Function at 0x1401384a9
Capabilities:
Write file on windows

Disassembly:
push rax
pushf
mov eax, 0xf72d7d53
pushf
not eax
add eax, 0xe638e5fe
xor eax, 0x82cf05e2
rol eax, 0xd9
popf
pushf
not eax
add eax, 0xe38ae3ae
xor eax, 0xff4f1901
rol eax, 0xf2
popf
pushf
not eax
add eax, 0xb9fd4414
xor eax, 0xaab28c92
rol eax, 0xee
popf
cmp eax, 4
jne 0x1401384f9
popf
pop rax
jmp 0x140138883
cmp eax, 0
jne 0x140138508
popf
pop rax
jmp 0x1401385ad
cmp eax, 3
jne 0x140138517
popf
pop rax
jmp 0x1401387d7
cmp eax, 1
jne 0x140138526
popf
pop rax
jmp 0x1401386e8
cmp eax, 0xa
jne 0x140138535
popf
pop rax
jmp 0x140138c24
cmp eax, 7
jne 0x140138544
popf
pop rax
jmp 0x140138ab2
cmp eax, 6
jne 0x140138553
popf
pop rax
jmp 0x1401389a1
cmp eax, 0xb
jne 0x140138562
popf
pop rax
jmp 0x140138c68
cmp eax, 0xc
jne 0x140138571
popf
pop rax
jmp 0x140138cc9
cmp eax, 8
jne 0x140138580
popf
pop rax
jmp 0x140138b44
cmp eax, 5
jne 0x14013858f
popf
pop rax
jmp 0x140138901
cmp eax, 2
jne 0x14013859e
popf
pop rax
jmp 0x140138720
cmp eax, 9
jne 0x1401385ad
popf
pop rax
jmp 0x140138c18
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
mov eax, 0x5f09d531
pushf
not eax
add eax, 0x8e77a16d
xor eax, 0xc62dd547
rol eax, 0x5e
popf
pushf
not eax
add eax, 0xd282bcab
xor eax, 0x98329eab
rol eax, 0xff
popf
call fcn.1401399f7
sub rsp, rax
mov rax, qword [0x14004b090]
xor rax, rsp
mov qword [rsp + 0x1460], rax
movsxd r10, edx
mov rbx, rcx
mov rax, r10
mov r14d, r9d
sar rax, 6
lea rcx, [0x18a71b9d9]
pushf
sub rcx, 0x4a6cdff9
popf
and r10d, 0x3f
push r8
not r8
sub r14, r8
pop r8
sub r14, 1
mov r15, r8
mov rdi, r8
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
mov r12, qword [rax + rdx*8 + 0x28]
xor eax, eax
mov qword [rbx], rax
cmp r8, r14
mov dword [rbx + 8], eax
jae 0x1401386a2
push rax
pushf
mov eax, 0x46c1a5ea
pushf
not eax
add eax, 0x81255fa1
xor eax, 0x878226d4
rol eax, 0x38
popf
pushf
not eax
add eax, 0xd34d5396
xor eax, 0xa311656c
rol eax, 0x4f
popf
pushf
not eax
add eax, 0x9f8202ba
xor eax, 0x913498ea
rol eax, 0x26
popf
jmp 0x1401384ea
push rax
pushf
mov eax, 0x2a232d03
pushf
not eax
add eax, 0xf9ff79d7
xor eax, 0x93fa2c3c
rol eax, 0xe6
popf
pushf
not eax
add eax, 0xbba17ee4
xor eax, 0xa5280323
rol eax, 0x9d
popf
pushf
not eax
add eax, 0xa51b5ac0
xor eax, 0xc3b732ba
rol eax, 0x2b
popf
jmp 0x1401384ea
lea rax, [rsp + 0x50]
push rax
pushf
mov eax, 0x51a54490
pushf
not eax
add eax, 0xef8b737c
xor eax, 0xecb4dbb7
rol eax, 0x31
popf
pushf
not eax
add eax, 0x91e08873
xor eax, 0xa707a5cd
rol eax, 0xcc
popf
jmp 0x1401384ea
cmp rdi, r14
jae 0x14013877e
push rax
pushf
mov eax, 0x4c83afd2
pushf
not eax
add eax, 0xce052adf
xor eax, 0xe791b4b3
rol eax, 0x18
popf
pushf
not eax
add eax, 0xd431910e
xor eax, 0xb719cc45
rol eax, 0xb1
popf
pushf
not eax
add eax, 0x8b27a994
xor eax, 0xb7fa9688
rol eax, 0xb6
popf
pushf
not eax
add eax, 0xc18448ea
xor eax, 0xe7b2d64c
rol eax, 0x1b
popf
jmp 0x1401384ea
push rax
pushf
mov eax, 0x42f60998
pushf
not eax
add eax, 0xfc22c823
xor eax, 0xe1aa9c1e
rol eax, 0x6b
popf
pushf
not eax
add eax, 0xe4401b8b
xor eax, 0xa6551c77
rol eax, 0x45
popf
pushf
not eax
add eax, 0x81ee1ccd
xor eax, 0xb07385fb
rol eax, 0x25
popf
pushf
not eax
add eax, 0xf2f3d1e3
xor eax, 0xa8b307b6
rol eax, 0xb4
popf
jmp 0x1401384ea
movzx ecx, word [rdi]
add rdi, 2
cmp cx, 0xa
jne 0x14013882a
push rax
pushf
mov eax, 0x5da414ad
pushf
not eax
add eax, 0xa20d438d
xor eax, 0xf22351e6
rol eax, 0xf1
popf
pushf
not eax
add eax, 0xeb390684
xor eax, 0xf161fb17
rol eax, 0xb6
popf
pushf
not eax
add eax, 0x83dbd288
xor eax, 0xc5d46d6f
rol eax, 0x98
popf
jmp 0x1401384ea
push rax
pushf
mov eax, 0x65c22008
pushf
not eax
add eax, 0x81991d16
xor eax, 0xcce814d7
rol eax, 0xa6
popf
pushf
not eax
add eax, 0xc018a725
xor eax, 0xa507b562
rol eax, 0xd4
popf
pushf
not eax
add eax, 0xe98e5b29
xor eax, 0x824ae534
rol eax, 0xf9
popf
pushf
not eax
add eax, 0xf8ad7552
xor eax, 0x98778d90
rol eax, 0xc5
popf
jmp 0x1401384ea
mov edx, 0xc24b7bf6
pushf
not edx
add edx, 0xd898f5c4
xor edx, 0xd4141abf
rol edx, 0xfa
popf
pushf
not edx
add edx, 0xfb3d3ba7
xor edx, 0xd0776719
rol edx, 0xc4
popf
pushf
not edx
add edx, 0xffde2bf8
xor edx, 0xfb93cbe9
rol edx, 0x54
popf
mov word [rax], dx
add rax, 2
push rax
pushf
mov eax, 0x474dd14b
pushf
not eax
add eax, 0xd9c17f1c
xor eax, 0xfabd87ca
rol eax, 0x61
popf
pushf
not eax
add eax, 0x930c43d5
xor eax, 0xc165efa0
rol eax, 0x8f
popf
jmp 0x1401384ea
mov word [rax], cx
add rax, 2
lea rcx, [rsp + 0x6f8]
cmp rax, rcx
jb 0x140138948
push rax
pushf
mov eax, 0xe9ae2988
pushf
not eax
add eax, 0x8b73295e
xor eax, 0xbbe4025f
rol eax, 0xa0
popf
pushf
not eax
add eax, 0xe7de212f
xor eax, 0xcdbd2fa4
rol eax, 0x57
popf
jmp 0x1401384ea
push rax
pushf
mov eax, 0x80e0fdd3
pushf
not eax
add eax, 0x8d96ebf8
xor eax, 0x93efa1a2
rol eax, 0x6f
popf
pushf
not eax
add eax, 0x90cadf58
xor eax, 0xe01e50e0
rol eax, 0x76
popf
pushf
not eax
add eax, 0xe2d7cdb3
xor eax, 0xb1469046
rol eax, 0xe3
popf
pushf
not eax
add eax, 0xd4d3a3a0
xor eax, 0xc93ae7b3
rol eax, 0x21
popf
jmp 0x1401384ea
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x50]
and qword [rsp + 0x30], 0
lea r8, [rsp + 0x50]
sub rax, rcx
mov dword [rsp + 0x28], 0xd55
lea rcx, [rsp + 0x700]
sar rax, 1
mov qword [rsp + 0x20], rcx
mov r9d, eax
mov ecx, 0x77179844
pushf
not ecx
add ecx, 0x97dbb5d3
xor ecx, 0xa99321ef
rol ecx, 0x82
popf
pushf
not ecx
add ecx, 0xb1e8f7dd
xor ecx, 0xb6434237
rol ecx, 0x6a
popf
pushf
not ecx
add ecx, 0xa8840c9a
xor ecx, 0x9cd687ad
rol ecx, 0xae
popf
xor edx, edx
call fcn.1401ac4ac
mov ebp, eax
test eax, eax
je 0x140138a59
push rax
pushf
mov eax, 0x972363f3
pushf
not eax
add eax, 0x870813f8
xor eax, 0xfc855dbc
rol eax, 0x2c
popf
pushf
not eax
add eax, 0xcdd403f0
xor eax, 0xaf3882b9
rol eax, 0x6a
popf
jmp 0x1401384ea
push rax
pushf
mov eax, 0x6e1da98a
pushf
not eax
add eax, 0xc8666b0e
xor eax, 0x853c4eaf
rol eax, 0x49
popf
pushf
not eax
add eax, 0xf5180076
xor eax, 0xfffa5611
rol eax, 0x78
popf
pushf
not eax
add eax, 0xd74ba394
xor eax, 0xe70f537e
rol eax, 0x47
popf
pushf
not eax
add eax, 0x97fe4259
xor eax, 0xeb96b36d
rol eax, 0x73
popf
jmp 0x1401384ea
xor esi, esi
test eax, eax
je 0x140138afe
push rax
pushf
mov eax, 0xfbbbea6b
pushf
not eax
add eax, 0xeb6a4599
xor eax, 0x8d28a33d
rol eax, 0x94
popf
pushf
not eax
add eax, 0xab0a6be3
xor eax, 0xba34b6e5
rol eax, 0xe2
popf
pushf
not eax
add eax, 0xc427f267
xor eax, 0x82641c0c
rol eax, 0x8b
popf
jmp 0x1401384ea
push rax
pushf
mov eax, 0xa380ef45
pushf
not eax
add eax, 0xfd383587
xor eax, 0x87e06c3a
rol eax, 0x1f
popf
pushf
not eax
add eax, 0xb66fd101
xor eax, 0x986ea6ea
rol eax, 0xe8
popf
pushf
not eax
add eax, 0xd011cb25
xor eax, 0xa57401c5
rol eax, 0xd4
popf
jmp 0x1401384ea
and qword [rsp + 0x20], 0
lea rdx, [rsp + 0x700]
mov ecx, esi
lea r9, [rsp + 0x40]
mov r8d, ebp
push rcx
not rcx
sub rdx, rcx
pop rcx
sub rdx, 1
mov rcx, r12
sub r8d, esi
jmp 0x140138b6f
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140138bd2
push rax
pushf
mov eax, 0x8646bb7e
pushf
not eax
add eax, 0xca1dc89d
xor eax, 0xe4afed56
rol eax, 0x52
popf
pushf
not eax
add eax, 0xc69e6fa4
xor eax, 0xd7593f4c
rol eax, 0x5f
popf
pushf
not eax
add eax, 0xbc9fbd42
xor eax, 0xedfcc142
rol eax, 0x25
popf
pushf
not eax
add eax, 0x98f1e06b
xor eax, 0xcaa1493e
rol eax, 0x80
popf
jmp 0x1401384ea
push rax
pushf
mov eax, 0x6a6cbdf6
pushf
not eax
add eax, 0xc8d171a1
xor eax, 0xcd0864bf
rol eax, 0x46
popf
pushf
not eax
add eax, 0xa31ddfff
xor eax, 0xe0b6f959
rol eax, 0xc8
popf
pushf
not eax
add eax, 0xf9f8fd75
xor eax, 0x9b153a61
rol eax, 0x5e
popf
jmp 0x1401384ea
add esi, dword [rsp + 0x40]
cmp esi, ebp
jb 0x140138b44
mov eax, edi
sub eax, r15d
mov dword [rbx + 4], eax
cmp rdi, r14
jmp 0x140138656
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
push rax
pushf
mov eax, 0xa93c9bf6
pushf
not eax
add eax, 0x83d588f9
xor eax, 0x825d5c9d
rol eax, 0xac
popf
pushf
not eax
add eax, 0xe4d39b06
xor eax, 0xcb5ca611
rol eax, 0xbb
popf
pushf
not eax
add eax, 0xf197e05f
xor eax, 0xf12d5d93
rol eax, 0x98
popf
pushf
not eax
add eax, 0xa3edff84
xor eax, 0xd20f519e
rol eax, 0x6b
popf
jmp 0x1401384ea
mov rax, rbx
mov rcx, qword [rsp + 0x1460]
xor rcx, rsp
call fcn.14012cd5d
lea r11, [rsp + 0x1470]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret