Function at 0x140351d97
Capabilities:
Write file on windows

Disassembly:
push rax
pushf
mov eax, 0x1e51c715
pushf
not eax
add eax, 0x8956be0e
xor eax, 0xba8c882a
rol eax, 0xf9
popf
pushf
not eax
add eax, 0x9c6faf8a
xor eax, 0xcd1c7bb6
rol eax, 0x5b
popf
pushf
not eax
add eax, 0x943b9aa4
xor eax, 0xc25d137a
rol eax, 0xdf
popf
cmp eax, 4
jne 0x140351de7
popf
pop rax
jmp 0x14035209a
cmp eax, 0
jne 0x140351df6
popf
pop rax
jmp 0x140351e8c
cmp eax, 3
jne 0x140351e05
popf
pop rax
jmp 0x140352027
cmp eax, 1
jne 0x140351e14
popf
pop rax
jmp 0x140351fe6
cmp eax, 0xa
jne 0x140351e23
popf
pop rax
jmp 0x1403523af
cmp eax, 7
jne 0x140351e32
popf
pop rax
jmp 0x14035224e
cmp eax, 6
jne 0x140351e41
popf
pop rax
jmp 0x1403521ba
cmp eax, 0xb
jne 0x140351e50
popf
pop rax
jmp 0x1403523ea
cmp eax, 9
jne 0x140351e5f
popf
pop rax
jmp 0x140352363
cmp eax, 8
jne 0x140351e6e
popf
pop rax
jmp 0x1403522e5
cmp eax, 5
jne 0x140351e7d
popf
pop rax
jmp 0x14035212d
cmp eax, 2
jne 0x140351e8c
popf
pop rax
jmp 0x14035201e
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
mov eax, 0x7d6af339
pushf
not eax
add eax, 0xa83241a7
xor eax, 0x8b66567a
rol eax, 0x33
popf
pushf
not eax
add eax, 0xf79a128c
xor eax, 0xa2dbd970
rol eax, 0x22
popf
pushf
not eax
add eax, 0x802ea976
xor eax, 0x96286fe2
rol eax, 0x8a
popf
pushf
not eax
add eax, 0xbd050ff0
xor eax, 0xcf9eed57
rol eax, 0x9a
popf
call fcn.14006dea1
sub rsp, rax
mov rax, qword [0x140183040]
xor rax, rsp
mov qword [rsp + 0x1440], rax
movsxd r10, edx
mov rdi, rcx
mov rax, r10
mov ebp, r9d
sar rax, 6
lea rcx, [0x1b47190f6]
pushf
sub rcx, 0x74591506
popf
and r10d, 0x3f
push r8
not r8
sub rbp, r8
pop r8
sub rbp, 1
mov rsi, r8
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
mov r14, qword [rax + rdx*8 + 0x28]
xor eax, eax
mov qword [rdi], rax
mov dword [rdi + 8], eax
cmp r8, rbp
jae 0x140351f8d
push rax
pushf
mov eax, 0x744f0cc4
pushf
not eax
add eax, 0x9fa43667
xor eax, 0xb4805d21
rol eax, 0x89
popf
pushf
not eax
add eax, 0x8221b598
xor eax, 0xdf38ae58
rol eax, 0x25
popf
jmp 0x140351dd8
push rax
pushf
mov eax, 0x1aeca08a
pushf
not eax
add eax, 0x8bda213c
xor eax, 0xa1db7466
rol eax, 0xc3
popf
pushf
not eax
add eax, 0xad8c101c
xor eax, 0xdb1fbd8e
rol eax, 0x50
popf
pushf
not eax
add eax, 0xc80d013a
xor eax, 0x9c024ce1
rol eax, 0x93
popf
pushf
not eax
add eax, 0xe3e2f77a
xor eax, 0xbf67cd9f
rol eax, 0x34
popf
jmp 0x140351dd8
lea rbx, [rsp + 0x40]
push rax
pushf
mov eax, 0x21c76c8b
pushf
not eax
add eax, 0xfbc7a777
xor eax, 0xbeb59906
rol eax, 0x5e
popf
pushf
not eax
add eax, 0xeb5756eb
xor eax, 0x9a29edef
rol eax, 0xc6
popf
jmp 0x140351dd8
cmp rsi, rbp
jae 0x1403521ba
movzx eax, word [rsi]
add rsi, 2
cmp ax, 0xa
jne 0x140352067
push rax
pushf
mov eax, 0x436143f4
pushf
not eax
add eax, 0xd28b5b1f
xor eax, 0xbe19a6d5
rol eax, 0x82
popf
pushf
not eax
add eax, 0xc218dfa3
xor eax, 0xf54a17a6
rol eax, 0x47
popf
jmp 0x140351dd8
push rax
pushf
mov eax, 0xad4811ab
pushf
not eax
add eax, 0xfa44d5a4
xor eax, 0x80839373
rol eax, 0xcc
popf
pushf
not eax
add eax, 0xbed0b412
xor eax, 0xc9c5774a
rol eax, 0x11
popf
jmp 0x140351dd8
add dword [rdi + 8], 2
mov ecx, 0x68bf109
pushf
not ecx
add ecx, 0xfdc2ce29
xor ecx, 0x95eb249f
rol ecx, 0x33
popf
pushf
not ecx
add ecx, 0xb4eb465e
xor ecx, 0xe8dc2f6e
rol ecx, 0x6e
popf
mov word [rbx], cx
add rbx, 2
push rax
pushf
mov eax, 0xcb40c36f
pushf
not eax
add eax, 0xbb941576
xor eax, 0x9421289d
rol eax, 0x8b
popf
pushf
not eax
add eax, 0xfd93d2b4
xor eax, 0xc0575b6c
rol eax, 3
popf
pushf
not eax
add eax, 0xeb828e97
xor eax, 0xb6ea758a
rol eax, 0xe5
popf
pushf
not eax
add eax, 0xfab3e6cf
xor eax, 0x9ec97e29
rol eax, 0x7a
popf
jmp 0x140351dd8
mov word [rbx], ax
add rbx, 2
lea rax, [rsp + 0x143e]
cmp rbx, rax
jb 0x140352187
push rax
pushf
mov eax, 0x7ec52d13
pushf
not eax
add eax, 0xd7b2a1de
xor eax, 0xcac8c213
rol eax, 7
popf
pushf
not eax
add eax, 0xa6060af0
xor eax, 0xbeaaeb0f
rol eax, 0xce
popf
pushf
not eax
add eax, 0xe3b1ffed
xor eax, 0xc667b4ec
rol eax, 0xfc
popf
jmp 0x140351dd8
push rax
pushf
mov eax, 0x5e19c2fa
pushf
not eax
add eax, 0xdb27a40e
xor eax, 0xd0c6f855
rol eax, 0x6a
popf
pushf
not eax
add eax, 0xb9798764
xor eax, 0x8d146cec
rol eax, 0xfb
popf
jmp 0x140351dd8
and qword [rsp + 0x20], 0
lea rax, [rsp + 0x40]
sub rbx, rax
lea r9, [rsp + 0x30]
sar rbx, 1
lea rdx, [rsp + 0x40]
add ebx, ebx
mov rcx, r14
mov r8d, ebx
jmp 0x1403521de
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14035221b
push rax
pushf
mov eax, 0x1ed594cf
pushf
not eax
add eax, 0xb8483438
xor eax, 0x82cb3ef9
rol eax, 0x90
popf
pushf
not eax
add eax, 0x919dcffd
xor eax, 0xec0cb443
rol eax, 0xa6
popf
jmp 0x140351dd8
push rax
pushf
mov eax, 0x745c144e
pushf
not eax
add eax, 0xce9e06ef
xor eax, 0xabfcfb4c
rol eax, 0xad
popf
pushf
not eax
add eax, 0x9b9b22f2
xor eax, 0xfa5d84b0
rol eax, 0xa0
popf
jmp 0x140351dd8
mov eax, dword [rsp + 0x30]
add dword [rdi + 4], eax
cmp eax, ebx
jb 0x14035228c
push rax
pushf
mov eax, 0xa2cce100
pushf
not eax
add eax, 0xa39c4ff8
xor eax, 0xd82de75f
rol eax, 0x69
popf
pushf
not eax
add eax, 0xe8f551db
xor eax, 0xa3e20029
rol eax, 0x84
popf
jmp 0x140351dd8
push rax
pushf
mov eax, 0x2fe51a2a
pushf
not eax
add eax, 0xac015600
xor eax, 0xfde04f68
rol eax, 0x5a
popf
pushf
not eax
add eax, 0xc055f04f
xor eax, 0xc1a72fe3
rol eax, 0x7a
popf
pushf
not eax
add eax, 0xa2cef0ad
xor eax, 0xe041f5e7
rol eax, 0x40
popf
pushf
not eax
add eax, 0xc574d802
xor eax, 0xfe962796
rol eax, 0xff
popf
jmp 0x140351dd8
cmp rsi, rbp
jb 0x140352330
push rax
pushf
mov eax, 0x2f8de48b
pushf
not eax
add eax, 0xa1efaea0
xor eax, 0x8cbc0c6e
rol eax, 0xa6
popf
pushf
not eax
add eax, 0xba6027eb
xor eax, 0xa31ee520
rol eax, 0x52
popf
pushf
not eax
add eax, 0x9d3e8715
xor eax, 0xed1dff53
rol eax, 0x2f
popf
jmp 0x140351dd8
push rax
pushf
mov eax, 0x1324c0c8
pushf
not eax
add eax, 0xfc5fce82
xor eax, 0x8dfed0a0
rol eax, 0x58
popf
pushf
not eax
add eax, 0xfe4b6800
xor eax, 0xe4e6a220
rol eax, 0xdf
popf
jmp 0x140351dd8
jmp 0x1403523ea
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
push rax
pushf
mov eax, 0xca31bcc9
pushf
not eax
add eax, 0xbc0dd96c
xor eax, 0x832d9cb4
rol eax, 0xda
popf
pushf
not eax
add eax, 0xb5de38a7
xor eax, 0x9c1272a4
rol eax, 2
popf
jmp 0x140351dd8
mov rax, rdi
mov rcx, qword [rsp + 0x1440]
xor rcx, rsp
call fcn.14006f69d
lea r11, [rsp + 0x1450]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret