Function at 0x14002d963
Capabilities:
Write file on windows

Disassembly:
push rax
pushf
mov eax, 0x62f2aeef
pushf
not eax
add eax, 0xada29259
xor eax, 0x819b5177
rol eax, 0x52
popf
pushf
not eax
add eax, 0x8cda8b95
xor eax, 0xd47f6f46
rol eax, 0xb6
popf
pushf
not eax
add eax, 0xae40dd62
xor eax, 0xf26fce03
rol eax, 0xe5
popf
pushf
not eax
add eax, 0x91a4144d
xor eax, 0xa740a975
rol eax, 0x88
popf
cmp eax, 4
jne 0x14002d9c6
popf
pop rax
jmp 0x14002dcbe
cmp eax, 0
jne 0x14002d9d5
popf
pop rax
jmp 0x14002da6b
cmp eax, 3
jne 0x14002d9e4
popf
pop rax
jmp 0x14002dc4e
cmp eax, 1
jne 0x14002d9f3
popf
pop rax
jmp 0x14002dbe7
cmp eax, 0xa
jne 0x14002da02
popf
pop rax
jmp 0x14002dfbf
cmp eax, 7
jne 0x14002da11
popf
pop rax
jmp 0x14002de84
cmp eax, 6
jne 0x14002da20
popf
pop rax
jmp 0x14002ddd1
cmp eax, 0xb
jne 0x14002da2f
popf
pop rax
jmp 0x14002e020
cmp eax, 9
jne 0x14002da3e
popf
pop rax
jmp 0x14002df73
cmp eax, 8
jne 0x14002da4d
popf
pop rax
jmp 0x14002df08
cmp eax, 5
jne 0x14002da5c
popf
pop rax
jmp 0x14002dd20
cmp eax, 2
jne 0x14002da6b
popf
pop rax
jmp 0x14002dc45
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
mov eax, 0xe12aa207
pushf
not eax
add eax, 0x91137ff9
xor eax, 0xdf150c50
rol eax, 0xfc
popf
pushf
not eax
add eax, 0xe46741b9
xor eax, 0x8e50e305
rol eax, 0xb0
popf
pushf
not eax
add eax, 0xb1638e45
xor eax, 0xb2c13b72
rol eax, 0x7a
popf
pushf
not eax
add eax, 0xe5913eeb
xor eax, 0xa7200d29
rol eax, 0xfa
popf
call fcn.140057e74
sub rsp, rax
mov rax, qword [0x140018008]
xor rax, rsp
mov qword [rsp + 0x1440], rax
movsxd r10, edx
mov rdi, rcx
mov rax, r10
mov ebp, r9d
sar rax, 6
lea rcx, [0x1a227a388]
pushf
sub rcx, 0x62260d08
popf
and r10d, 0x3f
push r8
not r8
sub rbp, r8
pop r8
sub rbp, 1
mov rsi, r8
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
mov r14, qword [rax + rdx*8 + 0x28]
xor eax, eax
mov qword [rdi], rax
mov dword [rdi + 8], eax
cmp r8, rbp
jae 0x14002db8e
push rax
pushf
mov eax, 0xe2d09a0c
pushf
not eax
add eax, 0xd788debe
xor eax, 0xa5ed44e4
rol eax, 0xcb
popf
pushf
not eax
add eax, 0xf6e94a3f
xor eax, 0xf64131fd
rol eax, 0x2e
popf
pushf
not eax
add eax, 0xa92a6877
xor eax, 0xb87cd1ac
rol eax, 0x40
popf
pushf
not eax
add eax, 0xd25ecd8f
xor eax, 0xcc53a1ad
rol eax, 0x6b
popf
jmp 0x14002d9b7
push rax
pushf
mov eax, 0x69162e06
pushf
not eax
add eax, 0xf3dfdfed
xor eax, 0xdca03858
rol eax, 0xed
popf
pushf
not eax
add eax, 0xa17c27af
xor eax, 0xd5423c38
rol eax, 0x2a
popf
pushf
not eax
add eax, 0xf72d1f05
xor eax, 0xbd6d118b
rol eax, 0xb9
popf
pushf
not eax
add eax, 0xa693df20
xor eax, 0xaf6255cc
rol eax, 0xc
popf
jmp 0x14002d9b7
lea rbx, [rsp + 0x40]
push rax
pushf
mov eax, 0xda7f5140
pushf
not eax
add eax, 0xdfaf4cfc
xor eax, 0xdfbf2746
rol eax, 0x5f
popf
pushf
not eax
add eax, 0x87ddc58c
xor eax, 0xfd1b568b
rol eax, 0x5c
popf
pushf
not eax
add eax, 0xc080c232
xor eax, 0xd6b1bbb3
rol eax, 0xbd
popf
pushf
not eax
add eax, 0xf72f03b4
xor eax, 0xa598787e
rol eax, 0x73
popf
jmp 0x14002d9b7
cmp rsi, rbp
jae 0x14002ddd1
mov al, byte [rsi]
inc rsi
cmp al, 0xa
jne 0x14002dc8a
push rax
pushf
mov eax, 0x9eb1e7dc
pushf
not eax
add eax, 0x8c2452ea
xor eax, 0xd06fd92d
rol eax, 0x5e
popf
pushf
not eax
add eax, 0x9c2be480
xor eax, 0xcce477f7
rol eax, 0x64
popf
jmp 0x14002d9b7
push rax
pushf
mov eax, 0xd8a13164
pushf
not eax
add eax, 0x8c128b55
xor eax, 0xffa2169c
rol eax, 0xfe
popf
pushf
not eax
add eax, 0xb1a4018e
xor eax, 0x9ecf2db2
rol eax, 0xeb
popf
jmp 0x14002d9b7
inc dword [rdi + 8]
mov byte [rbx], 0xd
inc rbx
push rax
pushf
mov eax, 0x6c4319c6
pushf
not eax
add eax, 0x8310db8f
xor eax, 0xf7a70e2b
rol eax, 0xc8
popf
pushf
not eax
add eax, 0xa69b42b0
xor eax, 0xca33a4f6
rol eax, 0xa1
popf
pushf
not eax
add eax, 0xcd3846a7
xor eax, 0xaa660de4
rol eax, 0x53
popf
pushf
not eax
add eax, 0xc6c831da
xor eax, 0xc83418d7
rol eax, 0x6f
popf
jmp 0x14002d9b7
mov byte [rbx], al
inc rbx
lea rax, [rsp + 0x143f]
cmp rbx, rax
jb 0x14002dd78
push rax
pushf
mov eax, 0xadf7aa8c
pushf
not eax
add eax, 0xa38d9b06
xor eax, 0xc60b3e63
rol eax, 0xd9
popf
pushf
not eax
add eax, 0xc854526d
xor eax, 0x88bdad69
rol eax, 0xee
popf
pushf
not eax
add eax, 0xd2581a28
xor eax, 0xa3e9e353
rol eax, 0x55
popf
jmp 0x14002d9b7
push rax
pushf
mov eax, 0x237fb107
pushf
not eax
add eax, 0xcee84841
xor eax, 0x8be84ec3
rol eax, 0xce
popf
pushf
not eax
add eax, 0xabe03c23
xor eax, 0xfae7debb
rol eax, 0x98
popf
pushf
not eax
add eax, 0xb688d37c
xor eax, 0x8c225ad9
rol eax, 0x9e
popf
pushf
not eax
add eax, 0xa08638bf
xor eax, 0xa44f72cc
rol eax, 4
popf
jmp 0x14002d9b7
and qword [rsp + 0x20], 0
lea rax, [rsp + 0x40]
sub ebx, eax
lea r9, [rsp + 0x30]
mov r8d, ebx
lea rdx, [rsp + 0x40]
mov rcx, r14
jmp 0x14002ddef
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14002de51
push rax
pushf
mov eax, 0x9d6d92f
pushf
not eax
add eax, 0xd8b57be4
xor eax, 0xc8b5b012
rol eax, 0xa7
popf
pushf
not eax
add eax, 0x90506838
xor eax, 0x864d6236
rol eax, 0x15
popf
pushf
not eax
add eax, 0xce147c8b
xor eax, 0xeeaead14
rol eax, 1
popf
pushf
not eax
add eax, 0x892edb1a
xor eax, 0x830252c9
rol eax, 0xb6
popf
jmp 0x14002d9b7
push rax
pushf
mov eax, 0x20cef9a5
pushf
not eax
add eax, 0x8698cadb
xor eax, 0x8e31ce23
rol eax, 0x75
popf
pushf
not eax
add eax, 0x90fcf93c
xor eax, 0xae1f7a68
rol eax, 0xbd
popf
jmp 0x14002d9b7
mov eax, dword [rsp + 0x30]
add dword [rdi + 4], eax
cmp eax, ebx
jb 0x14002dec2
push rax
pushf
mov eax, 0x3532e1ae
pushf
not eax
add eax, 0x989e46d6
xor eax, 0xc5cd2f09
rol eax, 0x35
popf
pushf
not eax
add eax, 0xee5ef95a
xor eax, 0xa88aa490
rol eax, 0xb4
popf
jmp 0x14002d9b7
push rax
pushf
mov eax, 0xee3d0e4e
pushf
not eax
add eax, 0xb47212cc
xor eax, 0xff56104f
rol eax, 0xd7
popf
pushf
not eax
add eax, 0xf05ecca2
xor eax, 0xbc48eb29
rol eax, 0xf7
popf
pushf
not eax
add eax, 0xf8d5ab8b
xor eax, 0xd9f82612
rol eax, 0xd
popf
jmp 0x14002d9b7
cmp rsi, rbp
jb 0x14002df40
push rax
pushf
mov eax, 0xb1839fea
pushf
not eax
add eax, 0xdaf83b20
xor eax, 0xcbbb6277
rol eax, 0x32
popf
pushf
not eax
add eax, 0xbdcd5285
xor eax, 0xd8c1e345
rol eax, 0x16
popf
jmp 0x14002d9b7
push rax
pushf
mov eax, 0x50284e2f
pushf
not eax
add eax, 0xe09429fa
xor eax, 0x90478d0e
rol eax, 0xb8
popf
pushf
not eax
add eax, 0x87588d32
xor eax, 0xc3d860db
rol eax, 9
popf
jmp 0x14002d9b7
jmp 0x14002e020
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
push rax
pushf
mov eax, 0xf4ea8672
pushf
not eax
add eax, 0xcf300ca6
xor eax, 0xee8be129
rol eax, 0xed
popf
pushf
not eax
add eax, 0x94944384
xor eax, 0xa47885c4
rol eax, 0x3b
popf
pushf
not eax
add eax, 0xd63f9208
xor eax, 0x9fbb8bc0
rol eax, 0xac
popf
pushf
not eax
add eax, 0xaab86e5c
xor eax, 0xfe591e92
rol eax, 0x93
popf
jmp 0x14002d9b7
mov rax, rdi
mov rcx, qword [rsp + 0x1440]
xor rcx, rsp
call fcn.140053af8
lea r11, [rsp + 0x1450]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret