Function at 0x1400cd9db
Capabilities:
Write file on windows

Disassembly:
push rax
pushf
mov eax, 0x95bae55
pushf
not eax
add eax, 0x8f539b17
xor eax, 0xa6acb457
rol eax, 0x44
popf
pushf
not eax
add eax, 0xfbe0d140
xor eax, 0xc62b47dd
rol eax, 0x2d
popf
cmp eax, 4
jne 0x1400cda18
popf
pop rax
jmp 0x1400cdd17
cmp eax, 0
jne 0x1400cda27
popf
pop rax
jmp 0x1400cdabd
cmp eax, 3
jne 0x1400cda36
popf
pop rax
jmp 0x1400cdc6b
cmp eax, 1
jne 0x1400cda45
popf
pop rax
jmp 0x1400cdc04
cmp eax, 0xa
jne 0x1400cda54
popf
pop rax
jmp 0x1400ce043
cmp eax, 7
jne 0x1400cda63
popf
pop rax
jmp 0x1400cdef5
cmp eax, 6
jne 0x1400cda72
popf
pop rax
jmp 0x1400cde61
cmp eax, 0xb
jne 0x1400cda81
popf
pop rax
jmp 0x1400ce0a4
cmp eax, 9
jne 0x1400cda90
popf
pop rax
jmp 0x1400cdfe4
cmp eax, 8
jne 0x1400cda9f
popf
pop rax
jmp 0x1400cdf66
cmp eax, 5
jne 0x1400cdaae
popf
pop rax
jmp 0x1400cddc1
cmp eax, 2
jne 0x1400cdabd
popf
pop rax
jmp 0x1400cdc62
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
mov eax, 0x4ec25432
pushf
not eax
add eax, 0xf546ffbf
xor eax, 0xaa6da79d
rol eax, 0xfb
popf
pushf
not eax
add eax, 0x914ff96c
xor eax, 0xf872b634
rol eax, 0x2d
popf
pushf
not eax
add eax, 0xccbe0588
xor eax, 0x8bc25774
rol eax, 0x38
popf
call fcn.1401399f7
sub rsp, rax
mov rax, qword [0x14004b090]
xor rax, rsp
mov qword [rsp + 0x1440], rax
movsxd r10, edx
mov rdi, rcx
mov rax, r10
mov ebp, r9d
sar rax, 6
lea rcx, [0x1a0823043]
pushf
sub rcx, 0x607d5663
popf
and r10d, 0x3f
push r8
not r8
sub rbp, r8
pop r8
sub rbp, 1
mov rsi, r8
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
mov r14, qword [rax + rdx*8 + 0x28]
xor eax, eax
mov qword [rdi], rax
mov dword [rdi + 8], eax
cmp r8, rbp
jae 0x1400cdbbe
push rax
pushf
mov eax, 0x49fe8ed4
pushf
not eax
add eax, 0xd20bfd95
xor eax, 0xf875fc6b
rol eax, 0xd6
popf
pushf
not eax
add eax, 0xa44f0dea
xor eax, 0xa4492bf1
rol eax, 0xe1
popf
pushf
not eax
add eax, 0xb736a65e
xor eax, 0xfcbf1db5
rol eax, 0xba
popf
jmp 0x1400cda09
push rax
pushf
mov eax, 0x75fdfa44
pushf
not eax
add eax, 0x8565fe5b
xor eax, 0xe8d5b7d6
rol eax, 0x4a
popf
pushf
not eax
add eax, 0xf9beefea
xor eax, 0xc1c098c0
rol eax, 0xad
popf
pushf
not eax
add eax, 0xd6e9c3cf
xor eax, 0xc4584b69
rol eax, 0xa6
popf
jmp 0x1400cda09
lea rbx, [rsp + 0x40]
push rax
pushf
mov eax, 0x603f0288
pushf
not eax
add eax, 0xe02d7868
xor eax, 0xf713c9df
rol eax, 0x43
popf
pushf
not eax
add eax, 0xf34a912d
xor eax, 0xffd9a2b8
rol eax, 0x46
popf
pushf
not eax
add eax, 0x9b5b5a82
xor eax, 0xf9ba1c94
rol eax, 0xf9
popf
pushf
not eax
add eax, 0xaecf2930
xor eax, 0xbdc7905a
rol eax, 0xd3
popf
jmp 0x1400cda09
cmp rsi, rbp
jae 0x1400cde61
movzx eax, word [rsi]
add rsi, 2
cmp ax, 0xa
jne 0x1400cdcbe
push rax
pushf
mov eax, 0x9ed61eca
pushf
not eax
add eax, 0x8a8f86a6
xor eax, 0xef455d8b
rol eax, 0x6a
popf
pushf
not eax
add eax, 0x9f91ff9c
xor eax, 0xc0c82eb9
rol eax, 0xf4
popf
pushf
not eax
add eax, 0xb56ed1c9
xor eax, 0xa357ebbf
rol eax, 0xa
popf
jmp 0x1400cda09
push rax
pushf
mov eax, 0x4df6be
pushf
not eax
add eax, 0x9605c3a6
xor eax, 0x911eee9d
rol eax, 0x14
popf
pushf
not eax
add eax, 0xac6f6f50
xor eax, 0xa5f6bbbc
rol eax, 0x4b
popf
pushf
not eax
add eax, 0x8cd22043
xor eax, 0xabaf4326
rol eax, 0xcb
popf
pushf
not eax
add eax, 0x8ad2a7bd
xor eax, 0xe019af19
rol eax, 0xed
popf
jmp 0x1400cda09
add dword [rdi + 8], 2
mov ecx, 0xfb25fc3
pushf
not ecx
add ecx, 0xae067ad7
xor ecx, 0xe3c1401c
rol ecx, 0x3c
popf
pushf
not ecx
add ecx, 0xaa57df7b
xor ecx, 0x8f65ea63
rol ecx, 0xc6
popf
pushf
not ecx
add ecx, 0x8abd3f24
xor ecx, 0xd7ae373b
rol ecx, 0x69
popf
pushf
not ecx
add ecx, 0x93bec3f1
xor ecx, 0xfefbe4c8
rol ecx, 0xb0
popf
mov word [rbx], cx
add rbx, 2
push rax
pushf
mov eax, 0x403187f7
pushf
not eax
add eax, 0xd2be4dbf
xor eax, 0xd7c14977
rol eax, 0xb0
popf
pushf
not eax
add eax, 0xc0831871
xor eax, 0xa8b41a5e
rol eax, 0x53
popf
pushf
not eax
add eax, 0xd61f63d5
xor eax, 0x88b2889e
rol eax, 0xa9
popf
jmp 0x1400cda09
mov word [rbx], ax
add rbx, 2
lea rax, [rsp + 0x143e]
cmp rbx, rax
jb 0x1400cde08
push rax
pushf
mov eax, 0xb6e253bc
pushf
not eax
add eax, 0xf1e99cd5
xor eax, 0xce636eb9
rol eax, 0x80
popf
pushf
not eax
add eax, 0xeb0d7899
xor eax, 0xf5a95cf7
rol eax, 0x37
popf
jmp 0x1400cda09
push rax
pushf
mov eax, 0x99d21f61
pushf
not eax
add eax, 0xba60ec2f
xor eax, 0x86d5e80d
rol eax, 0x1a
popf
pushf
not eax
add eax, 0xa1f6850a
xor eax, 0xa36d796a
rol eax, 0xbe
popf
pushf
not eax
add eax, 0xc4cd71cb
xor eax, 0xc8723505
rol eax, 0x79
popf
pushf
not eax
add eax, 0xe69fd2f2
xor eax, 0xf9a46c18
rol eax, 4
popf
jmp 0x1400cda09
and qword [rsp + 0x20], 0
lea rax, [rsp + 0x40]
sub rbx, rax
lea r9, [rsp + 0x30]
sar rbx, 1
lea rdx, [rsp + 0x40]
add ebx, ebx
mov rcx, r14
mov r8d, ebx
jmp 0x1400cde85
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400cdec2
push rax
pushf
mov eax, 0xa8ef302c
pushf
not eax
add eax, 0xb422e4fb
xor eax, 0x924b484c
rol eax, 3
popf
pushf
not eax
add eax, 0xc82adc14
xor eax, 0xfc6337ff
rol eax, 0x12
popf
jmp 0x1400cda09
push rax
pushf
mov eax, 0xab43eed8
pushf
not eax
add eax, 0xb8313402
xor eax, 0xa59ca00f
rol eax, 0x73
popf
pushf
not eax
add eax, 0xb59756f7
xor eax, 0xcc620b66
rol eax, 0xa3
popf
jmp 0x1400cda09
mov eax, dword [rsp + 0x30]
add dword [rdi + 4], eax
cmp eax, ebx
jb 0x1400cdf33
push rax
pushf
mov eax, 0x8ad75ec3
pushf
not eax
add eax, 0x9d407e22
xor eax, 0x857cec54
rol eax, 0x78
popf
pushf
not eax
add eax, 0xf0425b3d
xor eax, 0xe5a94549
rol eax, 0xb2
popf
jmp 0x1400cda09
push rax
pushf
mov eax, 0xc22606da
pushf
not eax
add eax, 0xdd63b92a
xor eax, 0x9961d66e
rol eax, 0x2a
popf
pushf
not eax
add eax, 0xfd0e3803
xor eax, 0x8b76b1f9
rol eax, 0x70
popf
jmp 0x1400cda09
cmp rsi, rbp
jb 0x1400cdfb1
push rax
pushf
mov eax, 0x1f3a74b9
pushf
not eax
add eax, 0x85aa9f1a
xor eax, 0xafcc35c3
rol eax, 0x96
popf
pushf
not eax
add eax, 0xfb477976
xor eax, 0xd3ace717
rol eax, 0x4d
popf
pushf
not eax
add eax, 0xe12e90f8
xor eax, 0xa37f5998
rol eax, 0x3b
popf
jmp 0x1400cda09
push rax
pushf
mov eax, 0xebd3af3c
pushf
not eax
add eax, 0xfa0ce562
xor eax, 0xc92e511a
rol eax, 0x5f
popf
pushf
not eax
add eax, 0xd8409b8e
xor eax, 0xf4a4e7ee
rol eax, 0xc
popf
jmp 0x1400cda09
jmp 0x1400ce0a4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
push rax
pushf
mov eax, 0xfb60030d
pushf
not eax
add eax, 0x92923de7
xor eax, 0x868bcb96
rol eax, 0x17
popf
pushf
not eax
add eax, 0x9dd88e88
xor eax, 0xdbe5edd0
rol eax, 0x90
popf
pushf
not eax
add eax, 0xb2e5e411
xor eax, 0x9df130e9
rol eax, 0x5f
popf
pushf
not eax
add eax, 0xc29a4a76
xor eax, 0xdcc8872e
rol eax, 0xcf
popf
jmp 0x1400cda09
mov rax, rdi
mov rcx, qword [rsp + 0x1440]
xor rcx, rsp
call fcn.14012cd5d
lea r11, [rsp + 0x1450]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret