Function at 0x18002815d
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rax
pushf
mov eax, 0x4fbc3232
pushf
not eax
add eax, 0x8e688db5
xor eax, 0xf936a325
rol eax, 0xc2
popf
pushf
not eax
add eax, 0x803df0c1
xor eax, 0xda21c0e3
rol eax, 0x5e
popf
pushf
not eax
add eax, 0xe9ba371c
xor eax, 0xe870b405
rol eax, 0x22
popf
pushf
not eax
add eax, 0xd29d141a
xor eax, 0x8765365e
rol eax, 0xd7
popf
cmp eax, 4
jne 0x1800281c0
popf
pop rax
jmp 0x1800285bb
cmp eax, 0
jne 0x1800281cf
popf
pop rax
jmp 0x180028292
cmp eax, 3
jne 0x1800281de
popf
pop rax
jmp 0x180028506
cmp eax, 1
jne 0x1800281ed
popf
pop rax
jmp 0x1800283a0
cmp eax, 0xd
jne 0x1800281fc
popf
pop rax
jmp 0x180028a5d
cmp eax, 7
jne 0x18002820b
popf
pop rax
jmp 0x180028759
cmp eax, 0xe
jne 0x18002821a
popf
pop rax
jmp 0x180028ae1
cmp eax, 0xb
jne 0x180028229
popf
pop rax
jmp 0x180028985
cmp eax, 0xc
jne 0x180028238
popf
pop rax
jmp 0x180028a09
cmp eax, 8
jne 0x180028247
popf
pop rax
jmp 0x1800287ec
cmp eax, 5
jne 0x180028256
popf
pop rax
jmp 0x180028671
cmp eax, 2
jne 0x180028265
popf
pop rax
jmp 0x180028412
cmp eax, 9
jne 0x180028274
popf
pop rax
jmp 0x18002887f
cmp eax, 0xa
jne 0x180028283
popf
pop rax
jmp 0x180028918
cmp eax, 6
jne 0x180028292
popf
pop rax
jmp 0x18002874d
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0xf40]
mov eax, 0xa840fdfa
pushf
not eax
add eax, 0x9b8969cf
xor eax, 0x8b5e7452
rol eax, 0x57
popf
pushf
not eax
add eax, 0xf19af8f4
xor eax, 0xae9d12b3
rol eax, 0x7d
popf
pushf
not eax
add eax, 0xac9b0c3a
xor eax, 0xcccfd50c
rol eax, 0xa5
popf
pushf
not eax
add eax, 0x9471ce66
xor eax, 0x8bc2a5f7
rol eax, 0xd4
popf
call fcn.18005644b
sub rsp, rax
xor esi, esi
mov rbx, rcx
mov dword [rbp + 0xf70], esi
mov dword [rbp + 0xf80], esi
cmp dword [rcx + 0x10], esi
je 0x18002836d
push rax
pushf
mov eax, 0x8f05b7b4
pushf
not eax
add eax, 0xcd94668c
xor eax, 0x86ada80b
rol eax, 0x4b
popf
pushf
not eax
add eax, 0x818f128b
xor eax, 0xd5e02152
rol eax, 0x57
popf
pushf
not eax
add eax, 0xb122792e
xor eax, 0xf9b48f09
rol eax, 0xd
popf
pushf
not eax
add eax, 0xede9b6cd
xor eax, 0xdbabf36e
rol eax, 0xad
popf
jmp 0x1800281b1
push rax
pushf
mov eax, 0x6d899ff4
pushf
not eax
add eax, 0xd403b33c
xor eax, 0xaa8ae785
rol eax, 0x53
popf
pushf
not eax
add eax, 0x9549049d
xor eax, 0xef329d21
rol eax, 0x9e
popf
jmp 0x1800281b1
mov dword [rcx + 0x10], esi
cmp dword [rcx + 0xc], esi
jne 0x1800283df
push rax
pushf
mov eax, 0xd8260c6b
pushf
not eax
add eax, 0xf58a1668
xor eax, 0xa68e51f7
rol eax, 0x1f
popf
pushf
not eax
add eax, 0x82bc4dcb
xor eax, 0xa4c7a1c5
rol eax, 0xb2
popf
jmp 0x1800281b1
push rax
pushf
mov eax, 0x10f87997
pushf
not eax
add eax, 0xea59ad30
xor eax, 0xf63ea0dc
rol eax, 0x59
popf
pushf
not eax
add eax, 0x805cf6c2
xor eax, 0xf7fe3781
rol eax, 0xbf
popf
jmp 0x1800281b1
movzx eax, word [rcx + 0x814]
lea r8d, [rsi + 0x10]
add ax, 0x18
mov word [rbp + 0xf8e], dx
mov word [rsp + 0x38], ax
lea r9, [rbp + 0xf70]
mov eax, dword [rcx + 8]
lea rdx, [rsp + 0x30]
mov rcx, qword [rcx]
lea r14d, [rsi + 5]
mov dword [rsp + 0x30], 0x3000005
mov dword [rsp + 0x34], r8d
mov word [rsp + 0x3a], si
mov dword [rsp + 0x3c], eax
mov dword [rbp + 0xf88], esi
mov word [rbp + 0xf8c], si
mov qword [rsp + 0x20], rsi
jmp 0x18002846c
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1800284c0
push rax
pushf
mov eax, 0x49206c0
pushf
not eax
add eax, 0xa5223fca
xor eax, 0xcb99f50d
rol eax, 0x9d
popf
pushf
not eax
add eax, 0xea077e09
xor eax, 0xafe39afe
rol eax, 0x3d
popf
pushf
not eax
add eax, 0x8e2c1fbb
xor eax, 0xafc353ec
rol eax, 0x54
popf
jmp 0x1800281b1
push rax
pushf
mov eax, 0x7543ec12
pushf
not eax
add eax, 0x867d845d
xor eax, 0xe150f4be
rol eax, 0xdd
popf
pushf
not eax
add eax, 0xff72a153
xor eax, 0x8a4fea45
rol eax, 0x71
popf
pushf
not eax
add eax, 0xe2c495c0
xor eax, 0xaee0bf5e
rol eax, 0xfe
popf
jmp 0x1800281b1
mov rcx, qword [rbx]
lea r9, [rbp + 0xf70]
lea r8d, [rsi + 8]
mov qword [rsp + 0x20], rsi
lea rdx, [rbp + 0xf88]
jmp 0x180028521
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180028588
push rax
pushf
mov eax, 0xd9010dbc
pushf
not eax
add eax, 0xe96a193b
xor eax, 0xc5538662
rol eax, 0x11
popf
pushf
not eax
add eax, 0x9286a6f4
xor eax, 0xede6537b
rol eax, 0xbb
popf
pushf
not eax
add eax, 0xa8a721a0
xor eax, 0xe994b7a0
rol eax, 0x22
popf
pushf
not eax
add eax, 0xca926bd9
xor eax, 0x90dc7dba
rol eax, 0x66
popf
jmp 0x1800281b1
push rax
pushf
mov eax, 0x552da03f
pushf
not eax
add eax, 0xd71bb5d5
xor eax, 0x9803b47f
rol eax, 0x15
popf
pushf
not eax
add eax, 0xd58b3ed9
xor eax, 0xac480124
rol eax, 0xc6
popf
jmp 0x1800281b1
mov r8d, dword [rbx + 0x814]
lea rdx, [rbx + 0x14]
mov rcx, qword [rbx]
lea r9, [rbp + 0xf70]
mov qword [rsp + 0x20], rsi
jmp 0x1800285d6
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18002862a
push rax
pushf
mov eax, 0x146e820e
pushf
not eax
add eax, 0xa1433ffa
xor eax, 0xb8462f0e
rol eax, 0x32
popf
pushf
not eax
add eax, 0xa36f97d0
xor eax, 0xb69fdaa5
rol eax, 0xf0
popf
pushf
not eax
add eax, 0xd908715c
xor eax, 0xb9b79016
rol eax, 0x2c
popf
jmp 0x1800281b1
push rax
pushf
mov eax, 0x6ae8ec30
pushf
not eax
add eax, 0x9c531cd7
xor eax, 0xe7173315
rol eax, 0x6d
popf
pushf
not eax
add eax, 0xa4243503
xor eax, 0x884c4465
rol eax, 0xd3
popf
pushf
not eax
add eax, 0xe8374c2a
xor eax, 0xb582ed19
rol eax, 0x42
popf
jmp 0x1800281b1
inc dword [rbx + 8]
lea rcx, [rsp + 0x40]
mov edi, 0x9c43f4e4
pushf
not edi
add edi, 0xef361c2a
xor edi, 0xf713004c
rol edi, 0xfb
popf
pushf
not edi
add edi, 0xd668d497
xor edi, 0x8939cb1e
rol edi, 0x66
popf
xor edx, edx
mov r8d, edi
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rbx]
lea r9, [rbp + 0xf80]
mov r8d, edi
mov qword [rsp + 0x20], rsi
lea rdx, [rsp + 0x40]
jmp 0x1800286ca
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180028707
push rax
pushf
mov eax, 0x6be1e14
pushf
not eax
add eax, 0xc712d0a6
xor eax, 0x859aacfb
rol eax, 0xe5
popf
pushf
not eax
add eax, 0xdf1a89b1
xor eax, 0xa556bc69
rol eax, 0xe2
popf
jmp 0x1800281b1
push rax
pushf
mov eax, 0xa1f90118
pushf
not eax
add eax, 0xf4ff13ca
xor eax, 0xf9152890
rol eax, 0xc4
popf
pushf
not eax
add eax, 0x99f15c58
xor eax, 0xaf3d813f
rol eax, 0x7b
popf
pushf
not eax
add eax, 0xd9b76b06
xor eax, 0xc6fb6fad
rol eax, 0x79
popf
jmp 0x1800281b1
cmp word [rsp + 0x40], r14w
jne 0x180028a5d
cmp byte [rsp + 0x42], 2
jne 0x180028793
push rax
pushf
mov eax, 0xe80f27a7
pushf
not eax
add eax, 0xcff5e20f
xor eax, 0x8f19b20a
rol eax, 0xa3
popf
pushf
not eax
add eax, 0xe46fa8d4
xor eax, 0x9c7f6568
rol eax, 0xd0
popf
jmp 0x1800281b1
push rax
pushf
mov eax, 0x8a873236
pushf
not eax
add eax, 0xdad378e0
xor eax, 0x9569cce5
rol eax, 0x5f
popf
pushf
not eax
add eax, 0xe9e45a41
xor eax, 0xb77b89e9
rol eax, 0xa4
popf
pushf
not eax
add eax, 0x9f2f48c3
xor eax, 0x89d9b81b
rol eax, 0x5e
popf
pushf
not eax
add eax, 0xdc321016
xor eax, 0xd6dd7fb0
rol eax, 0x73
popf
jmp 0x1800281b1
cmp byte [rsp + 0x43], 3
jne 0x180028826
push rax
pushf
mov eax, 0x555e8d2c
pushf
not eax
add eax, 0xa6defa8e
xor eax, 0x9e8c7a9e
rol eax, 0xc7
popf
pushf
not eax
add eax, 0x84fd661b
xor eax, 0xfef5e633
rol eax, 0x11
popf
jmp 0x1800281b1
push rax
pushf
mov eax, 0xbd379c7f
pushf
not eax
add eax, 0xb78935ac
xor eax, 0xf64007fa
rol eax, 0xa4
popf
pushf
not eax
add eax, 0xd31f2662
xor eax, 0xc8912978
rol eax, 0x21
popf
pushf
not eax
add eax, 0xa2aba4a8
xor eax, 0xfc30432c
rol eax, 0xb3
popf
pushf
not eax
add eax, 0x960e6bc7
xor eax, 0x914ddf88
rol eax, 0x9b
popf
jmp 0x1800281b1
movzx edi, word [rsp + 0x48]
cmp edi, dword [rbp + 0xf80]
jne 0x1800288d2
push rax
pushf
mov eax, 0x14a8fc42
pushf
not eax
add eax, 0xd69dd3f1
xor eax, 0xeb276139
rol eax, 0x95
popf
pushf
not eax
add eax, 0xda4eef65
xor eax, 0x90701f14
rol eax, 0x6e
popf
pushf
not eax
add eax, 0xeed8b60d
xor eax, 0x8bda1a46
rol eax, 0x98
popf
jmp 0x1800281b1
push rax
pushf
mov eax, 0xc345574f
pushf
not eax
add eax, 0xee04ffa4
xor eax, 0xc87b7a67
rol eax, 0x93
popf
pushf
not eax
add eax, 0xa40ec0b0
xor eax, 0x82e9edcd
rol eax, 0x72
popf
pushf
not eax
add eax, 0x86350dbb
xor eax, 0xc922cba0
rol eax, 0x23
popf
jmp 0x1800281b1
cmp word [rsp + 0x54], si
jne 0x180028952
push rax
pushf
mov eax, 0xb7a1a83f
pushf
not eax
add eax, 0xd8a17658
xor eax, 0xd0da838c
rol eax, 7
popf
pushf
not eax
add eax, 0xfa3090df
xor eax, 0xcb89c666
rol eax, 0xe6
popf
jmp 0x1800281b1
push rax
pushf
mov eax, 0xa9ff9542
pushf
not eax
add eax, 0xf97821eb
xor eax, 0xea771e13
rol eax, 0xdc
popf
pushf
not eax
add eax, 0xc602b64c
xor eax, 0xabb1bd21
rol eax, 0xe3
popf
jmp 0x1800281b1
add edi, 0xffffffe8
cmp edi, 0x800
ja 0x1800289c3
push rax
pushf
mov eax, 0x85f63875
pushf
not eax
add eax, 0xba60a851
xor eax, 0x8f40e000
rol eax, 0x8f
popf
pushf
not eax
add eax, 0xf2ab0163
xor eax, 0xaabd20cd
rol eax, 0xfa
popf
jmp 0x1800281b1
push rax
pushf
mov eax, 0x13f6ee61
pushf
not eax
add eax, 0xed83e5c9
xor eax, 0xc80e5cc4
rol eax, 0x86
popf
pushf
not eax
add eax, 0x955d9ef0
xor eax, 0xc8b66af5
rol eax, 2
popf
pushf
not eax
add eax, 0xde0097cb
xor eax, 0xeded25ef
rol eax, 0x1b
popf
jmp 0x1800281b1
mov r8d, edi
lea rcx, [rbx + 0x818]
lea rdx, [rsp + 0x58]
call sub.VCRUNTIME140.dll_memcpy
xor eax, eax
mov dword [rbx + 0x1018], edi
jmp 0x180028ae1
mov eax, 0xe153c8a2
pushf
not eax
add eax, 0xaee9452d
xor eax, 0xa427fedc
rol eax, 0x49
popf
pushf
not eax
add eax, 0xa90762fe
xor eax, 0xae4495f0
rol eax, 0x2e
popf
pushf
not eax
add eax, 0xaaa447fd
xor eax, 0xf166efbd
rol eax, 0x34
popf
pushf
not eax
add eax, 0xb06fa501
xor eax, 0x8303984a
rol eax, 0x10
popf
push rax
pushf
mov eax, 0xef4659fd
pushf
not eax
add eax, 0xdec0553a
xor eax, 0xcf6d2058
rol eax, 0xbf
popf
pushf
not eax
add eax, 0xdea3bd9f
xor eax, 0xf6994fec
rol eax, 6
popf
jmp 0x1800281b1
add rsp, 0x1040
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret