Function at 0x1400f49bb
Capabilities:
Write file on windows

Disassembly:
push rax
pushf
mov eax, 0x43228b2c
pushf
not eax
add eax, 0xf0cd63bd
xor eax, 0x9d740644
rol eax, 0xbd
popf
pushf
not eax
add eax, 0xa5dac950
xor eax, 0xa98b9cbc
rol eax, 0x13
popf
pushf
not eax
add eax, 0xc1e43059
xor eax, 0x9e1571c9
rol eax, 0x8b
popf
pushf
not eax
add eax, 0xc11f0753
xor eax, 0xa8a3e1e6
rol eax, 0x2b
popf
cmp eax, 4
jne 0x1400f4a1e
popf
pop rax
jmp 0x1400f4d0a
cmp eax, 0
jne 0x1400f4a2d
popf
pop rax
jmp 0x1400f4ac3
cmp eax, 3
jne 0x1400f4a3c
popf
pop rax
jmp 0x1400f4c71
cmp eax, 1
jne 0x1400f4a4b
popf
pop rax
jmp 0x1400f4c1d
cmp eax, 0xa
jne 0x1400f4a5a
popf
pop rax
jmp 0x1400f50a8
cmp eax, 7
jne 0x1400f4a69
popf
pop rax
jmp 0x1400f4f21
cmp eax, 6
jne 0x1400f4a78
popf
pop rax
jmp 0x1400f4e67
cmp eax, 0xb
jne 0x1400f4a87
popf
pop rax
jmp 0x1400f50e3
cmp eax, 9
jne 0x1400f4a96
popf
pop rax
jmp 0x1400f505c
cmp eax, 8
jne 0x1400f4aa5
popf
pop rax
jmp 0x1400f4fcb
cmp eax, 5
jne 0x1400f4ab4
popf
pop rax
jmp 0x1400f4db4
cmp eax, 2
jne 0x1400f4ac3
popf
pop rax
jmp 0x1400f4c68
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
mov eax, 0xf725c5a9
pushf
not eax
add eax, 0x925d4783
xor eax, 0xb141db8f
rol eax, 0x86
popf
pushf
not eax
add eax, 0xf6f38fb2
xor eax, 0xf6371656
rol eax, 0x67
popf
pushf
not eax
add eax, 0xba8c8f79
xor eax, 0xe9d56b2c
rol eax, 0x77
popf
pushf
not eax
add eax, 0x835829b9
xor eax, 0xbd24881a
rol eax, 0xf4
popf
call fcn.140110d10
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1440], rax
movsxd r10, edx
mov rdi, rcx
mov rax, r10
mov ebp, r9d
sar rax, 6
lea rcx, [0x188466253]
pushf
sub rcx, 0x4839a833
popf
and r10d, 0x3f
push r8
not r8
sub rbp, r8
pop r8
sub rbp, 1
mov rsi, r8
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
mov r14, qword [rax + rdx*8 + 0x28]
xor eax, eax
mov qword [rdi], rax
mov dword [rdi + 8], eax
cmp r8, rbp
jae 0x1400f4bea
push rax
pushf
mov eax, 0x4656ca70
pushf
not eax
add eax, 0xe5b9f240
xor eax, 0xd1d6c132
rol eax, 0xec
popf
pushf
not eax
add eax, 0x93d69950
xor eax, 0xaa450ab7
rol eax, 0x81
popf
pushf
not eax
add eax, 0xb2440002
xor eax, 0xec63bd81
rol eax, 0xdf
popf
pushf
not eax
add eax, 0xba5b19d0
xor eax, 0xea8b2de2
rol eax, 0x56
popf
jmp 0x1400f4a0f
push rax
pushf
mov eax, 0xbe5d27d8
pushf
not eax
add eax, 0xcfd030fc
xor eax, 0xc34f1f93
rol eax, 0x7c
popf
pushf
not eax
add eax, 0xb8a0d1d5
xor eax, 0xabcd1069
rol eax, 0x8c
popf
jmp 0x1400f4a0f
lea rbx, [rsp + 0x40]
push rax
pushf
mov eax, 0x3e22f9c9
pushf
not eax
add eax, 0x9051017c
xor eax, 0xe02d1255
rol eax, 0x9b
popf
pushf
not eax
add eax, 0xfd4e7563
xor eax, 0xb13e33ed
rol eax, 0xc4
popf
pushf
not eax
add eax, 0xb934ea28
xor eax, 0xd12df457
rol eax, 0x3d
popf
jmp 0x1400f4a0f
cmp rsi, rbp
jae 0x1400f4e67
movzx eax, word [rsi]
add rsi, 2
cmp ax, 0xa
jne 0x1400f4cd7
push rax
pushf
mov eax, 0x490c9d7
pushf
not eax
add eax, 0xf8162521
xor eax, 0xe8e245ed
rol eax, 0x6d
popf
pushf
not eax
add eax, 0xc644e527
xor eax, 0xfdbd2816
rol eax, 0x65
popf
pushf
not eax
add eax, 0xa21754f8
xor eax, 0xfff0f50c
rol eax, 0xb
popf
pushf
not eax
add eax, 0xc6b03f68
xor eax, 0xef5c7cab
rol eax, 0x25
popf
jmp 0x1400f4a0f
push rax
pushf
mov eax, 0xb962f735
pushf
not eax
add eax, 0xec8c8ec7
xor eax, 0xc66ba04f
rol eax, 0xf3
popf
pushf
not eax
add eax, 0x90e8b682
xor eax, 0xd1f10c75
rol eax, 0x60
popf
jmp 0x1400f4a0f
add dword [rdi + 8], 2
mov ecx, 0x5e987ec1
pushf
not ecx
add ecx, 0xf52b76b3
xor ecx, 0xcd8038bf
rol ecx, 0x3b
popf
pushf
not ecx
add ecx, 0xba3760ae
xor ecx, 0xbdc57f57
rol ecx, 0x64
popf
pushf
not ecx
add ecx, 0xb58ad75d
xor ecx, 0x9b4a2049
rol ecx, 0xfb
popf
pushf
not ecx
add ecx, 0xc8990f5a
xor ecx, 0xa415424f
rol ecx, 0xb3
popf
mov word [rbx], cx
add rbx, 2
push rax
pushf
mov eax, 0xec1c08ee
pushf
not eax
add eax, 0xa9f9f062
xor eax, 0xb8b8f5d2
rol eax, 0x91
popf
pushf
not eax
add eax, 0xc4d77f0a
xor eax, 0x9f84998b
rol eax, 0x68
popf
pushf
not eax
add eax, 0xc13bcd6b
xor eax, 0xaf4c996a
rol eax, 0x11
popf
jmp 0x1400f4a0f
mov word [rbx], ax
add rbx, 2
lea rax, [rsp + 0x143e]
cmp rbx, rax
jb 0x1400f4e21
push rax
pushf
mov eax, 0xc1391f17
pushf
not eax
add eax, 0xb5d87fab
xor eax, 0xd130a31d
rol eax, 3
popf
pushf
not eax
add eax, 0xd52cd39f
xor eax, 0xa241a53d
rol eax, 0xf4
popf
pushf
not eax
add eax, 0xe68ccf48
xor eax, 0xe97159dd
rol eax, 0x8b
popf
pushf
not eax
add eax, 0xa0c25a3a
xor eax, 0xb74600d2
rol eax, 0x4d
popf
jmp 0x1400f4a0f
push rax
pushf
mov eax, 0xb3d36d79
pushf
not eax
add eax, 0xb8d0b0ab
xor eax, 0xfb18d704
rol eax, 0xcd
popf
pushf
not eax
add eax, 0xd30103e4
xor eax, 0xc74a4b7e
rol eax, 0x65
popf
pushf
not eax
add eax, 0xd564a07d
xor eax, 0xef638dc0
rol eax, 0x5a
popf
jmp 0x1400f4a0f
and qword [rsp + 0x20], 0
lea rax, [rsp + 0x40]
sub rbx, rax
lea r9, [rsp + 0x30]
sar rbx, 1
lea rdx, [rsp + 0x40]
add ebx, ebx
mov rcx, r14
mov r8d, ebx
jmp 0x1400f4e8b
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400f4edb
push rax
pushf
mov eax, 0xab391ac7
pushf
not eax
add eax, 0xefa174a8
xor eax, 0x9b597583
rol eax, 0x7a
popf
pushf
not eax
add eax, 0xff322d11
xor eax, 0xf3f28bc1
rol eax, 0x23
popf
pushf
not eax
add eax, 0x9b14f057
xor eax, 0xb8d53362
rol eax, 0xd3
popf
jmp 0x1400f4a0f
push rax
pushf
mov eax, 0x5f3d1733
pushf
not eax
add eax, 0xb4f5af20
xor eax, 0xf9fbc6c1
rol eax, 0xa0
popf
pushf
not eax
add eax, 0xd968116c
xor eax, 0xff8537a8
rol eax, 0x4b
popf
pushf
not eax
add eax, 0xcde521c0
xor eax, 0xbe287f2a
rol eax, 0xd7
popf
jmp 0x1400f4a0f
mov eax, dword [rsp + 0x30]
add dword [rdi + 4], eax
cmp eax, ebx
jb 0x1400f4f85
push rax
pushf
mov eax, 0x99fafa7
pushf
not eax
add eax, 0xcc9cfed7
xor eax, 0x962168b0
rol eax, 0x18
popf
pushf
not eax
add eax, 0xa7ea3749
xor eax, 0x919dc91c
rol eax, 0x74
popf
pushf
not eax
add eax, 0xddff2c85
xor eax, 0xd8460afe
rol eax, 0x95
popf
pushf
not eax
add eax, 0xe329453a
xor eax, 0xc27cf847
rol eax, 0xbc
popf
jmp 0x1400f4a0f
push rax
pushf
mov eax, 0x50c19782
pushf
not eax
add eax, 0xe8c414aa
xor eax, 0xccc5bf30
rol eax, 0x13
popf
pushf
not eax
add eax, 0xd945825e
xor eax, 0xd5c62b16
rol eax, 0xa
popf
pushf
not eax
add eax, 0xbe2327f4
xor eax, 0x8a4706fe
rol eax, 0x39
popf
jmp 0x1400f4a0f
cmp rsi, rbp
jb 0x1400f5003
push rax
pushf
mov eax, 0xa429c630
pushf
not eax
add eax, 0xcaaefef7
xor eax, 0x8af400da
rol eax, 0x6c
popf
pushf
not eax
add eax, 0xa16a9a56
xor eax, 0x8fa8cf8e
rol eax, 0xea
popf
jmp 0x1400f4a0f
push rax
pushf
mov eax, 0x4274714e
pushf
not eax
add eax, 0xf35824d2
xor eax, 0x8d5c18b0
rol eax, 0x89
popf
pushf
not eax
add eax, 0xd5b4ec8c
xor eax, 0xb43e4e95
rol eax, 0xf1
popf
pushf
not eax
add eax, 0xf8c99ad3
xor eax, 0xfe2a8679
rol eax, 0x76
popf
pushf
not eax
add eax, 0xeac37259
xor eax, 0xd09d0cc4
rol eax, 0x3a
popf
jmp 0x1400f4a0f
jmp 0x1400f50e3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
push rax
pushf
mov eax, 0xca67960
pushf
not eax
add eax, 0x9db7c974
xor eax, 0xae05abaa
rol eax, 0x5f
popf
pushf
not eax
add eax, 0x8a24b1b9
xor eax, 0xea98f3dc
rol eax, 0x32
popf
jmp 0x1400f4a0f
mov rax, rdi
mov rcx, qword [rsp + 0x1440]
xor rcx, rsp
call fcn.14010a793
lea r11, [rsp + 0x1450]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret