Function at 0x140096bdd
Capabilities:
Write file on windows

Disassembly:
push rax
pushf
mov eax, 0x7f134886
pushf
not eax
add eax, 0xd6cc1e91
xor eax, 0xa2111f8b
rol eax, 0x7f
popf
pushf
not eax
add eax, 0x9a34ae24
xor eax, 0xeb299e1c
rol eax, 0x9d
popf
pushf
not eax
add eax, 0xaeab07f6
xor eax, 0xc01c3d06
rol eax, 0x88
popf
cmp eax, 4
jne 0x140096c2d
popf
pop rax
jmp 0x140096f25
cmp eax, 0
jne 0x140096c3c
popf
pop rax
jmp 0x140096cd2
cmp eax, 3
jne 0x140096c4b
popf
pop rax
jmp 0x140096e7c
cmp eax, 1
jne 0x140096c5a
popf
pop rax
jmp 0x140096e3b
cmp eax, 0xa
jne 0x140096c69
popf
pop rax
jmp 0x140097224
cmp eax, 7
jne 0x140096c78
popf
pop rax
jmp 0x1400970d9
cmp eax, 6
jne 0x140096c87
popf
pop rax
jmp 0x140097012
cmp eax, 0xb
jne 0x140096c96
popf
pop rax
jmp 0x14009725f
cmp eax, 9
jne 0x140096ca5
popf
pop rax
jmp 0x1400971ee
cmp eax, 8
jne 0x140096cb4
popf
pop rax
jmp 0x14009715d
cmp eax, 5
jne 0x140096cc3
popf
pop rax
jmp 0x140096f87
cmp eax, 2
jne 0x140096cd2
popf
pop rax
jmp 0x140096e73
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
mov eax, 0x68ab2fdc
pushf
not eax
add eax, 0xb144f2f8
xor eax, 0x9beae754
rol eax, 0x7c
popf
pushf
not eax
add eax, 0xef667f90
xor eax, 0xa4a0ede7
rol eax, 0x4f
popf
pushf
not eax
add eax, 0xefb16bc0
xor eax, 0xfa01932a
rol eax, 0xd6
popf
pushf
not eax
add eax, 0xb4282822
xor eax, 0xdf3f916d
rol eax, 0x96
popf
call fcn.1401399f7
sub rsp, rax
mov rax, qword [0x14004b090]
xor rax, rsp
mov qword [rsp + 0x1440], rax
movsxd r10, edx
mov rdi, rcx
mov rax, r10
mov ebp, r9d
sar rax, 6
lea rcx, [0x1b0844f21]
pushf
sub rcx, 0x707f7541
popf
and r10d, 0x3f
push r8
not r8
sub rbp, r8
pop r8
sub rbp, 1
mov rsi, r8
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
mov r14, qword [rax + rdx*8 + 0x28]
xor eax, eax
mov qword [rdi], rax
mov dword [rdi + 8], eax
cmp r8, rbp
jae 0x140096df5
push rax
pushf
mov eax, 0x5825f152
pushf
not eax
add eax, 0xa0f50aa7
xor eax, 0xd34d0ced
rol eax, 0xed
popf
pushf
not eax
add eax, 0x895ed704
xor eax, 0xe832be73
rol eax, 0xb0
popf
pushf
not eax
add eax, 0xde219ecc
xor eax, 0xeae407f9
rol eax, 0x12
popf
pushf
not eax
add eax, 0x9363252a
xor eax, 0xb4267ab6
rol eax, 0x3b
popf
jmp 0x140096c1e
push rax
pushf
mov eax, 0xb59ee31a
pushf
not eax
add eax, 0xee26ba86
xor eax, 0xf304595a
rol eax, 0x97
popf
pushf
not eax
add eax, 0xe279877e
xor eax, 0xb8e937b9
rol eax, 0xdd
popf
pushf
not eax
add eax, 0xe0aa1f05
xor eax, 0xde7ac0c3
rol eax, 0x66
popf
jmp 0x140096c1e
lea rbx, [rsp + 0x40]
push rax
pushf
mov eax, 0xebffdb03
pushf
not eax
add eax, 0xa0a6fb5b
xor eax, 0xb4a31de7
rol eax, 0xb9
popf
pushf
not eax
add eax, 0xf6ef934a
xor eax, 0x96ee8ace
rol eax, 0x31
popf
jmp 0x140096c1e
cmp rsi, rbp
jae 0x140097012
mov al, byte [rsi]
inc rsi
cmp al, 0xa
jne 0x140096ede
push rax
pushf
mov eax, 0x25a2de1
pushf
not eax
add eax, 0xf99f6d58
xor eax, 0xf043b2fa
rol eax, 0x4f
popf
pushf
not eax
add eax, 0xa84ed07a
xor eax, 0xe6a8d28f
rol eax, 0x99
popf
pushf
not eax
add eax, 0x9f844bd1
xor eax, 0xb2883fdf
rol eax, 0xf6
popf
pushf
not eax
add eax, 0xa63a19cf
xor eax, 0x97725a41
rol eax, 0x68
popf
jmp 0x140096c1e
push rax
pushf
mov eax, 0xbeb74c1b
pushf
not eax
add eax, 0xaf60a6a4
xor eax, 0x9a47fe86
rol eax, 0xb9
popf
pushf
not eax
add eax, 0xa928e3df
xor eax, 0x97b4ecd9
rol eax, 0x5b
popf
pushf
not eax
add eax, 0xfe49871c
xor eax, 0x856a4689
rol eax, 0x9a
popf
jmp 0x140096c1e
inc dword [rdi + 8]
mov byte [rbx], 0xd
inc rbx
push rax
pushf
mov eax, 0x1fa44793
pushf
not eax
add eax, 0xfd8e6a0d
xor eax, 0xd0b581d0
rol eax, 0xd0
popf
pushf
not eax
add eax, 0x849582dc
xor eax, 0xaa9fa6ad
rol eax, 0x20
popf
pushf
not eax
add eax, 0xb4cbd08a
xor eax, 0xacd4de69
rol eax, 0x60
popf
pushf
not eax
add eax, 0xb96585c0
xor eax, 0xf2e862ee
rol eax, 0xaf
popf
jmp 0x140096c1e
mov byte [rbx], al
inc rbx
lea rax, [rsp + 0x143f]
cmp rbx, rax
jb 0x140096fdf
push rax
pushf
mov eax, 0xc2aa68d7
pushf
not eax
add eax, 0xa33a4041
xor eax, 0xb86cb23a
rol eax, 0xd7
popf
pushf
not eax
add eax, 0x871dd09b
xor eax, 0xf48e9bf2
rol eax, 0x99
popf
pushf
not eax
add eax, 0xfe9586ec
xor eax, 0xca400761
rol eax, 0xf2
popf
jmp 0x140096c1e
push rax
pushf
mov eax, 0xce5c6f54
pushf
not eax
add eax, 0x98196ce0
xor eax, 0x9a6546b2
rol eax, 0x26
popf
pushf
not eax
add eax, 0x8620e650
xor eax, 0x8fb237fb
rol eax, 0xf4
popf
jmp 0x140096c1e
and qword [rsp + 0x20], 0
lea rax, [rsp + 0x40]
sub ebx, eax
lea r9, [rsp + 0x30]
mov r8d, ebx
lea rdx, [rsp + 0x40]
mov rcx, r14
jmp 0x140097030
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140097080
push rax
pushf
mov eax, 0x7174d683
pushf
not eax
add eax, 0xccf00e5c
xor eax, 0xb9981e01
rol eax, 0xf8
popf
pushf
not eax
add eax, 0x84a3dc94
xor eax, 0xcd9204e4
rol eax, 0x13
popf
pushf
not eax
add eax, 0xd075933f
xor eax, 0xe40258d7
rol eax, 0x5c
popf
jmp 0x140096c1e
push rax
pushf
mov eax, 0xeae265e9
pushf
not eax
add eax, 0x8f5da42c
xor eax, 0x94225e06
rol eax, 0xfc
popf
pushf
not eax
add eax, 0xf0414092
xor eax, 0xa56c6fdb
rol eax, 0x19
popf
pushf
not eax
add eax, 0xc9646cdb
xor eax, 0xb5bb1b0d
rol eax, 0x3c
popf
pushf
not eax
add eax, 0xc27a5294
xor eax, 0xe7ebcaae
rol eax, 0x3a
popf
jmp 0x140096c1e
mov eax, dword [rsp + 0x30]
add dword [rdi + 4], eax
cmp eax, ebx
jb 0x14009712a
push rax
pushf
mov eax, 0x5f18416b
pushf
not eax
add eax, 0xf863606b
xor eax, 0xf48d80cb
rol eax, 0xca
popf
pushf
not eax
add eax, 0xb6d731da
xor eax, 0xa8576722
rol eax, 0x2d
popf
pushf
not eax
add eax, 0xe427a9fe
xor eax, 0xc367a37c
rol eax, 0xe
popf
jmp 0x140096c1e
push rax
pushf
mov eax, 0x4d31e165
pushf
not eax
add eax, 0xaadf577f
xor eax, 0xca87c2c9
rol eax, 0xc1
popf
pushf
not eax
add eax, 0xd8faf78e
xor eax, 0xaaa5d5ec
rol eax, 0xb5
popf
jmp 0x140096c1e
cmp rsi, rbp
jb 0x140097195
push rax
pushf
mov eax, 0xb7bcd225
pushf
not eax
add eax, 0xfc4c3637
xor eax, 0xaa3c8aba
rol eax, 0x1c
popf
pushf
not eax
add eax, 0x98f0be20
xor eax, 0x92057f35
rol eax, 0x45
popf
jmp 0x140096c1e
push rax
pushf
mov eax, 0x4eaa8f86
pushf
not eax
add eax, 0xaa8ba4de
xor eax, 0xf315a2d1
rol eax, 5
popf
pushf
not eax
add eax, 0xb98deef1
xor eax, 0xc8a6acb4
rol eax, 0xa4
popf
pushf
not eax
add eax, 0x8fdc6a13
xor eax, 0xbc91bce6
rol eax, 0x8d
popf
pushf
not eax
add eax, 0xac96a4bf
xor eax, 0xdc17a9f6
rol eax, 0x51
popf
jmp 0x140096c1e
jmp 0x14009725f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
push rax
pushf
mov eax, 0x5e62552e
pushf
not eax
add eax, 0xe45de9a2
xor eax, 0xed123f79
rol eax, 0x45
popf
pushf
not eax
add eax, 0xd6078f1d
xor eax, 0xba122dcf
rol eax, 0x4a
popf
jmp 0x140096c1e
mov rax, rdi
mov rcx, qword [rsp + 0x1440]
xor rcx, rsp
call fcn.14012cd5d
lea r11, [rsp + 0x1450]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret