Function at 0x1400b2517
Capabilities:
Write file on windows

Disassembly:
push rax
pushf
mov eax, 0x681ba58a
pushf
not eax
add eax, 0x5ff20e7c
xor eax, 0x2344cc5a
rol eax, 0x35
popf
pushf
not eax
add eax, 0x1f4dcc2d
xor eax, 0x2b11c14e
rol eax, 0x1b
popf
pushf
not eax
add eax, 0x42fac39c
xor eax, 0x3d08d15a
rol eax, 0x2e
popf
pushf
not eax
add eax, 0x2ec337d1
xor eax, 0x101fcb95
rol eax, 0x83
popf
cmp eax, 7
jne 0x1400b257a
popf
pop rax
jmp 0x1400b2a8f
cmp eax, 1
jne 0x1400b2589
popf
pop rax
jmp 0x1400b2775
cmp eax, 4
jne 0x1400b2598
popf
pop rax
jmp 0x1400b28e7
cmp eax, 5
jne 0x1400b25a7
popf
pop rax
jmp 0x1400b2936
cmp eax, 0
jne 0x1400b25b6
popf
pop rax
jmp 0x1400b261f
cmp eax, 0xa
jne 0x1400b25c5
popf
pop rax
jmp 0x1400b2c16
cmp eax, 3
jne 0x1400b25d4
popf
pop rax
jmp 0x1400b2851
cmp eax, 0xb
jne 0x1400b25e3
popf
pop rax
jmp 0x1400b2c51
cmp eax, 2
jne 0x1400b25f2
popf
pop rax
jmp 0x1400b27d3
cmp eax, 6
jne 0x1400b2601
popf
pop rax
jmp 0x1400b29d4
cmp eax, 8
jne 0x1400b2610
popf
pop rax
jmp 0x1400b2b26
cmp eax, 9
jne 0x1400b261f
popf
pop rax
jmp 0x1400b2bb7
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
mov eax, 0xad2ecb4f
pushf
not eax
add eax, 0x217ce409
xor eax, 0x17009a23
rol eax, 0x8f
popf
pushf
not eax
add eax, 0x212a665a
xor eax, 0x1d959680
rol eax, 0xb4
popf
pushf
not eax
add eax, 0x733a12ab
xor eax, 0x5287ee20
rol eax, 0xf3
popf
call fcn.1400a9a64
sub rsp, rax
mov rax, qword [0x14002d7c0]
xor rax, rsp
mov qword [rsp + 0x1440], rax
movsxd r10, edx
mov rdi, rcx
mov rax, r10
mov ebp, r9d
sar rax, 6
lea rcx, [0x1953f2dfe]
pushf
sub rcx, 0x553c37ee
popf
and r10d, 0x3f
push r8
not r8
sub rbp, r8
pop r8
sub rbp, 1
mov rsi, r8
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
mov r14, qword [rax + rdx*8 + 0x28]
xor eax, eax
mov qword [rdi], rax
mov dword [rdi + 8], eax
cmp r8, rbp
jae 0x1400b271c
push rax
pushf
mov eax, 0xf1c27fe8
pushf
not eax
add eax, 0x66b42613
xor eax, 0x2272ca10
rol eax, 0x88
popf
pushf
not eax
add eax, 0x1b3f993f
xor eax, 0xfa79913
rol eax, 0x16
popf
pushf
not eax
add eax, 0x19cb0d4a
xor eax, 0x1ae47018
rol eax, 0x51
popf
jmp 0x1400b256b
push rax
pushf
mov eax, 0xa5834fb5
pushf
not eax
add eax, 0x464bdba8
xor eax, 0x15b336bf
rol eax, 0x2a
popf
pushf
not eax
add eax, 0x4708a95
xor eax, 0x7b0d0af6
rol eax, 0xdc
popf
pushf
not eax
add eax, 0x57ed9fa0
xor eax, 0x29049e48
rol eax, 0x41
popf
pushf
not eax
add eax, 0x47ce183d
xor eax, 0x77c8cf05
rol eax, 0x3c
popf
jmp 0x1400b256b
lea rbx, [rsp + 0x40]
push rax
pushf
mov eax, 0x7b4bbec
pushf
not eax
add eax, 0x4987500b
xor eax, 0x5a290290
rol eax, 0xbf
popf
pushf
not eax
add eax, 0x6de8f555
xor eax, 0x17ef4d23
rol eax, 0xd9
popf
pushf
not eax
add eax, 0x28b6084c
xor eax, 0x195e09aa
rol eax, 0x8b
popf
pushf
not eax
add eax, 0x2774b04c
xor eax, 0x47bcf1a0
rol eax, 0x51
popf
jmp 0x1400b256b
cmp rsi, rbp
jae 0x1400b280b
push rax
pushf
mov eax, 0xcf93d6bb
pushf
not eax
add eax, 0x1cbe12c
xor eax, 0x387aef09
rol eax, 0x45
popf
pushf
not eax
add eax, 0x4b72c2f3
xor eax, 0x31623d1
rol eax, 0x74
popf
jmp 0x1400b256b
push rax
pushf
mov eax, 0x8608a1c9
pushf
not eax
add eax, 0xb3ccea4
xor eax, 0x337a15c1
rol eax, 0x98
popf
pushf
not eax
add eax, 0xb05eb49
xor eax, 0x930750b
rol eax, 0xcb
popf
pushf
not eax
add eax, 0x422b7378
xor eax, 0x42eb4c74
rol eax, 0x1d
popf
jmp 0x1400b256b
mov al, byte [rsi]
inc rsi
cmp al, 0xa
jne 0x1400b288d
push rax
pushf
mov eax, 0x45b426b2
pushf
not eax
add eax, 0x5d579b29
xor eax, 0x1a03c361
rol eax, 0x64
popf
pushf
not eax
add eax, 0x371b949b
xor eax, 0x5910232a
rol eax, 0x28
popf
jmp 0x1400b256b
push rax
pushf
mov eax, 0x59a197ed
pushf
not eax
add eax, 0x48d8384
xor eax, 0x551864da
rol eax, 0x99
popf
pushf
not eax
add eax, 0x1c4f1d4a
xor eax, 0x4388d691
rol eax, 0xb2
popf
pushf
not eax
add eax, 0x25b5907b
xor eax, 0x2f46ebb5
rol eax, 0xf4
popf
pushf
not eax
add eax, 0x738d14aa
xor eax, 0x44a43aa3
rol eax, 0xda
popf
jmp 0x1400b256b
inc dword [rdi + 8]
mov byte [rbx], reloc.Cabinet.dll_FCIFlushCabinet
inc rbx
push rax
pushf
mov eax, 0x5b08f8ee
pushf
not eax
add eax, 0x23302d4a
xor eax, 0x1bf08c03
rol eax, 0xd4
popf
pushf
not eax
add eax, 0x7503fc74
xor eax, 0x18e13858
rol eax, 0x49
popf
pushf
not eax
add eax, 0x7e4a090f
xor eax, 0x4dbcc71f
rol eax, 0x69
popf
jmp 0x1400b256b
mov byte [rbx], al
inc rbx
lea rax, [rsp + 0x143f]
cmp rbx, rax
jb 0x1400b297b
push rax
pushf
mov eax, 0x976e977a
pushf
not eax
add eax, 0xef12cec
xor eax, 0x3e17e5b1
rol eax, 0x29
popf
pushf
not eax
add eax, 0x78f1e008
xor eax, 0x4e105ef4
rol eax, 0x9a
popf
jmp 0x1400b256b
push rax
pushf
mov eax, 0x28218be9
pushf
not eax
add eax, 0x26e3f9df
xor eax, 0x68a7ead0
rol eax, 0x5b
popf
pushf
not eax
add eax, 0x318c4e29
xor eax, 0x131a736a
rol eax, 0x12
popf
pushf
not eax
add eax, 0x2ad8a6c9
xor eax, 0x75200524
rol eax, 0x88
popf
pushf
not eax
add eax, 0x51be522a
xor eax, 0x7d7bb294
rol eax, 0x25
popf
jmp 0x1400b256b
and qword [rsp + 0x20], 0
lea rax, [rsp + 0x40]
push rax
not eax
add ebx, eax
pop rax
add ebx, 1
lea r9, [rsp + 0x30]
mov r8d, ebx
lea rdx, [rsp + 0x40]
mov rcx, r14
jmp 0x1400b29f9
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400b2a5c
push rax
pushf
mov eax, 0x568d0bba
pushf
not eax
add eax, 0x43dfa80a
xor eax, 0x43bf3e89
rol eax, 0xf
popf
pushf
not eax
add eax, 0x430402bc
xor eax, 0x22340fd4
rol eax, 0x72
popf
pushf
not eax
add eax, 0x10e31bd4
xor eax, 0x70621c77
rol eax, 0x8f
popf
pushf
not eax
add eax, 0x5be38032
xor eax, 0x72ef78b2
rol eax, 0xd0
popf
jmp 0x1400b256b
push rax
pushf
mov eax, 0x42237e72
pushf
not eax
add eax, 0x6c629e5f
xor eax, 0x533a92f4
rol eax, 0xcd
popf
pushf
not eax
add eax, 0x12f760c8
xor eax, 0x615451a2
rol eax, 0x81
popf
jmp 0x1400b256b
mov eax, dword [rsp + 0x30]
add dword [rdi + 4], eax
cmp eax, ebx
jb 0x1400b2ae0
push rax
pushf
mov eax, 0xecdd8feb
pushf
not eax
add eax, 0x2c2396d7
xor eax, 0x7cfbeeda
rol eax, 0xe5
popf
pushf
not eax
add eax, 0x6ba9f045
xor eax, 0x39914e81
rol eax, 0x91
popf
pushf
not eax
add eax, 0x57a340c5
xor eax, 0xe67ebc9
rol eax, 0x55
popf
jmp 0x1400b256b
push rax
pushf
mov eax, 0x3926f71
pushf
not eax
add eax, 0x4890ed2d
xor eax, 0x542b45a9
rol eax, 0xda
popf
pushf
not eax
add eax, 0x6e1c993f
xor eax, 0x4da0a2eb
rol eax, 0xad
popf
pushf
not eax
add eax, 0x7305e7bc
xor eax, 0x362f3aba
rol eax, 0xff
popf
jmp 0x1400b256b
cmp rsi, rbp
jb 0x1400b2b84
push rax
pushf
mov eax, 0xc0415cbf
pushf
not eax
add eax, 0x746614c4
xor eax, 0x7f8a8c2e
rol eax, 0x67
popf
pushf
not eax
add eax, 0x1247b334
xor eax, 0x14cf4595
rol eax, 0xc2
popf
pushf
not eax
add eax, 0x7d714262
xor eax, 0x7fec089c
rol eax, 0x4f
popf
pushf
not eax
add eax, 0x6ea86d85
xor eax, 0x7ef38c80
rol eax, 0xc9
popf
jmp 0x1400b256b
push rax
pushf
mov eax, 0xe78f2b56
pushf
not eax
add eax, 0x252f2243
xor eax, 0x18deca38
rol eax, 0xe2
popf
pushf
not eax
add eax, 0x68985548
xor eax, 0x539361f7
rol eax, 0xc1
popf
jmp 0x1400b256b
jmp 0x1400b2c51
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
push rax
pushf
mov eax, 0x23e2e464
pushf
not eax
add eax, 0x53511bf8
xor eax, 0x4fe1dc22
rol eax, 0x67
popf
pushf
not eax
add eax, 0xf37b16f
xor eax, 0x4741d8bb
rol eax, 0xc1
popf
jmp 0x1400b256b
mov rax, rdi
mov rcx, qword [rsp + 0x1440]
xor rcx, rsp
call fcn.1400a9158
lea r11, [rsp + 0x1450]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret