Function at 0x140071990
Capabilities:
Write file on windows

Disassembly:
push rax
pushf
mov eax, 0xbd4e1826
pushf
not eax
add eax, 0xebf05c05
xor eax, 0xf06ff9bc
rol eax, 0x6f
popf
pushf
not eax
add eax, 0x945ab994
xor eax, 0xb7294a2d
rol eax, 0xac
popf
cmp eax, 4
jne 0x1400719cd
popf
pop rax
jmp 0x140071c93
cmp eax, 0
jne 0x1400719dc
popf
pop rax
jmp 0x140071a72
cmp eax, 3
jne 0x1400719eb
popf
pop rax
jmp 0x140071c0d
cmp eax, 1
jne 0x1400719fa
popf
pop rax
jmp 0x140071bb9
cmp eax, 0xa
jne 0x140071a09
popf
pop rax
jmp 0x140071fbf
cmp eax, 7
jne 0x140071a18
popf
pop rax
jmp 0x140071e97
cmp eax, 6
jne 0x140071a27
popf
pop rax
jmp 0x140071ddd
cmp eax, 0xb
jne 0x140071a36
popf
pop rax
jmp 0x140072020
cmp eax, 9
jne 0x140071a45
popf
pop rax
jmp 0x140071f86
cmp eax, 8
jne 0x140071a54
popf
pop rax
jmp 0x140071f08
cmp eax, 5
jne 0x140071a63
popf
pop rax
jmp 0x140071d2a
cmp eax, 2
jne 0x140071a72
popf
pop rax
jmp 0x140071c04
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
mov eax, 0xd770e045
pushf
not eax
add eax, 0x8a099e7c
xor eax, 0x95b9ac44
rol eax, 0x43
popf
pushf
not eax
add eax, 0x80ae9222
xor eax, 0xc7a5fe32
rol eax, 0xe5
popf
call fcn.1400a3e9c
sub rsp, rax
mov rax, qword [0x140029028]
xor rax, rsp
mov qword [rsp + 0x1440], rax
movsxd r10, edx
mov rdi, rcx
mov rax, r10
mov ebp, r9d
sar rax, 6
lea rcx, [0x1831f6263]
pushf
sub rcx, 0x431cc313
popf
and r10d, 0x3f
push r8
not r8
sub rbp, r8
pop r8
sub rbp, 1
mov rsi, r8
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
mov r14, qword [rax + rdx*8 + 0x28]
xor eax, eax
mov qword [rdi], rax
mov dword [rdi + 8], eax
cmp r8, rbp
jae 0x140071b73
push rax
pushf
mov eax, 0x1833f5a1
pushf
not eax
add eax, 0x8c50b052
xor eax, 0x9d546fb9
rol eax, 0xfe
popf
pushf
not eax
add eax, 0xdccc7f39
xor eax, 0x90b3006d
rol eax, 0xd1
popf
pushf
not eax
add eax, 0xf233a072
xor eax, 0x9ab43a93
rol eax, 0xf6
popf
pushf
not eax
add eax, 0xbc70f643
xor eax, 0xad3fe262
rol eax, 0xe6
popf
jmp 0x1400719be
push rax
pushf
mov eax, 0x1d9b839f
pushf
not eax
add eax, 0xa5ad0a6c
xor eax, 0xbe79f7e6
rol eax, 0xc0
popf
pushf
not eax
add eax, 0xa21ee3bb
xor eax, 0x9fb36d3c
rol eax, 0xa6
popf
pushf
not eax
add eax, 0x80428622
xor eax, 0xcefa9ae4
rol eax, 0x64
popf
jmp 0x1400719be
lea rbx, [rsp + 0x40]
push rax
pushf
mov eax, 0xf62f127e
pushf
not eax
add eax, 0xf100544f
xor eax, 0xdb8d36b7
rol eax, 0x38
popf
pushf
not eax
add eax, 0xc7aba9d3
xor eax, 0xbed40ec4
rol eax, 0xe9
popf
pushf
not eax
add eax, 0xa50fc172
xor eax, 0xe88801b5
rol eax, 0x52
popf
jmp 0x1400719be
cmp rsi, rbp
jae 0x140071ddd
movzx eax, word [rsi]
add rsi, 2
cmp ax, 0xa
jne 0x140071c60
push rax
pushf
mov eax, 0xcde664ed
pushf
not eax
add eax, 0xc49ec983
xor eax, 0x91250f15
rol eax, 0x10
popf
pushf
not eax
add eax, 0xb7e936fe
xor eax, 0xedaf0c98
rol eax, 0xff
popf
pushf
not eax
add eax, 0xf468271d
xor eax, 0xa3844720
rol eax, 0x39
popf
jmp 0x1400719be
push rax
pushf
mov eax, 0xd95ae520
pushf
not eax
add eax, 0xad494cb4
xor eax, 0x919b7109
rol eax, 0xb1
popf
pushf
not eax
add eax, 0xfc6cdc62
xor eax, 0xcf385763
rol eax, 0xde
popf
jmp 0x1400719be
add dword [rdi + 8], 2
mov ecx, 0xd16bfb4e
pushf
not ecx
add ecx, 0xc2ffa1e8
xor ecx, 0xb5a6ecdc
rol ecx, 0x4e
popf
pushf
not ecx
add ecx, 0xd3921013
xor ecx, 0xc28218c2
rol ecx, 0xc8
popf
pushf
not ecx
add ecx, 0xe7939113
xor ecx, 0x8bab1884
rol ecx, 0x53
popf
pushf
not ecx
add ecx, 0xa8fa5ce3
xor ecx, 0xce9ae2dc
rol ecx, 0x24
popf
mov word [rbx], cx
add rbx, 2
push rax
pushf
mov eax, 0x9080b8cc
pushf
not eax
add eax, 0xaf3131fa
xor eax, 0xf34d6ed6
rol eax, 0x47
popf
pushf
not eax
add eax, 0xe6c14163
xor eax, 0xfc35436c
rol eax, 0x46
popf
jmp 0x1400719be
mov word [rbx], ax
add rbx, 2
lea rax, [rsp + 0x143e]
cmp rbx, rax
jb 0x140071d84
push rax
pushf
mov eax, 0xdf84c619
pushf
not eax
add eax, 0xe3197158
xor eax, 0xca7865a0
rol eax, 0xa6
popf
pushf
not eax
add eax, 0xeef674b3
xor eax, 0x9224b293
rol eax, 0x2d
popf
pushf
not eax
add eax, 0xe8a70a07
xor eax, 0x98b48dcb
rol eax, 0x42
popf
jmp 0x1400719be
push rax
pushf
mov eax, 0xdd85faef
pushf
not eax
add eax, 0xe64a826a
xor eax, 0xe9683e4d
rol eax, 0xfa
popf
pushf
not eax
add eax, 0xbd8d2685
xor eax, 0x8f923979
rol eax, 0x16
popf
pushf
not eax
add eax, 0x8f32e782
xor eax, 0x83610034
rol eax, 0xe2
popf
pushf
not eax
add eax, 0xf78af8ba
xor eax, 0x888cef44
rol eax, 0xfe
popf
jmp 0x1400719be
and qword [rsp + 0x20], 0
lea rax, [rsp + 0x40]
sub rbx, rax
lea r9, [rsp + 0x30]
sar rbx, 1
lea rdx, [rsp + 0x40]
add ebx, ebx
mov rcx, r14
mov r8d, ebx
jmp 0x140071e01
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140071e51
push rax
pushf
mov eax, 0x8b96a125
pushf
not eax
add eax, 0xf87b8b58
xor eax, 0x87285a6c
rol eax, 0x84
popf
pushf
not eax
add eax, 0xca86b7f3
xor eax, 0xd2d15066
rol eax, 0x18
popf
pushf
not eax
add eax, 0x81155db0
xor eax, 0xfe35f2cd
rol eax, 0x23
popf
jmp 0x1400719be
push rax
pushf
mov eax, 0xe6028ffe
pushf
not eax
add eax, 0xf31b3a3e
xor eax, 0xd35d60cc
rol eax, 0xc0
popf
pushf
not eax
add eax, 0xb4e4b3d0
xor eax, 0xbec6cf03
rol eax, 0xd0
popf
pushf
not eax
add eax, 0xaeb57336
xor eax, 0x83d60add
rol eax, 0xc9
popf
jmp 0x1400719be
mov eax, dword [rsp + 0x30]
add dword [rdi + 4], eax
cmp eax, ebx
jb 0x140071ed5
push rax
pushf
mov eax, 0x7cde7a52
pushf
not eax
add eax, 0xc3318b7d
xor eax, 0xc52e3ce7
rol eax, 0x9e
popf
pushf
not eax
add eax, 0xf172baaf
xor eax, 0x90976f3b
rol eax, 0x51
popf
jmp 0x1400719be
push rax
pushf
mov eax, 0x1acb32c5
pushf
not eax
add eax, 0x9a96df78
xor eax, 0xd9954abf
rol eax, 0x18
popf
pushf
not eax
add eax, 0xf4330b98
xor eax, 0xf08cacb1
rol eax, 0xc7
popf
jmp 0x1400719be
cmp rsi, rbp
jb 0x140071f53
push rax
pushf
mov eax, 0x21556526
pushf
not eax
add eax, 0xc091d1da
xor eax, 0xbffde1ac
rol eax, 0xbc
popf
pushf
not eax
add eax, 0x8840bedb
xor eax, 0xfc5a6318
rol eax, 0xf8
popf
pushf
not eax
add eax, 0xdabdd16e
xor eax, 0xe95362a9
rol eax, 0x83
popf
jmp 0x1400719be
push rax
pushf
mov eax, 0x3e2596fc
pushf
not eax
add eax, 0xa423064d
xor eax, 0xf73399d5
rol eax, 0xb4
popf
pushf
not eax
add eax, 0xfa5a13f2
xor eax, 0x9000e702
rol eax, 7
popf
jmp 0x1400719be
jmp 0x140072020
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
push rax
pushf
mov eax, 0x64eadf67
pushf
not eax
add eax, 0xfbe0d06a
xor eax, 0xd80680e6
rol eax, 0xe0
popf
pushf
not eax
add eax, 0xc13929cc
xor eax, 0xed38eb00
rol eax, 0x18
popf
pushf
not eax
add eax, 0x8eb58820
xor eax, 0x96565d7d
rol eax, 0xd0
popf
pushf
not eax
add eax, 0xf467edae
xor eax, 0x9ca9e46d
rol eax, 0xf5
popf
jmp 0x1400719be
mov rax, rdi
mov rcx, qword [rsp + 0x1440]
xor rcx, rsp
call fcn.14009c3e7
lea r11, [rsp + 0x1450]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret