Function at 0x1400db533
Capabilities:
Write file on windows

Disassembly:
push rax
pushf
mov eax, 0x62057534
pushf
not eax
add eax, 0xb1399411
xor eax, 0xdac1a487
rol eax, 0xc2
popf
pushf
not eax
add eax, 0xc283cbbd
xor eax, 0x9f37765c
rol eax, 0x18
popf
pushf
not eax
add eax, 0xdb8f3783
xor eax, 0xd96a868e
rol eax, 0xb9
popf
pushf
not eax
add eax, 0x8dc66418
xor eax, 0xcda27ddd
rol eax, 0xec
popf
cmp eax, 4
jne 0x1400db596
popf
pop rax
jmp 0x1400db8cd
cmp eax, 0
jne 0x1400db5a5
popf
pop rax
jmp 0x1400db60e
cmp eax, 3
jne 0x1400db5b4
popf
pop rax
jmp 0x1400db7fd
cmp eax, 1
jne 0x1400db5c3
popf
pop rax
jmp 0x1400db6e0
cmp eax, 5
jne 0x1400db5d2
popf
pop rax
jmp 0x1400db94a
cmp eax, 7
jne 0x1400db5e1
popf
pop rax
jmp 0x1400dba39
cmp eax, 6
jne 0x1400db5f0
popf
pop rax
jmp 0x1400db9a0
cmp eax, 2
jne 0x1400db5ff
popf
pop rax
jmp 0x1400db736
cmp eax, 8
jne 0x1400db60e
popf
pop rax
jmp 0x1400dba79
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x14001cf50]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0x772306a6
pushf
not eax
add eax, 0xc31edad0
xor eax, 0xfc30b8af
rol eax, 0xab
popf
pushf
not eax
add eax, 0x98a5b599
xor eax, 0xc2be8025
rol eax, 0x9e
popf
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x1400db69b
push rax
pushf
mov eax, 0x29cf1121
pushf
not eax
add eax, 0xc0616622
xor eax, 0xa9006512
rol eax, 0
popf
pushf
not eax
add eax, 0xf74ad111
xor eax, 0xb3b8a0fe
rol eax, 0x46
popf
jmp 0x1400db587
push rax
pushf
mov eax, 0x7cd00de8
pushf
not eax
add eax, 0xaca82f30
xor eax, 0xbd909419
rol eax, 0x83
popf
pushf
not eax
add eax, 0xde49432c
xor eax, 0x9abd6aaf
rol eax, 0x50
popf
pushf
not eax
add eax, 0x9a272df6
xor eax, 0xa78e5736
rol eax, 1
popf
jmp 0x1400db587
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
push rax
pushf
mov eax, 0x5c086184
pushf
not eax
add eax, 0xcbca0af8
xor eax, 0xf07bdb35
rol eax, 0xcf
popf
pushf
not eax
add eax, 0x8e5f132a
xor eax, 0xd08bf9c2
rol eax, 0x6a
popf
pushf
not eax
add eax, 0xa6a5b0e4
xor eax, 0xe5bb76c5
rol eax, 0x5e
popf
jmp 0x1400db587
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x1400db777
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x1400db7ca
push rax
pushf
mov eax, 0xfcf05f0b
pushf
not eax
add eax, 0xe1fe63b4
xor eax, 0x83ae73a3
rol eax, 0xe6
popf
pushf
not eax
add eax, 0xfd31c672
xor eax, 0xc7b5b0fd
rol eax, 0xf9
popf
pushf
not eax
add eax, 0x9aaa974c
xor eax, 0xcf855fe5
rol eax, 0xd6
popf
jmp 0x1400db587
push rax
pushf
mov eax, 0x8cc449cf
pushf
not eax
add eax, 0xff6635e5
xor eax, 0xd0206b0e
rol eax, 0xd
popf
pushf
not eax
add eax, 0xd61ad266
xor eax, 0xa5375e55
rol eax, 0xfc
popf
jmp 0x1400db587
mov rcx, rdi
mov edx, 0x6280998e
pushf
not edx
add edx, 0xe37e373b
xor edx, 0xff9e6564
rol edx, 0xdc
popf
pushf
not edx
add edx, 0xf20493be
xor edx, 0x95f1abce
rol edx, 0x84
popf
jmp 0x1400db830
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x1400db874
push rax
pushf
mov eax, 0x9dc92e92
pushf
not eax
add eax, 0xb5a82748
xor eax, 0x9c30f2d2
rol eax, 0x5e
popf
pushf
not eax
add eax, 0xb3f31a89
xor eax, 0xd0f797cf
rol eax, 0x3d
popf
jmp 0x1400db587
push rax
pushf
mov eax, 0xb7b8461e
pushf
not eax
add eax, 0xdd31026d
xor eax, 0xa049b55d
rol eax, 0xc5
popf
pushf
not eax
add eax, 0x8dabce3a
xor eax, 0x95b80e28
rol eax, 0xcf
popf
pushf
not eax
add eax, 0xffd4e672
xor eax, 0xada72baa
rol eax, 0xe3
popf
pushf
not eax
add eax, 0x8ebefafd
xor eax, 0x84a6c32c
rol eax, 0x7d
popf
jmp 0x1400db587
test eax, eax
js 0x1400db904
push rax
pushf
mov eax, 0x53e5a80
pushf
not eax
add eax, 0xff4c68d8
xor eax, 0xee92673d
rol eax, 0x25
popf
pushf
not eax
add eax, 0x8696fe7c
xor eax, 0xf359d139
rol eax, 0x8c
popf
jmp 0x1400db587
push rax
pushf
mov eax, 0xe05d0660
pushf
not eax
add eax, 0xaa961b08
xor eax, 0x8606be11
rol eax, 0xaa
popf
pushf
not eax
add eax, 0x95c93355
xor eax, 0xc34fff17
rol eax, 0x4e
popf
pushf
not eax
add eax, 0xeee72a5e
xor eax, 0x9d9a5549
rol eax, 0xa6
popf
jmp 0x1400db587
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x1400dba39
mov ecx, eax
jmp 0x1400db9a3
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 0x3d5690e5
pushf
not eax
add eax, 0xe3c9c472
xor eax, 0xe60d535b
rol eax, 0xb2
popf
pushf
not eax
add eax, 0xd6574b3b
xor eax, 0xd19199df
rol eax, 0x5a
popf
pushf
not eax
add eax, 0xd765acdd
xor eax, 0xe2e96067
rol eax, 0xb7
popf
pushf
not eax
add eax, 0x95fdf556
xor eax, 0x971e5607
rol eax, 0x32
popf
push rax
pushf
mov eax, 0x99a216da
pushf
not eax
add eax, 0xc96c8343
xor eax, 0xbde7beae
rol eax, 0x9a
popf
pushf
not eax
add eax, 0xd863450f
xor eax, 0xbe1a8d23
rol eax, 0x5b
popf
jmp 0x1400db587
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, [0x183db5a35]
pushf
sub rax, 0x43d98a85
popf
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.140054ee2
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.14004b287
mov ecx, 0x400e3ab8
pushf
not ecx
add ecx, 0xb6b2984f
xor ecx, 0x9c49ee34
rol ecx, 0x7b
popf
pushf
not ecx
add ecx, 0xf62d60e1
xor ecx, 0xdd6b30d7
rol ecx, 0xbf
popf
pushf
not ecx
add ecx, 0x9fffec3d
xor ecx, 0xd9bae640
rol ecx, 0xcb
popf
pushf
not ecx
add ecx, 0x8b84db5c
xor ecx, 0xb82349ff
rol ecx, 0xdb
popf
int 0x29
ud2