Function at 0x140189fcd
Capabilities:
Write file on windows

Disassembly:
push rax
pushf
mov eax, 0xc813bd86
pushf
not eax
add eax, 0xf931d0f9
xor eax, 0xa4a41630
rol eax, 0xc5
popf
pushf
not eax
add eax, 0xf13a72e8
xor eax, 0xe0813427
rol eax, 0xb3
popf
pushf
not eax
add eax, 0xe689c24a
xor eax, 0xf0f2f682
rol eax, 0xfc
popf
cmp eax, 4
jne 0x14018a01d
popf
pop rax
jmp 0x14018a2c9
cmp eax, 0
jne 0x14018a02c
popf
pop rax
jmp 0x14018a0c2
cmp eax, 3
jne 0x14018a03b
popf
pop rax
jmp 0x14018a246
cmp eax, 1
jne 0x14018a04a
popf
pop rax
jmp 0x14018a1df
cmp eax, 0xa
jne 0x14018a059
popf
pop rax
jmp 0x14018a5a5
cmp eax, 7
jne 0x14018a068
popf
pop rax
jmp 0x14018a41e
cmp eax, 6
jne 0x14018a077
popf
pop rax
jmp 0x14018a390
cmp eax, 0xb
jne 0x14018a086
popf
pop rax
jmp 0x14018a5e0
cmp eax, 9
jne 0x14018a095
popf
pop rax
jmp 0x14018a559
cmp eax, 8
jne 0x14018a0a4
popf
pop rax
jmp 0x14018a4db
cmp eax, 5
jne 0x14018a0b3
popf
pop rax
jmp 0x14018a305
cmp eax, 2
jne 0x14018a0c2
popf
pop rax
jmp 0x14018a23d
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
mov eax, 0x67f4f17d
pushf
not eax
add eax, 0x8fe18173
xor eax, 0xc03913ca
rol eax, 0xd4
popf
pushf
not eax
add eax, 0x90b73d52
xor eax, 0xe4b8bff2
rol eax, 0x69
popf
call fcn.14029380f
sub rsp, rax
mov rax, qword [0x140103090]
xor rax, rsp
mov qword [rsp + 0x1440], rax
movsxd r10, edx
mov rdi, rcx
mov rax, r10
mov ebp, r9d
sar rax, 6
lea rcx, [0x1bcff8059]
pushf
sub rcx, 0x7ceee0c9
popf
and r10d, 0x3f
push r8
not r8
sub rbp, r8
pop r8
sub rbp, 1
mov rsi, r8
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
mov r14, qword [rax + rdx*8 + 0x28]
xor eax, eax
mov qword [rdi], rax
mov dword [rdi + 8], eax
cmp r8, rbp
jae 0x14018a1ac
push rax
pushf
mov eax, 0xf1abcaa9
pushf
not eax
add eax, 0xaed8704f
xor eax, 0xc1f3c5e9
rol eax, 0x9a
popf
pushf
not eax
add eax, 0xe8423b25
xor eax, 0xd2f965fe
rol eax, 0xb1
popf
pushf
not eax
add eax, 0x80c61d76
xor eax, 0xd00b5c06
rol eax, 0x15
popf
jmp 0x14018a00e
push rax
pushf
mov eax, 0x50364e9
pushf
not eax
add eax, 0x86b7c147
xor eax, 0xa22e97cb
rol eax, 0x1d
popf
pushf
not eax
add eax, 0xbe8b7acd
xor eax, 0xfa18915a
rol eax, 0x94
popf
jmp 0x14018a00e
lea rbx, [rsp + 0x40]
push rax
pushf
mov eax, 0x271a2045
pushf
not eax
add eax, 0xfe186d65
xor eax, 0xa7c0bb1d
rol eax, 0x8c
popf
pushf
not eax
add eax, 0xa20493d2
xor eax, 0xd6f04905
rol eax, 0xe
popf
pushf
not eax
add eax, 0xd4506f20
xor eax, 0xe1fba0d6
rol eax, 0x5f
popf
pushf
not eax
add eax, 0xa9b73fca
xor eax, 0x942a241b
rol eax, 0x7b
popf
jmp 0x14018a00e
cmp rsi, rbp
jae 0x14018a390
mov al, byte [rsi]
inc rsi
cmp al, 0xa
jne 0x14018a282
push rax
pushf
mov eax, 0xa14f6765
pushf
not eax
add eax, 0x82f0f3df
xor eax, 0xd3edaf65
rol eax, 0xee
popf
pushf
not eax
add eax, 0xa3eb8341
xor eax, 0x932476ad
rol eax, 7
popf
jmp 0x14018a00e
push rax
pushf
mov eax, 0x7f8d6883
pushf
not eax
add eax, 0xbe9355b0
xor eax, 0xb71074ec
rol eax, 0xf1
popf
pushf
not eax
add eax, 0xfc9c6417
xor eax, 0xf30769eb
rol eax, 0x2f
popf
pushf
not eax
add eax, 0x9e2b7e88
xor eax, 0x842b6179
rol eax, 0xc8
popf
jmp 0x14018a00e
inc dword [rdi + 8]
mov byte [rbx], 0xd
inc rbx
push rax
pushf
mov eax, 0x4693b33b
pushf
not eax
add eax, 0xd0ab5f9e
xor eax, 0xaed33c5f
rol eax, 0x7a
popf
pushf
not eax
add eax, 0x94a7be01
xor eax, 0xa044abc0
rol eax, 0xec
popf
jmp 0x14018a00e
mov byte [rbx], al
inc rbx
lea rax, [rsp + 0x143f]
cmp rbx, rax
jb 0x14018a34a
push rax
pushf
mov eax, 0xb1bdf2cb
pushf
not eax
add eax, 0xe93e2756
xor eax, 0xadc18de1
rol eax, 0x3e
popf
pushf
not eax
add eax, 0x818145d6
xor eax, 0x96f0d77b
rol eax, 0x87
popf
jmp 0x14018a00e
push rax
pushf
mov eax, 0x5b7d3215
pushf
not eax
add eax, 0x928c1173
xor eax, 0xfcb03e15
rol eax, 0xdb
popf
pushf
not eax
add eax, 0xc9907603
xor eax, 0xd141ef3e
rol eax, 0xc0
popf
pushf
not eax
add eax, 0xdae8995f
xor eax, 0x88710798
rol eax, 0x4f
popf
jmp 0x14018a00e
and qword [rsp + 0x20], 0
lea rax, [rsp + 0x40]
sub ebx, eax
lea r9, [rsp + 0x30]
mov r8d, ebx
lea rdx, [rsp + 0x40]
mov rcx, r14
jmp 0x14018a3ae
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14018a3eb
push rax
pushf
mov eax, 0xac559dec
pushf
not eax
add eax, 0x99a4e791
xor eax, 0x855e7589
rol eax, 0xcd
popf
pushf
not eax
add eax, 0xf17e6f90
xor eax, 0xc9f8c34d
rol eax, 0xda
popf
jmp 0x14018a00e
push rax
pushf
mov eax, 0xa8f06c6c
pushf
not eax
add eax, 0xc5ca9253
xor eax, 0xf8740c18
rol eax, 0xd1
popf
pushf
not eax
add eax, 0xe62a83de
xor eax, 0x922dfa81
rol eax, 0x53
popf
jmp 0x14018a00e
mov eax, dword [rsp + 0x30]
add dword [rdi + 4], eax
cmp eax, ebx
jb 0x14018a482
push rax
pushf
mov eax, 0x24a08ed6
pushf
not eax
add eax, 0x92116dcc
xor eax, 0xd9e1d5be
rol eax, 0xa1
popf
pushf
not eax
add eax, 0x95a5d964
xor eax, 0xe4d923c9
rol eax, 0x26
popf
pushf
not eax
add eax, 0x9e516e70
xor eax, 0xf56481c9
rol eax, 0x45
popf
pushf
not eax
add eax, 0xf60f34db
xor eax, 0x86598e4c
rol eax, 0x87
popf
jmp 0x14018a00e
push rax
pushf
mov eax, 0x26c14f30
pushf
not eax
add eax, 0x91e47ae4
xor eax, 0x95dce7ac
rol eax, 0x1d
popf
pushf
not eax
add eax, 0xcf5bdb20
xor eax, 0xa333d453
rol eax, 0x69
popf
pushf
not eax
add eax, 0xd15bf6c2
xor eax, 0x96645414
rol eax, 0x52
popf
pushf
not eax
add eax, 0xdf8a516c
xor eax, 0xcf92f67b
rol eax, 0x7b
popf
jmp 0x14018a00e
cmp rsi, rbp
jb 0x14018a513
push rax
pushf
mov eax, 0xdcc08fc0
pushf
not eax
add eax, 0x89e7e63d
xor eax, 0xc1386dfc
rol eax, 0x66
popf
pushf
not eax
add eax, 0xb8f10676
xor eax, 0xb002265a
rol eax, 0x4b
popf
jmp 0x14018a00e
push rax
pushf
mov eax, 0xa8be6715
pushf
not eax
add eax, 0xea71fee6
xor eax, 0xf2a87933
rol eax, 0x13
popf
pushf
not eax
add eax, 0x9cb8ab73
xor eax, 0x8569ee96
rol eax, 0x48
popf
pushf
not eax
add eax, 0x8a6e5b2c
xor eax, 0x97725583
rol eax, 0x9d
popf
jmp 0x14018a00e
jmp 0x14018a5e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
push rax
pushf
mov eax, 0xbe3bd149
pushf
not eax
add eax, 0x8832f173
xor eax, 0xc7980929
rol eax, 0x79
popf
pushf
not eax
add eax, 0x827723b7
xor eax, 0x82514564
rol eax, 0xb0
popf
jmp 0x14018a00e
mov rax, rdi
mov rcx, qword [rsp + 0x1440]
xor rcx, rsp
call fcn.14027ae25
lea r11, [rsp + 0x1450]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret