Function at 0x1401223cb
Capabilities:
Write file on windows

Disassembly:
push rax
pushf
mov eax, 0xf7985ea5
pushf
not eax
add eax, 0xed2edf74
xor eax, 0x8da5a1f0
rol eax, 0x5a
popf
pushf
not eax
add eax, 0xc968adc8
xor eax, 0xcf87e143
rol eax, 0x13
popf
cmp eax, 4
jne 0x140122408
popf
pop rax
jmp 0x1401227a8
cmp eax, 0
jne 0x140122417
popf
pop rax
jmp 0x1401224cb
cmp eax, 3
jne 0x140122426
popf
pop rax
jmp 0x1401226e2
cmp eax, 1
jne 0x140122435
popf
pop rax
jmp 0x140122554
cmp eax, 0xd
jne 0x140122444
popf
pop rax
jmp 0x140122b1d
cmp eax, 7
jne 0x140122453
popf
pop rax
jmp 0x1401228f1
cmp eax, 6
jne 0x140122462
popf
pop rax
jmp 0x140122891
cmp eax, 0xb
jne 0x140122471
popf
pop rax
jmp 0x140122aa4
cmp eax, 0xc
jne 0x140122480
popf
pop rax
jmp 0x140122ae3
cmp eax, 8
jne 0x14012248f
popf
pop rax
jmp 0x140122962
cmp eax, 5
jne 0x14012249e
popf
pop rax
jmp 0x140122813
cmp eax, 2
jne 0x1401224ad
popf
pop rax
jmp 0x1401225ea
cmp eax, 9
jne 0x1401224bc
popf
pop rax
jmp 0x140122999
cmp eax, 0xa
jne 0x1401224cb
popf
pop rax
jmp 0x140122a5a
push rbx
sub rsp, 0x60
mov rax, qword [0x140084080]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140122521
push rax
pushf
mov eax, 0x494a8284
pushf
not eax
add eax, 0xf781cee3
xor eax, 0xea21b885
rol eax, 0xc6
popf
pushf
not eax
add eax, 0x93c38acf
xor eax, 0x9e0653fd
rol eax, 0x84
popf
jmp 0x1401223f9
push rax
pushf
mov eax, 0x2dea5489
pushf
not eax
add eax, 0x821e01b3
xor eax, 0xd557c16c
rol eax, 0x7d
popf
pushf
not eax
add eax, 0x96da49ca
xor eax, 0xe70dbc41
rol eax, 0xb
popf
jmp 0x1401223f9
cmp byte [rcx + 0x71], 0
je 0x1401225a4
push rax
pushf
mov eax, 0x12fdc0a
pushf
not eax
add eax, 0xa67e98cb
xor eax, 0x903a400a
rol eax, 0x1c
popf
pushf
not eax
add eax, 0x86e39dca
xor eax, 0xd6cc52e2
rol eax, 0xd9
popf
pushf
not eax
add eax, 0xf80cea14
xor eax, 0xb9a669d5
rol eax, 0xef
popf
jmp 0x1401223f9
push rax
pushf
mov eax, 0xcaeb1964
pushf
not eax
add eax, 0xf8862288
xor eax, 0xa7061244
rol eax, 0x88
popf
pushf
not eax
add eax, 0xb385e623
xor eax, 0xcf6003da
rol eax, 0x11
popf
pushf
not eax
add eax, 0xcec084fe
xor eax, 0xd77ad2e9
rol eax, 0xa
popf
jmp 0x1401223f9
mov rax, qword [rcx]
mov edx, 0x9aea3084
pushf
not edx
add edx, 0x987fd094
xor edx, 0x9e7f93ef
rol edx, 0x3f
popf
pushf
not edx
add edx, 0xc3862eca
xor edx, 0xd77ecf14
rol edx, 0xaa
popf
pushf
not edx
add edx, 0xd2ae9415
xor edx, 0xecc0a106
rol edx, 0x6e
popf
mov qword [rsp + 0x78], rdi
jmp 0x140122637
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x14012269c
push rax
pushf
mov eax, 0xfb309ea7
pushf
not eax
add eax, 0xd190457c
xor eax, 0x9d36eeb4
rol eax, 0x4d
popf
pushf
not eax
add eax, 0xd1a29d5d
xor eax, 0x8b29a71a
rol eax, 0x8c
popf
pushf
not eax
add eax, 0x8dfee7aa
xor eax, 0xf2242073
rol eax, 0x8e
popf
pushf
not eax
add eax, 0xf145b268
xor eax, 0xc3fe5845
rol eax, 0x22
popf
jmp 0x1401223f9
push rax
pushf
mov eax, 0x619fd902
pushf
not eax
add eax, 0xaef55d83
xor eax, 0x9d9c65bc
rol eax, 0x3c
popf
pushf
not eax
add eax, 0xb8e862e0
xor eax, 0xd40c1a40
rol eax, 0xdc
popf
pushf
not eax
add eax, 0xb1761ca4
xor eax, 0xed78aebb
rol eax, 0x76
popf
jmp 0x1401223f9
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
jmp 0x1401226ff
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14012274f
push rax
pushf
mov eax, 0x9a115d4b
pushf
not eax
add eax, 0xe8be8221
xor eax, 0xcd7167f1
rol eax, 0x1f
popf
pushf
not eax
add eax, 0x851b79c2
xor eax, 0xf442f93d
rol eax, 0x3d
popf
pushf
not eax
add eax, 0xf511f216
xor eax, 0x9e63fdf3
rol eax, 0xcc
popf
jmp 0x1401223f9
push rax
pushf
mov eax, 0xb773846c
pushf
not eax
add eax, 0xb2e31602
xor eax, 0x8c3c3523
rol eax, 0xe5
popf
pushf
not eax
add eax, 0xb49c5713
xor eax, 0xbcee81cb
rol eax, 0xcf
popf
pushf
not eax
add eax, 0xf929d5e8
xor eax, 0xc18cd4c8
rol eax, 0x18
popf
pushf
not eax
add eax, 0xf0db0906
xor eax, 0xa5c11a37
rol eax, 0x8c
popf
jmp 0x1401223f9
sub eax, 1
je 0x1401227e0
push rax
pushf
mov eax, 0x48a0aed9
pushf
not eax
add eax, 0xc9e9979c
xor eax, 0xfcbb3dc0
rol eax, 0xa5
popf
pushf
not eax
add eax, 0xa1f02df8
xor eax, 0xa3758da9
rol eax, 0x62
popf
jmp 0x1401223f9
push rax
pushf
mov eax, 0xd454e832
pushf
not eax
add eax, 0xc173d8b8
xor eax, 0xf4c22438
rol eax, 0x21
popf
pushf
not eax
add eax, 0xc51f49fc
xor eax, 0x9165a088
rol eax, 0xc0
popf
jmp 0x1401223f9
cmp eax, 2
jne 0x14012285e
push rax
pushf
mov eax, 0x9a7bd908
pushf
not eax
add eax, 0xa6317662
xor eax, 0xacfa753d
rol eax, 0
popf
pushf
not eax
add eax, 0xea61efd0
xor eax, 0x91a250d9
rol eax, 0x99
popf
pushf
not eax
add eax, 0xe9966e79
xor eax, 0x83f13dc9
rol eax, 0x55
popf
jmp 0x1401223f9
push rax
pushf
mov eax, 0x7b20645
pushf
not eax
add eax, 0xc8f17aa5
xor eax, 0x81c57381
rol eax, 0x16
popf
pushf
not eax
add eax, 0xbf67c45f
xor eax, 0xdfd785dd
rol eax, 0x87
popf
jmp 0x1401223f9
mov byte [rbx + 0x71], 0
mov al, reloc.WLDAP32.dll_Ordinal_79
pushf
not al
add al, 0x25
xor al, 0x7f
rol al, 0xf6
popf
pushf
not al
add al, 0x21
xor al, 0x24
rol al, 0x4f
popf
pushf
not al
add al, 0xdb
xor al, 0xf1
rol al, 0xca
popf
push rax
pushf
mov eax, 0xbb5bde84
pushf
not eax
add eax, 0x97395683
xor eax, 0x81015485
rol eax, 0x39
popf
pushf
not eax
add eax, 0xc28438f6
xor eax, 0xcbce816f
rol eax, 0xba
popf
jmp 0x1401223f9
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400e231b
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
push rax
pushf
mov eax, 0xf8a98c5e
pushf
not eax
add eax, 0xeadabf48
xor eax, 0xff82ad3d
rol eax, 0xc7
popf
pushf
not eax
add eax, 0xc245d2e0
xor eax, 0xe874c8d9
rol eax, 0x33
popf
jmp 0x1401223f9
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140122a01
push rax
pushf
mov eax, 0x914d0b51
pushf
not eax
add eax, 0xf64d92a7
xor eax, 0x96686192
rol eax, 0
popf
pushf
not eax
add eax, 0xc5857d35
xor eax, 0xcfe0a7a0
rol eax, 0x32
popf
pushf
not eax
add eax, 0xe4634e03
xor eax, 0xa660b3d7
rol eax, 0xa5
popf
pushf
not eax
add eax, 0xf8cfcd66
xor eax, 0x8f03162e
rol eax, 0xfa
popf
jmp 0x1401223f9
push rax
pushf
mov eax, 0x29a8ee69
pushf
not eax
add eax, 0xcfdf156a
xor eax, 0x97639a32
rol eax, 0x5b
popf
pushf
not eax
add eax, 0x8fe6b6e9
xor eax, 0x92753e0f
rol eax, 0xd5
popf
pushf
not eax
add eax, 0xba112f5e
xor eax, 0x9cd613ca
rol eax, 0xd2
popf
pushf
not eax
add eax, 0x8c46e27f
xor eax, 0xa451df23
rol eax, 0
popf
jmp 0x1401223f9
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 0x61b81137
pushf
not edx
add edx, 0x9bd9bd82
xor edx, 0xca07cbcd
rol edx, 0xbf
popf
pushf
not edx
add edx, 0xee862aca
xor edx, 0xf670f706
rol edx, 0xcf
popf
jmp 0x140122a99
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140122ae3
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1401228f1
xor al, al
jmp 0x1401228f1
mov al, 0x6b
pushf
not al
add al, 0x9e
xor al, 0x24
rol al, 0x78
popf
pushf
not al
add al, 0x1a
xor al, 9
rol al, 0xf7
popf
pushf
not al
add al, 0xbb
xor al, 0x95
rol al, 0xf3
popf
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400e231b
add rsp, 0x60
pop rbx
ret