Function at 0x1402912de
Capabilities:
Write file on windows

Disassembly:
push rax
pushf
mov eax, 0xa05535d0
pushf
not eax
add eax, 0xcb64a486
xor eax, 0xec094b76
rol eax, 0x23
popf
pushf
not eax
add eax, 0xe1c76afc
xor eax, 0xaa079bb7
rol eax, 0x9a
popf
pushf
not eax
add eax, 0xa5488b15
xor eax, 0xf9f85c77
rol eax, 0x4d
popf
pushf
not eax
add eax, 0xd866f873
xor eax, 0x9566f7da
rol eax, 0xfb
popf
cmp eax, 4
jne 0x140291341
popf
pop rax
jmp 0x1402915c7
cmp eax, 0
jne 0x140291350
popf
pop rax
jmp 0x1402913e6
cmp eax, 3
jne 0x14029135f
popf
pop rax
jmp 0x140291544
cmp eax, 1
jne 0x14029136e
popf
pop rax
jmp 0x140291503
cmp eax, 0xa
jne 0x14029137d
popf
pop rax
jmp 0x1402918ef
cmp eax, 7
jne 0x14029138c
popf
pop rax
jmp 0x14029177b
cmp eax, 6
jne 0x14029139b
popf
pop rax
jmp 0x1402916a1
cmp eax, 0xb
jne 0x1402913aa
popf
pop rax
jmp 0x140291950
cmp eax, 9
jne 0x1402913b9
popf
pop rax
jmp 0x1402918a3
cmp eax, 8
jne 0x1402913c8
popf
pop rax
jmp 0x140291812
cmp eax, 5
jne 0x1402913d7
popf
pop rax
jmp 0x140291616
cmp eax, 2
jne 0x1402913e6
popf
pop rax
jmp 0x14029153b
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
mov eax, 0x6c139c0e
pushf
not eax
add eax, 0x96021234
xor eax, 0xc37ba07a
rol eax, 0x1f
popf
pushf
not eax
add eax, 0xd3faf059
xor eax, 0xdeba2d29
rol eax, 0xf9
popf
call fcn.14006dea1
sub rsp, rax
mov rax, qword [0x140183040]
xor rax, rsp
mov qword [rsp + 0x1440], rax
movsxd r10, edx
mov rdi, rcx
mov rax, r10
mov ebp, r9d
sar rax, 6
lea rcx, [0x189c24164]
pushf
sub rcx, 0x49a9c574
popf
and r10d, 0x3f
push r8
not r8
sub rbp, r8
pop r8
sub rbp, 1
mov rsi, r8
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
mov r14, qword [rax + rdx*8 + 0x28]
xor eax, eax
mov qword [rdi], rax
mov dword [rdi + 8], eax
cmp r8, rbp
jae 0x1402914bd
push rax
pushf
mov eax, 0x1fb9f8a3
pushf
not eax
add eax, 0x81567408
xor eax, 0x9f130d4b
rol eax, 0x12
popf
pushf
not eax
add eax, 0x80dc9913
xor eax, 0xb81c9ed5
rol eax, 0x64
popf
jmp 0x140291332
push rax
pushf
mov eax, 0x23361f84
pushf
not eax
add eax, 0x994b4399
xor eax, 0xa3125516
rol eax, 0x92
popf
pushf
not eax
add eax, 0xa7c57166
xor eax, 0xc87beec8
rol eax, 0xf6
popf
pushf
not eax
add eax, 0xdd3b43a3
xor eax, 0xfd30532d
rol eax, 0xe0
popf
jmp 0x140291332
lea rbx, [rsp + 0x40]
push rax
pushf
mov eax, 0x99ff2fae
pushf
not eax
add eax, 0x98464de0
xor eax, 0xadfed190
rol eax, 0x67
popf
pushf
not eax
add eax, 0xd486305a
xor eax, 0xf79e5fb8
rol eax, 0x7e
popf
jmp 0x140291332
cmp rsi, rbp
jae 0x1402916a1
mov al, byte [rsi]
inc rsi
cmp al, 0xa
jne 0x140291593
push rax
pushf
mov eax, 0x153cfcac
pushf
not eax
add eax, 0xdf1bcd9c
xor eax, 0xe140b3f7
rol eax, 0x32
popf
pushf
not eax
add eax, 0x8d537ca5
xor eax, 0xcef90e0d
rol eax, 0xb4
popf
pushf
not eax
add eax, 0xf4693bef
xor eax, 0xb1fc5b21
rol eax, 0x3e
popf
jmp 0x140291332
push rax
pushf
mov eax, 0x1e5ead2a
pushf
not eax
add eax, 0xde6c54aa
xor eax, 0xd1a5354a
rol eax, 0x58
popf
pushf
not eax
add eax, 0xedbad26b
xor eax, 0xb8a92898
rol eax, 0x1a
popf
jmp 0x140291332
inc dword [rdi + 8]
mov byte [rbx], 0xd
inc rbx
push rax
pushf
mov eax, 0xda3512f0
pushf
not eax
add eax, 0xde1f18e3
xor eax, 0xc2a06309
rol eax, 0xc
popf
pushf
not eax
add eax, 0xc8483e5d
xor eax, 0xfbc168de
rol eax, 0xb2
popf
pushf
not eax
add eax, 0xa0f6b22d
xor eax, 0xf69b5dc5
rol eax, 0x76
popf
jmp 0x140291332
mov byte [rbx], al
inc rbx
lea rax, [rsp + 0x143f]
cmp rbx, rax
jb 0x14029165b
push rax
pushf
mov eax, 0x4eb8ec19
pushf
not eax
add eax, 0xf437eeee
xor eax, 0x9a953bd5
rol eax, 0x58
popf
pushf
not eax
add eax, 0x92c13b93
xor eax, 0xa1815159
rol eax, 0xa5
popf
jmp 0x140291332
push rax
pushf
mov eax, 0x286ef21
pushf
not eax
add eax, 0xe262dd8f
xor eax, 0xcf9dd25d
rol eax, 0x44
popf
pushf
not eax
add eax, 0xeb3bd0be
xor eax, 0x8e18620e
rol eax, 0x5e
popf
pushf
not eax
add eax, 0x96f36128
xor eax, 0xfcc7453b
rol eax, 0x6f
popf
jmp 0x140291332
and qword [rsp + 0x20], 0
lea rax, [rsp + 0x40]
sub ebx, eax
lea r9, [rsp + 0x30]
mov r8d, ebx
lea rdx, [rsp + 0x40]
mov rcx, r14
jmp 0x1402916bf
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140291722
push rax
pushf
mov eax, 0x1a51b51e
pushf
not eax
add eax, 0xf0c9d16d
xor eax, 0xe11b19ed
rol eax, 0x40
popf
pushf
not eax
add eax, 0xaa1ca056
xor eax, 0x8700d75f
rol eax, 0xea
popf
pushf
not eax
add eax, 0xff1384a7
xor eax, 0xadeef606
rol eax, 0xee
popf
pushf
not eax
add eax, 0xed329a5d
xor eax, 0x9e7ce34f
rol eax, 0x57
popf
jmp 0x140291332
push rax
pushf
mov eax, 0xcb7e1c53
pushf
not eax
add eax, 0x8c4e95a6
xor eax, 0xe9a86240
rol eax, 0xf9
popf
pushf
not eax
add eax, 0x9198741c
xor eax, 0xfecd4600
rol eax, 0x95
popf
pushf
not eax
add eax, 0xda4bc302
xor eax, 0xf96abc43
rol eax, 0x63
popf
pushf
not eax
add eax, 0xe66c4c4a
xor eax, 0xbf8cdef2
rol eax, 0x8b
popf
jmp 0x140291332
mov eax, dword [rsp + 0x30]
add dword [rdi + 4], eax
cmp eax, ebx
jb 0x1402917cc
push rax
pushf
mov eax, 0x423c3e0a
pushf
not eax
add eax, 0xa978259c
xor eax, 0x9f061172
rol eax, 0x7e
popf
pushf
not eax
add eax, 0x8346039e
xor eax, 0xe53cc1a6
rol eax, 0xf3
popf
pushf
not eax
add eax, 0xbd2d4cff
xor eax, 0x9b524cac
rol eax, 0x6d
popf
jmp 0x140291332
push rax
pushf
mov eax, 0xbb811bad
pushf
not eax
add eax, 0xcf5f95e3
xor eax, 0xc8523f10
rol eax, 0xe5
popf
pushf
not eax
add eax, 0xaa3bc993
xor eax, 0x94677a92
rol eax, 0x93
popf
pushf
not eax
add eax, 0x89a477b4
xor eax, 0x97c71111
rol eax, 0xac
popf
jmp 0x140291332
cmp rsi, rbp
jb 0x140291870
push rax
pushf
mov eax, 0xdea68883
pushf
not eax
add eax, 0x9c35381d
xor eax, 0xaa2e9e83
rol eax, 0x15
popf
pushf
not eax
add eax, 0x8ff99af1
xor eax, 0xc0f4c519
rol eax, 0x96
popf
pushf
not eax
add eax, 0x89e4f3bd
xor eax, 0xf51c2535
rol eax, 0xf
popf
pushf
not eax
add eax, 0xccd63599
xor eax, 0xe9cd5ca6
rol eax, 0x76
popf
jmp 0x140291332
push rax
pushf
mov eax, 0x45ae68ce
pushf
not eax
add eax, 0xef417392
xor eax, 0xe28f7d7f
rol eax, 0x2e
popf
pushf
not eax
add eax, 0xbfb36e0c
xor eax, 0xa1445b44
rol eax, 9
popf
jmp 0x140291332
jmp 0x140291950
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
push rax
pushf
mov eax, 0x15e979
pushf
not eax
add eax, 0xf966a503
xor eax, 0xfb6e9963
rol eax, 0xcb
popf
pushf
not eax
add eax, 0xb78eae65
xor eax, 0xcffe4546
rol eax, 0x15
popf
pushf
not eax
add eax, 0xcef1225e
xor eax, 0xc9e5af7d
rol eax, 0x37
popf
pushf
not eax
add eax, 0xede89625
xor eax, 0xca1598f5
rol eax, 0x15
popf
jmp 0x140291332
mov rax, rdi
mov rcx, qword [rsp + 0x1440]
xor rcx, rsp
call fcn.14006f69d
lea r11, [rsp + 0x1450]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret