Function at 0x18002e0cf
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rax
pushf
mov eax, 0xb2d90ddf
pushf
not eax
add eax, 0xe2ac4952
xor eax, 0xbab88a78
rol eax, 0x55
popf
pushf
not eax
add eax, 0xffc23c50
xor eax, 0xde6f8ed9
rol eax, 0x99
popf
cmp eax, 4
jne 0x18002e10c
popf
pop rax
jmp 0x18002e540
cmp eax, 0
jne 0x18002e11b
popf
pop rax
jmp 0x18002e1cf
cmp eax, 3
jne 0x18002e12a
popf
pop rax
jmp 0x18002e478
cmp eax, 1
jne 0x18002e139
popf
pop rax
jmp 0x18002e2b4
cmp eax, 0xd
jne 0x18002e148
popf
pop rax
jmp 0x18002ead5
cmp eax, 7
jne 0x18002e157
popf
pop rax
jmp 0x18002e7e0
cmp eax, 6
jne 0x18002e166
popf
pop rax
jmp 0x18002e74c
cmp eax, 0xb
jne 0x18002e175
popf
pop rax
jmp 0x18002e9d1
cmp eax, 0xc
jne 0x18002e184
popf
pop rax
jmp 0x18002ea68
cmp eax, 8
jne 0x18002e193
popf
pop rax
jmp 0x18002e873
cmp eax, 5
jne 0x18002e1a2
popf
pop rax
jmp 0x18002e5e3
cmp eax, 2
jne 0x18002e1b1
popf
pop rax
jmp 0x18002e372
cmp eax, 9
jne 0x18002e1c0
popf
pop rax
jmp 0x18002e92c
cmp eax, 0xa
jne 0x18002e1cf
popf
pop rax
jmp 0x18002e9c5
push rbp
push rbx
push rdi
lea rbp, [rsp - 0xf40]
mov eax, 0x89c1e1db
pushf
not eax
add eax, 0xe8585b85
xor eax, 0x826f16bf
rol eax, 0x91
popf
pushf
not eax
add eax, 0xb3bc9674
xor eax, 0xf1db8543
rol eax, 0x5b
popf
pushf
not eax
add eax, 0xdba32c79
xor eax, 0xea0081aa
rol eax, 0xcf
popf
call fcn.1800652b5
sub rsp, rax
xor edi, edi
mov rbx, rcx
mov dword [rbp + 0xf60], edi
mov dword [rbp + 0xf70], edi
cmp dword [rcx + 0x10], edi
je 0x18002e26e
push rax
pushf
mov eax, 0xefa3203b
pushf
not eax
add eax, 0x8529ab90
xor eax, 0xa89c807c
rol eax, 0xcf
popf
pushf
not eax
add eax, 0x8e372456
xor eax, 0x88a304c8
rol eax, 0x78
popf
jmp 0x18002e0fd
push rax
pushf
mov eax, 0xb9337fae
pushf
not eax
add eax, 0x93a5e6c3
xor eax, 0x9fffd0ac
rol eax, 0xea
popf
pushf
not eax
add eax, 0xf1019c03
xor eax, 0xcdb9e96e
rol eax, 0xcf
popf
pushf
not eax
add eax, 0xa27dc9c3
xor eax, 0xf8bcb9f5
rol eax, 0x56
popf
jmp 0x18002e0fd
mov dword [rcx + 0x10], edi
cmp dword [rcx + 0xc], edi
jne 0x18002e319
push rax
pushf
mov eax, 0xf19ba39c
pushf
not eax
add eax, 0xf5696a0b
xor eax, 0xa4f6eb2d
rol eax, 0xd4
popf
pushf
not eax
add eax, 0xba3a7ce3
xor eax, 0xe125d9bc
rol eax, 0x2b
popf
pushf
not eax
add eax, 0x8812f345
xor eax, 0xccae4cf4
rol eax, 0xf5
popf
pushf
not eax
add eax, 0xb2198862
xor eax, 0xb326e446
rol eax, 9
popf
jmp 0x18002e0fd
push rax
pushf
mov eax, 0x8281b480
pushf
not eax
add eax, 0xa954b080
xor eax, 0xbed925b1
rol eax, 0xcd
popf
pushf
not eax
add eax, 0x9faa8bc5
xor eax, 0xbc0d099a
rol eax, 0x82
popf
pushf
not eax
add eax, 0xad4014f2
xor eax, 0xbfe4dfef
rol eax, 0x75
popf
pushf
not eax
add eax, 0xaa96e884
xor eax, 0x9e049acb
rol eax, 0xbf
popf
jmp 0x18002e0fd
movzx eax, word [rcx + 0x814]
lea r9, [rbp + 0xf60]
add ax, 0x18
mov word [rbp + 0xf7e], dx
mov word [rsp + 0x38], ax
lea r8d, [rdi + 0x10]
mov eax, dword [rcx + 8]
lea rdx, [rsp + 0x30]
mov rcx, qword [rcx]
mov dword [rsp + 0x30], 0x3000005
mov dword [rsp + 0x34], 0x10
mov word [rsp + 0x3a], di
mov dword [rsp + 0x3c], eax
mov dword [rbp + 0xf78], edi
mov word [rbp + 0xf7c], di
mov qword [rsp + 0x20], rdi
jmp 0x18002e3cb
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18002e432
push rax
pushf
mov eax, 0x44dc940b
pushf
not eax
add eax, 0xb6ba0d9f
xor eax, 0x8d860ca9
rol eax, 0x10
popf
pushf
not eax
add eax, 0xbc96fb1b
xor eax, 0xf9285221
rol eax, 0x93
popf
pushf
not eax
add eax, 0xfcf658c0
xor eax, 0xdd4b70a0
rol eax, 0x50
popf
pushf
not eax
add eax, 0xc322adf4
xor eax, 0xaba068a8
rol eax, 0xe7
popf
jmp 0x18002e0fd
push rax
pushf
mov eax, 0xdb9eb688
pushf
not eax
add eax, 0xb8a3a105
xor eax, 0x98880348
rol eax, 0x53
popf
pushf
not eax
add eax, 0x9e2fd649
xor eax, 0x9326c57e
rol eax, 0xf6
popf
pushf
not eax
add eax, 0xbd120e30
xor eax, 0x95482354
rol eax, 0xed
popf
jmp 0x18002e0fd
mov rcx, qword [rbx]
lea r9, [rbp + 0xf60]
lea r8d, [rdi + 8]
mov qword [rsp + 0x20], rdi
lea rdx, [rbp + 0xf78]
jmp 0x18002e493
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18002e4e7
push rax
pushf
mov eax, 0xc27c4982
pushf
not eax
add eax, 0xa49bd090
xor eax, 0x8ec51a5d
rol eax, 0xd1
popf
pushf
not eax
add eax, 0x934c3516
xor eax, 0xe0828d8e
rol eax, 0x95
popf
pushf
not eax
add eax, 0x84be9547
xor eax, 0xa6c7900c
rol eax, 0x6d
popf
jmp 0x18002e0fd
push rax
pushf
mov eax, 0x229eb328
pushf
not eax
add eax, 0xd43d5b6a
xor eax, 0xef0b8f56
rol eax, 0x2e
popf
pushf
not eax
add eax, 0xb17b7d1c
xor eax, 0xa2d39d37
rol eax, 0xea
popf
pushf
not eax
add eax, 0xaedba503
xor eax, 0xcf48d320
rol eax, 0x48
popf
pushf
not eax
add eax, 0xd5b5c890
xor eax, 0xf366fab5
rol eax, 4
popf
jmp 0x18002e0fd
mov r8d, dword [rbx + 0x814]
lea rdx, [rbx + 0x14]
mov rcx, qword [rbx]
lea r9, [rbp + 0xf60]
mov qword [rsp + 0x20], rdi
jmp 0x18002e55b
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18002e59c
push rax
pushf
mov eax, 0x162bedd5
pushf
not eax
add eax, 0xe3458fac
xor eax, 0xbdf1d813
rol eax, 0x12
popf
pushf
not eax
add eax, 0xb16ff782
xor eax, 0xca5a36e0
rol eax, 0xb8
popf
jmp 0x18002e0fd
push rax
pushf
mov eax, 0x6f8e22b
pushf
not eax
add eax, 0xba49865c
xor eax, 0xdc9a1eae
rol eax, 8
popf
pushf
not eax
add eax, 0xc574ebb4
xor eax, 0xddfc5aef
rol eax, 0x26
popf
pushf
not eax
add eax, 0xb466d864
xor eax, 0xf8e0ed9a
rol eax, 0xc7
popf
jmp 0x18002e0fd
inc dword [rbx + 8]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0xc1dac92a
pushf
not r8d
add r8d, 0xca283294
xor r8d, 0xcc772940
rol r8d, 0xbf
popf
pushf
not r8d
add r8d, 0x839f5f20
xor r8d, 0xa1823f8b
rol r8d, 0xe5
popf
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rbx]
lea r9, [rbp + 0xf70]
mov r8d, 0x9b413540
pushf
not r8d
add r8d, 0xf31e888e
xor r8d, 0xd79dfa22
rol r8d, 0
popf
pushf
not r8d
add r8d, 0xb086d639
xor r8d, 0x9fe011da
rol r8d, 0x27
popf
pushf
not r8d
add r8d, 0xa4c7644f
xor r8d, 0xd1a8da76
rol r8d, 0xec
popf
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
jmp 0x18002e690
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18002e6f3
push rax
pushf
mov eax, 0xa52fc8d5
pushf
not eax
add eax, 0xc589f081
xor eax, 0x842e4c43
rol eax, 0xee
popf
pushf
not eax
add eax, 0x9ccf2766
xor eax, 0xddfb75ce
rol eax, 0xf2
popf
pushf
not eax
add eax, 0xbcb90296
xor eax, 0x903f1815
rol eax, 0x51
popf
pushf
not eax
add eax, 0xaafb324f
xor eax, 0x9716f50d
rol eax, 0x2c
popf
jmp 0x18002e0fd
push rax
pushf
mov eax, 0xeaef9fda
pushf
not eax
add eax, 0x9ed6afca
xor eax, 0xaa3881c9
rol eax, 0x47
popf
pushf
not eax
add eax, 0xaf1de0e5
xor eax, 0xec9a273b
rol eax, 0x80
popf
pushf
not eax
add eax, 0x80a7e33f
xor eax, 0xfa021115
rol eax, 0xbc
popf
pushf
not eax
add eax, 0x9507ff71
xor eax, 0x939a70dc
rol eax, 6
popf
jmp 0x18002e0fd
cmp word [rsp + 0x40], 5
jne 0x18002e7ad
push rax
pushf
mov eax, 0x3f596d9b
pushf
not eax
add eax, 0x8a970b19
xor eax, 0xea7bca08
rol eax, 0x33
popf
pushf
not eax
add eax, 0xe21be59b
xor eax, 0xcca9e972
rol eax, 0xb1
popf
pushf
not eax
add eax, 0xff875521
xor eax, 0xa5177f25
rol eax, 0x20
popf
pushf
not eax
add eax, 0xfede3c94
xor eax, 0xc0984bdc
rol eax, 0x14
popf
jmp 0x18002e0fd
push rax
pushf
mov eax, 0x788ebf1b
pushf
not eax
add eax, 0x961b76d0
xor eax, 0xd5688ac1
rol eax, 0xd6
popf
pushf
not eax
add eax, 0xf0d5797e
xor eax, 0x936346ee
rol eax, 0x39
popf
jmp 0x18002e0fd
cmp byte [rsp + 0x42], 2
jne 0x18002e81a
push rax
pushf
mov eax, 0x1bc9b97
pushf
not eax
add eax, 0x9fef3269
xor eax, 0xa2dd6e46
rol eax, 0x57
popf
pushf
not eax
add eax, 0xf9dead8b
xor eax, 0xaf40358e
rol eax, 0x6b
popf
jmp 0x18002e0fd
push rax
pushf
mov eax, 0x5698d005
pushf
not eax
add eax, 0xef61d389
xor eax, 0xcb36d084
rol eax, 0x2c
popf
pushf
not eax
add eax, 0x97312b3d
xor eax, 0x87b37be4
rol eax, 0x6e
popf
pushf
not eax
add eax, 0x8c10635b
xor eax, 0xe175720c
rol eax, 0xcb
popf
pushf
not eax
add eax, 0xb57a64fd
xor eax, 0xba2b508d
rol eax, 0x9b
popf
jmp 0x18002e0fd
cmp byte [rsp + 0x43], 3
jne 0x18002e8d3
push rax
pushf
mov eax, 0xd7814e48
pushf
not eax
add eax, 0xd1a33547
xor eax, 0x8f40cbde
rol eax, 0xd5
popf
pushf
not eax
add eax, 0x8680c8f5
xor eax, 0x863ee0e2
rol eax, 0xc9
popf
pushf
not eax
add eax, 0xbdc932cd
xor eax, 0xd61e0a05
rol eax, 0x17
popf
pushf
not eax
add eax, 0xe735b5c2
xor eax, 0xe2bace58
rol eax, 0xa9
popf
jmp 0x18002e0fd
push rax
pushf
mov eax, 0xe8a4c155
pushf
not eax
add eax, 0x95dc4f64
xor eax, 0xfe44d09c
rol eax, 0x69
popf
pushf
not eax
add eax, 0x9d211426
xor eax, 0xe9b2b223
rol eax, 0xfa
popf
pushf
not eax
add eax, 0xc606ec70
xor eax, 0xa8ca7d14
rol eax, 0xf0
popf
pushf
not eax
add eax, 0x83ab9f62
xor eax, 0xa7d4a314
rol eax, 0xad
popf
jmp 0x18002e0fd
movzx edi, word [rsp + 0x48]
cmp edi, dword [rbp + 0xf70]
jne 0x18002e96c
push rax
pushf
mov eax, 0x1faa6e2
pushf
not eax
add eax, 0xa5d78f56
xor eax, 0xe50d3e22
rol eax, 0x87
popf
pushf
not eax
add eax, 0xfcb02e09
xor eax, 0x93cf0565
rol eax, 0x10
popf
jmp 0x18002e0fd
push rax
pushf
mov eax, 0xcaf2368e
pushf
not eax
add eax, 0xd4c1e6a5
xor eax, 0xa8f61773
rol eax, 0xbe
popf
pushf
not eax
add eax, 0xfe10e299
xor eax, 0xf773c7e7
rol eax, 0xa2
popf
pushf
not eax
add eax, 0xfe3716c2
xor eax, 0xf263cfbb
rol eax, 0x4e
popf
pushf
not eax
add eax, 0xd518a695
xor eax, 0xdf674650
rol eax, 0x71
popf
jmp 0x18002e0fd
cmp word [rsp + 0x54], 0
jne 0x18002ead5
add edi, 0xffffffe8
cmp edi, 0x800
ja 0x18002ea0f
push rax
pushf
mov eax, 0x19353084
pushf
not eax
add eax, 0xc0d79b06
xor eax, 0x848641af
rol eax, 0xe1
popf
pushf
not eax
add eax, 0xe9400dc6
xor eax, 0xa1f7b769
rol eax, 0x2a
popf
jmp 0x18002e0fd
push rax
pushf
mov eax, 0x8dbb0f07
pushf
not eax
add eax, 0xe3ec008c
xor eax, 0xea4360b6
rol eax, 0xf
popf
pushf
not eax
add eax, 0xabca2cd8
xor eax, 0x9bf48a63
rol eax, 0x58
popf
pushf
not eax
add eax, 0xa7153c93
xor eax, 0x89f6386e
rol eax, 0x80
popf
pushf
not eax
add eax, 0xa8ae2f34
xor eax, 0x89e3ef13
rol eax, 0xeb
popf
jmp 0x18002e0fd
mov r8d, edi
lea rcx, [rbx + 0x818]
lea rdx, [rsp + 0x58]
call sub.VCRUNTIME140.dll_memcpy
xor eax, eax
mov dword [rbx + 0x1018], edi
add rsp, 0x1040
pop rdi
pop rbx
pop rbp
ret
mov eax, 0x972b6089
pushf
not eax
add eax, 0xb1691c79
xor eax, 0xedf29a86
rol eax, 0x17
popf
pushf
not eax
add eax, 0xcd5520c2
xor eax, 0xdeba4740
rol eax, 0x83
popf
pushf
not eax
add eax, 0xfc12d881
xor eax, 0xc4f6e4b2
rol eax, 0x9a
popf
add rsp, 0x1040
pop rdi
pop rbx
pop rbp
ret