Function at 0x1400e6bd3
Capabilities:
Write file on windows

Disassembly:
push rax
pushf
mov eax, 0x651ac1fd
pushf
not eax
add eax, 0x8b24bcfd
xor eax, 0xc39a7624
rol eax, 3
popf
pushf
not eax
add eax, 0xa37bcf1f
xor eax, 0x81d604f1
rol eax, 0x98
popf
pushf
not eax
add eax, 0xce2b4dc3
xor eax, 0xff344456
rol eax, 0xa8
popf
cmp eax, 4
jne 0x1400e6c23
popf
pop rax
jmp 0x1400e6f5b
cmp eax, 0
jne 0x1400e6c32
popf
pop rax
jmp 0x1400e6cc8
cmp eax, 3
jne 0x1400e6c41
popf
pop rax
jmp 0x1400e6e9c
cmp eax, 1
jne 0x1400e6c50
popf
pop rax
jmp 0x1400e6e35
cmp eax, 0xa
jne 0x1400e6c5f
popf
pop rax
jmp 0x1400e72f9
cmp eax, 7
jne 0x1400e6c6e
popf
pop rax
jmp 0x1400e715f
cmp eax, 6
jne 0x1400e6c7d
popf
pop rax
jmp 0x1400e70a5
cmp eax, 0xb
jne 0x1400e6c8c
popf
pop rax
jmp 0x1400e735a
cmp eax, 9
jne 0x1400e6c9b
popf
pop rax
jmp 0x1400e72ad
cmp eax, 8
jne 0x1400e6caa
popf
pop rax
jmp 0x1400e7209
cmp eax, 5
jne 0x1400e6cb9
popf
pop rax
jmp 0x1400e7018
cmp eax, 2
jne 0x1400e6cc8
popf
pop rax
jmp 0x1400e6e93
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
mov eax, 0x5850c39
pushf
not eax
add eax, 0xa7add0ed
xor eax, 0xe7a1c534
rol eax, 0x31
popf
pushf
not eax
add eax, 0xc0f4421f
xor eax, 0xe10982ab
rol eax, 0xf6
popf
pushf
not eax
add eax, 0xb059aae3
xor eax, 0xe11c4729
rol eax, 0xa4
popf
pushf
not eax
add eax, 0xfe7d480e
xor eax, 0x849a1ac3
rol eax, 0xfd
popf
call fcn.1401622c5
sub rsp, rax
mov rax, qword [0x140058058]
xor rax, rsp
mov qword [rsp + 0x1440], rax
movsxd r10, edx
mov rdi, rcx
mov rax, r10
mov ebp, r9d
sar rax, 6
lea rcx, [0x18228cfd3]
pushf
sub rcx, 0x42232853
popf
and r10d, 0x3f
push r8
not r8
sub rbp, r8
pop r8
sub rbp, 1
mov rsi, r8
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
mov r14, qword [rax + rdx*8 + 0x28]
xor eax, eax
mov qword [rdi], rax
mov dword [rdi + 8], eax
cmp r8, rbp
jae 0x1400e6def
push rax
pushf
mov eax, 0x2f7aa9f4
pushf
not eax
add eax, 0xbedf5342
xor eax, 0xa6693762
rol eax, 0xbb
popf
pushf
not eax
add eax, 0xaafc5c90
xor eax, 0x8912babd
rol eax, 0xe5
popf
pushf
not eax
add eax, 0xa68ba96f
xor eax, 0xa51e7003
rol eax, 0xcc
popf
pushf
not eax
add eax, 0x8ec67678
xor eax, 0x9777b300
rol eax, 0xb1
popf
jmp 0x1400e6c14
push rax
pushf
mov eax, 0x8bf7d384
pushf
not eax
add eax, 0xae381edb
xor eax, 0xeaf7e2fa
rol eax, 0xa
popf
pushf
not eax
add eax, 0x8c1c8969
xor eax, 0xbdd42df8
rol eax, 0xdc
popf
pushf
not eax
add eax, 0xc47fdd42
xor eax, 0xe6f5bd86
rol eax, 0xc9
popf
jmp 0x1400e6c14
lea rbx, [rsp + 0x40]
push rax
pushf
mov eax, 0xcd497eb6
pushf
not eax
add eax, 0xa72eedff
xor eax, 0xdf92cdc7
rol eax, 0x74
popf
pushf
not eax
add eax, 0xbc10ba08
xor eax, 0xb1208b34
rol eax, 0x89
popf
pushf
not eax
add eax, 0xee561b2e
xor eax, 0xa9d19a33
rol eax, 0x5b
popf
pushf
not eax
add eax, 0xb1306495
xor eax, 0xdf048afe
rol eax, 0x33
popf
jmp 0x1400e6c14
cmp rsi, rbp
jae 0x1400e70a5
movzx eax, word [rsi]
add rsi, 2
cmp ax, 0xa
jne 0x1400e6f02
push rax
pushf
mov eax, 0xb149a287
pushf
not eax
add eax, 0xe42d02f8
xor eax, 0x9f9d32b4
rol eax, 0xd2
popf
pushf
not eax
add eax, 0xb45c8f69
xor eax, 0xe31c547d
rol eax, 0x7b
popf
pushf
not eax
add eax, 0x8f8fec36
xor eax, 0xc4b7d56f
rol eax, 0x22
popf
pushf
not eax
add eax, 0x9226bd81
xor eax, 0x93fb10f8
rol eax, 0x19
popf
jmp 0x1400e6c14
push rax
pushf
mov eax, 0xd134e887
pushf
not eax
add eax, 0xd77e8044
xor eax, 0xc76e99a8
rol eax, 0x58
popf
pushf
not eax
add eax, 0x8caf7936
xor eax, 0xf7f95dc8
rol eax, 0xb6
popf
pushf
not eax
add eax, 0xd33f8f2b
xor eax, 0xacea69c6
rol eax, 0x2a
popf
pushf
not eax
add eax, 0xac5ce976
xor eax, 0xd59a6387
rol eax, 0x4a
popf
jmp 0x1400e6c14
add dword [rdi + 8], 2
mov ecx, 0x61b322bb
pushf
not ecx
add ecx, 0xff8cae21
xor ecx, 0xcfb71f4b
rol ecx, 0x3a
popf
pushf
not ecx
add ecx, 0x914e9ea0
xor ecx, 0x91e0e7b7
rol ecx, 0x3d
popf
pushf
not ecx
add ecx, 0xfdd89191
xor ecx, 0x9c2b776b
rol ecx, 0xed
popf
pushf
not ecx
add ecx, 0xc18ff42d
xor ecx, 0xd4c0aa16
rol ecx, 0x98
popf
mov word [rbx], cx
add rbx, 2
push rax
pushf
mov eax, 0x9e5cdadf
pushf
not eax
add eax, 0xca24da78
xor eax, 0xcd841d84
rol eax, 0x77
popf
pushf
not eax
add eax, 0x8043a422
xor eax, 0xb28695f2
rol eax, 0xc7
popf
pushf
not eax
add eax, 0xdc5ef1e9
xor eax, 0x88ffb567
rol eax, 0x29
popf
pushf
not eax
add eax, 0xf653d337
xor eax, 0x9f8811c3
rol eax, 0xe9
popf
jmp 0x1400e6c14
mov word [rbx], ax
add rbx, 2
lea rax, [rsp + 0x143e]
cmp rbx, rax
jb 0x1400e705f
push rax
pushf
mov eax, 0xb24ece6
pushf
not eax
add eax, 0xf40d18ea
xor eax, 0xb678dfde
rol eax, 0x18
popf
pushf
not eax
add eax, 0xb4f9aacb
xor eax, 0xb79b19d7
rol eax, 0xc4
popf
jmp 0x1400e6c14
push rax
pushf
mov eax, 0xd7b5b237
pushf
not eax
add eax, 0xe57fae65
xor eax, 0xa4d72607
rol eax, 0xd6
popf
pushf
not eax
add eax, 0x8a05557a
xor eax, 0xc592050f
rol eax, 0xa0
popf
pushf
not eax
add eax, 0xe670bbae
xor eax, 0xaba7a2e1
rol eax, 0x15
popf
jmp 0x1400e6c14
and qword [rsp + 0x20], 0
lea rax, [rsp + 0x40]
sub rbx, rax
lea r9, [rsp + 0x30]
sar rbx, 1
lea rdx, [rsp + 0x40]
add ebx, ebx
mov rcx, r14
mov r8d, ebx
jmp 0x1400e70c9
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400e7119
push rax
pushf
mov eax, 0xb9742164
pushf
not eax
add eax, 0x9c5e907a
xor eax, 0xa7885a03
rol eax, 4
popf
pushf
not eax
add eax, 0xa4d4bc40
xor eax, 0xc3000340
rol eax, 0x63
popf
pushf
not eax
add eax, 0xf533ccfd
xor eax, 0x87af8020
rol eax, 0x90
popf
jmp 0x1400e6c14
push rax
pushf
mov eax, 0xc7407a3f
pushf
not eax
add eax, 0xe8cc3e05
xor eax, 0xd4bcd7a5
rol eax, 0xc0
popf
pushf
not eax
add eax, 0xfe16e674
xor eax, 0xa30028f8
rol eax, 0xf3
popf
pushf
not eax
add eax, 0xce6d6a78
xor eax, 0xf7100178
rol eax, 0x38
popf
jmp 0x1400e6c14
mov eax, dword [rsp + 0x30]
add dword [rdi + 4], eax
cmp eax, ebx
jb 0x1400e71b0
push rax
pushf
mov eax, 0x2af537ab
pushf
not eax
add eax, 0xd6d9a7e0
xor eax, 0xd03d28e7
rol eax, 0xba
popf
pushf
not eax
add eax, 0x98026417
xor eax, 0xdbd106f3
rol eax, 0x4a
popf
pushf
not eax
add eax, 0xc91ca84a
xor eax, 0xb92ba602
rol eax, 0xef
popf
jmp 0x1400e6c14
push rax
pushf
mov eax, 0xa25f0ff8
pushf
not eax
add eax, 0xc02e04ac
xor eax, 0xa015b561
rol eax, 0x2a
popf
pushf
not eax
add eax, 0xa92a82c5
xor eax, 0xa4aa78a9
rol eax, 0x25
popf
pushf
not eax
add eax, 0xc1f1e9d6
xor eax, 0xdad8fcc9
rol eax, 0x48
popf
pushf
not eax
add eax, 0xff1bb2a3
xor eax, 0xf61a2738
rol eax, 0x67
popf
jmp 0x1400e6c14
cmp rsi, rbp
jb 0x1400e7254
push rax
pushf
mov eax, 0xdd99ab8b
pushf
not eax
add eax, 0xfbef5463
xor eax, 0xfa1f85f8
rol eax, 0x24
popf
pushf
not eax
add eax, 0xa0b0b05b
xor eax, 0xf2d97f19
rol eax, 0xf8
popf
pushf
not eax
add eax, 0xd9e07031
xor eax, 0x94310b8e
rol eax, 0x94
popf
jmp 0x1400e6c14
push rax
pushf
mov eax, 0xce884c98
pushf
not eax
add eax, 0xc0a21432
xor eax, 0xa4c6458e
rol eax, 0x6a
popf
pushf
not eax
add eax, 0xf07dfb3d
xor eax, 0x94580b00
rol eax, 0x49
popf
pushf
not eax
add eax, 0xd8cf6d01
xor eax, 0xabf374d0
rol eax, 0x23
popf
pushf
not eax
add eax, 0xaf0485d7
xor eax, 0xbc6d96b0
rol eax, 0x82
popf
jmp 0x1400e6c14
jmp 0x1400e735a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
push rax
pushf
mov eax, 0x468f896e
pushf
not eax
add eax, 0xf8916241
xor eax, 0xa3fb5d6e
rol eax, 0x88
popf
pushf
not eax
add eax, 0xcf67afac
xor eax, 0xa05295e5
rol eax, 0xa
popf
pushf
not eax
add eax, 0xdca7a68e
xor eax, 0x8d67db27
rol eax, 0xaf
popf
pushf
not eax
add eax, 0xbac99118
xor eax, 0x80fb59e2
rol eax, 0xf7
popf
jmp 0x1400e6c14
mov rax, rdi
mov rcx, qword [rsp + 0x1440]
xor rcx, rsp
call fcn.140153126
lea r11, [rsp + 0x1450]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret