Function at 0x140af3832
Capabilities:
Write file on windows

Disassembly:
push rax
pushf
mov eax, 0xf2fd062f
pushf
not eax
add eax, 0xb941dd05
xor eax, 0xee03ad0e
rol eax, 0xf8
popf
pushf
not eax
add eax, 0x84de21e1
xor eax, 0xd4d8829a
rol eax, 0xa7
popf
pushf
not eax
add eax, 0xc78603ba
xor eax, 0xf5efffee
rol eax, 0x81
popf
pushf
not eax
add eax, 0xa95ce191
xor eax, 0xdeefe965
rol eax, 0x4b
popf
cmp eax, 4
jne 0x140af3895
popf
pop rax
jmp 0x140af3b6e
cmp eax, 0
jne 0x140af38a4
popf
pop rax
jmp 0x140af393a
cmp eax, 3
jne 0x140af38b3
popf
pop rax
jmp 0x140af3ad5
cmp eax, 1
jne 0x140af38c2
popf
pop rax
jmp 0x140af3a81
cmp eax, 0xa
jne 0x140af38d1
popf
pop rax
jmp 0x140af3eab
cmp eax, 7
jne 0x140af38e0
popf
pop rax
jmp 0x140af3d4a
cmp eax, 6
jne 0x140af38ef
popf
pop rax
jmp 0x140af3c90
cmp eax, 0xb
jne 0x140af38fe
popf
pop rax
jmp 0x140af3f0c
cmp eax, 9
jne 0x140af390d
popf
pop rax
jmp 0x140af3e4c
cmp eax, 8
jne 0x140af391c
popf
pop rax
jmp 0x140af3de1
cmp eax, 5
jne 0x140af392b
popf
pop rax
jmp 0x140af3bf0
cmp eax, 2
jne 0x140af393a
popf
pop rax
jmp 0x140af3acc
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
mov eax, 0xa0d5758b
pushf
not eax
add eax, 0xf157b307
xor eax, 0x9dadda64
rol eax, 0x27
popf
pushf
not eax
add eax, 0xca3e9969
xor eax, 0xb7098174
rol eax, 0xd7
popf
pushf
not eax
add eax, 0xbe3b97e9
xor eax, 0xbea14503
rol eax, 0xdf
popf
pushf
not eax
add eax, 0xf1b15f2a
xor eax, 0xf38487dc
rol eax, 0x63
popf
call fcn.140b242f9
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1440], rax
movsxd r10, edx
mov rdi, rcx
mov rax, r10
mov ebp, r9d
sar rax, 6
lea rcx, [0x1ad05d7b3]
pushf
sub rcx, 0x6caed253
popf
and r10d, 0x3f
push r8
not r8
sub rbp, r8
pop r8
sub rbp, 1
mov rsi, r8
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
mov r14, qword [rax + rdx*8 + 0x28]
xor eax, eax
mov qword [rdi], rax
mov dword [rdi + 8], eax
cmp r8, rbp
jae 0x140af3a3b
push rax
pushf
mov eax, 0x5deac8b6
pushf
not eax
add eax, 0xdab9be8c
xor eax, 0xa02ddf6b
rol eax, 0x70
popf
pushf
not eax
add eax, 0xc50b7c9b
xor eax, 0x924c9fb7
rol eax, 0x65
popf
jmp 0x140af3886
push rax
pushf
mov eax, 0x90eb8652
pushf
not eax
add eax, 0xc89fd8f3
xor eax, 0x8cb8e85f
rol eax, 0x7e
popf
pushf
not eax
add eax, 0xbbd32887
xor eax, 0xf5a4edfa
rol eax, 0x1f
popf
pushf
not eax
add eax, 0x8465b7d9
xor eax, 0xe8103bba
rol eax, 0x97
popf
jmp 0x140af3886
lea rbx, [rsp + 0x40]
push rax
pushf
mov eax, 0x7a10541b
pushf
not eax
add eax, 0x923cef63
xor eax, 0x8b6b1a65
rol eax, 0x35
popf
pushf
not eax
add eax, 0xf2413ae8
xor eax, 0xe24d0ea0
rol eax, 7
popf
pushf
not eax
add eax, 0xbac440d3
xor eax, 0xe8d49539
rol eax, 0xe0
popf
jmp 0x140af3886
cmp rsi, rbp
jae 0x140af3c90
movzx eax, word [rsi]
add rsi, 2
cmp ax, 0xa
jne 0x140af3b28
push rax
pushf
mov eax, 0x3ae92647
pushf
not eax
add eax, 0x9d13fb5d
xor eax, 0x9479f97d
rol eax, 0x33
popf
pushf
not eax
add eax, 0xe9e7b470
xor eax, 0xe6c0b975
rol eax, 0x2b
popf
pushf
not eax
add eax, 0xd998b911
xor eax, 0xd3d39a0d
rol eax, 0xd8
popf
jmp 0x140af3886
push rax
pushf
mov eax, 0x7d94149e
pushf
not eax
add eax, 0xf7f6628b
xor eax, 0xbb481951
rol eax, 0x2f
popf
pushf
not eax
add eax, 0xd2ee1f1a
xor eax, 0x85ac3d9c
rol eax, 0x28
popf
pushf
not eax
add eax, 0xacdb5227
xor eax, 0x89d869f9
rol eax, 0x14
popf
jmp 0x140af3886
add dword [rdi + 8], 2
mov ecx, 0x28678c85
pushf
not ecx
add ecx, 0xbf9c0c1b
xor ecx, 0xa4668c72
rol ecx, 0x17
popf
pushf
not ecx
add ecx, 0x91de3f3c
xor ecx, 0x80444ef1
rol ecx, 0xf4
popf
pushf
not ecx
add ecx, 0x83aa41cc
xor ecx, 0xd078601e
rol ecx, 0x3b
popf
mov word [rbx], cx
add rbx, 2
push rax
pushf
mov eax, 0x8ed74353
pushf
not eax
add eax, 0xee5d2476
xor eax, 0xd916de31
rol eax, 0x7e
popf
pushf
not eax
add eax, 0x94de8750
xor eax, 0xb339b50b
rol eax, 0xf9
popf
jmp 0x140af3886
mov word [rbx], ax
add rbx, 2
lea rax, [rsp + 0x143e]
cmp rbx, rax
jb 0x140af3c37
push rax
pushf
mov eax, 0xd8124e9f
pushf
not eax
add eax, 0x9beabd9f
xor eax, 0xb2068ba6
rol eax, 8
popf
pushf
not eax
add eax, 0xa779f3b1
xor eax, 0xc8f49a3f
rol eax, 0xc
popf
jmp 0x140af3886
push rax
pushf
mov eax, 0x54d76545
pushf
not eax
add eax, 0x8dc44859
xor eax, 0x88ab9001
rol eax, 0xe5
popf
pushf
not eax
add eax, 0x9c3f724f
xor eax, 0xaaf5462f
rol eax, 0xe2
popf
pushf
not eax
add eax, 0xf413a75b
xor eax, 0xe30a196f
rol eax, 0x9c
popf
pushf
not eax
add eax, 0xac3af80d
xor eax, 0x8d52f1a3
rol eax, 0x92
popf
jmp 0x140af3886
and qword [rsp + 0x20], 0
lea rax, [rsp + 0x40]
sub rbx, rax
lea r9, [rsp + 0x30]
sar rbx, 1
lea rdx, [rsp + 0x40]
add ebx, ebx
mov rcx, r14
mov r8d, ebx
jmp 0x140af3cb4
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140af3d04
push rax
pushf
mov eax, 0x96db3bb
pushf
not eax
add eax, 0xa1ee1091
xor eax, 0xcdb591b0
rol eax, 0xd2
popf
pushf
not eax
add eax, 0xd119da43
xor eax, 0x819c2c37
rol eax, 0x23
popf
pushf
not eax
add eax, 0xbd5f1ed2
xor eax, 0xec99d381
rol eax, 0xfc
popf
jmp 0x140af3886
push rax
pushf
mov eax, 0x604c9b94
pushf
not eax
add eax, 0xc37440b0
xor eax, 0x95306c74
rol eax, 0x20
popf
pushf
not eax
add eax, 0xf28a5a2b
xor eax, 0x8972b42d
rol eax, 0x6f
popf
pushf
not eax
add eax, 0xeb7b8017
xor eax, 0xdbb04596
rol eax, 0x2a
popf
jmp 0x140af3886
mov eax, dword [rsp + 0x30]
add dword [rdi + 4], eax
cmp eax, ebx
jb 0x140af3d9b
push rax
pushf
mov eax, 0x8349fea
pushf
not eax
add eax, 0x906fa6a9
xor eax, 0xe98fadd9
rol eax, 0xa7
popf
pushf
not eax
add eax, 0x8c9a1e24
xor eax, 0xed637d5d
rol eax, 0x13
popf
pushf
not eax
add eax, 0x84a4e4c7
xor eax, 0xcb31ebce
rol eax, 0xdd
popf
jmp 0x140af3886
push rax
pushf
mov eax, 0xa232348f
pushf
not eax
add eax, 0xb0fa72bd
xor eax, 0xfbb239b8
rol eax, 0x4e
popf
pushf
not eax
add eax, 0x8f31ff83
xor eax, 0xbcf4e40a
rol eax, 0x68
popf
pushf
not eax
add eax, 0x921fc040
xor eax, 0xd9b9913e
rol eax, 0x7c
popf
jmp 0x140af3886
cmp rsi, rbp
jb 0x140af3e19
push rax
pushf
mov eax, 0xf80f2200
pushf
not eax
add eax, 0xd8cc7523
xor eax, 0x9df67368
rol eax, 0x64
popf
pushf
not eax
add eax, 0x8ee05844
xor eax, 0xf22e539c
rol eax, 0xc5
popf
jmp 0x140af3886
push rax
pushf
mov eax, 0x3a31291d
pushf
not eax
add eax, 0xb3b278fa
xor eax, 0xa556fd21
rol eax, 0x70
popf
pushf
not eax
add eax, 0x9a526c80
xor eax, 0xe3548fa8
rol eax, 0xa6
popf
jmp 0x140af3886
jmp 0x140af3f0c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
push rax
pushf
mov eax, 0xce4c6c3b
pushf
not eax
add eax, 0xb83e9997
xor eax, 0x9465df0b
rol eax, 0xa4
popf
pushf
not eax
add eax, 0xc0ddbfe5
xor eax, 0xcaf8a17c
rol eax, 0x7a
popf
pushf
not eax
add eax, 0x9eb6d0f1
xor eax, 0x8f34c7cf
rol eax, 0xe0
popf
pushf
not eax
add eax, 0x91fce980
xor eax, 0xfcc759b2
rol eax, 0x94
popf
jmp 0x140af3886
mov rax, rdi
mov rcx, qword [rsp + 0x1440]
xor rcx, rsp
call fcn.140b1dac3
lea r11, [rsp + 0x1450]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret