Function at 0x1800a7709
Capabilities:
Write file on windows

Disassembly:
push rax
pushf
mov eax, 0xdc2dcfb1
pushf
not eax
add eax, 0xbb575ed5
xor eax, 0xd56a7ea0
rol eax, 0x9b
popf
pushf
not eax
add eax, 0xa8961628
xor eax, 0x9043f69b
rol eax, 0xab
popf
cmp eax, 4
jne 0x1800a7746
popf
pop rax
jmp 0x1800a7a1f
cmp eax, 0
jne 0x1800a7755
popf
pop rax
jmp 0x1800a77eb
cmp eax, 3
jne 0x1800a7764
popf
pop rax
jmp 0x1800a7960
cmp eax, 1
jne 0x1800a7773
popf
pop rax
jmp 0x1800a790c
cmp eax, 0xa
jne 0x1800a7782
popf
pop rax
jmp 0x1800a7dd0
cmp eax, 7
jne 0x1800a7791
popf
pop rax
jmp 0x1800a7c49
cmp eax, 6
jne 0x1800a77a0
popf
pop rax
jmp 0x1800a7b7c
cmp eax, 0xb
jne 0x1800a77af
popf
pop rax
jmp 0x1800a7e0b
cmp eax, 9
jne 0x1800a77be
popf
pop rax
jmp 0x1800a7d84
cmp eax, 8
jne 0x1800a77cd
popf
pop rax
jmp 0x1800a7ce0
cmp eax, 5
jne 0x1800a77dc
popf
pop rax
jmp 0x1800a7ab6
cmp eax, 2
jne 0x1800a77eb
popf
pop rax
jmp 0x1800a7957
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
mov eax, 0x411a8782
pushf
not eax
add eax, 0xb9b218be
xor eax, 0xa0397e36
rol eax, 0xb6
popf
pushf
not eax
add eax, 0x834a6a0b
xor eax, 0xfad43e4e
rol eax, 0x4c
popf
call fcn.1800f433c
sub rsp, rax
mov rax, qword [0x180040280]
xor rax, rsp
mov qword [rsp + 0x1440], rax
movsxd r10, edx
mov rdi, rcx
mov rax, r10
mov ebp, r9d
sar rax, 6
lea rcx, [0x1df893900]
pushf
sub rcx, 0x5f851070
popf
and r10d, 0x3f
push r8
not r8
sub rbp, r8
pop r8
sub rbp, 1
mov rsi, r8
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
mov r14, qword [rax + rdx*8 + 0x28]
xor eax, eax
mov qword [rdi], rax
mov dword [rdi + 8], eax
cmp r8, rbp
jae 0x1800a78d9
push rax
pushf
mov eax, 0xc3d6503f
pushf
not eax
add eax, 0xf8641c5c
xor eax, 0xe8857d02
rol eax, 0x3f
popf
pushf
not eax
add eax, 0xdbef1354
xor eax, 0xa113b06a
rol eax, 0xcb
popf
pushf
not eax
add eax, 0xa3022e89
xor eax, 0xdaac3821
rol eax, 0xf1
popf
jmp 0x1800a7737
push rax
pushf
mov eax, 0xb21f4224
pushf
not eax
add eax, 0x954cd140
xor eax, 0xd0ef54b2
rol eax, 0x3f
popf
pushf
not eax
add eax, 0x807ebff3
xor eax, 0xed9d521e
rol eax, 0xe8
popf
jmp 0x1800a7737
lea rbx, [rsp + 0x40]
push rax
pushf
mov eax, 0x1a34a956
pushf
not eax
add eax, 0xbd941def
xor eax, 0x992ba03b
rol eax, 5
popf
pushf
not eax
add eax, 0xe073f4ef
xor eax, 0xfdcbc44a
rol eax, 0x41
popf
pushf
not eax
add eax, 0xaabdb969
xor eax, 0xd2996fce
rol eax, 0x51
popf
jmp 0x1800a7737
cmp rsi, rbp
jae 0x1800a7b7c
movzx eax, word [rsi]
add rsi, 2
cmp ax, 0xa
jne 0x1800a79c6
push rax
pushf
mov eax, 0xb195866f
pushf
not eax
add eax, 0x9c44045d
xor eax, 0xc9a440d1
rol eax, 0x84
popf
pushf
not eax
add eax, 0xa1ce4eff
xor eax, 0xbd6bed42
rol eax, 3
popf
pushf
not eax
add eax, 0xb6d7f186
xor eax, 0xafef0dc7
rol eax, 0x6f
popf
pushf
not eax
add eax, 0xce3a5e7c
xor eax, 0xb617e0e9
rol eax, 0xf1
popf
jmp 0x1800a7737
push rax
pushf
mov eax, 0x2de9f188
pushf
not eax
add eax, 0xcd2012de
xor eax, 0xe9622e2a
rol eax, 0xec
popf
pushf
not eax
add eax, 0xc1614fcd
xor eax, 0xccdcc7b9
rol eax, 0xc
popf
pushf
not eax
add eax, 0xd0e539ae
xor eax, 0xf062c2ff
rol eax, 0xdf
popf
pushf
not eax
add eax, 0xa42c84b2
xor eax, 0xe0e9b9b7
rol eax, 0x7e
popf
jmp 0x1800a7737
add dword [rdi + 8], 2
mov ecx, 0x5913dc83
pushf
not ecx
add ecx, 0xa58933cb
xor ecx, 0xf9597fae
rol ecx, 0xed
popf
pushf
not ecx
add ecx, 0x985038cd
xor ecx, 0xc5542b74
rol ecx, 0x66
popf
pushf
not ecx
add ecx, 0xfd2a9983
xor ecx, 0xa401ac35
rol ecx, 0x3d
popf
pushf
not ecx
add ecx, 0xcf64fa4e
xor ecx, 0xbb78bd36
rol ecx, 8
popf
mov word [rbx], cx
add rbx, 2
push rax
pushf
mov eax, 0xa02efa17
pushf
not eax
add eax, 0xcc048708
xor eax, 0xcfaa8ff3
rol eax, 0x18
popf
pushf
not eax
add eax, 0x9b75e74b
xor eax, 0x97916817
rol eax, 0xfc
popf
jmp 0x1800a7737
mov word [rbx], ax
add rbx, 2
lea rax, [rsp + 0x143e]
cmp rbx, rax
jb 0x1800a7b23
push rax
pushf
mov eax, 0x5729f3c9
pushf
not eax
add eax, 0x8d9030b8
xor eax, 0xebfd5e9d
rol eax, 0xeb
popf
pushf
not eax
add eax, 0x8629fcc5
xor eax, 0xc261beda
rol eax, 0xc
popf
pushf
not eax
add eax, 0xb72cf19d
xor eax, 0xaf8d69b4
rol eax, 0xf4
popf
pushf
not eax
add eax, 0xd271de41
xor eax, 0xa75e6726
rol eax, 0xd0
popf
jmp 0x1800a7737
push rax
pushf
mov eax, 0x86e3fdd7
pushf
not eax
add eax, 0x9d42df6e
xor eax, 0xc51ad36a
rol eax, 0x15
popf
pushf
not eax
add eax, 0xf8af0556
xor eax, 0xb9e2cfe5
rol eax, 0x4c
popf
pushf
not eax
add eax, 0xf935561a
xor eax, 0xbf993bfa
rol eax, 0xb9
popf
pushf
not eax
add eax, 0xc0198c1a
xor eax, 0xdfc354fa
rol eax, 0x51
popf
jmp 0x1800a7737
and qword [rsp + 0x20], 0
lea rax, [rsp + 0x40]
sub rbx, rax
lea r9, [rsp + 0x30]
sar rbx, 1
lea rdx, [rsp + 0x40]
add ebx, ebx
mov rcx, r14
mov r8d, ebx
jmp 0x1800a7ba0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1800a7bf0
push rax
pushf
mov eax, 0xc2c1f416
pushf
not eax
add eax, 0xca1b6d68
xor eax, 0xc45df413
rol eax, 0xf
popf
pushf
not eax
add eax, 0xf5a2cae7
xor eax, 0x8d78e370
rol eax, 0xe
popf
pushf
not eax
add eax, 0xf422221e
xor eax, 0x919d199f
rol eax, 0xfb
popf
jmp 0x1800a7737
push rax
pushf
mov eax, 0x7e18c23e
pushf
not eax
add eax, 0xb57f75a0
xor eax, 0xf6e59a67
rol eax, 0x52
popf
pushf
not eax
add eax, 0xebd06749
xor eax, 0xafc3efd1
rol eax, 0x99
popf
pushf
not eax
add eax, 0xa6dddef7
xor eax, 0xe94f0643
rol eax, 0x30
popf
pushf
not eax
add eax, 0xd9c69824
xor eax, 0xe28c75e0
rol eax, 0xec
popf
jmp 0x1800a7737
mov eax, dword [rsp + 0x30]
add dword [rdi + 4], eax
cmp eax, ebx
jb 0x1800a7c9a
push rax
pushf
mov eax, 0x6631af06
pushf
not eax
add eax, 0xd285aeb8
xor eax, 0xbe84789d
rol eax, 0x9e
popf
pushf
not eax
add eax, 0xda318d20
xor eax, 0xd2cf93e3
rol eax, 0x1d
popf
pushf
not eax
add eax, 0xe132088b
xor eax, 0xf23b8374
rol eax, 0x1a
popf
jmp 0x1800a7737
push rax
pushf
mov eax, 0xaeca4891
pushf
not eax
add eax, 0xce825400
xor eax, 0xe636d21d
rol eax, 0xf8
popf
pushf
not eax
add eax, 0xb5b11389
xor eax, 0x83887811
rol eax, 0xbf
popf
pushf
not eax
add eax, 0x9e56d3de
xor eax, 0xbd36d57b
rol eax, 0xa1
popf
jmp 0x1800a7737
cmp rsi, rbp
jb 0x1800a7d2b
push rax
pushf
mov eax, 0xd47adf93
pushf
not eax
add eax, 0xebee659a
xor eax, 0xdc6953a7
rol eax, 0x8a
popf
pushf
not eax
add eax, 0x9abd7c36
xor eax, 0xed68e88c
rol eax, 0xb6
popf
pushf
not eax
add eax, 0xec8e7082
xor eax, 0x8b1cccfa
rol eax, 0x33
popf
jmp 0x1800a7737
push rax
pushf
mov eax, 0xaf52f83
pushf
not eax
add eax, 0x902157a9
xor eax, 0xe3ce9b44
rol eax, 0x82
popf
pushf
not eax
add eax, 0xee53a03e
xor eax, 0xd3ff49d3
rol eax, 8
popf
pushf
not eax
add eax, 0xa3f65cc4
xor eax, 0xca9ef086
rol eax, 0xa3
popf
pushf
not eax
add eax, 0xd55c31cd
xor eax, 0x9f3c03a7
rol eax, 0xb3
popf
jmp 0x1800a7737
jmp 0x1800a7e0b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
push rax
pushf
mov eax, 0x840a675d
pushf
not eax
add eax, 0xcc1c2de8
xor eax, 0xccb8cc43
rol eax, 0xe2
popf
pushf
not eax
add eax, 0xdf3e1779
xor eax, 0xc799ec52
rol eax, 0x48
popf
jmp 0x1800a7737
mov rax, rdi
mov rcx, qword [rsp + 0x1440]
xor rcx, rsp
call fcn.1800e8c52
lea r11, [rsp + 0x1450]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret