Function at 0x140124024
Capabilities:
Write file on windows

Disassembly:
push rax
pushf
mov eax, 0xde48d3b5
pushf
not eax
add eax, 0x483747b6
xor eax, 0x6ec3bfe9
rol eax, 0xb
popf
pushf
not eax
add eax, 0x4eca49ba
xor eax, 0x1075505f
rol eax, 0x1b
popf
pushf
not eax
add eax, 0x1f52966f
xor eax, 0x4e27a84c
rol eax, 0xd6
popf
pushf
not eax
add eax, 0x4df4a984
xor eax, 0x62e02c01
rol eax, 0x25
popf
cmp eax, 4
jne 0x140124087
popf
pop rax
jmp 0x1401243d4
cmp eax, 5
jne 0x140124096
popf
pop rax
jmp 0x140124454
cmp eax, 8
jne 0x1401240a5
popf
pop rax
jmp 0x14012463b
cmp eax, 0xa
jne 0x1401240b4
popf
pop rax
jmp 0x14012472a
cmp eax, 9
jne 0x1401240c3
popf
pop rax
jmp 0x1401246de
cmp eax, 3
jne 0x1401240d2
popf
pop rax
jmp 0x14012434e
cmp eax, 0xb
jne 0x1401240e1
popf
pop rax
jmp 0x14012478b
cmp eax, 0
jne 0x1401240f0
popf
pop rax
jmp 0x14012412c
cmp eax, 2
jne 0x1401240ff
popf
pop rax
jmp 0x140124297
cmp eax, 7
jne 0x14012410e
popf
pop rax
jmp 0x1401245ca
cmp eax, 6
jne 0x14012411d
popf
pop rax
jmp 0x1401244f4
cmp eax, 1
jne 0x14012412c
popf
pop rax
jmp 0x14012425f
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
mov eax, 0xd15c4809
pushf
not eax
add eax, 0x6d938bb0
xor eax, 0x75280f62
rol eax, 0xc1
popf
pushf
not eax
add eax, 0x2cd6a6b8
xor eax, 0x4e980d2b
rol eax, 0xea
popf
call fcn.14009bcb8
sub rsp, rax
mov rax, qword [0x14003e040]
xor rax, rsp
mov qword [rsp + 0x1440], rax
movsxd r10, edx
mov rdi, rcx
mov rax, r10
mov ebp, r9d
sar rax, 6
lea rcx, [0x18c472ee4]
pushf
sub rcx, 0x4c4304b4
popf
and r10d, 0x3f
push r8
not r8
sub rbp, r8
pop r8
sub rbp, 1
mov rsi, r8
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
mov r14, qword [rax + rdx*8 + 0x28]
xor eax, eax
mov qword [rdi], rax
mov dword [rdi + 8], eax
cmp r8, rbp
jae 0x140124219
push rax
pushf
mov eax, 0x69a8c23e
pushf
not eax
add eax, 0x4a7488ce
xor eax, 0x5588df15
rol eax, 0x94
popf
pushf
not eax
add eax, 0x19ec0afe
xor eax, 0x696c610e
rol eax, 1
popf
pushf
not eax
add eax, 0x1db55ebe
xor eax, 0x4b5bef38
rol eax, 0x32
popf
jmp 0x140124078
push rax
pushf
mov eax, 0xa728c210
pushf
not eax
add eax, 0x5e6b127f
xor eax, 0x7513ee71
rol eax, 0x15
popf
pushf
not eax
add eax, 0xc3daef2
xor eax, 0x7072f363
rol eax, 0x69
popf
pushf
not eax
add eax, 0x7aae8fd0
xor eax, 0xb7ed8df
rol eax, 0x19
popf
jmp 0x140124078
lea rbx, [rsp + 0x40]
push rax
pushf
mov eax, 0x5fe86655
pushf
not eax
add eax, 0x332f0d70
xor eax, 0x4cb83806
rol eax, 0x89
popf
pushf
not eax
add eax, 0x2e0eaa0f
xor eax, 0x30d070cb
rol eax, 0xdf
popf
jmp 0x140124078
cmp rsi, rbp
jae 0x1401242f5
push rax
pushf
mov eax, 0x1de2832f
pushf
not eax
add eax, 0x73992eb5
xor eax, 0x5b072d2a
rol eax, 0x55
popf
pushf
not eax
add eax, 0x2b009e3
xor eax, 0x58c7e111
rol eax, 0xed
popf
pushf
not eax
add eax, 0x5f0b124
xor eax, 0x68969707
rol eax, 0x28
popf
pushf
not eax
add eax, 0x63d01ed3
xor eax, 0x68fa792f
rol eax, 0xa4
popf
jmp 0x140124078
push rax
pushf
mov eax, 0xd4dccdb3
pushf
not eax
add eax, 0x7fa7967
xor eax, 0x2921c2a5
rol eax, 0x74
popf
pushf
not eax
add eax, 0xd67047f
xor eax, 0x7af8295e
rol eax, 0x96
popf
pushf
not eax
add eax, 0x3f7e922d
xor eax, 0xe14206c
rol eax, 0x51
popf
pushf
not eax
add eax, 0x1ca8d814
xor eax, 0x313b4042
rol eax, 0x68
popf
jmp 0x140124078
movzx eax, word [rsi]
add rsi, 2
cmp ax, 0xa
jne 0x14012438e
push rax
pushf
mov eax, 0x158dc30d
pushf
not eax
add eax, 0x68fc3b86
xor eax, 0x3b99dd92
rol eax, 0xfb
popf
pushf
not eax
add eax, 0x74f96b97
xor eax, 0x21a1ae67
rol eax, 0xce
popf
jmp 0x140124078
push rax
pushf
mov eax, 0x3c598c8a
pushf
not eax
add eax, 0x20f693e3
xor eax, 0x4a90df8c
rol eax, 0xb
popf
pushf
not eax
add eax, 0x1d9020e9
xor eax, 0x3896174b
rol eax, 0xc
popf
pushf
not eax
add eax, 0x566a7db4
xor eax, 0x77a7444e
rol eax, 0xe5
popf
jmp 0x140124078
add dword [rdi + 8], 2
mov ecx, 0x37296cbd
pushf
not ecx
add ecx, 0x7f865892
xor ecx, 0x609dac57
rol ecx, 0xb2
popf
pushf
not ecx
add ecx, 0x7122e1fe
xor ecx, 0x53163db8
rol ecx, 0xda
popf
mov word [rbx], cx
add rbx, 2
push rax
pushf
mov eax, 0x2bc28ef8
pushf
not eax
add eax, 0x68b9a7ef
xor eax, 0x309bcbef
rol eax, 0x45
popf
pushf
not eax
add eax, 0x926e5e9
xor eax, 0x69cd4270
rol eax, 0xcb
popf
pushf
not eax
add eax, 0x5695b71d
xor eax, 0x488ffe80
rol eax, 0x1f
popf
jmp 0x140124078
mov word [rbx], ax
add rbx, 2
lea rax, [rsp + 0x143e]
cmp rbx, rax
jb 0x14012449b
push rax
pushf
mov eax, 0x765974a7
pushf
not eax
add eax, 0x713b3807
xor eax, 0x7bee8f32
rol eax, 0xc6
popf
pushf
not eax
add eax, 0x4e5fb7c4
xor eax, 0xc8c9c63
rol eax, 0x88
popf
jmp 0x140124078
push rax
pushf
mov eax, 0xac462093
pushf
not eax
add eax, 0x297e8ed6
xor eax, 0x19b072f3
rol eax, 0x11
popf
pushf
not eax
add eax, 0x794d91c
xor eax, 0x2b8e41c8
rol eax, 0x65
popf
pushf
not eax
add eax, 0x66807549
xor eax, 0x36e7e6ac
rol eax, 5
popf
pushf
not eax
add eax, 0x3087680c
xor eax, 0x2e4c0bf8
rol eax, 0xd5
popf
jmp 0x140124078
and qword [rsp + 0x20], 0
lea rax, [rsp + 0x40]
push rax
not rax
add rbx, rax
pop rax
add rbx, 1
lea r9, [rsp + 0x30]
sar rbx, 1
lea rdx, [rsp + 0x40]
add ebx, ebx
mov rcx, r14
mov r8d, ebx
jmp 0x140124521
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140124584
push rax
pushf
mov eax, 0x2b749ce1
pushf
not eax
add eax, 0x3d6832ef
xor eax, 0x75620c9
rol eax, 5
popf
pushf
not eax
add eax, 0x6e49a052
xor eax, 0x4586860d
rol eax, 0xa9
popf
pushf
not eax
add eax, 0xed12702
xor eax, 0x60f4554
rol eax, 0x76
popf
pushf
not eax
add eax, 0x13a293ff
xor eax, 0xc2a8359
rol eax, 0x1e
popf
jmp 0x140124078
push rax
pushf
mov eax, 0x9bb12bcc
pushf
not eax
add eax, 0x11eb707b
xor eax, 0x2001fa6a
rol eax, 0x48
popf
pushf
not eax
add eax, 0x258eae9f
xor eax, 0x2d93564a
rol eax, 0xf7
popf
pushf
not eax
add eax, 0x3dbfa77b
xor eax, 0x3c49791c
rol eax, 0x4f
popf
jmp 0x140124078
mov eax, dword [rsp + 0x30]
add dword [rdi + 4], eax
cmp eax, ebx
jb 0x140124608
push rax
pushf
mov eax, 0x7e00456b
pushf
not eax
add eax, 0x5d35d372
xor eax, 0x9cd4fa6
rol eax, 0x94
popf
pushf
not eax
add eax, 0x3099928f
xor eax, 0x168c2303
rol eax, 0xc3
popf
jmp 0x140124078
push rax
pushf
mov eax, 0x8f63ff43
pushf
not eax
add eax, 0x56fa270e
xor eax, 0x2a5e7c27
rol eax, 2
popf
pushf
not eax
add eax, 0x2022e398
xor eax, 0x69b173e0
rol eax, 0xc
popf
jmp 0x140124078
cmp rsi, rbp
jb 0x140124686
push rax
pushf
mov eax, 0xacbd3ed2
pushf
not eax
add eax, 0xfe2e60b
xor eax, 0x58ec6d7b
rol eax, 0x81
popf
pushf
not eax
add eax, 0x3df6cfb1
xor eax, 0x75a69b3
rol eax, 0x7f
popf
pushf
not eax
add eax, 0x461dc751
xor eax, 0x25811e06
rol eax, 0x42
popf
jmp 0x140124078
push rax
pushf
mov eax, 0x22fe1db6
pushf
not eax
add eax, 0x3ec401b5
xor eax, 0x554e6525
rol eax, 1
popf
pushf
not eax
add eax, 0x6a96c604
xor eax, 0x2763ad11
rol eax, 0x12
popf
pushf
not eax
add eax, 0x65c4bf20
xor eax, 0x37891617
rol eax, 0xbd
popf
pushf
not eax
add eax, 0x40cd0a51
xor eax, 0x3bd21a39
rol eax, 0x14
popf
jmp 0x140124078
jmp 0x14012478b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
push rax
pushf
mov eax, 0x1348fb8
pushf
not eax
add eax, 0xccd20e9
xor eax, 0xe928981
rol eax, 0xe
popf
pushf
not eax
add eax, 0x669b276f
xor eax, 0xc8d2764
rol eax, 5
popf
pushf
not eax
add eax, 0x2dc33de0
xor eax, 0x7800e561
rol eax, 0x51
popf
pushf
not eax
add eax, 0xa3338bf
xor eax, 0x26eb662c
rol eax, 0x60
popf
jmp 0x140124078
mov rax, rdi
mov rcx, qword [rsp + 0x1440]
xor rcx, rsp
call fcn.140098f5b
lea r11, [rsp + 0x1450]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret