0x9190f767
xor eax, 0xc8eb315d
rol eax, 0x51
popf
pushf
not eax
add eax, 0x8e167d04
xor eax, 0xed0d2f9e
rol eax, 0x96
popf
pushf
not eax
add eax, 0xd67c7719
xor eax, 0xc24255e5
rol eax, 0x37
popf
jmp 0x140048c07
lea rbx, [rsp + 0x40]
push rax
pushf
mov eax, 0xc744f40f
pushf
not eax
add eax, 0xd63d2a23
xor eax, 0xcc551a49
rol eax, 0xc7
popf
pushf
not eax
add eax, 0xe6bbceba
xor eax, 0x9035a158
rol eax, 0x6d
popf
jmp 0x140048c07
cmp rsi, rbp
jae 0x14004900f
movzx eax, word [rsi]
add rsi, 2
cmp ax, 0xa
jne 0x140048e96
push rax
pushf
mov eax, 0x74b1da26
pushf
not eax
add eax, 0xd25a06c8
xor eax, 0xf10fc078
rol eax, 0x17
popf
pushf
not eax
add eax, 0x9b8d1d4f
xor eax, 0xab039b5c
rol eax, 0x6b
popf
pushf
not eax
add eax, 0xdc547326
xor eax, 0xb87cbb8d
rol eax, 0xc1
popf
pushf
not eax
add eax, 0xabe20583
xor eax, 0x98301a97
rol eax, 0x6c
popf
jmp 0x140048c07
push rax
pushf
mov eax, 0x42719fe7
pushf
not eax
add eax, 0xba46aab6
xor eax, 0xb0d90cb9
rol eax, 0x2f
popf
pushf
not eax
add eax, 0xe4de58cf
xor eax, 0xe1a2754d
rol eax, 0x20
popf
jmp 0x140048c07
add dword [rdi + 8], 2
mov ecx, 0xb1d83e06
pushf
not ecx
add ecx, 0xa4caa2e9
xor ecx, 0xbd291db7
rol ecx, 0x46
popf
pushf
not ecx
add ecx, 0xa6dc457f
xor ecx, 0xaffd982b
rol ecx, 0xb5
popf
mov word [rbx], cx
add rbx, 2
push rax
pushf
mov eax, 0xfa1b6286
pushf
not eax
add eax, 0x98dec6ae
xor eax, 0xda4fdfac
rol eax, 0x9d
popf
pushf
not eax
add eax, 0x94fd27b7
xor eax, 0x84ab0936
rol eax, 0x19
popf
pushf
not eax
add eax, 0xad0e585f
xor eax, 0xf261c137
rol eax, 0x51
popf
pushf
not eax
add eax, 0xf02107d5
xor eax, 0xebea981a
rol eax, 0x65
popf
jmp 0x140048c07
mov word [rbx], ax
add rbx, 2
lea rax, [rsp + 0x143e]
cmp rbx, rax
jb 0x140048fb6
push rax
pushf
mov eax, 0xfc788d52
pushf
not eax
add eax, 0xd6d319a1
xor eax, 0x9c1962f4
rol eax, 0x69
popf
pushf
not eax
add eax, 0xe13f62ce
xor eax, 0x87ed8dde
rol eax, 0x9d
popf
pushf
not eax
add eax, 0xd8cb0bd8
xor eax, 0xdaf97f64
rol eax, 0x68
popf
jmp 0x140048c07
push rax
pushf
mov eax, 0x71c29110
pushf
not eax
add eax, 0xaaeb05c9
xor eax, 0x96060fb9
rol eax, 0xc7
popf
pushf
not eax
add eax, 0xcc0b7aff
xor eax, 0x904077bc
rol eax, 0xc4
popf
pushf
not eax
add eax, 0xd226e2ef
xor eax, 0xaab53d30
rol eax, 0x5e
popf
pushf
not eax
add eax, 0xedbeca72
xor eax, 0xe4bff970
rol eax, 0x77
popf
jmp 0x140048c07
and qword [rsp + 0x20], 0
lea rax, [rsp + 0x40]
sub rbx, rax
lea r9, [rsp + 0x30]
sar rbx, 1
lea rdx, [rsp + 0x40]
add ebx, ebx
mov rcx, r14
mov r8d, ebx
jmp 0x140049033
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140049083
push rax
pushf
mov eax, 0xbe44e8bf
pushf
not eax
add eax, 0xe27205f6
xor eax, 0xf11a94bd
rol eax, 0x52
popf
pushf
not eax
add eax, 0xee303c08
xor eax, 0xa2524696
rol eax, 0x25
popf
pushf
not eax
add eax, 0xfa158e02
xor eax, 0xaff95614
rol eax, 0x8d
popf
jmp 0x140048c07
push rax
pushf
mov eax, 0xdd20ea45
pushf
not eax
add eax, 0xb7fe88ca
xor eax, 0xbc8263dd
rol eax, 0x30
popf
pushf
not eax
add eax, 0xc97ae844
xor eax, 0xf0adf40e
rol eax, 0xe8
popf
pushf
not eax
add eax, 0x8061cf1b
xor eax, 0x975e671e
rol eax, 0xf6
popf
pushf
not eax
add eax, 0xcd45afc9
xor eax, 0xdd2c8328
rol eax, 0x7b
popf
jmp 0x140048c07
mov eax, dword [rsp + 0x30]
add dword [rdi + 4], eax
cmp eax, ebx
jb 0x140049140
push rax
pushf
mov eax, 0x6c6a9de6
pushf
not eax
add eax, 0xd6a5fd73
xor eax, 0xe6896b6c
rol eax, 0x96
popf
pushf
not eax
add eax, 0xe6b5fb14
xor eax, 0xbbcf2ced
rol eax, 0x46
popf
pushf
not eax
add eax, 0xe9aa46f8
xor eax, 0x878b5b1a
rol eax, 0x30
popf
pushf
not eax
add eax, 0x84bb2973
xor eax, 0x8f9313b8
rol eax, 0x6a
popf
jmp 0x140048c07
push rax
pushf
mov eax, 0x2c3c8e2c
pushf
not eax
add eax, 0xb20795bf
xor eax, 0x9e89957c
rol eax, 0xbc
popf
pushf
not eax
add eax, 0xb83914e0
xor eax, 0xd684fdb1
rol eax, 0x17
popf
jmp 0x140048c07
cmp rsi, rbp
jb 0x1400491ab
push rax
pushf
mov eax, 0xc8ae0d5f
pushf
not eax
add eax, 0x8709b85c
xor eax, 0x9eb9ba3f
rol eax, 0x64
popf
pushf
not eax
add eax, 0xa2de89b5
xor eax, 0xb0bd7d82
rol eax, 0x46
popf
jmp 0x140048c07
push rax
pushf
mov eax, 0x7a79b2b7
pushf
not eax
add eax, 0xdb9e0edb
xor eax, 0xed7ac026
rol eax, 0xf4
popf
pushf
not eax
add eax, 0x8fbb6ac1
xor eax, 0xcf62a497
rol eax, 0x5a
popf
jmp 0x140048c07
jmp 0x14004924f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
push rax
pushf
mov eax, 0xdd708782
pushf
not eax
add eax, 0xd4738c1f
xor eax, 0xadf44638
rol eax, 0x34
popf
pushf
not eax
add eax, 0xc2a1b0f3
xor eax, 0x985c0152
rol eax, 0xfe
popf
jmp 0x140048c07
mov rax, rdi
mov rcx, qword [rsp + 0x1440]
xor rcx, rsp
call fcn.14006097a
lea r11, [rsp + 0x1450]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret