Function at 0x140b23726
Capabilities:
Write file on windows

Disassembly:
push rax
pushf
mov eax, 0xcbe8a4d1
pushf
not eax
add eax, 0x85ac7b5c
xor eax, 0xb043a167
rol eax, 0x49
popf
pushf
not eax
add eax, 0x8734ad70
xor eax, 0xaafe4442
rol eax, 0x56
popf
pushf
not eax
add eax, 0x850796ec
xor eax, 0xbd7c6846
rol eax, 0x82
popf
cmp eax, 4
jne 0x140b23776
popf
pop rax
jmp 0x140b23aa1
cmp eax, 0
jne 0x140b23785
popf
pop rax
jmp 0x140b2382a
cmp eax, 3
jne 0x140b23794
popf
pop rax
jmp 0x140b23a1b
cmp eax, 1
jne 0x140b237a3
popf
pop rax
jmp 0x140b2393f
cmp eax, 0xa
jne 0x140b237b2
popf
pop rax
jmp 0x140b23e1a
cmp eax, 7
jne 0x140b237c1
popf
pop rax
jmp 0x140b23ca8
cmp eax, 6
jne 0x140b237d0
popf
pop rax
jmp 0x140b23b97
cmp eax, 0xb
jne 0x140b237df
popf
pop rax
jmp 0x140b23e5e
cmp eax, 0xc
jne 0x140b237ee
popf
pop rax
jmp 0x140b23e99
cmp eax, 8
jne 0x140b237fd
popf
pop rax
jmp 0x140b23d3a
cmp eax, 5
jne 0x140b2380c
popf
pop rax
jmp 0x140b23b0a
cmp eax, 2
jne 0x140b2381b
popf
pop rax
jmp 0x140b2399d
cmp eax, 9
jne 0x140b2382a
popf
pop rax
jmp 0x140b23e0e
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
mov eax, 0x90689031
pushf
not eax
add eax, 0x86890732
xor eax, 0x98ee12f5
rol eax, 0x59
popf
pushf
not eax
add eax, 0x90046568
xor eax, 0xa585489c
rol eax, 0x75
popf
call fcn.140b242f9
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1460], rax
movsxd r10, edx
mov rbx, rcx
mov rax, r10
mov r14d, r9d
sar rax, 6
lea rcx, [0x183e95bf6]
pushf
sub rcx, 0x43925696
popf
and r10d, 0x3f
push r8
not r8
sub r14, r8
pop r8
sub r14, 1
mov r15, r8
mov rdi, r8
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
mov r12, qword [rax + rdx*8 + 0x28]
xor eax, eax
mov qword [rbx], rax
cmp r8, r14
mov dword [rbx + 8], eax
jae 0x140b2390c
push rax
pushf
mov eax, 0xb184a341
pushf
not eax
add eax, 0x9a54689c
xor eax, 0xa60b72ca
rol eax, 0x7d
popf
pushf
not eax
add eax, 0xc1d91220
xor eax, 0xb8007f2d
rol eax, 0x76
popf
jmp 0x140b23767
push rax
pushf
mov eax, 0x8a555008
pushf
not eax
add eax, 0xe097bdb8
xor eax, 0xe43490f0
rol eax, 0xa
popf
pushf
not eax
add eax, 0xbb66dce3
xor eax, 0xdf715e1f
rol eax, 0x21
popf
jmp 0x140b23767
lea rax, [rsp + 0x50]
push rax
pushf
mov eax, 0xffe816a5
pushf
not eax
add eax, 0xc84d2e86
xor eax, 0xd0fc9fee
rol eax, 0x85
popf
pushf
not eax
add eax, 0x85a77ed3
xor eax, 0x8905e167
rol eax, 0x35
popf
pushf
not eax
add eax, 0x987e574c
xor eax, 0xaa74232c
rol eax, 0xa
popf
pushf
not eax
add eax, 0xa686806b
xor eax, 0xfb57ade6
rol eax, 0x71
popf
jmp 0x140b23767
cmp rdi, r14
jae 0x140b239e8
push rax
pushf
mov eax, 0xa7c9cfe6
pushf
not eax
add eax, 0x98589841
xor eax, 0xfe85e0c1
rol eax, 0xe4
popf
pushf
not eax
add eax, 0xabb9fcea
xor eax, 0xf39a2a15
rol eax, 0x35
popf
pushf
not eax
add eax, 0xdbcd76e2
xor eax, 0xae466336
rol eax, 0x65
popf
jmp 0x140b23767
push rax
pushf
mov eax, 0x9a04d988
pushf
not eax
add eax, 0x802d25f1
xor eax, 0xe3952499
rol eax, 0x66
popf
pushf
not eax
add eax, 0xd76e0737
xor eax, 0xe813caf4
rol eax, 0x62
popf
jmp 0x140b23767
movzx ecx, word [rdi]
add rdi, 2
cmp cx, 0xa
jne 0x140b23a6e
push rax
pushf
mov eax, 0xc9641da0
pushf
not eax
add eax, 0x8ba357c6
xor eax, 0xec0c8b55
rol eax, 0x3f
popf
pushf
not eax
add eax, 0x9c3dc0e7
xor eax, 0xdb63d910
rol eax, 0x6b
popf
pushf
not eax
add eax, 0xb8b0d431
xor eax, 0xb726e33e
rol eax, 0x99
popf
jmp 0x140b23767
push rax
pushf
mov eax, 0x33f5e377
pushf
not eax
add eax, 0x9a493f1f
xor eax, 0xed73f12b
rol eax, 0x22
popf
pushf
not eax
add eax, 0xe27e72aa
xor eax, 0xb5fbc87d
rol eax, 0x7f
popf
jmp 0x140b23767
mov edx, 0x9e11dda0
pushf
not edx
add edx, 0xbb55616c
xor edx, 0xbf24869d
rol edx, 0xe6
popf
pushf
not edx
add edx, 0x85a6c7af
xor edx, 0xebe57232
rol edx, 0xbe
popf
mov word [rax], dx
add rax, 2
push rax
pushf
mov eax, 0x9c9284cc
pushf
not eax
add eax, 0xc4ae067e
xor eax, 0xfd18c6f7
rol eax, 0x23
popf
pushf
not eax
add eax, 0x974f8908
xor eax, 0xfb354ed1
rol eax, 0xc6
popf
jmp 0x140b23767
mov word [rax], cx
add rax, 2
lea rcx, [rsp + 0x6f8]
cmp rax, rcx
jb 0x140b23b51
push rax
pushf
mov eax, 0xaef6502e
pushf
not eax
add eax, 0xf6b40cb9
xor eax, 0xcea12ac3
rol eax, 5
popf
pushf
not eax
add eax, 0xe9ea6047
xor eax, 0xc6578f15
rol eax, 0x76
popf
jmp 0x140b23767
push rax
pushf
mov eax, 0xa850a6b1
pushf
not eax
add eax, 0xfb0c20e5
xor eax, 0xc0e7fdb5
rol eax, 0xc8
popf
pushf
not eax
add eax, 0x9a134151
xor eax, 0x99933b91
rol eax, 0xc7
popf
pushf
not eax
add eax, 0xd45c0751
xor eax, 0xc01b6f7e
rol eax, 0x86
popf
jmp 0x140b23767
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x50]
and qword [rsp + 0x30], 0
lea r8, [rsp + 0x50]
sub rax, rcx
mov dword [rsp + 0x28], 0xd55
lea rcx, [rsp + 0x700]
sar rax, 1
mov qword [rsp + 0x20], rcx
mov r9d, eax
mov ecx, 0x59ad2709
pushf
not ecx
add ecx, 0xc0986a82
xor ecx, 0xf7da7af0
rol ecx, 0x3d
popf
pushf
not ecx
add ecx, 0x996345cb
xor ecx, 0xfeaec810
rol ecx, 0xb3
popf
pushf
not ecx
add ecx, 0x8d95261e
xor ecx, 0xd937adff
rol ecx, 0xf9
popf
xor edx, edx
call fcn.140b52813
mov ebp, eax
test eax, eax
je 0x140b23c4f
push rax
pushf
mov eax, 0x6355c93c
pushf
not eax
add eax, 0xb3a08baf
xor eax, 0xd41a3d46
rol eax, 0xb6
popf
pushf
not eax
add eax, 0xa30e9869
xor eax, 0xd66d8429
rol eax, 0x69
popf
jmp 0x140b23767
push rax
pushf
mov eax, 0xaee213a2
pushf
not eax
add eax, 0xd903290b
xor eax, 0xce631426
rol eax, 0x84
popf
pushf
not eax
add eax, 0x91025ed1
xor eax, 0xe9cd313a
rol eax, 0x82
popf
pushf
not eax
add eax, 0xfa4e7d02
xor eax, 0x83c8c44f
rol eax, 0xe8
popf
pushf
not eax
add eax, 0xec804d2a
xor eax, 0x94227d23
rol eax, 0xbb
popf
jmp 0x140b23767
xor esi, esi
test eax, eax
je 0x140b23d07
push rax
pushf
mov eax, 0xb34e2b73
pushf
not eax
add eax, 0xe6cdaeb1
xor eax, 0xb7f2649e
rol eax, 0x11
popf
pushf
not eax
add eax, 0xabd34b90
xor eax, 0xefa367bf
rol eax, 0xe1
popf
pushf
not eax
add eax, 0x8c5f2860
xor eax, 0xf342e079
rol eax, 0x8d
popf
pushf
not eax
add eax, 0xccea2b87
xor eax, 0x855418de
rol eax, 0xf8
popf
jmp 0x140b23767
push rax
pushf
mov eax, 0x33281d1e
pushf
not eax
add eax, 0xee4e2396
xor eax, 0x873236a0
rol eax, 0x6c
popf
pushf
not eax
add eax, 0xf7db287b
xor eax, 0xb4cdb1b9
rol eax, 0x79
popf
jmp 0x140b23767
and qword [rsp + 0x20], 0
lea rdx, [rsp + 0x700]
mov ecx, esi
lea r9, [rsp + 0x40]
mov r8d, ebp
push rcx
not rcx
sub rdx, rcx
pop rcx
sub rdx, 1
mov rcx, r12
sub r8d, esi
jmp 0x140b23d65
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140b23dc8
push rax
pushf
mov eax, 0x71f39da6
pushf
not eax
add eax, 0xc73f4cfd
xor eax, 0x9303cac3
rol eax, 0xf5
popf
pushf
not eax
add eax, 0xf74e6f2c
xor eax, 0x9aac2311
rol eax, 0xa3
popf
pushf
not eax
add eax, 0xf3fa1a3c
xor eax, 0xea517092
rol eax, 0x73
popf
pushf
not eax
add eax, 0xff69d239
xor eax, 0xf4aa8c14
rol eax, 0x9a
popf
jmp 0x140b23767
push rax
pushf
mov eax, 0x90b9e12c
pushf
not eax
add eax, 0xa1a17d89
xor eax, 0x84a3a918
rol eax, 0xfe
popf
pushf
not eax
add eax, 0xd099767d
xor eax, 0xa5546297
rol eax, 0xae
popf
pushf
not eax
add eax, 0xb167ed33
xor eax, 0xae78e923
rol eax, 0x9d
popf
jmp 0x140b23767
add esi, dword [rsp + 0x40]
cmp esi, ebp
jb 0x140b23d3a
mov eax, edi
sub eax, r15d
mov dword [rbx + 4], eax
cmp rdi, r14
jmp 0x140b238d3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
push rax
pushf
mov eax, 0xa25ed5a1
pushf
not eax
add eax, 0x8574d7fd
xor eax, 0xa665d929
rol eax, 0x3c
popf
pushf
not eax
add eax, 0xf66e12d3
xor eax, 0xd216b51b
rol eax, 0x75
popf
jmp 0x140b23767
mov rax, rbx
mov rcx, qword [rsp + 0x1460]
xor rcx, rsp
call fcn.140b1dac3
lea r11, [rsp + 0x1470]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret