Function at 0x140161044
Capabilities:
Write file on windows

Disassembly:
push rax
pushf
mov eax, 0xed986872
pushf
not eax
add eax, 0xbefd6633
xor eax, 0xffae8cdf
rol eax, 0xb3
popf
pushf
not eax
add eax, 0xe9462963
xor eax, 0xf4304615
rol eax, 0x24
popf
pushf
not eax
add eax, 0xf19fe4cb
xor eax, 0xd8731568
rol eax, 0x95
popf
pushf
not eax
add eax, 0x96c4284a
xor eax, 0xcd95f3d9
rol eax, 0xa0
popf
cmp eax, 4
jne 0x1401610a7
popf
pop rax
jmp 0x1401613f8
cmp eax, 0
jne 0x1401610b6
popf
pop rax
jmp 0x14016115b
cmp eax, 3
jne 0x1401610c5
popf
pop rax
jmp 0x140161372
cmp eax, 1
jne 0x1401610d4
popf
pop rax
jmp 0x140161296
cmp eax, 0xa
jne 0x1401610e3
popf
pop rax
jmp 0x140161782
cmp eax, 7
jne 0x1401610f2
popf
pop rax
jmp 0x140161623
cmp eax, 6
jne 0x140161101
popf
pop rax
jmp 0x140161514
cmp eax, 0xb
jne 0x140161110
popf
pop rax
jmp 0x1401617ec
cmp eax, 0xc
jne 0x14016111f
popf
pop rax
jmp 0x140161827
cmp eax, 8
jne 0x14016112e
popf
pop rax
jmp 0x14016168f
cmp eax, 5
jne 0x14016113d
popf
pop rax
jmp 0x140161487
cmp eax, 2
jne 0x14016114c
popf
pop rax
jmp 0x1401612e1
cmp eax, 9
jne 0x14016115b
popf
pop rax
jmp 0x140161776
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
mov eax, 0x5766e10d
pushf
not eax
add eax, 0x98cd2084
xor eax, 0xc2f596d9
rol eax, 0xf2
popf
pushf
not eax
add eax, 0xbc24d9e4
xor eax, 0xde6f24a8
rol eax, 0x67
popf
pushf
not eax
add eax, 0xe0acc497
xor eax, 0xf83525b1
rol eax, 0xad
popf
call fcn.1401622c5
sub rsp, rax
mov rax, qword [0x140058058]
xor rax, rsp
mov qword [rsp + 0x1460], rax
movsxd r10, edx
mov rbx, rcx
mov rax, r10
mov r14d, r9d
sar rax, 6
lea rcx, [0x19090e18c]
pushf
sub rcx, 0x508b3a0c
popf
and r10d, 0x3f
push r8
not r8
sub r14, r8
pop r8
sub r14, 1
mov r15, r8
mov rdi, r8
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
mov r12, qword [rax + rdx*8 + 0x28]
xor eax, eax
mov qword [rbx], rax
cmp r8, r14
mov dword [rbx + 8], eax
jae 0x140161250
push rax
pushf
mov eax, 0x1562a3d3
pushf
not eax
add eax, 0x91b01dd6
xor eax, 0x93d45a40
rol eax, 6
popf
pushf
not eax
add eax, 0xd0851009
xor eax, 0xea3cef4d
rol eax, 0x74
popf
jmp 0x140161098
push rax
pushf
mov eax, 0xf3a6a383
pushf
not eax
add eax, 0x83f1418d
xor eax, 0xd54a84d7
rol eax, 0xb1
popf
pushf
not eax
add eax, 0x98718e01
xor eax, 0x972533b2
rol eax, 0xae
popf
pushf
not eax
add eax, 0xdc5d94b2
xor eax, 0xce10d74d
rol eax, 0xad
popf
jmp 0x140161098
lea rax, [rsp + 0x50]
push rax
pushf
mov eax, 0xd5e9212d
pushf
not eax
add eax, 0xb4e6e0ee
xor eax, 0xda1c8a04
rol eax, 0x2c
popf
pushf
not eax
add eax, 0xfe623207
xor eax, 0xd8c6d5eb
rol eax, 0x66
popf
pushf
not eax
add eax, 0xdb22e8b7
xor eax, 0xea59d3fa
rol eax, 0x3d
popf
jmp 0x140161098
cmp rdi, r14
jae 0x140161319
push rax
pushf
mov eax, 0x9fdccc74
pushf
not eax
add eax, 0xfeb52aa0
xor eax, 0xc2d26e9c
rol eax, 0xad
popf
pushf
not eax
add eax, 0xeaa834d7
xor eax, 0xa4894155
rol eax, 0x6d
popf
jmp 0x140161098
push rax
pushf
mov eax, 0x955da7d5
pushf
not eax
add eax, 0x9e81f5a9
xor eax, 0xaa73d3a9
rol eax, 0xa6
popf
pushf
not eax
add eax, 0x8b23fedf
xor eax, 0x82e5f1b0
rol eax, 0xc9
popf
pushf
not eax
add eax, 0xa80a4ba0
xor eax, 0xdc8fee6c
rol eax, 0xb
popf
pushf
not eax
add eax, 0xe1ec9539
xor eax, 0x9b61bff5
rol eax, 0x97
popf
jmp 0x140161098
movzx ecx, word [rdi]
add rdi, 2
cmp cx, 0xa
jne 0x1401613b2
push rax
pushf
mov eax, 0x8c08a76c
pushf
not eax
add eax, 0xe43eb54a
xor eax, 0x9ab601fd
rol eax, 0xae
popf
pushf
not eax
add eax, 0xadf923ec
xor eax, 0xabf0f34b
rol eax, 0x4a
popf
jmp 0x140161098
push rax
pushf
mov eax, 0xa876c898
pushf
not eax
add eax, 0x94127cf6
xor eax, 0xa47e3fe8
rol eax, 0x44
popf
pushf
not eax
add eax, 0xc0110859
xor eax, 0x9fffe375
rol eax, 0x5a
popf
pushf
not eax
add eax, 0x8cfada2f
xor eax, 0xc781bb25
rol eax, 0xfc
popf
jmp 0x140161098
mov edx, 0xaf003ba1
pushf
not edx
add edx, 0xe004f704
xor edx, 0xaeeb7641
rol edx, 0x8d
popf
pushf
not edx
add edx, 0xb9492427
xor edx, 0xffa4b02a
rol edx, 0xc2
popf
mov word [rax], dx
add rax, 2
push rax
pushf
mov eax, 0x2ddd39fc
pushf
not eax
add eax, 0xb640b23b
xor eax, 0xe5398540
rol eax, 0x2d
popf
pushf
not eax
add eax, 0xe7b93db4
xor eax, 0xde3fed7d
rol eax, 0x7d
popf
pushf
not eax
add eax, 0xcb9327b8
xor eax, 0xe331990d
rol eax, 0xf1
popf
pushf
not eax
add eax, 0x96570c21
xor eax, 0xfc4d86a5
rol eax, 0xb9
popf
jmp 0x140161098
mov word [rax], cx
add rax, 2
lea rcx, [rsp + 0x6f8]
cmp rax, rcx
jb 0x1401614ce
push rax
pushf
mov eax, 0x1f85dcad
pushf
not eax
add eax, 0xeb239754
xor eax, 0xdc980719
rol eax, 0x10
popf
pushf
not eax
add eax, 0x8a465140
xor eax, 0xcc9f3a3a
rol eax, 0x8e
popf
jmp 0x140161098
push rax
pushf
mov eax, 0x8c47c116
pushf
not eax
add eax, 0x83a09ac6
xor eax, 0xa2bc0dc3
rol eax, 0x93
popf
pushf
not eax
add eax, 0x849b081e
xor eax, 0xdedbe881
rol eax, 0xb0
popf
pushf
not eax
add eax, 0x89bc2d91
xor eax, 0xd941edad
rol eax, 0x6f
popf
jmp 0x140161098
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x50]
and qword [rsp + 0x30], 0
lea r8, [rsp + 0x50]
sub rax, rcx
mov dword [rsp + 0x28], 0xd55
lea rcx, [rsp + 0x700]
sar rax, 1
mov qword [rsp + 0x20], rcx
mov r9d, eax
mov ecx, 0x37ad2e0c
pushf
not ecx
add ecx, 0xe7b55ca0
xor ecx, 0xd0c808eb
rol ecx, 0x25
popf
pushf
not ecx
add ecx, 0xc122f10b
xor ecx, 0xa91dd65a
rol ecx, 0x1e
popf
xor edx, edx
call fcn.1401e9a12
mov ebp, eax
test eax, eax
je 0x1401615dd
push rax
pushf
mov eax, 0x64e57e8
pushf
not eax
add eax, 0xbadd98d6
xor eax, 0xb5807677
rol eax, 0x1a
popf
pushf
not eax
add eax, 0xde42a3a1
xor eax, 0xed81115e
rol eax, 0x7b
popf
pushf
not eax
add eax, 0xdec9e985
xor eax, 0xb855260d
rol eax, 0x57
popf
pushf
not eax
add eax, 0xcae31b30
xor eax, 0xe8123a0a
rol eax, 0xba
popf
jmp 0x140161098
push rax
pushf
mov eax, 0xd2f79d91
pushf
not eax
add eax, 0xa2d1b632
xor eax, 0xc6c8039c
rol eax, 0x6c
popf
pushf
not eax
add eax, 0xc95fb251
xor eax, 0xfe98c4e8
rol eax, 0xc0
popf
pushf
not eax
add eax, 0xfb74f5e5
xor eax, 0xb441c08d
rol eax, 0x47
popf
jmp 0x140161098
xor esi, esi
test eax, eax
je 0x14016165c
push rax
pushf
mov eax, 0xb2000439
pushf
not eax
add eax, 0xccc7d656
xor eax, 0xe31a7601
rol eax, 0x59
popf
pushf
not eax
add eax, 0xe0adaa8a
xor eax, 0xa4b9cf41
rol eax, 0xb6
popf
jmp 0x140161098
push rax
pushf
mov eax, 0xc473b598
pushf
not eax
add eax, 0xe713b060
xor eax, 0xcdefc840
rol eax, 0x4f
popf
pushf
not eax
add eax, 0xa02d0086
xor eax, 0x86e902cd
rol eax, 0xd8
popf
jmp 0x140161098
and qword [rsp + 0x20], 0
lea rdx, [rsp + 0x700]
mov ecx, esi
lea r9, [rsp + 0x40]
mov r8d, ebp
push rcx
not rcx
sub rdx, rcx
pop rcx
sub rdx, 1
mov rcx, r12
sub r8d, esi
jmp 0x1401616ba
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14016171d
push rax
pushf
mov eax, 0x84e3190e
pushf
not eax
add eax, 0xab5b8b34
xor eax, 0xd2af0a5e
rol eax, 0x93
popf
pushf
not eax
add eax, 0xd888351c
xor eax, 0xa080efb6
rol eax, 0x89
popf
pushf
not eax
add eax, 0xb8ccc73b
xor eax, 0xc70de718
rol eax, 0xca
popf
pushf
not eax
add eax, 0xe0859185
xor eax, 0xcc8826c8
rol eax, 0x12
popf
jmp 0x140161098
push rax
pushf
mov eax, 0xfbec29ac
pushf
not eax
add eax, 0xd63d26f4
xor eax, 0x96ae121c
rol eax, 0x73
popf
pushf
not eax
add eax, 0xc66ece53
xor eax, 0xfaa18cc7
rol eax, 0x42
popf
pushf
not eax
add eax, 0x9e962fab
xor eax, 0xce77fee6
rol eax, 0x3b
popf
pushf
not eax
add eax, 0x915aa36c
xor eax, 0x8c9c578d
rol eax, 0xe6
popf
jmp 0x140161098
add esi, dword [rsp + 0x40]
cmp esi, ebp
jb 0x14016168f
mov eax, edi
sub eax, r15d
mov dword [rbx + 4], eax
cmp rdi, r14
jmp 0x140161217
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
push rax
pushf
mov eax, 0x3db26687
pushf
not eax
add eax, 0x84adfbb3
xor eax, 0xf821d594
rol eax, 0xfd
popf
pushf
not eax
add eax, 0xcda84bdf
xor eax, 0xd6cd03c7
rol eax, 0xea
popf
jmp 0x140161098
mov rax, rbx
mov rcx, qword [rsp + 0x1460]
xor rcx, rsp
call fcn.140153126
lea r11, [rsp + 0x1470]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret