function withdraw() is working