Function at 0x140adcbdb
Capabilities:
Write file on windows

Disassembly:
push rax
pushf
mov eax, 0x444ff5c1
pushf
not eax
add eax, 0xf17e3dee
xor eax, 0xac3e8454
rol eax, 0x93
popf
pushf
not eax
add eax, 0xd0f1bc74
xor eax, 0xe4de98d5
rol eax, 0xc4
popf
pushf
not eax
add eax, 0xf9542e79
xor eax, 0xa2ab977c
rol eax, 0x3e
popf
pushf
not eax
add eax, 0xd491f331
xor eax, 0x965f37cd
rol eax, 0x50
popf
cmp eax, 4
jne 0x140adcc3e
popf
pop rax
jmp 0x140adcf36
cmp eax, 0
jne 0x140adcc4d
popf
pop rax
jmp 0x140adcce3
cmp eax, 3
jne 0x140adcc5c
popf
pop rax
jmp 0x140adcea0
cmp eax, 1
jne 0x140adcc6b
popf
pop rax
jmp 0x140adce39
cmp eax, 0xa
jne 0x140adcc7a
popf
pop rax
jmp 0x140add283
cmp eax, 7
jne 0x140adcc89
popf
pop rax
jmp 0x140add110
cmp eax, 6
jne 0x140adcc98
popf
pop rax
jmp 0x140add049
cmp eax, 0xb
jne 0x140adcca7
popf
pop rax
jmp 0x140add2d1
cmp eax, 9
jne 0x140adccb6
popf
pop rax
jmp 0x140add24a
cmp eax, 8
jne 0x140adccc5
popf
pop rax
jmp 0x140add1ba
cmp eax, 5
jne 0x140adccd4
popf
pop rax
jmp 0x140adcf98
cmp eax, 2
jne 0x140adcce3
popf
pop rax
jmp 0x140adce97
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
mov eax, 0x4859dd0c
pushf
not eax
add eax, 0xdf994f61
xor eax, 0xcbd05527
rol eax, 0x1e
popf
pushf
not eax
add eax, 0x9ef70829
xor eax, 0xfe2d4828
rol eax, 0xdc
popf
pushf
not eax
add eax, 0xc34dd494
xor eax, 0xbaea750a
rol eax, 0xd6
popf
pushf
not eax
add eax, 0x9a77a200
xor eax, 0x90864f6d
rol eax, 2
popf
call fcn.140b242f9
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1440], rax
movsxd r10, edx
mov rdi, rcx
mov rax, r10
mov ebp, r9d
sar rax, 6
lea rcx, [0x1bbaeb503]
pushf
sub rcx, 0x7b57afa3
popf
and r10d, 0x3f
push r8
not r8
sub rbp, r8
pop r8
sub rbp, 1
mov rsi, r8
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
mov r14, qword [rax + rdx*8 + 0x28]
xor eax, eax
mov qword [rdi], rax
mov dword [rdi + 8], eax
cmp r8, rbp
jae 0x140adce06
push rax
pushf
mov eax, 0x75a824c8
pushf
not eax
add eax, 0xdd659bea
xor eax, 0xe33444c2
rol eax, 0x38
popf
pushf
not eax
add eax, 0xc58a9d13
xor eax, 0xbbf52f93
rol eax, 0xee
popf
pushf
not eax
add eax, 0xf25f0cf1
xor eax, 0x819e6300
rol eax, 0xba
popf
pushf
not eax
add eax, 0xca229a2c
xor eax, 0xf79743c6
rol eax, 0xdc
popf
jmp 0x140adcc2f
push rax
pushf
mov eax, 0x636b33a4
pushf
not eax
add eax, 0x94a79592
xor eax, 0x8195ddcd
rol eax, 0x45
popf
pushf
not eax
add eax, 0xa5bc43ea
xor eax, 0x9084bf63
rol eax, 0x7c
popf
jmp 0x140adcc2f
lea rbx, [rsp + 0x40]
push rax
pushf
mov eax, 0xd05a570e
pushf
not eax
add eax, 0xd736e0f8
xor eax, 0x8be7f07e
rol eax, 0x7e
popf
pushf
not eax
add eax, 0xee7bcd4d
xor eax, 0xe9a02697
rol eax, 0x41
popf
pushf
not eax
add eax, 0xa4292a7f
xor eax, 0x90c868dd
rol eax, 0x26
popf
pushf
not eax
add eax, 0xb0f5f6d3
xor eax, 0xbef9a6ff
rol eax, 0xbb
popf
jmp 0x140adcc2f
cmp rsi, rbp
jae 0x140add049
mov al, byte [rsi]
inc rsi
cmp al, 0xa
jne 0x140adcedc
push rax
pushf
mov eax, 0xe5b06296
pushf
not eax
add eax, 0xf272d372
xor eax, 0x8a2e047e
rol eax, 0xf8
popf
pushf
not eax
add eax, 0x87ed484d
xor eax, 0xe2265bd8
rol eax, 0xec
popf
jmp 0x140adcc2f
push rax
pushf
mov eax, 0xb16defba
pushf
not eax
add eax, 0xf952e329
xor eax, 0x98f2c173
rol eax, 0xd
popf
pushf
not eax
add eax, 0xa9c0be06
xor eax, 0xf2ad1055
rol eax, 0xef
popf
pushf
not eax
add eax, 0xf7989428
xor eax, 0xacc55ec1
rol eax, 0x34
popf
pushf
not eax
add eax, 0xfdf9459a
xor eax, 0xde151c0d
rol eax, 2
popf
jmp 0x140adcc2f
inc dword [rdi + 8]
mov byte [rbx], 0xd
inc rbx
push rax
pushf
mov eax, 0xcd514624
pushf
not eax
add eax, 0xbca72499
xor eax, 0xa2090fbc
rol eax, 0xdf
popf
pushf
not eax
add eax, 0xc13f48d5
xor eax, 0xabd12c0f
rol eax, 0x39
popf
pushf
not eax
add eax, 0xfe817a48
xor eax, 0xcfb84999
rol eax, 0x2d
popf
pushf
not eax
add eax, 0xcee4e031
xor eax, 0xf6cda63c
rol eax, 0xed
popf
jmp 0x140adcc2f
mov byte [rbx], al
inc rbx
lea rax, [rsp + 0x143f]
cmp rbx, rax
jb 0x140adcff0
push rax
pushf
mov eax, 0x82b53bde
pushf
not eax
add eax, 0xf3e1c2d2
xor eax, 0x86d7b69c
rol eax, 0x7f
popf
pushf
not eax
add eax, 0xbbcfd99f
xor eax, 0x8a0ebfc2
rol eax, 0xd6
popf
pushf
not eax
add eax, 0x9791f2e3
xor eax, 0xe8447ba3
rol eax, 0xc8
popf
jmp 0x140adcc2f
push rax
pushf
mov eax, 0x3044a8fb
pushf
not eax
add eax, 0xc6e5d4cd
xor eax, 0xf47d8115
rol eax, 0x14
popf
pushf
not eax
add eax, 0x94a0d6ab
xor eax, 0xc8e27c5b
rol eax, 0x22
popf
pushf
not eax
add eax, 0xfb4fa251
xor eax, 0xa12711f6
rol eax, 8
popf
pushf
not eax
add eax, 0xe3aad78b
xor eax, 0x984c44b5
rol eax, 0x7f
popf
jmp 0x140adcc2f
and qword [rsp + 0x20], 0
lea rax, [rsp + 0x40]
sub ebx, eax
lea r9, [rsp + 0x30]
mov r8d, ebx
lea rdx, [rsp + 0x40]
mov rcx, r14
jmp 0x140add067
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140add0ca
push rax
pushf
mov eax, 0xd26a4190
pushf
not eax
add eax, 0xa43cd00b
xor eax, 0x93bd8a03
rol eax, 0x4a
popf
pushf
not eax
add eax, 0x997e8922
xor eax, 0xdd11cf53
rol eax, 0xeb
popf
pushf
not eax
add eax, 0xc7c64451
xor eax, 0xb3319649
rol eax, 0xa5
popf
pushf
not eax
add eax, 0xa3502088
xor eax, 0xc800dffa
rol eax, 4
popf
jmp 0x140adcc2f
push rax
pushf
mov eax, 0xba954ed
pushf
not eax
add eax, 0x81df70ff
xor eax, 0xf48eef7f
rol eax, 0xaa
popf
pushf
not eax
add eax, 0x9f3ef06c
xor eax, 0xfb0520dc
rol eax, 0xa5
popf
pushf
not eax
add eax, 0xc8a07350
xor eax, 0xbf1d9ba7
rol eax, 0x49
popf
jmp 0x140adcc2f
mov eax, dword [rsp + 0x30]
add dword [rdi + 4], eax
cmp eax, ebx
jb 0x140add174
push rax
pushf
mov eax, 0x1a17d417
pushf
not eax
add eax, 0xd83046da
xor eax, 0x8f3c51fb
rol eax, 0xf4
popf
pushf
not eax
add eax, 0xc8813ddc
xor eax, 0xea4afed9
rol eax, 0xc2
popf
pushf
not eax
add eax, 0xf5074320
xor eax, 0xd6c4659e
rol eax, 0x9a
popf
pushf
not eax
add eax, 0xe36466c1
xor eax, 0xe2f18892
rol eax, 0x4d
popf
jmp 0x140adcc2f
push rax
pushf
mov eax, 0xa14037d7
pushf
not eax
add eax, 0xc02fd2cc
xor eax, 0x8365dcd2
rol eax, 0x8a
popf
pushf
not eax
add eax, 0xf2d4fc00
xor eax, 0xc83378d9
rol eax, 0x54
popf
pushf
not eax
add eax, 0xa3da1dab
xor eax, 0xbeda04b9
rol eax, 0x24
popf
jmp 0x140adcc2f
cmp rsi, rbp
jb 0x140add1f2
push rax
pushf
mov eax, 0xd8d4c28c
pushf
not eax
add eax, 0xd54ee6ca
xor eax, 0xc735ad02
rol eax, 0x93
popf
pushf
not eax
add eax, 0xe8c7960e
xor eax, 0x9ecdf391
rol eax, 0x55
popf
jmp 0x140adcc2f
push rax
pushf
mov eax, 0xad40dfa7
pushf
not eax
add eax, 0xcccf1848
xor eax, 0xc203daca
rol eax, 0x97
popf
pushf
not eax
add eax, 0xbe3d37cd
xor eax, 0xb08b4b04
rol eax, 1
popf
pushf
not eax
add eax, 0xd63bff1c
xor eax, 0xd5993b70
rol eax, 0x6b
popf
pushf
not eax
add eax, 0xf0d28448
xor eax, 0xaaf116c7
rol eax, 0xa0
popf
jmp 0x140adcc2f
jmp 0x140add2d1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
push rax
pushf
mov eax, 0xb2e21c37
pushf
not eax
add eax, 0xa4671cd3
xor eax, 0xbe58d049
rol eax, 0xcd
popf
pushf
not eax
add eax, 0xd785ef8c
xor eax, 0xe65b079b
rol eax, 0xe8
popf
pushf
not eax
add eax, 0xf3882a27
xor eax, 0xc2e61e07
rol eax, 0x3e
popf
jmp 0x140adcc2f
mov rax, rdi
mov rcx, qword [rsp + 0x1440]
xor rcx, rsp
call fcn.140b1dac3
lea r11, [rsp + 0x1450]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret