Function at 0x140068e74
Capabilities:
Write file on windows

Disassembly:
push rax
pushf
mov eax, 0xa7579bef
pushf
not eax
add eax, 0x6683136b
xor eax, 0x3d8fb571
rol eax, 0x9c
popf
pushf
not eax
add eax, 0x558748ca
xor eax, 0x3fcb93c3
rol eax, 0x83
popf
pushf
not eax
add eax, 0x1a9e13cd
xor eax, 0x51019ff1
rol eax, 0x2e
popf
pushf
not eax
add eax, 0x37b8025c
xor eax, 0x75d58d23
rol eax, 0x5a
popf
cmp eax, 5
jne 0x140068ed7
popf
pop rax
jmp 0x140069216
cmp eax, 4
jne 0x140068ee6
popf
pop rax
jmp 0x1400691e1
cmp eax, 0
jne 0x140068ef5
popf
pop rax
jmp 0x140068f22
cmp eax, 2
jne 0x140068f04
popf
pop rax
jmp 0x140069050
cmp eax, 1
jne 0x140068f13
popf
pop rax
jmp 0x140068fe5
cmp eax, 3
jne 0x140068f22
popf
pop rax
jmp 0x14006916c
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x40
xor ebx, ebx
mov edi, r8d
mov dword [rax + 0x10], ebx
mov rsi, rdx
test rdx, rdx
je 0x140068f8c
push rax
pushf
mov eax, 0xfc7bfc9e
pushf
not eax
add eax, 0x79f0cda8
xor eax, 0x659a168b
rol eax, 0x3f
popf
pushf
not eax
add eax, 0x37a1d82b
xor eax, 0x1f4f8d50
rol eax, 0xcd
popf
pushf
not eax
add eax, 0x214ce38d
xor eax, 0x6205bd00
rol eax, 0x4b
popf
jmp 0x140068ec8
push rax
pushf
mov eax, 0x28c58c
pushf
not eax
add eax, 0x35e930ef
xor eax, 0x58f7326a
rol eax, 0x23
popf
pushf
not eax
add eax, 0x626c3e98
xor eax, 0x1eedda26
rol eax, 0xc6
popf
pushf
not eax
add eax, 0x5c5a69e8
xor eax, 0x12085d45
rol eax, 0xa
popf
pushf
not eax
add eax, 0x119c8914
xor eax, 0x754ad9b7
rol eax, 0xce
popf
jmp 0x140068ec8
test r8d, r8d
je 0x14006901d
push rax
pushf
mov eax, 0x719121cb
pushf
not eax
add eax, 0x3e26103b
xor eax, 0x7bd7a6c3
rol eax, 0xf0
popf
pushf
not eax
add eax, 0x6d1fb00f
xor eax, 0x2472f84b
rol eax, 0x9a
popf
jmp 0x140068ec8
push rax
pushf
mov eax, 0x539ca757
pushf
not eax
add eax, 0x3f02f4ef
xor eax, 0x248de687
rol eax, 0x71
popf
pushf
not eax
add eax, 0x71877ec2
xor eax, 0x1b65ceea
rol eax, 0x16
popf
jmp 0x140068ec8
mov qword [rax - 0x18], rbx
xor r9d, r9d
mov dword [rax - 0x20], ebx
xor r8d, r8d
mov edx, 0xb49c3bbb
pushf
not edx
add edx, 0x75ff6cae
xor edx, 0x7c0a2025
rol edx, 0xb2
popf
pushf
not edx
add edx, 0x483c8dc5
xor edx, 0x6ab42736
rol edx, 0xc0
popf
pushf
not edx
add edx, 0x3f933a43
xor edx, 0xc1f61c9
rol edx, 0x84
popf
pushf
not edx
add edx, 0x535bde41
xor edx, 0x3ffa2fe3
rol edx, 0xc0
popf
mov dword [rax - 0x28], 2
jmp 0x1400690be
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x140069126
push rax
pushf
mov eax, 0x54fc571f
pushf
not eax
add eax, 0x36e59f43
xor eax, 0x1e50ec19
rol eax, 0x86
popf
pushf
not eax
add eax, 0x7a71c338
xor eax, 0x15467050
rol eax, 0x74
popf
pushf
not eax
add eax, 0x5d93f26
xor eax, 0x23dbe6c4
rol eax, 0x5b
popf
pushf
not eax
add eax, 0x50f41062
xor eax, 0x61ef6c7a
rol eax, 0xf9
popf
jmp 0x140068ec8
push rax
pushf
mov eax, 0x9fb1e645
pushf
not eax
add eax, 0x41c00db5
xor eax, 0x47b23169
rol eax, 0xaa
popf
pushf
not eax
add eax, 0x3a0c077c
xor eax, 0x4e53a46c
rol eax, 2
popf
pushf
not eax
add eax, 0x66ff3f11
xor eax, 0x677e00ec
rol eax, 0xa5
popf
jmp 0x140068ec8
lea r9, [rsp + 0x58]
mov qword [rsp + 0x20], rbx
mov r8d, edi
mov rdx, rsi
mov rcx, rax
jmp 0x140069180
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbp
jmp 0x14006918a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x58], edi
sete bl
mov eax, ebx
jmp 0x140069216
xor eax, eax
push rax
pushf
mov eax, 0xf16c0ad
pushf
not eax
add eax, 0x2ec438b6
xor eax, 0x41f9281
rol eax, 0xd4
popf
pushf
not eax
add eax, 0x234e0ae
xor eax, 0x59f3257f
rol eax, 0x4c
popf
jmp 0x140068ec8
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret