Function at 0x140153df7
Capabilities:
Write file on windows

Disassembly:
push rax
pushf
mov eax, 0xe0fd8ce1
pushf
not eax
add eax, 0x8347058e
xor eax, 0xadbefbc5
rol eax, 0x4b
popf
pushf
not eax
add eax, 0xc18e25fa
xor eax, 0xfab65945
rol eax, 0x99
popf
pushf
not eax
add eax, 0xe684740a
xor eax, 0xc7cd11ae
rol eax, 0x50
popf
pushf
not eax
add eax, 0xc595793c
xor eax, 0xcae5d7f2
rol eax, 0xa6
popf
cmp eax, 4
jne 0x140153e5a
popf
pop rax
jmp 0x14015410d
cmp eax, 0
jne 0x140153e69
popf
pop rax
jmp 0x140153eff
cmp eax, 3
jne 0x140153e78
popf
pop rax
jmp 0x140154074
cmp eax, 1
jne 0x140153e87
popf
pop rax
jmp 0x140154020
cmp eax, 0xa
jne 0x140153e96
popf
pop rax
jmp 0x140154437
cmp eax, 7
jne 0x140153ea5
popf
pop rax
jmp 0x1401542c3
cmp eax, 6
jne 0x140153eb4
popf
pop rax
jmp 0x140154209
cmp eax, 0xb
jne 0x140153ec3
popf
pop rax
jmp 0x140154485
cmp eax, 9
jne 0x140153ed2
popf
pop rax
jmp 0x1401543d8
cmp eax, 8
jne 0x140153ee1
popf
pop rax
jmp 0x14015435a
cmp eax, 5
jne 0x140153ef0
popf
pop rax
jmp 0x14015418f
cmp eax, 2
jne 0x140153eff
popf
pop rax
jmp 0x14015406b
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
mov eax, 0xc02f19a7
pushf
not eax
add eax, 0x87b3a705
xor eax, 0xc235c4c8
rol eax, 0x88
popf
pushf
not eax
add eax, 0x8927fe4a
xor eax, 0x92de6945
rol eax, 0x4c
popf
call fcn.140181e18
sub rsp, rax
mov rax, qword [0x140030040]
xor rax, rsp
mov qword [rsp + 0x1440], rax
movsxd r10, edx
mov rdi, rcx
mov rax, r10
mov ebp, r9d
sar rax, 6
lea rcx, [0x1a48cff9b]
pushf
sub rcx, 0x6489e43b
popf
and r10d, 0x3f
push r8
not r8
sub rbp, r8
pop r8
sub rbp, 1
mov rsi, r8
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
mov r14, qword [rax + rdx*8 + 0x28]
xor eax, eax
mov qword [rdi], rax
mov dword [rdi + 8], eax
cmp r8, rbp
jae 0x140153fda
push rax
pushf
mov eax, 0x9c37e271
pushf
not eax
add eax, 0xc97b30d6
xor eax, 0xe5779d0f
rol eax, 0xe7
popf
pushf
not eax
add eax, 0xf1358031
xor eax, 0xd6cbca5c
rol eax, 0x7c
popf
jmp 0x140153e4b
push rax
pushf
mov eax, 0x76601fca
pushf
not eax
add eax, 0xd9802041
xor eax, 0xa8410dc6
rol eax, 0x1b
popf
pushf
not eax
add eax, 0xbee864d5
xor eax, 0xf5029238
rol eax, 0xd2
popf
pushf
not eax
add eax, 0xddc3d49f
xor eax, 0xa4449bdf
rol eax, 0xd9
popf
jmp 0x140153e4b
lea rbx, [rsp + 0x40]
push rax
pushf
mov eax, 0xc337285
pushf
not eax
add eax, 0xc4a14de3
xor eax, 0xcf830656
rol eax, 0x8f
popf
pushf
not eax
add eax, 0xa56923a0
xor eax, 0xaf91c7e5
rol eax, 0xf8
popf
pushf
not eax
add eax, 0xeac9b314
xor eax, 0x9d304077
rol eax, 0x7f
popf
jmp 0x140153e4b
cmp rsi, rbp
jae 0x140154209
movzx eax, word [rsi]
add rsi, 2
cmp ax, 0xa
jne 0x1401540da
push rax
pushf
mov eax, 0xa9fc0b3f
pushf
not eax
add eax, 0x8f810c46
xor eax, 0xaf55abc3
rol eax, 0x71
popf
pushf
not eax
add eax, 0xf6f5c6a8
xor eax, 0xb433b4c0
rol eax, 0x99
popf
pushf
not eax
add eax, 0xe36de04f
xor eax, 0xc3ba31ac
rol eax, 0xa5
popf
pushf
not eax
add eax, 0x957cc465
xor eax, 0xf658c672
rol eax, 0x95
popf
jmp 0x140153e4b
push rax
pushf
mov eax, 0x709857a1
pushf
not eax
add eax, 0x9da3c134
xor eax, 0xf33c7b08
rol eax, 0x5e
popf
pushf
not eax
add eax, 0xaa29bf2c
xor eax, 0xf28ffa85
rol eax, 0xce
popf
jmp 0x140153e4b
add dword [rdi + 8], 2
mov ecx, 0x645ee67a
pushf
not ecx
add ecx, 0xb0e1f43b
xor ecx, 0x8f91c0d1
rol ecx, 0x7b
popf
pushf
not ecx
add ecx, 0x96981e8e
xor ecx, 0xfd5a4d06
rol ecx, 0xe8
popf
pushf
not ecx
add ecx, 0xded6a796
xor ecx, 0xb911eba0
rol ecx, 0x35
popf
mov word [rbx], cx
add rbx, 2
push rax
pushf
mov eax, 0xabd2ace4
pushf
not eax
add eax, 0xb6e8b663
xor eax, 0x8fe82e03
rol eax, 0x95
popf
pushf
not eax
add eax, 0xe1ff2546
xor eax, 0xf24e8701
rol eax, 0x39
popf
jmp 0x140153e4b
mov word [rbx], ax
add rbx, 2
lea rax, [rsp + 0x143e]
cmp rbx, rax
jb 0x1401541d6
push rax
pushf
mov eax, 0x47342973
pushf
not eax
add eax, 0xb96c3c36
xor eax, 0x8c1d4233
rol eax, 0xc1
popf
pushf
not eax
add eax, 0xf41176a6
xor eax, 0xf646d4c2
rol eax, 0x4a
popf
jmp 0x140153e4b
push rax
pushf
mov eax, 0x6966fd9a
pushf
not eax
add eax, 0x8f36d527
xor eax, 0x953d1e74
rol eax, 0x5e
popf
pushf
not eax
add eax, 0xb1538995
xor eax, 0x851ed716
rol eax, 0xce
popf
jmp 0x140153e4b
and qword [rsp + 0x20], 0
lea rax, [rsp + 0x40]
sub rbx, rax
lea r9, [rsp + 0x30]
sar rbx, 1
lea rdx, [rsp + 0x40]
add ebx, ebx
mov rcx, r14
mov r8d, ebx
jmp 0x14015422d
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14015426a
push rax
pushf
mov eax, 0xb43eadbd
pushf
not eax
add eax, 0xca03059f
xor eax, 0xf7b42596
rol eax, 0xe4
popf
pushf
not eax
add eax, 0xba0d770a
xor eax, 0x90864f8b
rol eax, 0x69
popf
jmp 0x140153e4b
push rax
pushf
mov eax, 0xb41a4fd7
pushf
not eax
add eax, 0xd29a4334
xor eax, 0xa9f9ae9d
rol eax, 7
popf
pushf
not eax
add eax, 0xe01fe6f8
xor eax, 0xa1e9c16b
rol eax, 0xe7
popf
pushf
not eax
add eax, 0x8e00086c
xor eax, 0x938de781
rol eax, 0x78
popf
pushf
not eax
add eax, 0xfd6ed536
xor eax, 0xf0dcc39e
rol eax, 0x1f
popf
jmp 0x140153e4b
mov eax, dword [rsp + 0x30]
add dword [rdi + 4], eax
cmp eax, ebx
jb 0x140154314
push rax
pushf
mov eax, 0x3aae7590
pushf
not eax
add eax, 0xbaa9b32b
xor eax, 0x9a5b91df
rol eax, 0x56
popf
pushf
not eax
add eax, 0xd750bd10
xor eax, 0xf70733d5
rol eax, 0x4f
popf
pushf
not eax
add eax, 0xe748f0ea
xor eax, 0xb3b07781
rol eax, 0x76
popf
jmp 0x140153e4b
push rax
pushf
mov eax, 0x4f199f6d
pushf
not eax
add eax, 0xe3f5c5bf
xor eax, 0xe3cf4d53
rol eax, 3
popf
pushf
not eax
add eax, 0xfa0e4796
xor eax, 0xc3ae101e
rol eax, 0x83
popf
pushf
not eax
add eax, 0xae195bfc
xor eax, 0x97315e77
rol eax, 0x7b
popf
jmp 0x140153e4b
cmp rsi, rbp
jb 0x1401543a5
push rax
pushf
mov eax, 0x3aff9da2
pushf
not eax
add eax, 0xa7fb2ca2
xor eax, 0x87f78062
rol eax, 0xd0
popf
pushf
not eax
add eax, 0xc3f5c97c
xor eax, 0xf6868d69
rol eax, 0xe3
popf
pushf
not eax
add eax, 0xf3d7ca14
xor eax, 0xd54d33a1
rol eax, 0x1a
popf
jmp 0x140153e4b
push rax
pushf
mov eax, 0x26cc0f0f
pushf
not eax
add eax, 0xbc60477f
xor eax, 0xbd617745
rol eax, 0x5d
popf
pushf
not eax
add eax, 0xef6f472f
xor eax, 0xea509d49
rol eax, 0xe2
popf
jmp 0x140153e4b
jmp 0x140154485
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
push rax
pushf
mov eax, 0x9260a688
pushf
not eax
add eax, 0xb05bf53e
xor eax, 0x84b0aa67
rol eax, 0x4d
popf
pushf
not eax
add eax, 0xfbc8c364
xor eax, 0x9e544fc0
rol eax, 0xab
popf
pushf
not eax
add eax, 0xa4bcebda
xor eax, 0xd2bc74ce
rol eax, 0x93
popf
jmp 0x140153e4b
mov rax, rdi
mov rcx, qword [rsp + 0x1440]
xor rcx, rsp
call fcn.140178dd1
lea r11, [rsp + 0x1450]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret